docs(install): record the two trust/portability assumptions in install_node

Comment-only, no behaviour change. Both raised by scooby in the #1229 review
as non-blocking findings worth writing down rather than fixing here.

F-A: the SHASUMS256.txt check gives integrity, not authenticity. TLS to
$NODE_DIST_BASE is the whole trust root, and MOSAIC_NODE_DIST_BASE widens it
to any mirror with no signature backstop. GPG-verifying SHASUMS256.txt.sig is
filed as its own follow-up so it gets its own review.

F-C: the uname map pulls the glibc build, so musl hosts fail — visibly, via
node_is_suitable, not silently.

packages/mosaic/__tests__/platform/detect.test.ts

@@ -0,0 +1,74 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+
+// homedir/platform are read at call time, so they can be stubbed per case.
+vi.mock('node:os', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('node:os')>();
+  return {
+    ...actual,
+    homedir: () => '/home/tester',
+    platform: () => mockPlatform,
+  };
+});
+
+let mockPlatform: NodeJS.Platform = 'linux';
+
+const { getShellProfilePath, detectShell } = await import('../../src/platform/detect.js');
+
+describe('getShellProfilePath', () => {
+  const originalShell = process.env['SHELL'];
+  const originalZdotdir = process.env['ZDOTDIR'];
+
+  beforeEach(() => {
+    mockPlatform = 'linux';
+    delete process.env['ZDOTDIR'];
+  });
+
+  afterEach(() => {
+    if (originalShell === undefined) delete process.env['SHELL'];
+    else process.env['SHELL'] = originalShell;
+    if (originalZdotdir === undefined) delete process.env['ZDOTDIR'];
+    else process.env['ZDOTDIR'] = originalZdotdir;
+  });
+
+  // The regression this guards: setupPath() in stages/finalize.ts appends the
+  // PATH export to whatever this returns. A line written to ~/.bashrc is
+  // unreachable to `bash -lc`, systemd units and agent seats, because Debian's
+  // default .bashrc returns early for non-interactive shells — so an install
+  // reported success and left `mosaic: command not found`. Same for .zshrc,
+  // which zsh only reads for interactive shells.
+  it('never targets an interactive-only rc file', () => {
+    for (const shell of ['/bin/bash', '/usr/bin/zsh']) {
+      process.env['SHELL'] = shell;
+      const profile = getShellProfilePath();
+      expect(profile).not.toMatch(/\.bashrc$/);
+      expect(profile).not.toMatch(/\.zshrc$/);
+    }
+  });
+
+  it('uses ~/.profile for bash', () => {
+    process.env['SHELL'] = '/bin/bash';
+    expect(getShellProfilePath()).toBe('/home/tester/.profile');
+  });
+
+  it('uses ~/.zshenv for zsh', () => {
+    process.env['SHELL'] = '/usr/bin/zsh';
+    expect(getShellProfilePath()).toBe('/home/tester/.zshenv');
+  });
+
+  it('honours ZDOTDIR for zsh', () => {
+    process.env['SHELL'] = '/usr/bin/zsh';
+    process.env['ZDOTDIR'] = '/custom/zdot';
+    expect(getShellProfilePath()).toBe('/custom/zdot/.zshenv');
+  });
+
+  it('falls back to ~/.profile for an unknown shell', () => {
+    process.env['SHELL'] = '/bin/somethingelse';
+    expect(detectShell()).toBe('unknown');
+    expect(getShellProfilePath()).toBe('/home/tester/.profile');
+  });
+
+  it('still routes fish to its own config', () => {
+    process.env['SHELL'] = '/usr/bin/fish';
+    expect(getShellProfilePath()).toBe('/home/tester/.config/fish/config.fish');
+  });
+});

packages/mosaic/framework/systemd/user/mosaic-agent@.service

@@ -4,14 +4,6 @@ Documentation=https://git.mosaicstack.dev/mosaicstack/stack
 Requires=mosaic-tmux-holder.service
 After=mosaic-tmux-holder.service
 PartOf=mosaic-tmux-holder.service
-# Do not attempt a seat before its generated env exists. `install` enables this
-# unit (WantedBy=default.target) but on a roster-v2 fleet the reconciler owns the
-# generated env, so between `install` and the first `apply`/`regen --write` there
-# is a boot window where ExecStart would run against an absent env file and the
-# launcher would fail the unit. A skipped unit is the honest state for "enabled
-# but not yet configured"; systemd re-evaluates the condition on every start, so
-# the seat comes up on the next start once the reconciler has written env.
-ConditionPathExists=%h/.config/mosaic/fleet/agents/%i.env.generated
 
 [Service]
 Type=oneshot

packages/mosaic/src/commands/fleet-roster-v2-dispatch.spec.ts

@@ -1,323 +0,0 @@
-import { execFile } from 'node:child_process';
-import { mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { join, resolve } from 'node:path';
-import { Command } from 'commander';
-import { afterEach, describe, expect, it, vi } from 'vitest';
-import { registerFleetCommand, type CommandResult, type CommandRunner } from './fleet.js';
-
-/**
- * #1237: the v1-only commands (`ps`, `install`, `install-systemd`, `add`,
- * `remove`) rejected a roster-v2 fleet outright, so a greenfield v2 box could
- * never get its units placed. These tests pin the three behaviours that fix
- * gives it, and the two it deliberately does NOT give it.
- *
- * The load-bearing negative is that `install` on v2 writes no generated env:
- * the reconciler owns that file through projectRosterV2AgentGeneratedEnv, and a
- * second writer here — necessarily through the v1 mapping — is exactly the
- * drift the #791 single-SSOT invariant exists to prevent.
- */
-
-const rosterV2 = `
-version: 2
-generation: 4
-transport: tmux
-tmux:
-  socket_name: mosaic-fleet
-  holder_session: _holder
-defaults:
-  working_directory: /srv/mosaic
-  runtime: pi
-runtimes:
-  pi:
-    reset_command: /new
-agents:
-  - name: coder0
-    alias: Coder 0
-    class: code
-    runtime: pi
-    provider: openai
-    model: gpt-5.6-sol
-    reasoning: high
-    tool_policy: code
-    working_directory: /srv/mosaic
-    persistent_persona: false
-    reset_between_tasks: true
-    lifecycle:
-      enabled: true
-      desired_state: stopped
-    launch:
-      yolo: true
-  - name: coder1
-    alias: Coder 1
-    class: code
-    runtime: pi
-    provider: openai
-    model: gpt-5.6-sol
-    reasoning: medium
-    tool_policy: code
-    working_directory: /srv/other
-    persistent_persona: false
-    reset_between_tasks: true
-    lifecycle:
-      enabled: true
-      desired_state: stopped
-    launch:
-      yolo: true
-`;
-
-let tempHome: string | undefined;
-const savedHome = process.env.HOME;
-const savedMosaicHome = process.env.MOSAIC_HOME;
-
-afterEach(async (): Promise<void> => {
-  vi.restoreAllMocks();
-  process.exitCode = undefined;
-  if (savedHome === undefined) delete process.env.HOME;
-  else process.env.HOME = savedHome;
-  if (savedMosaicHome === undefined) delete process.env.MOSAIC_HOME;
-  else process.env.MOSAIC_HOME = savedMosaicHome;
-  if (tempHome) await rm(tempHome, { recursive: true, force: true });
-  tempHome = undefined;
-});
-
-/**
- * A HOME with a roster-v2 fleet and nothing else — the greenfield shape, before
- * anything has been installed, applied or started.
- */
-async function v2Home(): Promise<string> {
-  tempHome = await mkdtemp(join(tmpdir(), 'mosaic-fleet-v2-dispatch-'));
-  process.env.HOME = tempHome;
-  delete process.env.MOSAIC_HOME;
-  const mosaicHome = join(tempHome, '.config', 'mosaic');
-  for (const directory of ['fleet', 'fleet/agents', 'fleet/roles']) {
-    await mkdir(join(mosaicHome, directory), { recursive: true, mode: 0o700 });
-  }
-  await writeFile(join(mosaicHome, 'fleet', 'roster.yaml'), rosterV2, { mode: 0o600 });
-  await writeFile(join(mosaicHome, 'fleet', 'roles', 'code.md'), '`class: code`\n\n# code\n', {
-    mode: 0o600,
-  });
-  return mosaicHome;
-}
-
-/**
- * Stands in for a box where nothing is running: every systemctl and tmux probe
- * fails the way it does before the holder has ever started. `ps` must survive
- * this — it is the command an operator reaches for to find out *why* there is
- * no seat, so it has to report the emptiness rather than fail on it.
- */
-const greenfieldRunner: CommandRunner = async (command): Promise<CommandResult> => {
-  if (command === 'tmux') {
-    return { stdout: '', stderr: 'no server running on /tmp/tmux-1000/mosaic-fleet', exitCode: 1 };
-  }
-  return { stdout: '', stderr: '', exitCode: 1 };
-};
-
-function program(runner: CommandRunner = greenfieldRunner): Command {
-  const result = new Command();
-  result.exitOverride();
-  registerFleetCommand(result, { runner, frameworkRoot: resolve(process.cwd(), 'framework') });
-  return result;
-}
-
-function capture(): string[] {
-  const lines: string[] = [];
-  vi.spyOn(console, 'log').mockImplementation((value: string): void => {
-    lines.push(value);
-  });
-  return lines;
-}
-
-async function exists(path: string): Promise<boolean> {
-  try {
-    await stat(path);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-describe('mosaic fleet ps — roster v2', (): void => {
-  it('lists every v2 agent on a greenfield box with nothing running, and does not throw', async (): Promise<void> => {
-    await v2Home();
-    const lines = capture();
-
-    await expect(
-      program().parseAsync(['node', 'mosaic', 'fleet', 'ps', '--json']),
-    ).resolves.toBeDefined();
-
-    const rows = JSON.parse(lines.join('\n')) as {
-      name: string;
-      runtime: string;
-      alias?: string;
-      paneAlive: boolean;
-      source: string;
-    }[];
-    expect(rows.map((row) => row.name).sort()).toEqual(['coder0', 'coder1']);
-    // The v2 roster's per-agent fields must survive the read model, not be
-    // flattened into defaults.
-    expect(rows.every((row) => row.runtime === 'pi')).toBe(true);
-    expect(rows.find((row) => row.name === 'coder0')?.alias).toBe('Coder 0');
-    // Nothing is running, and that is a report, not an error.
-    expect(rows.every((row) => row.paneAlive === false)).toBe(true);
-    expect(rows.every((row) => row.source === 'roster')).toBe(true);
-    expect(process.exitCode ?? 0).toBe(0);
-  });
-});
-
-describe('mosaic fleet install — roster v2', (): void => {
-  it('places the tool files and unit templates', async (): Promise<void> => {
-    const mosaicHome = await v2Home();
-    capture();
-
-    await expect(
-      program().parseAsync(['node', 'mosaic', 'fleet', 'install', '--no-enable']),
-    ).resolves.toBeDefined();
-
-    // Units live in the systemd user dir, not under the Mosaic home.
-    const systemdUserDir = join(tempHome!, '.config', 'systemd', 'user');
-    for (const unit of [
-      'mosaic-tmux-holder.service',
-      '[email protected]',
-      '[email protected]',
-    ]) {
-      expect(await exists(join(systemdUserDir, unit))).toBe(true);
-    }
-    const launcher = join(mosaicHome, 'tools', 'fleet', 'start-agent-session.sh');
-    expect(await exists(launcher)).toBe(true);
-    expect((await stat(launcher)).mode & 0o777).toBe(0o755);
-  });
-
-  it('writes NO generated env — that file belongs to the reconciler (#791)', async (): Promise<void> => {
-    const mosaicHome = await v2Home();
-    capture();
-
-    await program().parseAsync(['node', 'mosaic', 'fleet', 'install', '--no-enable']);
-
-    const agentDir = join(mosaicHome, 'fleet', 'agents');
-    expect(await readdir(agentDir)).toEqual([]);
-  });
-
-  it('tells the operator which command does own the env', async (): Promise<void> => {
-    await v2Home();
-    const lines = capture();
-
-    await program().parseAsync(['node', 'mosaic', 'fleet', 'install', '--no-enable']);
-
-    expect(lines.join('\n')).toContain('mosaic fleet apply');
-  });
-});
-
-describe('[email protected]', (): void => {
-  const unitPath = resolve(process.cwd(), 'framework', 'systemd', 'user', '[email protected]');
-
-  /** The single `ConditionPathExists=` value declared by the unit template. */
-  async function conditionPath(): Promise<string> {
-    const unit = await readFile(unitPath, 'utf8');
-    const matches = unit.match(/^ConditionPathExists=(.+)$/gm) ?? [];
-    expect(matches).toHaveLength(1);
-    return matches[0]!.slice('ConditionPathExists='.length).trim();
-  }
-
-  it('will not attempt a seat before the reconciler has written its env', async (): Promise<void> => {
-    // The pairing that makes "install writes no env" safe: install enables the
-    // unit (WantedBy=default.target) but does not start it, so without this
-    // condition a reboot between `install` and the first `apply` would run
-    // ExecStart against an absent env file and fail every seat unit.
-    expect(await conditionPath()).toBe('%h/.config/mosaic/fleet/agents/%i.env.generated');
-  });
-
-  /**
-   * The two halves of the guard's *effect*, which no assertion on the literal
-   * string can cover on its own.
-   *
-   * Measured end to end on a real box (canary, 2026-08-16) rather than inferred:
-   * with the condition, `systemctl --user start mosaic-agent@<name>` on an agent
-   * with no generated env returns rc=0, `Result=success`, `ConditionResult=no`,
-   * and journals "skipped, unmet condition check". With the condition removed by
-   * drop-in and nothing else changed, the same start returns rc=1,
-   * `Result=exit-code`, `ExecMainStatus=64`, and the unit enters `failed`.
-   *
-   * systemd is not available in this suite, so these two tests pin the parts
-   * that can drift in code: the condition naming a *different* file than the one
-   * the fleet actually writes, and the launcher quietly becoming tolerant of an
-   * absent env — either of which turns the condition into decoration while the
-   * literal-string assertion above still passes.
-   */
-  it('guards exactly the file the fleet writes, so the two cannot drift apart', async (): Promise<void> => {
-    const mosaicHome = await v2Home();
-    const rendered = (await conditionPath()).replace('%h', tempHome!).replace('%i', 'coder0');
-
-    // The path an installed fleet actually places for this agent.
-    expect(rendered).toBe(join(mosaicHome, 'fleet', 'agents', 'coder0.env.generated'));
-  });
-
-  it('guards a real failure — the launcher rejects an absent generated env', async (): Promise<void> => {
-    await v2Home();
-    await program().parseAsync(['node', 'mosaic', 'fleet', 'install', '--no-enable']);
-
-    // Exactly what ExecStart runs, against the state the condition exists to
-    // catch: unit enabled, reconciler has not written env yet.
-    const launched = await new Promise<{ code: number | null; stderr: string }>((settle) => {
-      const child = execFile(
-        '/bin/bash',
-        [
-          '--noprofile',
-          '--norc',
-          join(tempHome!, '.config', 'mosaic', 'tools', 'fleet', 'start-agent-session.sh'),
-          'coder0',
-        ],
-        { env: { HOME: tempHome!, MOSAIC_AGENT_NAME: 'coder0', PATH: '/usr/bin:/bin' } },
-        (_error, _stdout, stderr) => {
-          settle({ code: child.exitCode, stderr });
-        },
-      );
-    });
-
-    expect(launched.code).not.toBe(0);
-    expect(launched.stderr).toContain('missing-file');
-  });
-});
-
-describe('mosaic fleet add / remove — roster v2', (): void => {
-  it('add refuses, and names the two-step v2 sequence instead of inventing defaults', async (): Promise<void> => {
-    await v2Home();
-
-    await expect(
-      program().parseAsync([
-        'node',
-        'mosaic',
-        'fleet',
-        'add',
-        'coder2',
-        '--runtime',
-        'pi',
-        '--class',
-        'code',
-      ]),
-    ).rejects.toThrow(/mosaic fleet create[\s\S]*mosaic fleet apply/);
-  });
-
-  it('remove refuses, and names delete plus apply', async (): Promise<void> => {
-    await v2Home();
-
-    await expect(
-      program().parseAsync(['node', 'mosaic', 'fleet', 'remove', 'coder1']),
-    ).rejects.toThrow(/mosaic fleet delete coder1[\s\S]*mosaic fleet apply/);
-  });
-
-  // Note: this one passes on the unmodified tree too — there `remove` throws in
-  // the v1 parser, before it can touch anything. It is a regression guard on the
-  // ordering of the new guard clause, not evidence that the fix works.
-  it('refuses BEFORE mutating the roster', async (): Promise<void> => {
-    const mosaicHome = await v2Home();
-    const rosterPath = join(mosaicHome, 'fleet', 'roster.yaml');
-    const before = await readFile(rosterPath, 'utf8');
-
-    await expect(
-      program().parseAsync(['node', 'mosaic', 'fleet', 'remove', 'coder1']),
-    ).rejects.toThrow();
-
-    expect(await readFile(rosterPath, 'utf8')).toBe(before);
-  });
-});

packages/mosaic/src/commands/fleet.ts

@@ -34,7 +34,6 @@ export {
   resolveInstalledFleetRosterPath,
 } from '../fleet/fleet-roster-v1.js';
 export type { FleetAgent, FleetRoster } from '../fleet/fleet-roster-v1.js';
-import { parseRosterV2 } from '../fleet/roster-v2.js';
 import {
   registerFleetAgentCrudCommands,
   type FleetAgentCrudCommandDeps,
@@ -821,7 +820,7 @@ export function buildEnableLingerCommand(user: string): string[] {
  */
 export async function enableFleetUnits(
   runner: CommandRunner,
-  roster: { readonly agents: readonly { readonly name: string }[] },
+  roster: FleetRoster,
   opts: { enable?: boolean },
 ): Promise<void> {
   if (opts.enable === false) {
@@ -1528,8 +1527,7 @@ export function registerFleetCommand(program: Command, deps: FleetCommandDeps =
     .option('--no-enable', 'Skip enabling units for boot-survival')
     .action(async (opts: { enable?: boolean }) => {
       await installFleet(cmd, frameworkRoot);
-      // Unit enablement needs agent names only, so it reads either version.
-      const roster = await loadRosterReadModel(cmd);
+      const roster = await loadRosterForCommand(cmd);
       await enableFleetUnits(runner, roster, opts);
     });
 
@@ -1539,8 +1537,7 @@ export function registerFleetCommand(program: Command, deps: FleetCommandDeps =
     .option('--no-enable', 'Skip enabling units for boot-survival')
     .action(async (opts: { enable?: boolean }) => {
       await installFleet(cmd, frameworkRoot);
-      // Unit enablement needs agent names only, so it reads either version.
-      const roster = await loadRosterReadModel(cmd);
+      const roster = await loadRosterForCommand(cmd);
       await enableFleetUnits(runner, roster, opts);
     });
 
@@ -1691,9 +1688,7 @@ export function registerFleetCommand(program: Command, deps: FleetCommandDeps =
     .action(async (opts: { json?: boolean }) => {
       const commandOpts = cmd.opts<{ mosaicHome: string; roster?: string }>();
       const activePaths = resolveFleetPaths(commandOpts.mosaicHome);
-      // ps only reads, so it takes the version-agnostic read model rather than
-      // the v1 parser, which rejects a v2 roster outright.
-      const roster = await loadRosterReadModel(cmd);
+      const roster = await loadRosterForCommand(cmd);
       const { tenant_id, host } = getDefaultTenantAndHost();
       const nowMs = Date.now();
 
@@ -1913,16 +1908,6 @@ export function registerFleetCommand(program: Command, deps: FleetCommandDeps =
           start: boolean;
         },
       ) => {
-        if (await usesRosterV2ControlPlane(cmd)) {
-          // command.error, not a bare throw: this is operator guidance, and a
-          // bare throw reaches the top level uncaught and prints it under a Node
-          // stack trace. Measured on canary — the message is the whole point of
-          // the refusal, so it has to arrive readable.
-          cmd.error(rosterV2MutationGuidance('add', 'create', name), {
-            code: 'fleet.roster-v2',
-            exitCode: 1,
-          });
-        }
         if (!VALID_FLEET_RUNTIMES.includes(opts.runtime)) {
           throw new Error(
             `Invalid runtime "${opts.runtime}". Valid runtimes: ${VALID_FLEET_RUNTIMES.join(', ')}.`,
@@ -1988,12 +1973,6 @@ export function registerFleetCommand(program: Command, deps: FleetCommandDeps =
     .description('Remove an agent from the fleet roster')
     .option('--keep-files', 'Skip deleting env and heartbeat files')
     .action(async (name: string, opts: { keepFiles?: boolean }) => {
-      if (await usesRosterV2ControlPlane(cmd)) {
-        cmd.error(rosterV2MutationGuidance('remove', 'delete', name), {
-          code: 'fleet.roster-v2',
-          exitCode: 1,
-        });
-      }
       const commandOpts = cmd.opts<{ mosaicHome: string; roster?: string }>();
       const activePaths = resolveFleetPaths(commandOpts.mosaicHome);
       const rosterPath = await resolveRosterPath(commandOpts.mosaicHome, commandOpts.roster);
@@ -2352,9 +2331,7 @@ export function registerFleetAgentCommands(
 async function installFleet(cmd: Command, frameworkRoot: string): Promise<void> {
   const activePaths = resolveFleetPaths(cmd.opts<{ mosaicHome: string }>().mosaicHome);
   assertDefaultMosaicHomeForSystemd(activePaths.mosaicHome);
-  // Read model first: every file this function places is roster-independent, and
-  // the v1 parser would reject a v2 roster before any of them were written.
-  const roster = await loadRosterReadModel(cmd);
+  const roster = await loadRosterForCommand(cmd);
   await ensureFleetHolderIdentity(activePaths.mosaicHome);
   await mkdir(activePaths.fleetToolsDir, { recursive: true });
   await mkdir(activePaths.tmuxToolsDir, { recursive: true });
@@ -2414,30 +2391,16 @@ async function installFleet(cmd: Command, frameworkRoot: string): Promise<void>
     join(activePaths.systemdUserDir, '[email protected]'),
   );
 
-  // On roster v2 the reconciler owns the generated env: `apply` writes it and
-  // `regen` rebuilds it, both from projectRosterV2AgentGeneratedEnv. Writing it
-  // here too — necessarily through the v1 mapping — would be the third writer of
-  // one file and would break the #791 single-SSOT invariant. So v2 gets the tool
-  // files and the units, and nothing else.
-  if (roster.version === 2) {
-    console.log(
-      `Installed fleet tools and systemd units for ${roster.agents.length} agent(s). ` +
-        `Generated env is owned by the reconciler on roster v2 — run: mosaic fleet apply --expected-generation <n>`,
-    );
-    return;
-  }
-
-  const v1Roster = await loadRosterForCommand(cmd);
-  for (const agent of v1Roster.agents) {
+  for (const agent of roster.agents) {
     await writeAgentEnvironmentProjection({
       mosaicHome: activePaths.mosaicHome,
       agentEnvDir: activePaths.agentEnvDir,
       agentName: agent.name,
-      generated: generateAgentEnvValues(v1Roster, agent),
+      generated: generateAgentEnvValues(roster, agent),
     });
   }
 
-  console.log(`Installed fleet files for ${v1Roster.agents.length} agent(s).`);
+  console.log(`Installed fleet files for ${roster.agents.length} agent(s).`);
 }
 
 async function loadRosterForCommand(cmd: Command): Promise<FleetRoster> {
@@ -2464,77 +2427,6 @@ async function usesRosterV2ControlPlane(cmd: Command): Promise<boolean> {
   );
 }
 
-/**
- * `add`/`remove` and `create`/`delete` are not two spellings of one operation.
- * The v1 pair edits the roster *and* drives systemd; the v2 pair is documented
- * as changing desired state "without runtime actions", leaving convergence to
- * `apply`. `add` also collects four fields where a v2 agent requires eleven, so
- * routing it to `create` would mean inventing provider, alias, reasoning and
- * tool-policy defaults on the operator's behalf. Refusing with the real command
- * is honest; silently guessing an agent's provider is not.
- */
-function rosterV2MutationGuidance(
-  v1Command: 'add' | 'remove',
-  v2Command: 'create' | 'delete',
-  name: string,
-): string {
-  const target = v2Command === 'delete' ? ` ${name}` : '';
-  return (
-    `mosaic fleet ${v1Command} does not operate on a roster-v2 fleet. ` +
-    `Roster v2 separates desired state from convergence:\n` +
-    `  1. mosaic fleet ${v2Command}${target} --expected-generation <current> ` +
-    `${v2Command === 'create' ? "--agent '<json>' " : ''}` +
-    `(edits the roster only)\n` +
-    `  2. mosaic fleet apply --expected-generation <new> (converges systemd and tmux)\n` +
-    `Read the current generation with: mosaic fleet status`
-  );
-}
-
-/**
- * The read-only fields shared by roster v1 and v2, for the commands that only
- * ever *read* the roster (`ps`, and unit enablement inside `install`).
- *
- * This is deliberately NOT a v2→v1 downshift. A downshifted `FleetRoster` would
- * be accepted by `generateAgentEnvValues`, and that would make a third writer of
- * `fleet/agents/<name>.env.generated` — through the v1 mapping — breaking the
- * #791 single-SSOT invariant that {@link projectRosterV2AgentGeneratedEnv} is
- * documented to hold. Keeping the read model this small makes that misuse
- * impossible: there is nothing here to write a roster or an env file back from.
- */
-interface FleetRosterReadModel {
-  readonly version: 1 | 2;
-  readonly tmux: { readonly socketName: string; readonly holderSession: string };
-  readonly agents: readonly {
-    readonly name: string;
-    readonly alias?: string;
-    readonly runtime: string;
-  }[];
-}
-
-/** Reads either roster version into the shared read-only view. */
-async function loadRosterReadModel(cmd: Command): Promise<FleetRosterReadModel> {
-  const opts = cmd.opts<{ mosaicHome: string; roster?: string }>();
-  const path = await resolveRosterPath(opts.mosaicHome, opts.roster);
-  if (!(await usesRosterV2ControlPlane(cmd))) {
-    const v1 = await loadRosterAtPath(cmd, path);
-    return {
-      version: 1,
-      tmux: { socketName: v1.tmux.socketName, holderSession: v1.tmux.holderSession },
-      agents: v1.agents,
-    };
-  }
-  try {
-    const v2 = parseRosterV2(await readFleetRosterText(path), 'yaml');
-    return {
-      version: 2,
-      tmux: { socketName: v2.tmux.socketName, holderSession: v2.tmux.holderSession },
-      agents: v2.agents,
-    };
-  } catch (error) {
-    reportFleetRosterConfigurationError(cmd, error);
-  }
-}
-
 async function loadRosterFromAgentCommand(
   command: Command,
   mosaicHomeOverride?: string,

packages/mosaic/src/platform/detect.ts

@@ -1,4 +1,3 @@
-import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir, platform } from 'node:os';
 
@@ -22,15 +21,18 @@ export function getShellProfilePath(): string | null {
 
   const shell = detectShell();
   switch (shell) {
+    // Both of these deliberately avoid the interactive-only rc files.
+    // Debian's default .bashrc returns early for non-interactive shells, so a
+    // PATH line appended to it never runs for `bash -lc`, systemd units, or
+    // agent seats — an install could report success and still leave `mosaic`
+    // unreachable. .profile is read by login shells and sources .bashrc for
+    // interactive ones, so one line covers both; .zshenv is zsh's equivalent.
     case 'zsh': {
       const zdotdir = process.env['ZDOTDIR'] ?? home;
-      return join(zdotdir, '.zshrc');
+      return join(zdotdir, '.zshenv');
     }
-    case 'bash': {
-      const bashrc = join(home, '.bashrc');
-      if (existsSync(bashrc)) return bashrc;
+    case 'bash':
       return join(home, '.profile');
-    }
     case 'fish':
       return join(home, '.config', 'fish', 'config.fish');
     default:

tools/install.sh

@@ -309,6 +309,87 @@ require_cmd() {
   fi
 }
 
+# True if any shell rc file already puts $1 on PATH.
+#
+# Each file is tested for existence first and grepped one at a time, rather than
+# handed to a single `grep -qs ... "${rc_files[@]}"`. Handing grep a missing file
+# makes the exit status implementation-defined: GNU grep 3.11 returns 0 when -q
+# matched an earlier file, ugrep 7.5 returns 2 for the missing one regardless.
+# On the 2 path the caller reads "not present yet" and appends a duplicate PATH
+# line on every single install.
+path_entry_exists() {
+  local dir="$1" rc_file
+  for rc_file in "$HOME/.profile" "$HOME/.zshenv" "$HOME/.zshrc" "$HOME/.bashrc"; do
+    if [[ -f "$rc_file" ]] && grep -qF "$dir" "$rc_file"; then
+      return 0
+    fi
+  done
+  return 1
+}
+
+# Append `export PATH="$1:$PATH"` to the shell profile so $1 survives this
+# process. An `export` here reaches only the installer; every directory the
+# install leaves behind has to be written down somewhere a later shell reads.
+#
+# Deliberately NOT ~/.bashrc: Debian's default .bashrc returns early for
+# non-interactive shells, so a PATH line appended to the bottom of it is
+# unreachable to `bash -lc`, to systemd units, and to every agent seat — the
+# exact consumers that need these binaries. ~/.profile is read by login shells
+# and Debian's .profile sources .bashrc for interactive ones, so a single line
+# there reaches both. For zsh the always-sourced file is .zshenv, not .zshrc.
+#
+# $1 = directory to add, $2 = label for the comment line.
+# Returns 1 (having warned) if the profile could not be written.
+persist_on_path() {
+  local dir="$1" label="$2" profile
+
+  if path_entry_exists "$dir"; then
+    return 0
+  fi
+
+  if [[ -n "${ZSH_VERSION:-}" ]] || [[ "$(basename "${SHELL:-}")" == "zsh" ]]; then
+    profile="$HOME/.zshenv"
+  else
+    profile="$HOME/.profile"
+  fi
+
+  # Probe writability in a subshell. A redirection failure on a special built-in
+  # aborts the shell it runs in, so it has to be a child; and the redirection on
+  # the subshell is what silences the "Permission denied" the shell would
+  # otherwise print ahead of our own message.
+  if ! ( : >>"$profile" ) 2>/dev/null; then
+    warn "$dir is not on your PATH and $profile could not be written"
+    dim "  Add to your shell rc:  export PATH=\"$dir:\$PATH\""
+    return 1
+  fi
+
+  {
+    echo ""
+    echo "# $label"
+    echo "export PATH=\"$dir:\$PATH\""
+  } >>"$profile"
+  ok "Added $dir to PATH in $profile"
+  return 0
+}
+
+# Persist $PREFIX/bin on PATH instead of only warning about it.
+#
+# The warning it replaces was the last step of an otherwise successful install,
+# so the installer reported success and left `mosaic: command not found` — an
+# unattended install had no operator to read the advice and act on it.
+ensure_prefix_on_path() {
+  if [[ ":$PATH:" == *":$PREFIX/bin:"* ]]; then
+    return
+  fi
+
+  if path_entry_exists "$PREFIX/bin"; then
+    warn "$PREFIX/bin is in your shell profile but not in this shell"
+  elif ! persist_on_path "$PREFIX/bin" "Mosaic CLI"; then
+    return
+  fi
+  dim "  Run:  export PATH=\"$PREFIX/bin:\$PATH\"   (or start a new login shell)"
+}
+
 installed_cli_version() {
   local json
   json="$(npm ls -g --depth=0 --json --prefix="$PREFIX" 2>/dev/null)" || true
@@ -516,8 +597,175 @@ install_next_cli_from_registry() {
   ok "Installed @next packages: CLI ${installed_cli}, gateway ${installed_gateway}"
 }
 
+# ─── node bootstrap ───────────────────────────────────────────────────────────
+#
+# Nothing on a greenfield host installs Node.js, yet this installer and the CLI
+# it installs both hard-require it. Measured on a clean Debian 13 image: the
+# installer stopped at `require_cmd node` with "Required command not found" and
+# nothing was installed, with no hint of how to proceed.
+#
+# Inlined rather than factored into a sibling file on purpose: this script is
+# fetched standalone by curl and has nothing to source.
+#
+# No-op when a suitable node is already on PATH, so it never fights an
+# operator's nvm/fnm/distro node.
+
+NODE_ROOT="${MOSAIC_NODE_ROOT:-$HOME/.mosaic/node}"
+NODE_BOOTSTRAP_VERSION="${MOSAIC_NODE_VERSION:-v22.23.2}"
+NODE_MIN_MAJOR="${MOSAIC_NODE_MIN_MAJOR:-20}"
+NODE_DIST_BASE="${MOSAIC_NODE_DIST_BASE:-https://nodejs.org/dist}"
+
+# Major version of the node at $1, or empty if it will not run.
+node_major_of() {
+  local candidate="$1" version
+  version="$("$candidate" -e 'process.stdout.write(process.versions.node)' 2>/dev/null)" || return 0
+  printf '%s' "${version%%.*}"
+}
+
+node_is_suitable() {
+  local major
+  major="$(node_major_of "$1")"
+  [[ -n "$major" ]] && [[ "$major" -ge "$NODE_MIN_MAJOR" ]]
+}
+
+install_node() {
+  local node_os node_arch tarball release_url work_dir extracted target node_bin
+
+  case "$(uname -s)" in
+    Linux)  node_os="linux" ;;
+    Darwin) node_os="darwin" ;;
+    *) fail "Unsupported OS '$(uname -s)'. Install Node.js >= $NODE_MIN_MAJOR manually."; return 1 ;;
+  esac
+
+  # Linux here means glibc. Node's official linux-x64 build is dynamically
+  # linked against glibc, so on musl (Alpine) the binary will not exec — but it
+  # fails visibly: node_is_suitable rejects it and ensure_node exits with
+  # "install Node.js manually". No silent breakage, just a wasted download.
+  # A musl host needs the unofficial build, which is out of scope here.
+  case "$(uname -m)" in
+    x86_64|amd64)  node_arch="x64" ;;
+    aarch64|arm64) node_arch="arm64" ;;
+    armv7l)        node_arch="armv7l" ;;
+    *) fail "Unsupported architecture '$(uname -m)'. Install Node.js >= $NODE_MIN_MAJOR manually."; return 1 ;;
+  esac
+
+  # .tar.gz rather than the smaller .tar.xz: gzip is universally present, xz is
+  # not, and a minimal image is exactly the case this exists to handle.
+  tarball="node-${NODE_BOOTSTRAP_VERSION}-${node_os}-${node_arch}.tar.gz"
+  release_url="${NODE_DIST_BASE}/${NODE_BOOTSTRAP_VERSION}"
+
+  work_dir="$(mktemp -d "${TMPDIR:-/tmp}/mosaic-node-XXXXXX")"
+
+  info "Installing Node.js $NODE_BOOTSTRAP_VERSION ($node_os-$node_arch) to $NODE_ROOT…"
+
+  if ! curl -fsSL "${release_url}/${tarball}" -o "$work_dir/$tarball"; then
+    fail "Download failed: ${release_url}/${tarball}"
+    rm -rf "$work_dir"; return 1
+  fi
+
+  # Trust assumption, stated so nobody has to infer it: this verifies INTEGRITY
+  # (the tarball matches the manifest), not AUTHENTICITY (the manifest is
+  # genuinely Node's). The only thing establishing that is TLS to
+  # $NODE_DIST_BASE. Node publishes SHASUMS256.txt.sig signed by its release
+  # keys and we do not check it, which is on par with nvm but means pointing
+  # MOSAIC_NODE_DIST_BASE at an untrusted mirror has no signature backstop.
+  # Tracked as a hardening follow-up (raised by scooby in the #1229 review).
+  if ! curl -fsSL "${release_url}/SHASUMS256.txt" -o "$work_dir/SHASUMS256.txt"; then
+    fail "Could not fetch SHASUMS256.txt; refusing to install an unverified runtime."
+    rm -rf "$work_dir"; return 1
+  fi
+
+  # Keep only our artifact's line, so a missing entry is an error not a pass.
+  if ! grep " ${tarball}\$" "$work_dir/SHASUMS256.txt" >"$work_dir/expected.sha256"; then
+    fail "$tarball has no entry in SHASUMS256.txt; refusing to install."
+    rm -rf "$work_dir"; return 1
+  fi
+
+  if ! (cd "$work_dir" && verify_sha256 expected.sha256); then
+    fail "Checksum mismatch for $tarball; refusing to install."
+    rm -rf "$work_dir"; return 1
+  fi
+  ok "Checksum verified"
+
+  tar xzf "$work_dir/$tarball" -C "$work_dir"
+  extracted="$work_dir/node-${NODE_BOOTSTRAP_VERSION}-${node_os}-${node_arch}"
+  if [[ ! -x "$extracted/bin/node" ]]; then
+    fail "Extracted archive has no bin/node"
+    rm -rf "$work_dir"; return 1
+  fi
+
+  mkdir -p "$NODE_ROOT"
+  target="$NODE_ROOT/$NODE_BOOTSTRAP_VERSION"
+  rm -rf "$target.incoming"
+  mv "$extracted" "$target.incoming"
+  rm -rf "$target"
+  mv "$target.incoming" "$target"
+  ln -sfn "$NODE_BOOTSTRAP_VERSION" "$NODE_ROOT/current"
+  rm -rf "$work_dir"
+
+  node_bin="$NODE_ROOT/current/bin"
+  if ! node_is_suitable "$node_bin/node"; then
+    fail "Installed node at $node_bin/node did not run"
+    return 1
+  fi
+
+  export PATH="$node_bin:$PATH"
+  ok "Node.js $(node -v) installed with npm $(npm -v 2>/dev/null || echo '?')"
+  return 0
+}
+
+# Make the Mosaic-managed Node reachable from the next shell as well as this
+# one. Measured on a greenfield canary run: without this the install finished
+# rc=0, wrote $PREFIX/bin to ~/.profile, and the next login shell found `mosaic`
+# and then died on `env: 'node': No such file or directory` — the CLI is a Node
+# script, so a CLI on PATH without its runtime is a successful install that
+# produces a broken command.
+persist_node_on_path() {
+  persist_on_path "$NODE_ROOT/current/bin" "Mosaic-managed Node.js" || true
+}
+
+ensure_node() {
+  if command -v node &>/dev/null && node_is_suitable node; then
+    return 0
+  fi
+
+  # A previous run may have installed one that is not on this shell's PATH.
+  if node_is_suitable "$NODE_ROOT/current/bin/node"; then
+    export PATH="$NODE_ROOT/current/bin:$PATH"
+    persist_node_on_path
+    return 0
+  fi
+
+  if [[ "${MOSAIC_SKIP_NODE_BOOTSTRAP:-0}" == "1" ]]; then
+    fail "No suitable Node.js and MOSAIC_SKIP_NODE_BOOTSTRAP=1; refusing to download."
+    echo "  Install Node.js >= $NODE_MIN_MAJOR yourself, then re-run this script."
+    exit 1
+  fi
+
+  require_cmd curl
+  require_cmd tar
+
+  # sha256sum on Linux, shasum on macOS. Verification is not optional: without a
+  # checksum this would install an unauthenticated runtime.
+  if command -v sha256sum &>/dev/null; then
+    verify_sha256() { sha256sum -c --status "$1"; }
+  elif command -v shasum &>/dev/null; then
+    verify_sha256() { shasum -a 256 -c --status "$1"; }
+  else
+    fail "sha256sum or shasum required to verify the Node.js download"
+    exit 1
+  fi
+
+  if ! install_node; then
+    fail "Could not bootstrap Node.js. Install Node.js >= $NODE_MIN_MAJOR and re-run."
+    exit 1
+  fi
+  persist_node_on_path
+}
+
 # ─── preflight ────────────────────────────────────────────────────────────────
 
+ensure_node
 require_cmd node
 require_cmd npm
 
@@ -682,11 +930,7 @@ if [[ "$FLAG_CLI" == "true" ]]; then
     ensure_monorepo
     install_cli_from_source
 
-    # PATH check for npm prefix
-    if [[ ":$PATH:" != *":$PREFIX/bin:"* ]]; then
-      warn "$PREFIX/bin is not on your PATH"
-      dim "  Add to your shell rc:  export PATH=\"$PREFIX/bin:\$PATH\""
-    fi
+    ensure_prefix_on_path
   elif is_next_registry_lane; then
     info "Next mode — trying fast npm @next install from ${REGISTRY}…"
     if install_next_cli_from_registry; then
@@ -699,11 +943,7 @@ if [[ "$FLAG_CLI" == "true" ]]; then
       export MOSAIC_GATEWAY_SKIP_NPM_INSTALL=1
     fi
 
-    # PATH check for npm prefix
-    if [[ ":$PATH:" != *":$PREFIX/bin:"* ]]; then
-      warn "$PREFIX/bin is not on your PATH"
-      dim "  Add to your shell rc:  export PATH=\"$PREFIX/bin:\$PATH\""
-    fi
+    ensure_prefix_on_path
   else
     if [[ -z "$LATEST" ]]; then
       warn "Could not reach registry at $REGISTRY — skipping npm CLI."
@@ -721,11 +961,7 @@ if [[ "$FLAG_CLI" == "true" ]]; then
       ok "CLI is at or ahead of registry ($CURRENT ≥ $LATEST)."
     fi
 
-    # PATH check for npm prefix
-    if [[ ":$PATH:" != *":$PREFIX/bin:"* ]]; then
-      warn "$PREFIX/bin is not on your PATH"
-      dim "  Add to your shell rc:  export PATH=\"$PREFIX/bin:\$PATH\""
-    fi
+    ensure_prefix_on_path
   fi
 fi