fix(store): refuse unmarked targets by default; reclaim only under --reclaim (W-F4 review)

Resolves the review finding on c23a71d7: 'store add' silently deleted a markerless target directory and reported it as recovered-partial, but the code cannot distinguish its own interrupted-write debris from content the operator placed by hand — and the USER root's entire contract is that tooling never destroys operator content. - addStoreEntry now throws typed STORE_TARGET_UNMARKED on an unmarked target; deletion happens only when the caller passes { reclaim: true }. - CLI: 'store add' gains --reclaim ('replace an existing UNMARKED target directory; refuses without this flag'). - Status renamed recovered-partial -> reclaimed-unmarked so even the opted-in path names what it did (fix 2 folded into fix 1). - Spec: default-refusal test asserts operator content SURVIVES; opt-in test asserts replacement; two CLI tests cover exit codes. - Ordering test (second review round): 'reclaim can never destroy a marked, vetted entry' — adds a vetted entry, re-adds with reclaim:true, asserts STORE_ALREADY_PRESENT AND the original content + marker survive on disk. Pins marker-check-before-reclaim-check against the guard-clause-migrates-upward refactor; discrimination proven by sabotaging the order (1 failed, exactly this test) and restoring (49/49). - TOCTOU note added at assertSourceTreeHasNoSymlinks per review (known check-then-use window, accepted for a local operator-run CLI). Gates (settled set, rc-honest): store spec 49/49; package vitest 87 files / 1596 tests; package build+lint rc0; root build 25/25 + typecheck 45/45; prettier --check rc0 on all four touched files. c23a71d7 remains the reviewed object, untouched.
feat(mosaic): vetted user store — mosaic store add|list (W-F4)
2026-08-17 13:16:23 -05:00 · 2026-08-17 13:09:24 -05:00 · 2026-08-16 18:12:33 +00:00 · 2026-08-16 13:11:31 -05:00 · 2026-08-16 18:06:53 +00:00 · 2026-08-16 18:06:50 +00:00
15 changed files with 1900 additions and 28 deletions
@@ -0,0 +1,74 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+
+// homedir/platform are read at call time, so they can be stubbed per case.
+vi.mock('node:os', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('node:os')>();
+  return {
+    ...actual,
+    homedir: () => '/home/tester',
+    platform: () => mockPlatform,
+  };
+});
+
+let mockPlatform: NodeJS.Platform = 'linux';
+
+const { getShellProfilePath, detectShell } = await import('../../src/platform/detect.js');
+
+describe('getShellProfilePath', () => {
+  const originalShell = process.env['SHELL'];
+  const originalZdotdir = process.env['ZDOTDIR'];
+
+  beforeEach(() => {
+    mockPlatform = 'linux';
+    delete process.env['ZDOTDIR'];
+  });
+
+  afterEach(() => {
+    if (originalShell === undefined) delete process.env['SHELL'];
+    else process.env['SHELL'] = originalShell;
+    if (originalZdotdir === undefined) delete process.env['ZDOTDIR'];
+    else process.env['ZDOTDIR'] = originalZdotdir;
+  });
+
+  // The regression this guards: setupPath() in stages/finalize.ts appends the
+  // PATH export to whatever this returns. A line written to ~/.bashrc is
+  // unreachable to `bash -lc`, systemd units and agent seats, because Debian's
+  // default .bashrc returns early for non-interactive shells — so an install
+  // reported success and left `mosaic: command not found`. Same for .zshrc,
+  // which zsh only reads for interactive shells.
+  it('never targets an interactive-only rc file', () => {
+    for (const shell of ['/bin/bash', '/usr/bin/zsh']) {
+      process.env['SHELL'] = shell;
+      const profile = getShellProfilePath();
+      expect(profile).not.toMatch(/\.bashrc$/);
+      expect(profile).not.toMatch(/\.zshrc$/);
+    }
+  });
+
+  it('uses ~/.profile for bash', () => {
+    process.env['SHELL'] = '/bin/bash';
+    expect(getShellProfilePath()).toBe('/home/tester/.profile');
+  });
+
+  it('uses ~/.zshenv for zsh', () => {
+    process.env['SHELL'] = '/usr/bin/zsh';
+    expect(getShellProfilePath()).toBe('/home/tester/.zshenv');
+  });
+
+  it('honours ZDOTDIR for zsh', () => {
+    process.env['SHELL'] = '/usr/bin/zsh';
+    process.env['ZDOTDIR'] = '/custom/zdot';
+    expect(getShellProfilePath()).toBe('/custom/zdot/.zshenv');
+  });
+
+  it('falls back to ~/.profile for an unknown shell', () => {
+    process.env['SHELL'] = '/bin/somethingelse';
+    expect(detectShell()).toBe('unknown');
+    expect(getShellProfilePath()).toBe('/home/tester/.profile');
+  });
+
+  it('still routes fish to its own config', () => {
+    process.env['SHELL'] = '/usr/bin/fish';
+    expect(getShellProfilePath()).toBe('/home/tester/.config/fish/config.fish');
+  });
+});
@@ -35,6 +35,18 @@ SOURCE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 TARGET_DIR="${MOSAIC_HOME:-$HOME/.config/mosaic}"
 INSTALL_MODE="${MOSAIC_INSTALL_MODE:-prompt}"

+# Normalize the ambient umask so directory modes are a property of the installer
+# and not of whatever shell invoked it (#1236). Debian/Ubuntu ship umask 002, so
+# every `mkdir -p` below yielded 0775 — and the fleet env boundary rejects any
+# managed directory with `mode & 0o022`, which made `mosaic fleet init --write`
+# impossible on a stock install of those distros. Fedora/RHEL ship 022 and did
+# not trip it, so the product worked or did not depending on the operator's
+# login shell. 022 is what this script already assumes it produces: see the
+# umask note in make_durable_snapshot, which restores to the ambient value
+# precisely so "every later sync copy and new framework dir" gets 0644/0755.
+# Now that value is 022 rather than whatever was inherited.
+umask 022
+
 # Deliberately parsed from "$@" (a real, explicit, per-invocation argument) —
 # never an environment variable — so this opt-out can never sit silently
 # inherited in a shell profile. See #869 Point-1 C2.
@@ -696,6 +708,52 @@ sync_framework
 mkdir -p "$TARGET_DIR/memory"
 mkdir -p "$TARGET_DIR/credentials"

+# Three directories must be 0700, not merely not-group-writable (#1236).
+# The fleet code guards them with two different masks in two different
+# languages, and the strict one wins:
+#
+#   assertPrivateManagedDirectory (fleet-reconciler.js, `mode & 0o077`)
+#       -> MOSAIC_HOME and MOSAIC_HOME/fleet, checked before the roster lock is
+#          taken, so every mutating `mosaic fleet` command dies at 0755.
+#   assert_private_directory (tools/fleet/start-agent-session.sh, `mode & 077`)
+#       -> MOSAIC_HOME/fleet/agents, checked before a pane is ever spawned.
+#
+# Their laxer siblings (`mode & 0o022`) accept 0755, which is why normalizing
+# the umask above is necessary and not sufficient — a correct umask-022 install
+# still produces 0755 and still cannot run `mosaic fleet init --write`. Say the
+# strict modes outright rather than inferring them from a umask.
+#
+# Only these. The rest of the tree is content, stays 0755, and is only ever
+# reached by the 0o022 checks, which 0755 satisfies.
+chmod 700 "$TARGET_DIR" 2>/dev/null || \
+  warn "Could not set 0700 on $TARGET_DIR — 'mosaic fleet' mutations will fail as unsafe-permissions."
+if [[ -d "$TARGET_DIR/fleet" ]]; then
+  chmod 700 "$TARGET_DIR/fleet" 2>/dev/null || \
+    warn "Could not set 0700 on $TARGET_DIR/fleet — 'mosaic fleet' mutations will fail as unsafe-permissions."
+fi
+# fleet/agents does not exist on a first install — the CLI creates it 0700 on
+# demand. It is chmod'd here for the UPGRADE case: a tree built under umask 002
+# has it at 0775, and the repair sweep below cannot rescue it, because stripping
+# group/other write from 0755 leaves 0750 and `mode & 077` is still non-zero.
+if [[ -d "$TARGET_DIR/fleet/agents" ]]; then
+  chmod 700 "$TARGET_DIR/fleet/agents" 2>/dev/null || \
+    warn "Could not set 0700 on $TARGET_DIR/fleet/agents — agent sessions will fail to start as unsafe-permissions."
+fi
+# credentials/ holds secrets and was never meant to be group-readable either.
+# It is not on the fleet boundary, so a failure here breaks nothing — but it is
+# the one directory where a silently-failed chmod leaves secrets group-readable,
+# which is precisely the failure worth a line in the output.
+chmod 700 "$TARGET_DIR/credentials" 2>/dev/null || \
+  warn "Could not set 0700 on $TARGET_DIR/credentials — stored secrets may be readable by other users on this host."
+
+# Repair an existing tree. The umask above only governs directories this run
+# creates, so a host installed under umask 002 before this fix keeps its 0775
+# dirs through every upgrade and stays broken. Strips group/other WRITE only —
+# never read or execute — so it can repair the boundary violation without
+# changing who can traverse or read anything. Scoped to directories: file modes
+# are the manifest's business, not this fix's.
+find "$TARGET_DIR" -type d -perm /022 -exec chmod go-w {} + 2>/dev/null || true
+
 # Reconcile contract files from defaults/ into the framework root: framework-owned
 # files (CONSTITUTION/AGENTS/STANDARDS) are overwritten every upgrade (a divergent
 # copy is backed up once); user-seeded files (TOOLS) are written on first install only.
@@ -128,6 +128,14 @@ EOF
 sleep 30
 EOF
  chmod 700 "$AGENT_BIN/mosaic"
+  # The launcher resolves the roster's runtime against PANE_PATH before it
+  # spawns anything (#1241), so the runtime this projection names has to be
+  # present here even though the fake `mosaic` above never execs it.
+  cat > "$AGENT_BIN/pi" <<'EOF'
+#!/bin/sh
+sleep 30
+EOF
+  chmod 700 "$AGENT_BIN/pi"
  server_environment_before=$(tmux -L "$TEST_SOCKET" show-environment -g | sort)
  server_sessions_before=$(tmux -L "$TEST_SOCKET" list-sessions | sort)
  if /usr/bin/env -i HOME="$HOLDER_HOME" PATH=/usr/bin:/bin MOSAIC_HOME="$AGENT_HOME" \
@@ -225,6 +225,54 @@ else
  warn "mosaic-ensure-sequential-thinking helper missing"
 fi

+# Fleet transport binary (#1240).
+#
+# `mosaic fleet --help` reads "Manage the local Mosaic tmux fleet" and every
+# roster the CLI scaffolds sets `transport: tmux`, but nothing in the install
+# path provides tmux and, until now, nothing here noticed it was absent. On a
+# greenfield host that produced a fleet which installed clean, started clean,
+# and had no live seat; `mosaic fleet ps` was the operator's first and only
+# signal that anything was wrong.
+#
+# The roster's own `transport:` is read rather than assumed, so a host that
+# declares something other than tmux is told about the binary it actually
+# needs. Absent a roster the check still runs — `mosaic fleet init` will
+# scaffold a tmux fleet on this host, and finding out beforehand is the point.
+#
+# `tools/install.sh` carries a deliberately parallel check at the end of its
+# summary. The two are separate because the installer must be able to say this
+# before the framework's own scripts are guaranteed to be on disk; keep their
+# wording in step.
+fleet_declared_transport() {
+  local roster="$MOSAIC_HOME/fleet/roster.yaml"
+  local declared=""
+
+  if [[ -f "$roster" ]]; then
+    declared="$(sed -n 's/^[[:space:]]*transport:[[:space:]]*//p' "$roster" | head -1 |
+      tr -d '"'\''' | tr -d '\r' | awk '{print $1}')"
+  fi
+
+  printf '%s\n' "${declared:-tmux}"
+}
+
+check_fleet_transport() {
+  local transport
+  transport="$(fleet_declared_transport)"
+
+  if command -v "$transport" >/dev/null 2>&1; then
+    pass "Fleet transport available: $transport"
+    return
+  fi
+
+  if [[ -f "$MOSAIC_HOME/fleet/roster.yaml" ]]; then
+    warn "Fleet transport '$transport' is not installed — this host has a roster and no seat can launch. Install it (e.g. sudo apt-get install -y $transport), then 'mosaic fleet start'."
+  else
+    warn "Fleet transport '$transport' is not installed — 'mosaic fleet' cannot run seats here. Install it (e.g. sudo apt-get install -y $transport) before 'mosaic fleet init'."
+  fi
+}
+
+check_fleet_transport
+
 # Legacy migration surfaces should no longer contain symlink trees.
 legacy_paths=(
  "$HOME/.claude/agent-guides"
@@ -0,0 +1,215 @@
+#!/usr/bin/env bash
+# Covers the #1240 fleet-transport checks in `mosaic-doctor` and in
+# `tools/install.sh`.
+#
+# Both checks answer the same question — "can a seat actually launch on this
+# host?" — from two different places, because the installer has to be able to
+# answer it before the framework's own scripts are guaranteed to be on disk.
+# Two implementations of one rule is exactly the shape that drifts, so this
+# harness drives BOTH, in one file, from the same table of cases.
+#
+# The functions are extracted from the shipped scripts rather than copied here.
+# A test that carries its own copy of the logic is a test that keeps passing
+# after the shipped copy changes — the failure mode this whole change is about.
+# Extraction is by exact function header and a closing brace in column one; if
+# either script is reshaped so that stops matching, the extraction yields
+# nothing and this fails loudly instead of silently measuring an empty string.
+set -euo pipefail
+
+SCRIPT_DIR=$(cd -- "$(dirname -- "$0")" && pwd)
+DOCTOR="$SCRIPT_DIR/mosaic-doctor"
+# framework/tools/_scripts -> framework/tools -> framework -> mosaic -> packages -> repo
+INSTALLER=$(cd -- "$SCRIPT_DIR/../../../../.." && pwd)/tools/install.sh
+
+fail() {
+  echo "FAIL: $*" >&2
+  exit 1
+}
+
+[ -f "$DOCTOR" ] || fail "missing mosaic-doctor at $DOCTOR"
+[ -f "$INSTALLER" ] || fail "missing install.sh at $INSTALLER"
+
+ROOT=$(mktemp -d)
+trap 'rm -rf "$ROOT"' EXIT
+
+# The cases below run with PATH set to a directory that deliberately does not
+# contain a shell, and a PATH assignment on a command also governs how that
+# command is looked up — so bash has to be named absolutely or it becomes the
+# thing that is missing.
+BASH_BIN=$(command -v bash) || fail "host is missing 'bash'"
+
+# A PATH containing exactly the utilities these functions use and nothing else.
+# The absent-transport cases are only meaningful on a PATH where the transport
+# is genuinely unresolvable, and this host (like most) has tmux in /usr/bin —
+# so the system path cannot be part of the path under test.
+FAKE_BIN="$ROOT/bin"
+mkdir -p "$FAKE_BIN"
+for utility in sed head tr awk; do
+  utility_path=$(command -v "$utility") || fail "host is missing '$utility'"
+  ln -s "$utility_path" "$FAKE_BIN/$utility"
+done
+
+if PATH="$FAKE_BIN" command -v tmux >/dev/null 2>&1; then
+  fail "'tmux' is resolvable on the minimal test path; absent-transport cases are not measurable"
+fi
+
+# Extract a function by its exact header, up to a closing brace in column one.
+extract_function() {
+  local source_file="$1"
+  local function_name="$2"
+  local destination="$3"
+
+  awk -v name="$function_name" '
+    $0 == name "() {" { collecting = 1 }
+    collecting { print }
+    collecting && $0 == "}" { exit }
+  ' "$source_file" > "$destination"
+
+  grep -qF "$function_name() {" "$destination" ||
+    fail "could not extract '$function_name' from $source_file — has it been renamed or reshaped?"
+  # An unterminated extraction would be a syntax error the moment it is sourced,
+  # but saying so here names the cause instead of leaving a bash parse error.
+  bash -n "$destination" ||
+    fail "extracted '$function_name' does not parse; the closing brace was probably not found"
+}
+
+extract_function "$DOCTOR" fleet_declared_transport "$ROOT/doctor-declared.sh"
+extract_function "$DOCTOR" check_fleet_transport "$ROOT/doctor-check.sh"
+extract_function "$INSTALLER" check_fleet_transport "$ROOT/installer-check.sh"
+
+# Build a MOSAIC_HOME, optionally with a roster declaring a transport.
+make_home() {
+  local home="$ROOT/$1"
+  local declared="${2-}"
+
+  rm -rf "$home"
+  mkdir -p "$home"
+  if [ -n "$declared" ]; then
+    mkdir -p "$home/fleet"
+    cat > "$home/fleet/roster.yaml" <<EOF
+version: 2
+generation: 1
+transport: $declared
+agents: []
+EOF
+  fi
+  printf '%s\n' "$home"
+}
+
+# Run the doctor's check against a given home and path, capturing which
+# reporter the check chose. The real `pass` prints only under `--verbose` and
+# the real `warn` always prints; these stubs make both unconditional on
+# purpose, because what is under test is the severity the check selects, not
+# whether the default verbosity happens to show it. A check that warned where
+# it should pass would otherwise be invisible here.
+run_doctor_check() {
+  local home="$1"
+  local path="$2"
+
+  MOSAIC_HOME="$home" PATH="$path" "$BASH_BIN" --noprofile --norc -c '
+    set -euo pipefail
+    warn() { echo "[WARN] $*"; }
+    pass() { echo "[OK] $*"; }
+    MOSAIC_HOME="$1"
+    source "$2"
+    source "$3"
+    check_fleet_transport
+  ' _ "$home" "$ROOT/doctor-declared.sh" "$ROOT/doctor-check.sh" 2>&1
+}
+
+run_installer_check() {
+  local home="$1"
+  local path="$2"
+
+  MOSAIC_HOME="$home" PATH="$path" "$BASH_BIN" --noprofile --norc -c '
+    set -euo pipefail
+    warn() { echo "[WARN] $*"; }
+    C="" RESET=""
+    MOSAIC_HOME="$1"
+    source "$2"
+    check_fleet_transport
+  ' _ "$home" "$ROOT/installer-check.sh" 2>&1
+}
+
+# A transport that exists. Named tmux because that is what the default roster
+# declares; the binary never runs, it only has to resolve.
+PRESENT_BIN="$ROOT/present-bin"
+mkdir -p "$PRESENT_BIN"
+printf '#!/usr/bin/env bash\nexit 0\n' > "$PRESENT_BIN/tmux"
+chmod +x "$PRESENT_BIN/tmux"
+PATH_WITH_TMUX="$PRESENT_BIN:$FAKE_BIN"
+
+# ── absent, no roster ────────────────────────────────────────────────────────
+# Nothing has been configured yet, so the honest thing to point at is `init`.
+home=$(make_home no-roster)
+
+output=$(run_doctor_check "$home" "$FAKE_BIN")
+echo "$output" | grep -qF '[WARN]' || fail "doctor did not warn when tmux was absent"
+echo "$output" | grep -qF 'tmux' || fail "doctor warning did not name the transport"
+echo "$output" | grep -qF 'mosaic fleet init' || fail "doctor did not point a rosterless host at init"
+
+output=$(run_installer_check "$home" "$FAKE_BIN")
+echo "$output" | grep -qF '[WARN]' || fail "installer did not warn when tmux was absent"
+echo "$output" | grep -qF 'reports success and no seat comes up' ||
+  fail "installer warning did not say what the missing transport actually breaks"
+
+# ── absent, roster present ───────────────────────────────────────────────────
+# A configured fleet that cannot launch is a stronger statement than a
+# hypothetical one, and the message says so.
+home=$(make_home with-roster tmux)
+
+output=$(run_doctor_check "$home" "$FAKE_BIN")
+echo "$output" | grep -qF '[WARN]' || fail "doctor did not warn with a roster present and tmux absent"
+echo "$output" | grep -qF 'roster' || fail "doctor did not mention the roster it found"
+echo "$output" | grep -qF 'mosaic fleet start' || fail "doctor did not point a configured host at start"
+
+# ── present ──────────────────────────────────────────────────────────────────
+# Silence from the installer, and a pass (not a warning) from the audit.
+for home_name in no-roster with-roster; do
+  home="$ROOT/$home_name"
+
+  output=$(run_doctor_check "$home" "$PATH_WITH_TMUX")
+  if echo "$output" | grep -qF '[WARN]'; then
+    fail "doctor warned about the transport while tmux was present ($home_name)"
+  fi
+  echo "$output" | grep -qF '[OK]' || fail "doctor did not record a pass with tmux present ($home_name)"
+
+  output=$(run_installer_check "$home" "$PATH_WITH_TMUX")
+  if [ -n "$output" ]; then
+    fail "installer was not silent with tmux present ($home_name): $output"
+  fi
+done
+
+# ── the roster declares something other than tmux ────────────────────────────
+# The roster is read, not assumed. A host that declares a different transport
+# is told about the binary it actually needs, and never about tmux — being sent
+# to install the wrong package is worse than no advice at all.
+home=$(make_home other-transport zellij)
+
+output=$(run_doctor_check "$home" "$PATH_WITH_TMUX")
+echo "$output" | grep -qF 'zellij' || fail "doctor ignored the roster's declared transport"
+if echo "$output" | grep -qF 'tmux'; then
+  fail "doctor named tmux for a host whose roster declares zellij"
+fi
+
+output=$(run_installer_check "$home" "$PATH_WITH_TMUX")
+echo "$output" | grep -qF 'zellij' || fail "installer ignored the roster's declared transport"
+if echo "$output" | grep -qF 'tmux'; then
+  fail "installer named tmux for a host whose roster declares zellij"
+fi
+
+# ── a quoted or trailing-comment transport value ─────────────────────────────
+# YAML permits both and neither is exotic; a check that installs `tmux"` or
+# reads `tmux # default` as a binary name would send the operator nowhere.
+home=$(make_home quoted-transport '"tmux"   # the only transport today')
+
+output=$(run_doctor_check "$home" "$PATH_WITH_TMUX")
+echo "$output" | grep -qF '[OK] Fleet transport available: tmux' ||
+  fail "doctor did not parse a quoted/commented transport value: $output"
+
+output=$(run_installer_check "$home" "$PATH_WITH_TMUX")
+if [ -n "$output" ]; then
+  fail "installer did not parse a quoted/commented transport value: $output"
+fi
+
+echo "ok - fleet transport checks (mosaic-doctor + install.sh)"
@@ -286,6 +286,36 @@ _build_runtime_bin_prefix() {
 MOSAIC_RUNTIME_BIN_PREFIX=$(_build_runtime_bin_prefix)
 PANE_PATH=${MOSAIC_RUNTIME_BIN_PREFIX:+${MOSAIC_RUNTIME_BIN_PREFIX}:}/usr/local/bin:/usr/bin:/bin

+# #1241. The pane runs `mosaic yolo <runtime>` under PANE_PATH with a cleared
+# environment. A binary missing from *that* path is a pane that dies in under a
+# second, inside a session nobody is attached to, with its diagnostic scrolled
+# into a pane tmux then destroys. Resolve both here, before any effect, where
+# the failure is still attributable to the thing that caused it.
+#
+# `mosaic yolo <runtime>` runs checkRuntime(runtime) and the binary it looks for
+# is named exactly like the runtime, so resolving the runtime name is the same
+# question the pane will ask a moment later — asked while an operator can still
+# see the answer.
+_resolve_in_pane_path() {
+  PATH="$PANE_PATH" command -v -- "$1" 2>/dev/null
+}
+
+# Exit 69 (EX_UNAVAILABLE): the seat cannot be provided. Distinguished from the
+# 64 (EX_USAGE) rejections above, which mean the projection itself was bad —
+# here the data is fine and the host is not ready. Callers tell the individual
+# cases apart by `code=`, the same way fail_env's many codes share exit 64.
+fail_launch() {
+  local code="$1"
+  shift
+  echo "ERROR: agent launch aborted: code=${code} agent=${AGENT_NAME} $*" >&2
+  exit 69
+}
+
+for required_binary in mosaic "$MOSAIC_AGENT_RUNTIME"; do
+  _resolve_in_pane_path "$required_binary" >/dev/null ||
+    fail_launch missing-binary "'${required_binary}' is not on the pane PATH (${PANE_PATH})"
+done
+
 _ensure_claude_workdir_trusted() {
  local workdir="$1"
  local resolved
@@ -384,6 +414,19 @@ if [ -n "$PANE_PID" ]; then
  _start_heartbeat_sidecar "$AGENT_NAME" "$PANE_PID" \
    "$MOSAIC_HEARTBEAT_RUN_DIR" "$MOSAIC_HEARTBEAT_INTERVAL" || \
    echo "WARNING: heartbeat sidecar could not be started for $AGENT_NAME" >&2
+elif _tmux has-session -t "=${AGENT_NAME}:0.0" 2>/dev/null; then
+  # #1241. Session present, no pane PID after a second of retries. Whatever this
+  # is, it is not a seat an operator can use, so it is not a success either.
+  fail_launch pane-pid-unresolved \
+    "tmux reports the session but no pane PID after 5 attempts"
 else
-  echo "WARNING: could not resolve pane PID for $AGENT_NAME — heartbeat sidecar not started" >&2
+  # #1241. This branch used to print a WARNING about the heartbeat sidecar and
+  # exit 0. It is not a heartbeat problem: tmux destroys a session when its pane
+  # command exits, so an absent session one second after new-session means the
+  # runtime died on startup. Reporting it as success is what let `fleet start`
+  # return 0 over three dead panes — the launcher knew, and said the wrong thing
+  # at the wrong severity to the wrong layer.
+  fail_launch pane-did-not-survive \
+    "the pane exited immediately and tmux destroyed the session;" \
+    "run 'mosaic yolo ${MOSAIC_AGENT_RUNTIME}' in ${MOSAIC_AGENT_WORKDIR} to see why"
 fi
@@ -23,8 +23,26 @@ index=0
 if [ "${args[0]:-}" = -L ]; then index=2; fi
 case "${args[$index]:-}" in
  has-session)
+    # The holder always answers. MOSAIC_TEST_HELD_SESSIONS lets a case add
+    # other targets that should answer too — without it there is no way to
+    # model "tmux still reports the session" for a non-holder agent, and the
+    # launcher's pane-pid-unresolved branch is unreachable from this harness.
+    #
+    # A listed target answers only AFTER new-session, because the launcher asks
+    # this question twice about the same name: once before launching, where a
+    # yes means "already running, nothing to do, exit 0", and once after, where
+    # a yes means "the session survived". A shim that answered yes to both
+    # would short-circuit at the first and never reach the branch under test —
+    # it would look like coverage and measure the idempotency path instead.
    for argument in "${args[@]}"; do
      [ "$argument" = '=_holder:0.0' ] && exit 0
+      case " ${MOSAIC_TEST_HELD_SESSIONS:-} " in
+        *" $argument "*)
+          if tr '\0' '\n' < "${MOSAIC_TEST_TMUX_CALLS:?}" | grep -qxF new-session; then
+            exit 0
+          fi
+          ;;
+      esac
    done
    exit 1
    ;;
@@ -62,6 +80,30 @@ env -0 > "${MOSAIC_HOME:?}/fleet/pane-environment"
 SHIM
 chmod +x "$FAKE_BIN/mosaic"

+# The runtime the rosters below name. The launcher resolves it against PANE_PATH
+# before spawning (#1241), so it has to exist somewhere the pane would find it —
+# not merely on the launcher's own PATH.
+printf '#!/usr/bin/env bash\nexit 0\n' > "$FAKE_BIN/pi"
+chmod +x "$FAKE_BIN/pi"
+
+# PANE_PATH is derived partly from `npm config get prefix`. Left to the real npm
+# it would splice whatever the host has installed into the path under test, and
+# the missing-binary cases below would pass or fail by accident of the machine.
+cat > "$FAKE_BIN/npm" <<'SHIM'
+#!/usr/bin/env bash
+printf '%s\n' "${MOSAIC_TEST_NPM_PREFIX:-/nonexistent}"
+SHIM
+chmod +x "$FAKE_BIN/npm"
+
+# PANE_PATH always ends in the system path. A host that installs these there can
+# not measure the missing-binary cases at all, and a green run would mean
+# nothing — so say so instead of passing.
+for host_binary in mosaic pi; do
+  if PATH=/usr/local/bin:/usr/bin:/bin command -v "$host_binary" >/dev/null 2>&1; then
+    fail "host provides '$host_binary' in the system path; missing-binary cases are not measurable here"
+  fi
+done
+
 write_generated() {
  local home="$1"
  local agent="$2"
@@ -81,6 +123,19 @@ MOSAIC_TMUX_SOCKET=mosaic-test
 EOF
  chmod 600 "$home/fleet/agents/$agent.env.generated"
  mkdir -p "$home/work"
+  install_pane_binaries "$home"
+}
+
+# `$PANE_HOME/.npm-global/bin` is one of the prefixes the launcher folds into
+# PANE_PATH, so this is the pane's own view of "installed", distinct from the
+# launcher's PATH. Tests that need a binary *absent* remove it from here.
+install_pane_binaries() {
+  local pane_home="$1"
+  mkdir -p "$pane_home/.npm-global/bin"
+  local binary
+  for binary in mosaic pi; do
+    ln -sf "$FAKE_BIN/$binary" "$pane_home/.npm-global/bin/$binary"
+  done
 }

 run_start() {
@@ -88,6 +143,7 @@ run_start() {
  local agent="$2"
  HOME="$home" PATH="$FAKE_BIN:$PATH" MOSAIC_TEST_TMUX_CALLS="$TMUX_CALLS" \
    MOSAIC_TEST_PANE_PID="${MOSAIC_TEST_PANE_PID:-}" \
+    MOSAIC_TEST_HELD_SESSIONS="${MOSAIC_TEST_HELD_SESSIONS:-}" \
    MOSAIC_TEST_HOME="$home" \
    MOSAIC_TEST_FLEET_OWNER=123e4567-e89b-12d3-a456-426614174000 \
    MOSAIC_HOME="$home" "$START" "$agent"
@@ -98,7 +154,10 @@ run_start() {
 HOME_VALID="$ROOT/valid"
 AGENT_VALID="coder0"
 write_generated "$HOME_VALID" "$AGENT_VALID"
-run_start "$HOME_VALID" "$AGENT_VALID"
+# A live pane PID is part of what "valid launch" means. Until #1241 this case
+# ran with none, so the suite's one success path was itself a dead pane the
+# launcher reported as fine.
+MOSAIC_TEST_PANE_PID=$$ run_start "$HOME_VALID" "$AGENT_VALID"
 valid_args=$(tr '\0' '\n' < "$TMUX_CALLS")
 echo "$valid_args" | grep -qF new-session || fail "valid generated projection did not reach tmux"
 echo "$valid_args" | grep -qF 'mosaic' || fail "fixed mosaic launcher command missing"
@@ -245,6 +304,13 @@ PANE_BASH_ENV="$ROOT/pane-boundary.bash-env"
 printf 'MOSAIC_RUNTIME_BIN=%s\n' "$FAKE_BIN" > \
  "$HOME_PANE_BOUNDARY/fleet/agents/coder-pane-boundary.env.local"
 chmod 600 "$HOME_PANE_BOUNDARY/fleet/agents/coder-pane-boundary.env.local"
+# This case does not go through run_start, so its pane binaries come from
+# MOSAIC_RUNTIME_BIN=$FAKE_BIN in the env.local written above — not from the
+# symlinks install_pane_binaries planted under the generated home, which this
+# launcher never consults because HOME here is the trusted parent. That is a
+# legitimate resolution path, but it means dropping MOSAIC_RUNTIME_BIN from
+# this case on the belief that the symlinks cover it would break the #1241
+# binary check rather than exercise it.
 LD_PRELOAD='/not/loaded/by-clean-bootstrap.so' \
 BASH_ENV="$PANE_BASH_ENV" \
 MOSAIC_UNTRUSTED_SENTINEL='must-not-reach-pane' \
@@ -258,6 +324,7 @@ PATH="$PANE_STALE_PATH" \
    "MOSAIC_TEST_HOME=$PANE_TRUSTED_HOME" \
    MOSAIC_TEST_FLEET_OWNER=123e4567-e89b-12d3-a456-426614174000 \
    MOSAIC_TEST_EXECUTE_PANE=1 \
+    "MOSAIC_TEST_PANE_PID=$$" \
    "$START" coder-pane-boundary
 pane_args=$(tr '\0' '\n' < "$TMUX_CALLS")
 echo "$pane_args" | grep -qxF "HOME=$PANE_TRUSTED_HOME" || \
@@ -392,6 +459,75 @@ echo "$interaction_policy_args" | grep -qF 'new-session' && \
 echo "$output" | grep -qF 'operator interaction service requires runtime pi' || \
  fail "interaction pinned-policy check did not follow strict parsing"

+# #1241. The pane runs `mosaic yolo <runtime>` against PANE_PATH. A binary
+# missing from that path is a launch failure, and it has to be named before the
+# session is created — after it, the diagnostic dies with the pane.
+assert_missing_pane_binary_rejected() {
+  local binary="$1"
+  local home="$ROOT/missing-$binary"
+  local agent="coder-missing-$binary"
+  write_generated "$home" "$agent"
+  rm -f "$home/.npm-global/bin/$binary"
+
+  : > "$TMUX_CALLS"
+  local output
+  if output=$(MOSAIC_TEST_PANE_PID=$$ run_start "$home" "$agent" 2>&1); then
+    fail "launch succeeded with '$binary' absent from the pane PATH"
+  fi
+  echo "$output" | grep -qF 'code=missing-binary' || fail "missing '$binary' diagnostic missing"
+  echo "$output" | grep -qF "'$binary'" || fail "missing-binary diagnostic did not name $binary"
+  if tr '\0' '\n' < "$TMUX_CALLS" | grep -qF new-session; then
+    fail "launcher created a session it knew would die ($binary absent)"
+  fi
+}
+
+assert_missing_pane_binary_rejected mosaic
+assert_missing_pane_binary_rejected pi
+
+# #1241. tmux destroys a session when its pane command exits, so no pane PID a
+# second after new-session means the runtime died on startup. This used to be a
+# WARNING about the heartbeat sidecar followed by exit 0 — three layers above it
+# then reported a fleet that was not running.
+: > "$TMUX_CALLS"
+HOME_DEAD_PANE="$ROOT/dead-pane"
+write_generated "$HOME_DEAD_PANE" "coder-dead-pane"
+if output=$(MOSAIC_TEST_PANE_PID='' run_start "$HOME_DEAD_PANE" coder-dead-pane 2>&1); then
+  fail "launcher reported success over a pane that did not survive"
+fi
+echo "$output" | grep -qF 'code=pane-did-not-survive' || fail "dead-pane diagnostic missing"
+if echo "$output" | grep -qiF 'heartbeat'; then
+  fail "dead pane is still being reported as a heartbeat-sidecar problem"
+fi
+tr '\0' '\n' < "$TMUX_CALLS" | grep -qF new-session || \
+  fail "dead-pane case did not reach the launch it is measuring"
+
+# #1241, the other way a pane fails. Above, tmux destroyed the session and
+# has-session said so. Here the session is still there and no PID comes back
+# after the retries — a different fault (the pane is alive but unusable, or
+# tmux is answering inconsistently) that an operator has to be told apart from
+# a runtime that died on startup.
+#
+# This case exists because the branch that handles it shipped with nothing able
+# to reach it: the shim answered has-session only for the holder, so every
+# non-holder agent landed in the session-is-gone branch no matter what. A
+# defensive branch nothing exercises is the same shape as the bug this whole
+# change is about, one layer down.
+: > "$TMUX_CALLS"
+HOME_NO_PID="$ROOT/pane-no-pid"
+write_generated "$HOME_NO_PID" "coder-no-pid"
+if output=$(MOSAIC_TEST_PANE_PID='' MOSAIC_TEST_HELD_SESSIONS='=coder-no-pid:0.0' \
+  run_start "$HOME_NO_PID" coder-no-pid 2>&1); then
+  fail "launcher reported success over a session with no resolvable pane PID"
+fi
+echo "$output" | grep -qF 'code=pane-pid-unresolved' || \
+  fail "session-present/no-PID was not reported as pane-pid-unresolved: $output"
+if echo "$output" | grep -qF 'code=pane-did-not-survive'; then
+  fail "a session tmux still reports was diagnosed as a destroyed session"
+fi
+if echo "$output" | grep -qiF 'heartbeat'; then
+  fail "an unresolvable pane PID is still being reported as a heartbeat-sidecar problem"
+fi
+
 # Exact stop derives the socket exclusively from the validated generated
 # projection and ignores an ambient socket supplied by the caller.
 : > "$TMUX_CALLS"
@@ -32,10 +32,6 @@ packages/mosaic/framework/tools/tmux/test-send-message-socket.sh | requires a re
 packages/mosaic/framework/tools/tmux/test-send-message-verdict.sh | requires real tmux-pane fixtures on a throwaway socket; CI image ships no tmux; #1017 burndown (same condition as its sibling)

 # --- single-suite directories: unmeasured in CI ---
-packages/mosaic/framework/tools/fleet/test-start-agent-session.sh | unmeasured in CI image; stubs tmux via a fake bin dir, likely CI-fit; #1017 burndown
-packages/mosaic/framework/tools/glpi/test-list-http-status.sh | unmeasured in CI image; stub-based (#807 regression harness), likely CI-fit; #1017 burndown
-packages/mosaic/framework/tools/orchestrator/test-board-roll.sh | unmeasured in CI image; file-fixture based, likely CI-fit; #1017 burndown
-packages/mosaic/framework/tools/woodpecker/test-ci-wait-exit-matrix.sh | unmeasured in CI image; drives ci-wait.sh against a stub pipeline-status.sh, likely CI-fit; #1017 burndown

 # --- naming-boundary files the strict test-*.sh prefix cannot even name ---
 # (#1017: three independent censuses handled the microtest file three different
@@ -25,7 +25,7 @@
    "lint": "eslint src",
    "typecheck": "tsc --noEmit",
    "test": "vitest run --passWithNoTests && pnpm run test:framework-shell",
-    "test:framework-shell": "bash framework/tools/quality/scripts/check-test-enumeration.sh && bash framework/tools/quality/scripts/test-check-test-enumeration.sh && python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/promotion_binding_unittest.py && python3 src/lease-broker/promotion_trigger_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/receipt_observer_client_unittest.py && python3 src/lease-broker/invariant_r_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 src/mutator-gate/version_coupling_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh && bash framework/tools/git/test-pr-review-repo-host-override.sh && bash framework/tools/git/test-ci-queue-wait-branch-absent.sh && bash framework/tools/git/test-ci-queue-wait-tristate.sh && bash framework/tools/git/test-ci-queue-wait-github-checks.sh && bash framework/tools/git/test-pr-merge-queue-branch.sh && bash framework/tools/git/test-pr-merge-head-pin.sh && bash framework/tools/git/test-pr-merge-message-field.sh && bash framework/tools/git/test-git-credential-mosaic.sh && bash framework/tools/git/test-gitea-token-identity.sh && bash framework/tools/woodpecker/test-terminal-green-contract.sh && bash framework/tools/_scripts/test-install-ordering-guard.sh && bash framework/tools/_scripts/test-mosaic-init-rce.sh && bash framework/tools/tmux/agent-send.test.sh && bash framework/tools/wake/test-wake-store-ack.sh && bash framework/tools/wake/test-wake-store-enqueue-race.sh && bash framework/tools/wake/test-wake-digest-hmac.sh && bash framework/tools/wake/test-wake-digest-quarantine.sh && bash framework/tools/wake/test-wake-detector.sh && bash framework/tools/wake/test-wake-fn-oracle.sh && bash framework/tools/wake/test-wake-reconcile.sh && bash framework/tools/wake/test-wake-beacon.sh && bash framework/tools/wake/test-wake-preimage.sh && bash framework/tools/wake/test-wake-install.sh"
+    "test:framework-shell": "bash framework/tools/quality/scripts/check-test-enumeration.sh && bash framework/tools/quality/scripts/test-check-test-enumeration.sh && python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/promotion_binding_unittest.py && python3 src/lease-broker/promotion_trigger_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/receipt_observer_client_unittest.py && python3 src/lease-broker/invariant_r_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 src/mutator-gate/version_coupling_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh && bash framework/tools/git/test-pr-review-repo-host-override.sh && bash framework/tools/git/test-ci-queue-wait-branch-absent.sh && bash framework/tools/git/test-ci-queue-wait-tristate.sh && bash framework/tools/git/test-ci-queue-wait-github-checks.sh && bash framework/tools/git/test-pr-merge-queue-branch.sh && bash framework/tools/git/test-pr-merge-head-pin.sh && bash framework/tools/git/test-pr-merge-message-field.sh && bash framework/tools/git/test-git-credential-mosaic.sh && bash framework/tools/git/test-gitea-token-identity.sh && bash framework/tools/woodpecker/test-terminal-green-contract.sh && bash framework/tools/_scripts/test-install-ordering-guard.sh && bash framework/tools/_scripts/test-mosaic-init-rce.sh && bash framework/tools/tmux/agent-send.test.sh && bash framework/tools/wake/test-wake-store-ack.sh && bash framework/tools/wake/test-wake-store-enqueue-race.sh && bash framework/tools/wake/test-wake-digest-hmac.sh && bash framework/tools/wake/test-wake-digest-quarantine.sh && bash framework/tools/wake/test-wake-detector.sh && bash framework/tools/wake/test-wake-fn-oracle.sh && bash framework/tools/wake/test-wake-reconcile.sh && bash framework/tools/wake/test-wake-beacon.sh && bash framework/tools/wake/test-wake-preimage.sh && bash framework/tools/wake/test-wake-install.sh && bash framework/tools/fleet/test-start-agent-session.sh && bash framework/tools/glpi/test-list-http-status.sh && bash framework/tools/orchestrator/test-board-roll.sh && bash framework/tools/woodpecker/test-ci-wait-exit-matrix.sh && bash framework/tools/_scripts/test-fleet-transport-check.sh"
  },
  "dependencies": {
    "@mosaicstack/brain": "workspace:*",
@@ -20,6 +20,7 @@ import { registerMissionCommand } from './commands/mission.js';
 import { registerUninstallCommand } from './commands/uninstall.js';
 import { registerRestoreCommand } from './commands/restore.js';
 import { registerSkillCommand } from './commands/skill.js';
+import { registerStoreCommand } from './commands/store.js';
 // prdy is registered via launch.ts
 import { registerLaunchCommands } from './commands/launch.js';
 import { registerLeaseCapabilityProbe } from './commands/lease-activation-probe.js';
@@ -425,6 +426,10 @@ registerRestoreCommand(program);

 registerSkillCommand(program);

+// ─── store ───────────────────────────────────────────────────────────────────
+
+registerStoreCommand(program);
+
 // ─── telemetry ───────────────────────────────────────────────────────────────

 registerTelemetryCommand(program);
@@ -0,0 +1,458 @@
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { Command } from 'commander';
+import {
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  symlinkSync,
+  writeFileSync,
+} from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import {
+  addStoreEntry,
+  getDefaultStorePaths,
+  listStoreEntries,
+  registerStoreCommand,
+  StoreError,
+  storeKindDir,
+  validateStoreKind,
+  validateStoreName,
+  validateStoreVersion,
+  type StorePaths,
+} from './store.js';
+
+/** Assert a typed StoreError with exactly the expected code. */
+function expectStoreError(run: () => unknown, code: string): void {
+  try {
+    run();
+  } catch (error) {
+    expect(error).toBeInstanceOf(StoreError);
+    expect((error as StoreError).code).toBe(code);
+    return;
+  }
+  throw new Error(`expected StoreError ${code}, but nothing threw`);
+}
+
+describe('vetted user store (W-F4)', () => {
+  let root: string;
+  let paths: StorePaths;
+  let sourceRoot: string;
+
+  beforeEach(() => {
+    root = mkdtempSync(join(tmpdir(), 'mosaic-store-cli-'));
+    paths = { userRoot: join(root, '.mosaic') };
+    sourceRoot = join(root, 'sources');
+    mkdirSync(sourceRoot, { recursive: true });
+  });
+
+  afterEach(() => {
+    rmSync(root, { recursive: true, force: true });
+  });
+
+  function createSource(name: string): string {
+    const dir = join(sourceRoot, name);
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(join(dir, 'SKILL.md'), `# ${name}\n`);
+    return dir;
+  }
+
+  describe('name and version validation (before any filesystem call)', () => {
+    const invalidNames = [
+      '../../etc',
+      '/abs/path',
+      'a/b',
+      String.raw`a\b`,
+      '-rf',
+      '..',
+      'safe.',
+      'space name',
+      'line\nbreak',
+      'escape\u001B[31m',
+    ];
+
+    for (const name of invalidNames) {
+      it(`rejects name ${JSON.stringify(name)}`, () => {
+        expect(() => validateStoreName(name)).toThrow(StoreError);
+      });
+    }
+
+    const invalidVersions = ['', '-1', '1..0', 'a/b', '..', '1.0 beta', '/x'];
+    for (const version of invalidVersions) {
+      it(`rejects version ${JSON.stringify(version)}`, () => {
+        expect(() => validateStoreVersion(version)).toThrow(StoreError);
+      });
+    }
+
+    it('accepts semver-shaped versions including prerelease and build metadata', () => {
+      expect(() => validateStoreVersion('0.1.0-beta.1')).not.toThrow();
+      expect(() => validateStoreVersion('1.2.3+build.7')).not.toThrow();
+    });
+
+    it('rejects plural and unknown kinds', () => {
+      expectStoreError(() => validateStoreKind('plugins'), 'STORE_INVALID_KIND');
+      expectStoreError(() => validateStoreKind('widget'), 'STORE_INVALID_KIND');
+    });
+
+    it('accepts the two spec kinds', () => {
+      expect(() => validateStoreKind('plugin')).not.toThrow();
+      expect(() => validateStoreKind('skill')).not.toThrow();
+    });
+  });
+
+  describe('addStoreEntry', () => {
+    it('copies content into a versioned directory and writes the marker last', () => {
+      const result = addStoreEntry(
+        'skill',
+        'demo',
+        '1.0.0',
+        createSource('demo'),
+        'op',
+        undefined,
+        paths,
+      );
+      expect(result.status).toBe('added');
+      const entryPath = join(paths.userRoot, 'skills', 'demo', '1.0.0');
+      expect(result.entryPath).toBe(entryPath);
+      expect(existsSync(join(entryPath, 'SKILL.md'))).toBe(true);
+      expect(existsSync(join(entryPath, 'store-entry.json'))).toBe(true);
+      const meta = JSON.parse(readFileSync(join(entryPath, 'store-entry.json'), 'utf-8'));
+      expect(meta).toMatchObject({
+        schema: 1,
+        kind: 'skill',
+        name: 'demo',
+        version: '1.0.0',
+        vettedBy: 'op',
+      });
+      expect(typeof meta['vettedAt']).toBe('string');
+    });
+
+    it('writes plugins under plugins/ and skills under skills/', () => {
+      addStoreEntry('plugin', 'alpha', '0.1.0', createSource('alpha'), 'op', undefined, paths);
+      addStoreEntry('skill', 'beta', '2.0.0', createSource('beta'), 'op', undefined, paths);
+      expect(existsSync(join(paths.userRoot, 'plugins', 'alpha', '0.1.0'))).toBe(true);
+      expect(existsSync(join(paths.userRoot, 'skills', 'beta', '2.0.0'))).toBe(true);
+    });
+
+    it('is append-only: an existing version with a marker is refused, not overwritten', () => {
+      const sourceA = createSource('demo');
+      const sourceB = join(sourceRoot, 'demo-other');
+      mkdirSync(sourceB, { recursive: true });
+      writeFileSync(join(sourceB, 'SKILL.md'), '# changed\n');
+      addStoreEntry('skill', 'demo', '1.0.0', sourceA, 'op', undefined, paths);
+      expectStoreError(
+        () => addStoreEntry('skill', 'demo', '1.0.0', sourceB, 'op', undefined, paths),
+        'STORE_ALREADY_PRESENT',
+      );
+      expect(
+        readFileSync(join(paths.userRoot, 'skills', 'demo', '1.0.0', 'SKILL.md'), 'utf-8'),
+      ).toBe('# demo\n');
+    });
+
+    it('allows a second version alongside the first', () => {
+      addStoreEntry('skill', 'demo', '1.0.0', createSource('demo'), 'op', undefined, paths);
+      const result = addStoreEntry(
+        'skill',
+        'demo',
+        '1.1.0',
+        createSource('demo'),
+        'op',
+        undefined,
+        paths,
+      );
+      expect(result.status).toBe('added');
+      expect(readdirSync(join(paths.userRoot, 'skills', 'demo')).sort()).toEqual([
+        '1.0.0',
+        '1.1.0',
+      ]);
+    });
+
+    it('refuses an unmarked target directory by default and preserves its content', () => {
+      const unmarked = join(paths.userRoot, 'skills', 'demo', '1.0.0');
+      mkdirSync(unmarked, { recursive: true });
+      writeFileSync(join(unmarked, 'SKILL.md'), '# operator content\n');
+      expectStoreError(
+        () => addStoreEntry('skill', 'demo', '1.0.0', createSource('demo'), 'op', undefined, paths),
+        'STORE_TARGET_UNMARKED',
+      );
+      // The operator's hand-placed content survives the refusal.
+      expect(readFileSync(join(unmarked, 'SKILL.md'), 'utf-8')).toBe('# operator content\n');
+    });
+
+    it('reclaims an unmarked target only under explicit reclaim opt-in', () => {
+      const unmarked = join(paths.userRoot, 'skills', 'demo', '1.0.0');
+      mkdirSync(unmarked, { recursive: true });
+      writeFileSync(join(unmarked, 'SKILL.md'), '# torn write\n');
+      const result = addStoreEntry(
+        'skill',
+        'demo',
+        '1.0.0',
+        createSource('demo'),
+        'op',
+        undefined,
+        paths,
+        { reclaim: true },
+      );
+      expect(result.status).toBe('reclaimed-unmarked');
+      expect(readFileSync(join(unmarked, 'SKILL.md'), 'utf-8')).toBe('# demo\n');
+    });
+
+    it('reclaim can never destroy a marked, vetted entry (append-only holds under --reclaim)', () => {
+      addStoreEntry('skill', 'demo', '1.0.0', createSource('demo'), 'op', undefined, paths);
+      const marked = join(paths.userRoot, 'skills', 'demo', '1.0.0');
+      const vettedContent = readFileSync(join(marked, 'SKILL.md'), 'utf-8');
+      expectStoreError(
+        () =>
+          addStoreEntry('skill', 'demo', '1.0.0', createSource('demo'), 'op', undefined, paths, {
+            reclaim: true,
+          }),
+        'STORE_ALREADY_PRESENT',
+      );
+      // Load-bearing half: the throw alone does not prove nothing was deleted
+      // before it. Pins the marker-check-before-reclaim-check ordering against
+      // the guard-clause-migrates-upward refactor (review finding on b2124c6).
+      expect(readFileSync(join(marked, 'SKILL.md'), 'utf-8')).toBe(vettedContent);
+      expect(existsSync(join(marked, 'store-entry.json'))).toBe(true);
+    });
+
+    it('refuses a missing source with a typed error', () => {
+      expectStoreError(
+        () =>
+          addStoreEntry('skill', 'demo', '1.0.0', join(sourceRoot, 'nope'), 'op', undefined, paths),
+        'STORE_SOURCE_MISSING',
+      );
+    });
+
+    it('refuses a file (non-directory) source with a typed error', () => {
+      const filePath = join(sourceRoot, 'file.txt');
+      writeFileSync(filePath, 'x');
+      expectStoreError(
+        () => addStoreEntry('skill', 'demo', '1.0.0', filePath, 'op', undefined, paths),
+        'STORE_SOURCE_NOT_DIR',
+      );
+    });
+
+    it('refuses a symlinked source with a typed error and writes nothing', () => {
+      const real = createSource('demo');
+      const link = join(sourceRoot, 'demo-link');
+      symlinkSync(real, link);
+      expectStoreError(
+        () => addStoreEntry('skill', 'demo', '1.0.0', link, 'op', undefined, paths),
+        'STORE_SOURCE_SYMLINK',
+      );
+      expect(existsSync(join(paths.userRoot, 'skills', 'demo'))).toBe(false);
+    });
+
+    it('refuses a source tree containing nested symlinks and writes nothing', () => {
+      const src = createSource('demo');
+      const target = join(sourceRoot, 'elsewhere');
+      mkdirSync(target, { recursive: true });
+      symlinkSync(target, join(src, 'escape'));
+      expectStoreError(
+        () => addStoreEntry('skill', 'demo', '1.0.0', src, 'op', undefined, paths),
+        'STORE_SOURCE_SYMLINK',
+      );
+      expect(existsSync(join(paths.userRoot, 'skills', 'demo'))).toBe(false);
+    });
+
+    it('refuses adding from inside the store itself', () => {
+      const first = addStoreEntry(
+        'skill',
+        'demo',
+        '1.0.0',
+        createSource('demo'),
+        'op',
+        undefined,
+        paths,
+      );
+      expectStoreError(
+        () => addStoreEntry('skill', 'copy', '1.0.0', first.entryPath, 'op', undefined, paths),
+        'STORE_SOURCE_INSIDE_STORE',
+      );
+    });
+
+    it('refuses a symlinked user root ancestor', () => {
+      const linkedRoot = join(sourceRoot, 'linked-mosaic');
+      symlinkSync(paths.userRoot, linkedRoot);
+      expectStoreError(
+        () =>
+          addStoreEntry('skill', 'demo', '1.0.0', createSource('demo'), 'op', undefined, {
+            userRoot: linkedRoot,
+          }),
+        'STORE_SYMLINK_ROOT',
+      );
+    });
+
+    it('requires a non-empty vetting attribution', () => {
+      expectStoreError(
+        () => addStoreEntry('skill', 'demo', '1.0.0', createSource('demo'), '  ', undefined, paths),
+        'STORE_INVALID_VETTER',
+      );
+    });
+  });
+
+  describe('listStoreEntries', () => {
+    it('returns empty for an absent store without creating it', () => {
+      expect(listStoreEntries(paths)).toEqual([]);
+      expect(existsSync(paths.userRoot)).toBe(false);
+    });
+
+    it('lists entries deterministically with vetting metadata', () => {
+      addStoreEntry('plugin', 'alpha', '0.1.0', createSource('alpha'), 'fred', undefined, paths);
+      addStoreEntry('skill', 'beta', '2.0.0', createSource('beta'), 'fargo', 'looked fine', paths);
+      addStoreEntry('skill', 'beta', '2.1.0', createSource('beta'), 'fargo', undefined, paths);
+
+      const entries = listStoreEntries(paths);
+      expect(entries.map((e) => `${e.kind}:${e.name}:${e.version}`)).toEqual([
+        'plugin:alpha:0.1.0',
+        'skill:beta:2.0.0',
+        'skill:beta:2.1.0',
+      ]);
+      expect(entries[0]?.meta?.vettedBy).toBe('fred');
+      expect(entries[1]?.meta?.notes).toBe('looked fine');
+    });
+
+    it('classifies markerless version directories as incomplete', () => {
+      addStoreEntry('skill', 'demo', '1.0.0', createSource('demo'), 'op', undefined, paths);
+      mkdirSync(join(paths.userRoot, 'skills', 'demo', '2.0.0'), { recursive: true });
+      const entries = listStoreEntries(paths, { kind: 'skill', name: 'demo' });
+      expect(entries.find((e) => e.version === '1.0.0')?.status).toBe('vetted');
+      expect(entries.find((e) => e.version === '2.0.0')?.status).toBe('incomplete');
+    });
+
+    it('classifies malformed marker JSON as invalid-metadata, not vetted', () => {
+      addStoreEntry('skill', 'demo', '1.0.0', createSource('demo'), 'op', undefined, paths);
+      writeFileSync(
+        join(paths.userRoot, 'skills', 'demo', '1.0.0', 'store-entry.json'),
+        '{not json',
+      );
+      const entries = listStoreEntries(paths);
+      expect(entries[0]?.status).toBe('invalid-metadata');
+    });
+
+    it('surfaces foreign files (never mutates them)', () => {
+      mkdirSync(join(paths.userRoot, 'skills'), { recursive: true });
+      writeFileSync(join(paths.userRoot, 'skills', 'stray.txt'), 'x');
+      const entries = listStoreEntries(paths);
+      expect(entries[0]?.status).toBe('foreign');
+      expect(existsSync(join(paths.userRoot, 'skills', 'stray.txt'))).toBe(true);
+    });
+
+    it('filters by kind and name', () => {
+      addStoreEntry('plugin', 'alpha', '0.1.0', createSource('alpha'), 'op', undefined, paths);
+      addStoreEntry('skill', 'beta', '1.0.0', createSource('beta'), 'op', undefined, paths);
+      expect(listStoreEntries(paths, { kind: 'plugin' }).map((e) => e.name)).toEqual(['alpha']);
+      expect(listStoreEntries(paths, { name: 'beta' }).map((e) => e.name)).toEqual(['beta']);
+      expect(() => listStoreEntries(paths, { name: '../escape' })).toThrow(StoreError);
+    });
+  });
+
+  describe('default paths seam', () => {
+    it('honors MOSAIC_USER_HOME', () => {
+      const previous = process.env['MOSAIC_USER_HOME'];
+      try {
+        process.env['MOSAIC_USER_HOME'] = join(root, 'custom-user-home');
+        expect(getDefaultStorePaths().userRoot).toBe(join(root, 'custom-user-home'));
+        expect(storeKindDir('plugin')).toBe(join(root, 'custom-user-home', 'plugins'));
+      } finally {
+        if (previous === undefined) delete process.env['MOSAIC_USER_HOME'];
+        else process.env['MOSAIC_USER_HOME'] = previous;
+      }
+    });
+  });
+
+  describe('CLI', () => {
+    let previousExitCode: string | number | null | undefined;
+
+    beforeEach(() => {
+      previousExitCode = process.exitCode;
+      process.exitCode = undefined;
+    });
+
+    afterEach(() => {
+      process.exitCode = previousExitCode;
+    });
+
+    const parse = (args: string[]) => {
+      const program = new Command().exitOverride();
+      registerStoreCommand(program, paths);
+      return program.parseAsync(['node', 'mosaic', 'store', ...args]);
+    };
+
+    it('registers on the parent program and renders help', () => {
+      const program = new Command().exitOverride();
+      registerStoreCommand(program, paths);
+      const cmd = program.commands.find((c) => c.name() === 'store');
+      expect(cmd).toBeDefined();
+      expect(() => cmd?.helpInformation()).not.toThrow();
+    });
+
+    it('add exits nonzero with a typed code for an invalid name', async () => {
+      await parse([
+        'add',
+        'skill',
+        '../../etc',
+        '1.0.0',
+        '--from',
+        createSource('x'),
+        '--by',
+        'op',
+      ]);
+      expect(process.exitCode).toBe(1);
+    });
+
+    it('add exits nonzero when the kind is plural', async () => {
+      await parse(['add', 'skills', 'demo', '1.0.0', '--from', createSource('demo'), '--by', 'op']);
+      expect(process.exitCode).toBe(1);
+    });
+
+    it('add succeeds and creates the entry directory', async () => {
+      await parse(['add', 'skill', 'demo', '1.0.0', '--from', createSource('demo'), '--by', 'op']);
+      expect(process.exitCode).toBeUndefined();
+      expect(lstatSync(join(paths.userRoot, 'skills', 'demo', '1.0.0')).isDirectory()).toBe(true);
+    });
+
+    it('add requires --by (commander requiredOption)', async () => {
+      await expect(
+        parse(['add', 'skill', 'demo', '1.0.0', '--from', createSource('demo')]),
+      ).rejects.toThrow(/--by/);
+    });
+
+    it('add exits nonzero on an unmarked target without --reclaim, preserving content', async () => {
+      const unmarked = join(paths.userRoot, 'skills', 'demo', '1.0.0');
+      mkdirSync(unmarked, { recursive: true });
+      writeFileSync(join(unmarked, 'SKILL.md'), '# operator\n');
+      await parse(['add', 'skill', 'demo', '1.0.0', '--from', createSource('demo'), '--by', 'op']);
+      expect(process.exitCode).toBe(1);
+      expect(readFileSync(join(unmarked, 'SKILL.md'), 'utf-8')).toBe('# operator\n');
+    });
+
+    it('add --reclaim replaces the unmarked target and succeeds', async () => {
+      const unmarked = join(paths.userRoot, 'skills', 'demo', '1.0.0');
+      mkdirSync(unmarked, { recursive: true });
+      writeFileSync(join(unmarked, 'SKILL.md'), '# torn\n');
+      await parse([
+        'add',
+        'skill',
+        'demo',
+        '1.0.0',
+        '--from',
+        createSource('demo'),
+        '--by',
+        'op',
+        '--reclaim',
+      ]);
+      expect(process.exitCode).toBeUndefined();
+      expect(readFileSync(join(unmarked, 'SKILL.md'), 'utf-8')).toBe('# demo\n');
+    });
+
+    it('list exits 0 on an empty store', async () => {
+      await parse(['list']);
+      expect(process.exitCode).toBeUndefined();
+    });
+  });
+});
@@ -0,0 +1,544 @@
+import {
+  cpSync,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+  type Dirent,
+  type Stats,
+} from 'node:fs';
+import { isAbsolute, join, parse, relative, resolve, sep } from 'node:path';
+import type { Command } from 'commander';
+import { DEFAULT_MOSAIC_USER_HOME } from '../constants.js';
+
+/**
+ * `mosaic store` — the vetted user store under `~/.mosaic/{plugins,skills}` (W-F4).
+ *
+ * Two roots with distinct ownership (HARNESS-HOMES design, frozen REV3):
+ * - `~/.config/mosaic/` is the SYSTEM root: update-owned, replaceable wholesale.
+ * - `~/.mosaic/` is the USER root: never touched by installs or updates.
+ *
+ * This module only ever writes under the USER root. The store is the vetting
+ * boundary: content lands here only through an explicit `store add` carrying a
+ * named vetting attribution, and every entry is versioned
+ * (`store/<kind>s/<name>/<version>/`) with a `store-entry.json` marker written
+ * LAST — a version directory without its marker is never a usable entry, and
+ * an unmarked target is REFUSED by default: it may be this tool's own debris
+ * from an interrupted add, or content the operator placed by hand, and the
+ * code cannot tell those apart — so deletion happens only under an explicit
+ * `--reclaim` opt-in, and the result status names what was done.
+ *
+ * Deferred by design (W-F6 and later): activation/symlink-install into agent
+ * homes, `current`-pointer pinning, network acquisition. `add` accepts a local
+ * source path only — no network, no credentials, ever.
+ */
+
+export type StoreKind = 'plugin' | 'skill';
+export const STORE_KINDS: readonly StoreKind[] = ['plugin', 'skill'];
+
+/** On-disk metadata marker; written last so its presence commits an entry. */
+export const STORE_ENTRY_MARKER = 'store-entry.json';
+
+export interface StorePaths {
+  /** User data root, e.g. `~/.mosaic`. */
+  userRoot: string;
+}
+
+export interface StoreEntryMeta {
+  schema: 1;
+  kind: StoreKind;
+  name: string;
+  version: string;
+  /** Absolute source path the content was vetted from, as resolved at add time. */
+  sourcePath: string;
+  /** Operator who vouched for the content — required, non-empty. */
+  vettedBy: string;
+  /** ISO timestamp of the add. */
+  vettedAt: string;
+  /** Free-form vetting notes, if any. */
+  notes?: string;
+}
+
+export type StoreAddStatus = 'added' | 'reclaimed-unmarked';
+
+export interface StoreAddResult {
+  kind: StoreKind;
+  name: string;
+  version: string;
+  status: StoreAddStatus;
+  entryPath: string;
+  sourcePath: string;
+}
+
+export type StoreEntryStatus = 'vetted' | 'incomplete' | 'invalid-metadata' | 'foreign';
+
+export interface StoreListEntry {
+  kind: StoreKind;
+  name: string;
+  /** Undefined for name-level foreign files (not a directory at all). */
+  version?: string;
+  status: StoreEntryStatus;
+  entryPath: string;
+  meta?: StoreEntryMeta;
+}
+
+const SAFE_STORE_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+const SAFE_STORE_VERSION = /^[A-Za-z0-9][A-Za-z0-9._+-]*$/;
+
+export class StoreError extends Error {
+  public readonly code: string;
+
+  public constructor(code: string, message: string) {
+    super(message);
+    this.name = 'StoreError';
+    this.code = code;
+  }
+}
+
+/** Resolve the user store root while keeping tests injectable. */
+export function getDefaultStorePaths(): StorePaths {
+  const userRoot = process.env['MOSAIC_USER_HOME'] ?? DEFAULT_MOSAIC_USER_HOME;
+  return { userRoot };
+}
+
+/**
+ * Reject a user-supplied name before any filesystem operation.
+ * A store name identifies one directory under `store/<kind>s/`.
+ */
+export function validateStoreName(name: string): void {
+  if (
+    name.length === 0 ||
+    name.startsWith('-') ||
+    name.endsWith('.') ||
+    name.includes('..') ||
+    name.includes('/') ||
+    name.includes('\\') ||
+    isAbsolute(name) ||
+    !SAFE_STORE_NAME.test(name)
+  ) {
+    throw new StoreError(
+      'STORE_INVALID_NAME',
+      `Invalid store name ${JSON.stringify(name)}: use letters, numbers, dots, underscores, or hyphens; start with a letter or number; and do not use paths, "..", or a leading "-".`,
+    );
+  }
+}
+
+/** Versions share the name discipline plus `+` (semver build metadata). */
+export function validateStoreVersion(version: string): void {
+  if (
+    version.length === 0 ||
+    version.startsWith('-') ||
+    version.endsWith('.') ||
+    version.includes('..') ||
+    version.includes('/') ||
+    version.includes('\\') ||
+    isAbsolute(version) ||
+    !SAFE_STORE_VERSION.test(version)
+  ) {
+    throw new StoreError(
+      'STORE_INVALID_VERSION',
+      `Invalid version ${JSON.stringify(version)}: use letters, numbers, dots, underscores, hyphens, or plus; start with a letter or number; and do not use paths, "..", or a leading "-".`,
+    );
+  }
+}
+
+export function validateStoreKind(kind: string): asserts kind is StoreKind {
+  if (!(STORE_KINDS as readonly string[]).includes(kind)) {
+    throw new StoreError(
+      'STORE_INVALID_KIND',
+      `Invalid store kind ${JSON.stringify(kind)}: expected one of ${STORE_KINDS.map((k) => `"${k}"`).join(', ')}.`,
+    );
+  }
+}
+
+function validateVettedBy(vettedBy: string): void {
+  if (vettedBy.trim().length === 0 || vettedBy.includes('\n') || vettedBy.length > 80) {
+    throw new StoreError(
+      'STORE_INVALID_VETTER',
+      'Invalid --by value: name the operator vouching for this content (single line, at most 80 characters).',
+    );
+  }
+}
+
+function lstatIfPresent(path: string): Stats | undefined {
+  try {
+    return lstatSync(path);
+  } catch (error: unknown) {
+    if (error instanceof Error && 'code' in error && error.code === 'ENOENT') return undefined;
+    throw error;
+  }
+}
+
+function assertNoSymlinkAncestors(path: string): void {
+  const absolute = resolve(path);
+  const pathRoot = parse(absolute).root;
+  let current = pathRoot;
+
+  for (const segment of relative(pathRoot, absolute).split(sep)) {
+    if (segment.length === 0) continue;
+    current = join(current, segment);
+    const entry = lstatIfPresent(current);
+    if (!entry) break;
+    if (entry.isSymbolicLink()) {
+      throw new StoreError(
+        'STORE_SYMLINK_ROOT',
+        `Refusing symlink ancestor at ${current}; the user store root must resolve without symlink traversal.`,
+      );
+    }
+  }
+}
+
+/** `plugins` for plugin, `skills` for skill — plural on disk per the layout. */
+function kindDirName(kind: StoreKind): string {
+  return kind === 'plugin' ? 'plugins' : 'skills';
+}
+
+export function storeKindDir(kind: StoreKind, paths: StorePaths = getDefaultStorePaths()): string {
+  return join(paths.userRoot, kindDirName(kind));
+}
+
+function entryDir(kind: StoreKind, name: string, version: string, paths: StorePaths): string {
+  return join(storeKindDir(kind, paths), name, version);
+}
+
+function isInsideRoot(candidate: string, root: string): boolean {
+  const rel = relative(resolve(root), resolve(candidate));
+  return rel.length > 0 && rel !== '..' && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
+}
+
+/**
+ * Refuse any symlink in the source tree — the vetting boundary copies real
+ * content only, so a vetted entry can never carry a link that escapes it.
+ *
+ * NOTE: known check-then-use window between this walk and the `cpSync` below:
+ * a symlink created concurrently with the add could slip through. Accepted
+ * for a local, operator-run CLI; revisit before any unattended or networked
+ * acquisition path exists.
+ */
+function assertSourceTreeHasNoSymlinks(sourcePath: string): void {
+  const stack: string[] = [sourcePath];
+  while (stack.length > 0) {
+    const current = stack.pop()!;
+    for (const dirent of readdirSync(current, { withFileTypes: true })) {
+      const child = join(current, dirent.name);
+      if (dirent.isSymbolicLink()) {
+        throw new StoreError(
+          'STORE_SOURCE_SYMLINK',
+          `Refusing to vet content containing a symlink: ${child}. Resolve or remove symlinks before adding to the store.`,
+        );
+      }
+      if (dirent.isDirectory()) stack.push(child);
+    }
+  }
+}
+
+/**
+ * Vet and add one versioned entry to the user store.
+ *
+ * Copies the source directory (real content, no symlinks) to
+ * `<userRoot>/<kind>s/<name>/<version>/` and writes the `store-entry.json`
+ * marker LAST: a crash mid-copy leaves at most a recoverable partial, never a
+ * half-vetted entry that lists as present.
+ */
+export function addStoreEntry(
+  kind: StoreKind,
+  name: string,
+  version: string,
+  sourcePath: string,
+  vettedBy: string,
+  notes: string | undefined,
+  paths: StorePaths = getDefaultStorePaths(),
+  options: { reclaim?: boolean } = {},
+): StoreAddResult {
+  validateStoreKind(kind);
+  validateStoreName(name);
+  validateStoreVersion(version);
+  validateVettedBy(vettedBy);
+  assertNoSymlinkAncestors(paths.userRoot);
+
+  const resolvedSource = resolve(sourcePath);
+  const source = lstatIfPresent(resolvedSource);
+  if (!source) {
+    throw new StoreError('STORE_SOURCE_MISSING', `Source path does not exist: ${resolvedSource}`);
+  }
+  if (source.isSymbolicLink()) {
+    throw new StoreError(
+      'STORE_SOURCE_SYMLINK',
+      `Refusing to vet a symlink as store content: ${resolvedSource} (points at ${resolve(sourcePath)}). Add the real directory.`,
+    );
+  }
+  if (!source.isDirectory()) {
+    throw new StoreError(
+      'STORE_SOURCE_NOT_DIR',
+      `Source path is not a directory: ${resolvedSource}`,
+    );
+  }
+  if (isInsideRoot(resolvedSource, paths.userRoot)) {
+    throw new StoreError(
+      'STORE_SOURCE_INSIDE_STORE',
+      `Refusing to add store content from inside the store itself: ${resolvedSource}`,
+    );
+  }
+  assertSourceTreeHasNoSymlinks(resolvedSource);
+
+  const target = entryDir(kind, name, version, paths);
+  const existing = lstatIfPresent(target);
+  let status: StoreAddStatus = 'added';
+  if (existing) {
+    if (existsSync(join(target, STORE_ENTRY_MARKER))) {
+      throw new StoreError(
+        'STORE_ALREADY_PRESENT',
+        `${kind} "${name}" version "${version}" is already present at ${target}; stores are append-only — add a new version instead.`,
+      );
+    }
+    // Unmarked target: either this tool's own debris from an interrupted add,
+    // or content the operator placed by hand — indistinguishable on disk. The
+    // USER root's contract is that tooling never destroys operator content,
+    // so deletion requires the explicit --reclaim opt-in (review finding on
+    // c23a71d7: silent rmSync under a benign-sounding status).
+    if (!options.reclaim) {
+      throw new StoreError(
+        'STORE_TARGET_UNMARKED',
+        `Target exists without ${STORE_ENTRY_MARKER}: ${target}. Refusing to delete unmarked content — if this is debris from an interrupted add, re-run with --reclaim to replace it.`,
+      );
+    }
+    rmSync(target, { recursive: true, force: true });
+    status = 'reclaimed-unmarked';
+  }
+
+  mkdirSync(target, { recursive: true });
+  cpSync(resolvedSource, target, { recursive: true });
+
+  const meta: StoreEntryMeta = {
+    schema: 1,
+    kind,
+    name,
+    version,
+    sourcePath: resolvedSource,
+    vettedBy: vettedBy.trim(),
+    vettedAt: new Date().toISOString(),
+    ...(notes === undefined ? {} : { notes }),
+  };
+  writeFileSync(join(target, STORE_ENTRY_MARKER), `${JSON.stringify(meta, null, 2)}\n`);
+
+  return { kind, name, version, status, entryPath: target, sourcePath: resolvedSource };
+}
+
+function readEntryMeta(markerPath: string): { meta?: StoreEntryMeta; status: StoreEntryStatus } {
+  let raw: string;
+  try {
+    raw = readFileSync(markerPath, 'utf-8');
+  } catch {
+    return { status: 'invalid-metadata' };
+  }
+  try {
+    const parsed = JSON.parse(raw) as StoreEntryMeta;
+    if (
+      parsed?.schema === 1 &&
+      (STORE_KINDS as readonly string[]).includes(parsed.kind) &&
+      typeof parsed.name === 'string' &&
+      typeof parsed.version === 'string' &&
+      typeof parsed.vettedBy === 'string' &&
+      typeof parsed.vettedAt === 'string'
+    ) {
+      return { meta: parsed, status: 'vetted' };
+    }
+  } catch {
+    // fall through
+  }
+  return { status: 'invalid-metadata' };
+}
+
+/**
+ * Enumerate every store entry deterministically (kind, then name, then
+ * version). Version directories without a marker list as `incomplete`; files
+ * where directories were expected list as `foreign` — surfaced, never mutated.
+ */
+export function listStoreEntries(
+  paths: StorePaths = getDefaultStorePaths(),
+  filter: { kind?: StoreKind; name?: string } = {},
+): StoreListEntry[] {
+  if (filter.name !== undefined) validateStoreName(filter.name);
+  assertNoSymlinkAncestors(paths.userRoot);
+
+  const kinds = filter.kind ? [filter.kind] : [...STORE_KINDS];
+  const entries: StoreListEntry[] = [];
+
+  for (const kind of kinds) {
+    const kindRoot = lstatIfPresent(storeKindDir(kind, paths));
+    if (!kindRoot) continue;
+    if (!kindRoot.isDirectory()) {
+      entries.push({
+        kind,
+        name: kindDirName(kind),
+        status: 'foreign',
+        entryPath: storeKindDir(kind, paths),
+      });
+      continue;
+    }
+
+    for (const nameDirent of readdirSync(storeKindDir(kind, paths), {
+      withFileTypes: true,
+    }).sort(byName) as Dirent[]) {
+      if (filter.name !== undefined && nameDirent.name !== filter.name) continue;
+      const namePath = join(storeKindDir(kind, paths), nameDirent.name);
+
+      if (!nameDirent.isDirectory()) {
+        entries.push({ kind, name: nameDirent.name, status: 'foreign', entryPath: namePath });
+        continue;
+      }
+
+      const versionDirents = readdirSync(namePath, { withFileTypes: true }).sort(byName);
+      if (versionDirents.length === 0) {
+        entries.push({ kind, name: nameDirent.name, status: 'incomplete', entryPath: namePath });
+        continue;
+      }
+      for (const versionDirent of versionDirents) {
+        const versionPath = join(namePath, versionDirent.name);
+        if (!versionDirent.isDirectory()) {
+          entries.push({
+            kind,
+            name: nameDirent.name,
+            version: versionDirent.name,
+            status: 'foreign',
+            entryPath: versionPath,
+          });
+          continue;
+        }
+        const markerPath = join(versionPath, STORE_ENTRY_MARKER);
+        if (!existsSync(markerPath)) {
+          entries.push({
+            kind,
+            name: nameDirent.name,
+            version: versionDirent.name,
+            status: 'incomplete',
+            entryPath: versionPath,
+          });
+          continue;
+        }
+        const { meta, status } = readEntryMeta(markerPath);
+        entries.push({
+          kind,
+          name: nameDirent.name,
+          version: versionDirent.name,
+          status,
+          entryPath: versionPath,
+          ...(meta === undefined ? {} : { meta }),
+        });
+      }
+    }
+  }
+
+  return entries;
+}
+
+function byName(a: Dirent, b: Dirent): number {
+  return a.name < b.name ? -1 : a.name > b.name ? 1 : 0;
+}
+
+function reportCommandError(error: unknown): void {
+  if (error instanceof StoreError) {
+    console.error(`store: ${error.code}: ${error.message}`);
+  } else {
+    console.error(error instanceof Error ? error.message : String(error));
+  }
+  process.exitCode = 1;
+}
+
+function displayStoreName(name: string): string {
+  return SAFE_STORE_NAME.test(name) ? name : JSON.stringify(name);
+}
+
+/** Register the `mosaic store` command group (W-F4). */
+export function registerStoreCommand(
+  program: Command,
+  paths: StorePaths = getDefaultStorePaths(),
+): void {
+  const store = program
+    .command('store')
+    .description('Manage the vetted user store under ~/.mosaic (plugins, skills)')
+    .configureHelp({ sortSubcommands: true });
+
+  store
+    .command('add <kind> <name> <version>')
+    .description(
+      'Vet and add a local plugin/skill directory to the user store (versioned, append-only)',
+    )
+    .requiredOption('--from <path>', 'Local source directory to vet (no network acquisition)')
+    .requiredOption('--by <operator>', 'Name of the operator vouching for this content')
+    .option('--notes <notes>', 'Vetting notes recorded in the entry metadata')
+    .option(
+      '--reclaim',
+      'Replace an existing UNMARKED target directory (e.g. debris from an interrupted add); refuses without this flag',
+    )
+    .action(
+      async (
+        kind: string,
+        name: string,
+        version: string,
+        opts: {
+          from: string;
+          by: string;
+          notes?: string;
+          reclaim: boolean;
+        },
+      ) => {
+        try {
+          const result = addStoreEntry(
+            kind as StoreKind,
+            name,
+            version,
+            opts.from,
+            opts.by,
+            opts.notes,
+            paths,
+            { reclaim: opts.reclaim },
+          );
+          const suffix =
+            result.status === 'reclaimed-unmarked' ? ' (replaced unmarked directory)' : '';
+          console.log(
+            `${result.kind} ${displayStoreName(result.name)} ${result.version}: added${suffix}`,
+          );
+          console.log(`  entry: ${result.entryPath}`);
+          console.log(`  vetted by ${opts.by.trim()}`);
+        } catch (error: unknown) {
+          reportCommandError(error);
+        }
+      },
+    );
+
+  store
+    .command('list')
+    .description('List store entries with vetting status')
+    .option('--kind <kind>', 'Filter by kind (plugin | skill)')
+    .option('--name <name>', 'Filter by entry name')
+    .action((opts: { kind?: string; name?: string }) => {
+      try {
+        let kind: StoreKind | undefined;
+        if (opts.kind !== undefined) {
+          validateStoreKind(opts.kind);
+          kind = opts.kind;
+        }
+        const entries = listStoreEntries(paths, {
+          ...(kind === undefined ? {} : { kind }),
+          ...(opts.name === undefined ? {} : { name: opts.name }),
+        });
+        if (entries.length === 0) {
+          console.log('No store entries found.');
+          return;
+        }
+        for (const entry of entries) {
+          const version = entry.version ?? '-';
+          const vetter = entry.meta?.vettedBy ?? '-';
+          console.log(
+            `${entry.status.padEnd(17)}${entry.kind.padEnd(8)}${displayStoreName(entry.name).padEnd(24)}${version.padEnd(16)}${vetter}`,
+          );
+        }
+      } catch (error: unknown) {
+        reportCommandError(error);
+      }
+    });
+}
@@ -5,6 +5,13 @@ export const VERSION = '0.0.2';

 export const DEFAULT_MOSAIC_HOME = join(homedir(), '.config', 'mosaic');

+/**
+ * USER data root (HARNESS-HOMES two-root split): everything under here is user
+ * content — never replaced or removed by installs, updates, or uninstallers.
+ * Distinct from the SYSTEM root above, which is update-owned.
+ */
+export const DEFAULT_MOSAIC_USER_HOME = join(homedir(), '.mosaic');
+
 export const DEFAULTS = {
  agentName: 'Assistant',
  roleDescription: 'execution partner and visibility engine',
@@ -1,4 +1,3 @@
-import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir, platform } from 'node:os';

@@ -22,15 +21,18 @@ export function getShellProfilePath(): string | null {

  const shell = detectShell();
  switch (shell) {
+    // Both of these deliberately avoid the interactive-only rc files.
+    // Debian's default .bashrc returns early for non-interactive shells, so a
+    // PATH line appended to it never runs for `bash -lc`, systemd units, or
+    // agent seats — an install could report success and still leave `mosaic`
+    // unreachable. .profile is read by login shells and sources .bashrc for
+    // interactive ones, so one line covers both; .zshenv is zsh's equivalent.
    case 'zsh': {
      const zdotdir = process.env['ZDOTDIR'] ?? home;
-      return join(zdotdir, '.zshrc');
+      return join(zdotdir, '.zshenv');
    }
-    case 'bash': {
-      const bashrc = join(home, '.bashrc');
-      if (existsSync(bashrc)) return bashrc;
+    case 'bash':
      return join(home, '.profile');
-    }
    case 'fish':
      return join(home, '.config', 'fish', 'config.fish');
    default:
@@ -309,6 +309,124 @@ require_cmd() {
  fi
 }

+# True if any shell rc file already puts $1 on PATH.
+#
+# Each file is tested for existence first and grepped one at a time, rather than
+# handed to a single `grep -qs ... "${rc_files[@]}"`. Handing grep a missing file
+# makes the exit status implementation-defined: GNU grep 3.11 returns 0 when -q
+# matched an earlier file, ugrep 7.5 returns 2 for the missing one regardless.
+# On the 2 path the caller reads "not present yet" and appends a duplicate PATH
+# line on every single install.
+path_entry_exists() {
+  local dir="$1" rc_file
+  for rc_file in "$HOME/.profile" "$HOME/.zshenv" "$HOME/.zshrc" "$HOME/.bashrc"; do
+    if [[ -f "$rc_file" ]] && grep -qF "$dir" "$rc_file"; then
+      return 0
+    fi
+  done
+  return 1
+}
+
+# Append `export PATH="$1:$PATH"` to the shell profile so $1 survives this
+# process. An `export` here reaches only the installer; every directory the
+# install leaves behind has to be written down somewhere a later shell reads.
+#
+# Deliberately NOT ~/.bashrc: Debian's default .bashrc returns early for
+# non-interactive shells, so a PATH line appended to the bottom of it is
+# unreachable to `bash -lc`, to systemd units, and to every agent seat — the
+# exact consumers that need these binaries. ~/.profile is read by login shells
+# and Debian's .profile sources .bashrc for interactive ones, so a single line
+# there reaches both. For zsh the always-sourced file is .zshenv, not .zshrc.
+#
+# $1 = directory to add, $2 = label for the comment line.
+# Returns 1 (having warned) if the profile could not be written.
+persist_on_path() {
+  local dir="$1" label="$2" profile
+
+  if path_entry_exists "$dir"; then
+    return 0
+  fi
+
+  if [[ -n "${ZSH_VERSION:-}" ]] || [[ "$(basename "${SHELL:-}")" == "zsh" ]]; then
+    profile="$HOME/.zshenv"
+  else
+    profile="$HOME/.profile"
+  fi
+
+  # Probe writability in a subshell. A redirection failure on a special built-in
+  # aborts the shell it runs in, so it has to be a child; and the redirection on
+  # the subshell is what silences the "Permission denied" the shell would
+  # otherwise print ahead of our own message.
+  if ! ( : >>"$profile" ) 2>/dev/null; then
+    warn "$dir is not on your PATH and $profile could not be written"
+    dim "  Add to your shell rc:  export PATH=\"$dir:\$PATH\""
+    return 1
+  fi
+
+  {
+    echo ""
+    echo "# $label"
+    echo "export PATH=\"$dir:\$PATH\""
+  } >>"$profile"
+  ok "Added $dir to PATH in $profile"
+  return 0
+}
+
+# Persist $PREFIX/bin on PATH instead of only warning about it.
+#
+# The warning it replaces was the last step of an otherwise successful install,
+# so the installer reported success and left `mosaic: command not found` — an
+# unattended install had no operator to read the advice and act on it.
+ensure_prefix_on_path() {
+  if [[ ":$PATH:" == *":$PREFIX/bin:"* ]]; then
+    return
+  fi
+
+  if path_entry_exists "$PREFIX/bin"; then
+    warn "$PREFIX/bin is in your shell profile but not in this shell"
+  elif ! persist_on_path "$PREFIX/bin" "Mosaic CLI"; then
+    return
+  fi
+  dim "  Run:  export PATH=\"$PREFIX/bin:\$PATH\"   (or start a new login shell)"
+}
+
+# Fleet transport binary (#1240).
+#
+# `mosaic fleet --help` reads "Manage the local Mosaic tmux fleet" and every
+# roster the CLI scaffolds sets `transport: tmux`, but nothing in this script
+# provides tmux and, until now, nothing in it mentioned tmux at all. A
+# greenfield host came out of this installer able to install a fleet, start a
+# fleet, and run no seat — the operator's first signal was `mosaic fleet ps`.
+#
+# Not a `require_cmd`: tmux is required by the fleet, not by mosaic. Plenty of
+# hosts install this to run `mosaic claude` and will never scaffold a roster,
+# and failing their install over a binary they do not need would be wrong. It
+# is a warning that names precisely what it blocks.
+#
+# `tools/_scripts/mosaic-doctor` carries a deliberately parallel check, so the
+# same host state gets the same answer from an audit as from an install. They
+# are separate implementations because this one has to work before the
+# framework's scripts are guaranteed to be on disk; keep their wording in step.
+check_fleet_transport() {
+  local transport=tmux
+  local roster="$MOSAIC_HOME/fleet/roster.yaml"
+  local declared=""
+
+  if [[ -f "$roster" ]]; then
+    declared="$(sed -n 's/^[[:space:]]*transport:[[:space:]]*//p' "$roster" | head -1 |
+      tr -d '"'\''' | tr -d '\r' | awk '{print $1}')"
+    [[ -n "$declared" ]] && transport="$declared"
+  fi
+
+  command -v "$transport" &>/dev/null && return 0
+
+  warn "Fleet transport '$transport' is not installed."
+  echo "  The Mosaic fleet runs its agent seats inside $transport. Without it,"
+  echo "  ${C}mosaic fleet start${RESET} reports success and no seat comes up."
+  echo "  Install it before using the fleet, e.g. ${C}sudo apt-get install -y $transport${RESET}"
+  echo "  (this does not affect ${C}mosaic claude${RESET} or the other single-runtime commands)."
+}
+
 installed_cli_version() {
  local json
  json="$(npm ls -g --depth=0 --json --prefix="$PREFIX" 2>/dev/null)" || true
@@ -516,8 +634,175 @@ install_next_cli_from_registry() {
  ok "Installed @next packages: CLI ${installed_cli}, gateway ${installed_gateway}"
 }

+# ─── node bootstrap ───────────────────────────────────────────────────────────
+#
+# Nothing on a greenfield host installs Node.js, yet this installer and the CLI
+# it installs both hard-require it. Measured on a clean Debian 13 image: the
+# installer stopped at `require_cmd node` with "Required command not found" and
+# nothing was installed, with no hint of how to proceed.
+#
+# Inlined rather than factored into a sibling file on purpose: this script is
+# fetched standalone by curl and has nothing to source.
+#
+# No-op when a suitable node is already on PATH, so it never fights an
+# operator's nvm/fnm/distro node.
+
+NODE_ROOT="${MOSAIC_NODE_ROOT:-$HOME/.mosaic/node}"
+NODE_BOOTSTRAP_VERSION="${MOSAIC_NODE_VERSION:-v22.23.2}"
+NODE_MIN_MAJOR="${MOSAIC_NODE_MIN_MAJOR:-20}"
+NODE_DIST_BASE="${MOSAIC_NODE_DIST_BASE:-https://nodejs.org/dist}"
+
+# Major version of the node at $1, or empty if it will not run.
+node_major_of() {
+  local candidate="$1" version
+  version="$("$candidate" -e 'process.stdout.write(process.versions.node)' 2>/dev/null)" || return 0
+  printf '%s' "${version%%.*}"
+}
+
+node_is_suitable() {
+  local major
+  major="$(node_major_of "$1")"
+  [[ -n "$major" ]] && [[ "$major" -ge "$NODE_MIN_MAJOR" ]]
+}
+
+install_node() {
+  local node_os node_arch tarball release_url work_dir extracted target node_bin
+
+  case "$(uname -s)" in
+    Linux)  node_os="linux" ;;
+    Darwin) node_os="darwin" ;;
+    *) fail "Unsupported OS '$(uname -s)'. Install Node.js >= $NODE_MIN_MAJOR manually."; return 1 ;;
+  esac
+
+  # Linux here means glibc. Node's official linux-x64 build is dynamically
+  # linked against glibc, so on musl (Alpine) the binary will not exec — but it
+  # fails visibly: node_is_suitable rejects it and ensure_node exits with
+  # "install Node.js manually". No silent breakage, just a wasted download.
+  # A musl host needs the unofficial build, which is out of scope here.
+  case "$(uname -m)" in
+    x86_64|amd64)  node_arch="x64" ;;
+    aarch64|arm64) node_arch="arm64" ;;
+    armv7l)        node_arch="armv7l" ;;
+    *) fail "Unsupported architecture '$(uname -m)'. Install Node.js >= $NODE_MIN_MAJOR manually."; return 1 ;;
+  esac
+
+  # .tar.gz rather than the smaller .tar.xz: gzip is universally present, xz is
+  # not, and a minimal image is exactly the case this exists to handle.
+  tarball="node-${NODE_BOOTSTRAP_VERSION}-${node_os}-${node_arch}.tar.gz"
+  release_url="${NODE_DIST_BASE}/${NODE_BOOTSTRAP_VERSION}"
+
+  work_dir="$(mktemp -d "${TMPDIR:-/tmp}/mosaic-node-XXXXXX")"
+
+  info "Installing Node.js $NODE_BOOTSTRAP_VERSION ($node_os-$node_arch) to $NODE_ROOT…"
+
+  if ! curl -fsSL "${release_url}/${tarball}" -o "$work_dir/$tarball"; then
+    fail "Download failed: ${release_url}/${tarball}"
+    rm -rf "$work_dir"; return 1
+  fi
+
+  # Trust assumption, stated so nobody has to infer it: this verifies INTEGRITY
+  # (the tarball matches the manifest), not AUTHENTICITY (the manifest is
+  # genuinely Node's). The only thing establishing that is TLS to
+  # $NODE_DIST_BASE. Node publishes SHASUMS256.txt.sig signed by its release
+  # keys and we do not check it, which is on par with nvm but means pointing
+  # MOSAIC_NODE_DIST_BASE at an untrusted mirror has no signature backstop.
+  # Tracked as a hardening follow-up (raised by scooby in the #1229 review).
+  if ! curl -fsSL "${release_url}/SHASUMS256.txt" -o "$work_dir/SHASUMS256.txt"; then
+    fail "Could not fetch SHASUMS256.txt; refusing to install an unverified runtime."
+    rm -rf "$work_dir"; return 1
+  fi
+
+  # Keep only our artifact's line, so a missing entry is an error not a pass.
+  if ! grep " ${tarball}\$" "$work_dir/SHASUMS256.txt" >"$work_dir/expected.sha256"; then
+    fail "$tarball has no entry in SHASUMS256.txt; refusing to install."
+    rm -rf "$work_dir"; return 1
+  fi
+
+  if ! (cd "$work_dir" && verify_sha256 expected.sha256); then
+    fail "Checksum mismatch for $tarball; refusing to install."
+    rm -rf "$work_dir"; return 1
+  fi
+  ok "Checksum verified"
+
+  tar xzf "$work_dir/$tarball" -C "$work_dir"
+  extracted="$work_dir/node-${NODE_BOOTSTRAP_VERSION}-${node_os}-${node_arch}"
+  if [[ ! -x "$extracted/bin/node" ]]; then
+    fail "Extracted archive has no bin/node"
+    rm -rf "$work_dir"; return 1
+  fi
+
+  mkdir -p "$NODE_ROOT"
+  target="$NODE_ROOT/$NODE_BOOTSTRAP_VERSION"
+  rm -rf "$target.incoming"
+  mv "$extracted" "$target.incoming"
+  rm -rf "$target"
+  mv "$target.incoming" "$target"
+  ln -sfn "$NODE_BOOTSTRAP_VERSION" "$NODE_ROOT/current"
+  rm -rf "$work_dir"
+
+  node_bin="$NODE_ROOT/current/bin"
+  if ! node_is_suitable "$node_bin/node"; then
+    fail "Installed node at $node_bin/node did not run"
+    return 1
+  fi
+
+  export PATH="$node_bin:$PATH"
+  ok "Node.js $(node -v) installed with npm $(npm -v 2>/dev/null || echo '?')"
+  return 0
+}
+
+# Make the Mosaic-managed Node reachable from the next shell as well as this
+# one. Measured on a greenfield canary run: without this the install finished
+# rc=0, wrote $PREFIX/bin to ~/.profile, and the next login shell found `mosaic`
+# and then died on `env: 'node': No such file or directory` — the CLI is a Node
+# script, so a CLI on PATH without its runtime is a successful install that
+# produces a broken command.
+persist_node_on_path() {
+  persist_on_path "$NODE_ROOT/current/bin" "Mosaic-managed Node.js" || true
+}
+
+ensure_node() {
+  if command -v node &>/dev/null && node_is_suitable node; then
+    return 0
+  fi
+
+  # A previous run may have installed one that is not on this shell's PATH.
+  if node_is_suitable "$NODE_ROOT/current/bin/node"; then
+    export PATH="$NODE_ROOT/current/bin:$PATH"
+    persist_node_on_path
+    return 0
+  fi
+
+  if [[ "${MOSAIC_SKIP_NODE_BOOTSTRAP:-0}" == "1" ]]; then
+    fail "No suitable Node.js and MOSAIC_SKIP_NODE_BOOTSTRAP=1; refusing to download."
+    echo "  Install Node.js >= $NODE_MIN_MAJOR yourself, then re-run this script."
+    exit 1
+  fi
+
+  require_cmd curl
+  require_cmd tar
+
+  # sha256sum on Linux, shasum on macOS. Verification is not optional: without a
+  # checksum this would install an unauthenticated runtime.
+  if command -v sha256sum &>/dev/null; then
+    verify_sha256() { sha256sum -c --status "$1"; }
+  elif command -v shasum &>/dev/null; then
+    verify_sha256() { shasum -a 256 -c --status "$1"; }
+  else
+    fail "sha256sum or shasum required to verify the Node.js download"
+    exit 1
+  fi
+
+  if ! install_node; then
+    fail "Could not bootstrap Node.js. Install Node.js >= $NODE_MIN_MAJOR and re-run."
+    exit 1
+  fi
+  persist_node_on_path
+}
+
 # ─── preflight ────────────────────────────────────────────────────────────────

+ensure_node
 require_cmd node
 require_cmd npm

@@ -682,11 +967,7 @@ if [[ "$FLAG_CLI" == "true" ]]; then
    ensure_monorepo
    install_cli_from_source

-    # PATH check for npm prefix
-    if [[ ":$PATH:" != *":$PREFIX/bin:"* ]]; then
-      warn "$PREFIX/bin is not on your PATH"
-      dim "  Add to your shell rc:  export PATH=\"$PREFIX/bin:\$PATH\""
-    fi
+    ensure_prefix_on_path
  elif is_next_registry_lane; then
    info "Next mode — trying fast npm @next install from ${REGISTRY}…"
    if install_next_cli_from_registry; then
@@ -699,11 +980,7 @@ if [[ "$FLAG_CLI" == "true" ]]; then
      export MOSAIC_GATEWAY_SKIP_NPM_INSTALL=1
    fi

-    # PATH check for npm prefix
-    if [[ ":$PATH:" != *":$PREFIX/bin:"* ]]; then
-      warn "$PREFIX/bin is not on your PATH"
-      dim "  Add to your shell rc:  export PATH=\"$PREFIX/bin:\$PATH\""
-    fi
+    ensure_prefix_on_path
  else
    if [[ -z "$LATEST" ]]; then
      warn "Could not reach registry at $REGISTRY — skipping npm CLI."
@@ -721,11 +998,7 @@ if [[ "$FLAG_CLI" == "true" ]]; then
      ok "CLI is at or ahead of registry ($CURRENT ≥ $LATEST)."
    fi

-    # PATH check for npm prefix
-    if [[ ":$PATH:" != *":$PREFIX/bin:"* ]]; then
-      warn "$PREFIX/bin is not on your PATH"
-      dim "  Add to your shell rc:  export PATH=\"$PREFIX/bin:\$PATH\""
-    fi
+    ensure_prefix_on_path
  fi
 fi

@@ -870,6 +1143,11 @@ if [[ "$FLAG_CHECK" == "false" ]]; then
  ok "Done."
 fi

+# Fleet readiness (#1240). Runs in both normal and --check mode: "what is the
+# state of this host" is exactly the question --check is asked, and a host that
+# cannot run a seat should not have to discover it from `fleet ps`.
+check_fleet_transport
+
 } # end main

 main "$@"