fix(tmux): confirm delivery by draft transition, not by prompt glyph (#1257 )

send-message.sh located the REPL input box with grep -E '❯|^>|│ >'. That set is Claude Code's box. A pi seat renders a bare U+2500 rule with no glyph, so on every idle pi seat the capture succeeded, the grep matched nothing, status stayed "unconfirmed", and the tool exited 2 "may be UNDELIVERED" with the paste and the Enter both landed. The stderr tells the operator to retry, and that retry is the duplicate delivery reported against the same tool. Confirmation is now runtime-agnostic: our message tail sits on the input line (located by cursor row, no glyph) before Enter and has left it after. That transition is positive proof of submission. Absence still proves nothing, which is the guard the 2026-08 fix was reaching for and got backwards. Two positive checks keep it: - a prompt box that IS locatable and still carries our tail => draft, exit 2. This covers the cursor-row blind spot: a cooked pane whose foreground process never reads stdin echoes the paste through the kernel line discipline and moves the cursor off it on Enter, which by cursor row alone is indistinguishable from a real submit. - no draft ever observed on the input line => unconfirmed, non-zero. Tests, both red-first against the shipping blob d397907: test-send-message-glyph-agnostic.sh (new, 6 fixtures) 4/6 -> 6/6 test-send-message-verdict.sh (fixture 2 reshaped, 2b added) 3/4 -> 4/4 Fixture 2 of the verdict suite asserted exit 2 for a glyphless pane that submits and was labelled "false-positive FIXED". A pi seat is that fixture, so the suite was locking the bug in. It is reshaped deliberately, and the guard it was credited with moves to new fixture 2b (glyphless AND non-submitting, raw/no-echo) so the "never infer delivered from absence" property is tested positively rather than as a side effect. Measured on tmux 3.7b (sb-it-1-dt), 3.5a (fomo-lin), and dragon-lin. Co-authored-by: scooby <[email protected]>
2026-08-16 16:35:36 -05:00
19 changed files with 253 additions and 1409 deletions
@@ -115,19 +115,18 @@ gateway-backed agent catalog.
 ### Normative requirements
-| ID           | Requirement                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| ID           | Requirement                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
-| ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `FCM-REQ-01` | The roster SHALL be the sole writable desired-state source for local fleet membership, launch policy, and persisted lifecycle target. Generated environment files, systemd enablement, tmux sessions, and heartbeat state SHALL be non-authoritative projections.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| `FCM-REQ-01` | The roster SHALL be the sole writable desired-state source for local fleet membership, launch policy, and persisted lifecycle target. Generated environment files, systemd enablement, tmux sessions, and heartbeat state SHALL be non-authoritative projections.                                                                                                                                                                                                         |
-| `FCM-REQ-02` | The implementation SHALL provide one executable structural contract for YAML/JSON input and one shared semantic validator. Roster load, profile validation, provision, migration, and apply SHALL reuse the existing baseline-plus-`roles.local` profile/persona resolver; a parallel role resolver is forbidden.                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| `FCM-REQ-02` | The implementation SHALL provide one executable structural contract for YAML/JSON input and one shared semantic validator. Roster load, profile validation, provision, migration, and apply SHALL reuse the existing baseline-plus-`roles.local` profile/persona resolver; a parallel role resolver is forbidden.                                                                                                                                                         |
-| `FCM-REQ-03` | The local fleet CLI SHALL expose documented programmatic validate, show, plan, apply/reconcile, create, inspect, update, delete, start, stop, restart, status, verify, and doctor operations with stable JSON and exit-code behavior. Existing `fleet add/remove` compatibility aliases may remain during the stated deprecation window.                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| `FCM-REQ-03` | The local fleet CLI SHALL expose documented programmatic validate, show, plan, apply/reconcile, create, inspect, update, delete, start, stop, restart, status, verify, and doctor operations with stable JSON and exit-code behavior. Existing `fleet add/remove` compatibility aliases may remain during the stated deprecation window.                                                                                                                                  |
-| `FCM-REQ-04` | A fresh create SHALL persist `enabled:true` and `desired_state:stopped` unless an explicit persisted start is requested. The model SHALL distinguish enabled state, persisted desired state, and observed state. Migration, apply, reboot, and rollback SHALL not start an agent that was observed stopped before cutover.                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| `FCM-REQ-04` | A fresh create SHALL persist `enabled:true` and `desired_state:stopped` unless an explicit persisted start is requested. The model SHALL distinguish enabled state, persisted desired state, and observed state. Migration, apply, reboot, and rollback SHALL not start an agent that was observed stopped before cutover.                                                                                                                                                |
-| `FCM-REQ-05` | The launch chain SHALL consume deterministic, digest-stamped generated input only. Optional local overrides SHALL be parsed as strict data, may not shadow authoritative generated keys, and may not contain arbitrary commands, credential values, channels, or unknown `MOSAIC_AGENT_*` keys. Forbidden legacy keys, including `MOSAIC_AGENT_COMMAND`, SHALL be privately quarantined before launch and reported only by key name and content hash.                                                                                                                                                                                                                                                                                                                                       |
+| `FCM-REQ-05` | The launch chain SHALL consume deterministic, digest-stamped generated input only. Optional local overrides SHALL be parsed as strict data, may not shadow authoritative generated keys, and may not contain arbitrary commands, credential values, channels, or unknown `MOSAIC_AGENT_*` keys. Forbidden legacy keys, including `MOSAIC_AGENT_COMMAND`, SHALL be privately quarantined before launch and reported only by key name and content hash.                     |
-| `FCM-REQ-06` | Mutations and apply SHALL validate before mutation, use an expected generation/lock, write projections atomically, produce a deterministic plan, and emit recovery information on partial failure. Reconciliation SHALL act only on local, enabled, roster-owned projections and SHALL not kill unmanaged tmux sessions by fuzzy name.                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| `FCM-REQ-06` | Mutations and apply SHALL validate before mutation, use an expected generation/lock, write projections atomically, produce a deterministic plan, and emit recovery information on partial failure. Reconciliation SHALL act only on local, enabled, roster-owned projections and SHALL not kill unmanaged tmux sessions by fuzzy name.                                                                                                                                    |
-| `FCM-REQ-07` | Canonical required classes are `code`, `review`, `validator`, `orchestrator`, `team-leader`, `enhancer`, and `interaction`. `validator` issues an independent final certificate but has no merge authority; `merge-gate` remains sole approve-to-land/merge authority. Team-leader capacity is bounded by an orchestrator-issued lease, and interaction is request/status only. Tess and Ultron are configurable instance/display names, not required machine identities.                                                                                                                                                                                                                                                                                                                   |
+| `FCM-REQ-07` | Canonical required classes are `code`, `review`, `validator`, `orchestrator`, `team-leader`, `enhancer`, and `interaction`. `validator` issues an independent final certificate but has no merge authority; `merge-gate` remains sole approve-to-land/merge authority. Team-leader capacity is bounded by an orchestrator-issued lease, and interaction is request/status only. Tess and Ultron are configurable instance/display names, not required machine identities. |
-| `FCM-REQ-08` | v1 migration SHALL be field-complete, reversible, and explicit about aliases, unresolved classes, lifecycle inference, generated-file regeneration, local override quarantine, schema-only remote/connector fields, and rollback. Every shipped example, profile, and service preset SHALL be migrated and executable, retained as an explicitly versioned v1 fixture, or retired with a replacement and deprecation note.                                                                                                                                                                                                                                                                                                                                                                  |
+| `FCM-REQ-08` | v1 migration SHALL be field-complete, reversible, and explicit about aliases, unresolved classes, lifecycle inference, generated-file regeneration, local override quarantine, schema-only remote/connector fields, and rollback. Every shipped example, profile, and service preset SHALL be migrated and executable, retained as an explicitly versioned v1 fixture, or retired with a replacement and deprecation note.                                                |
-| `FCM-REQ-09` | M1–M5 SHALL remain local tmux/systemd control-plane work. Remote/SSH reconciliation, connector mutation, secret references, arbitrary command/channel overrides, gateway/API convergence, and UI configuration storage are excluded and require a separate PRD/threat model.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| `FCM-REQ-09` | M1–M5 SHALL remain local tmux/systemd control-plane work. Remote/SSH reconciliation, connector mutation, secret references, arbitrary command/channel overrides, gateway/API convergence, and UI configuration storage are excluded and require a separate PRD/threat model.                                                                                                                                                                                              |
-| `FCM-REQ-10` | Documentation and examples are delivery gates. The M0 checklist at [docs/fleet/FLEET-CONFIG-DOCS-IA-CHECKLIST.md](./fleet/FLEET-CONFIG-DOCS-IA-CHECKLIST.md) and the baseline disposition inventory at [docs/fleet/LEGACY-EXAMPLE-PROFILE-DISPOSITION-INVENTORY.md](./fleet/LEGACY-EXAMPLE-PROFILE-DISPOSITION-INVENTORY.md) SHALL be maintained as acceptance evidence.                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| `FCM-REQ-10` | Documentation and examples are delivery gates. The M0 checklist at [docs/fleet/FLEET-CONFIG-DOCS-IA-CHECKLIST.md](./fleet/FLEET-CONFIG-DOCS-IA-CHECKLIST.md) and the baseline disposition inventory at [docs/fleet/LEGACY-EXAMPLE-PROFILE-DISPOSITION-INVENTORY.md](./fleet/LEGACY-EXAMPLE-PROFILE-DISPOSITION-INVENTORY.md) SHALL be maintained as acceptance evidence.                                                                                                  |
 | `FCM-REQ-11` | Fleet provisioning SHALL validate the fleet CLI and distinct runtimes requested by the roster against the exact PATH construction used by the runtime pane, through one shared implementation rather than the operator PATH or a parallel PATH model. Name resolution alone is insufficient: a resolved script's shebang interpreter SHALL also be reachable, and Node SHALL execute a side-effect-free version probe when it is that interpreter. `fleet install` and `install-systemd` SHALL fail before installation effects when a required executable is absent or unreachable. `fleet doctor` SHALL emit the same named checks as non-green evidence. Every runtime failure SHALL name the runtime, all requesting roster rows, the pane PATH searched, and an exact install command. |
 ### Acceptance criteria
@@ -139,7 +138,6 @@ gateway-backed agent catalog.
 6. `AC-FCM-06`: A v1 roster migration previews field-by-field disposition, preserves observed stopped/running state, inventories rather than reconciles remote/schema-only entries, supports a canary and rollback, and classifies every shipped example, profile, and service preset according to the M0 inventory.
 7. `AC-FCM-07`: Required role authority is validated: validator certificate is consumed but does not merge, merge-gate is the sole merge authority, team-leader leases do not change roster/credentials/authority, and interaction/Tess cannot claim orchestration or merge powers.
 8. `AC-FCM-08`: Documentation, examples, migration, troubleshooting, operational recovery, package/update asset drift, schema/example/profile validation, independent code/security review, validator certificate, and terminal-green CI are complete before #758 closes.
 9. `AC-FCM-09`: Red-first isolated tests create (a) a roster whose runtime exists on the operator PATH but is absent from the constructed pane PATH and (b) a greenfield pane where `mosaic` and a runtime resolve as Node-shebang scripts while Node is absent. They prove `fleet install` fails before effects, the launcher creates no doomed session, and `fleet doctor` reports named non-green checks. Diagnostics include the executable or runtime, all requesting rows, searched pane PATH, shebang dependency when present, and exact runtime install command; repeated rows are checked once per distinct runtime/effective pane path. Tests use temporary `--mosaic-home` state and fixture binaries, never host runtime mutation.
 ### M0 implementation gate
@@ -59,28 +59,6 @@ valid allowed local data can move to `.env.local`; invalid legacy input is priva
 Diagnostics expose only rule code, key name, and a SHA-256 content hash. They do not reveal command
 text, credentials, or other values.
 ## Pane executable preflight
 The fleet install, install-systemd, and doctor commands plus the session launcher use
 **pane-runtime-path.sh** as the single pane-PATH implementation. Install inspects every distinct
 roster runtime and effective MOSAIC_RUNTIME_BIN pair before creating holder identity, tool,
 projection, or unit files. Doctor reports the same checks as JSON.
 A resolved command is not automatically executable. The helper reads a script shebang, unwraps the
 common “/usr/bin/env node” and “/usr/bin/env -S node …” forms, then resolves the declared command
 against the pane PATH. When Node is the declared interpreter, the helper runs the side-effect-free
 “node --version” probe. It does not run “mosaic --version”, whose startup update check can write cache
 state. Native binaries have no PATH-resolved shebang dependency and retain their normal executable
 check. Failures name the executable or runtime, requesting roster rows, searched pane PATH,
 dependency, and runtime install command.
 Supported runtime install commands are:
 - **Claude:** curl -fsSL https://claude.ai/install.sh | bash
 - **Codex:** npm install -g @openai/codex
 - **OpenCode:** npm install -g opencode-ai
 - **Pi:** npm install -g @earendil-works/pi-coding-agent
 ## Launch and stop behavior
 The launcher obtains the agent's socket only from the validated generated projection. It creates or
@@ -1,71 +0,0 @@
 # #1256 — Fleet runtime preflight
 **Agent:** tiny
 **Branch:** `fix/1256-fleet-runtime-preflight` from `origin/next@476db12b92971634b67fd2057b7577ee5894e449`
 **Issue:** `mosaicstack/stack#1256` blocker 1
 **Adjacent PR:** `#1258` (`fix/1256-fleet-pane-path-node`) owns the bootstrapped-Node candidate and must remain a separate change
 **Budget:** 30K-token soft cap; one bounded implementation lane
 ## Objective
 Make fleet provisioning fail before installation effects when the roster names a runtime binary absent from the exact PATH the tmux pane will receive. Make `mosaic fleet doctor` report the same named runtime check. Diagnostics must name the runtime, every requesting roster row, the pane PATH searched, and an exact install command.
 For Pi the exact command is:
 ```text
 npm install -g @earendil-works/pi-coding-agent
 ```
 ## Constraints
 - TDD: add the failing behavior test and capture RED before implementation.
 - Runtime resolution uses the launcher's pane-PATH construction; a second PATH model is forbidden.
 - Operator PATH is non-authoritative and must not cause a false pass.
 - Tests use an isolated `--mosaic-home`/temporary HOME and never mutate host runtime binaries.
 - No install, removal, or binary-resolution changes on sb-it-1-dt.
 - PR targets `next` and requires a reviewer other than fred.
 - Commit identity is `tiny <[email protected]>`.
 - #1258's Node candidate is a dependency/adjacent change, never reimplemented here.
 ## Planned seam
 1. Factor the shell pane-path builder/resolver into one sourceable and executable fleet helper.
 2. Have `start-agent-session.sh` source that helper, preserving one definition of the pane PATH.
 3. Have the TypeScript fleet command invoke the same helper under the unit-equivalent clean launcher environment.
 4. Group roster rows by distinct runtime and effective pane PATH, then report requesting row names.
 5. Run the preflight before `installFleet` performs any write.
 6. Add the named result to roster-v2 `fleet doctor` JSON and set a failing exit when a runtime is absent.
 7. Install/copy the helper alongside `start-agent-session.sh` and update framework manifest/docs as required.
 This seam overlaps #1258 only at the location of the existing shell function. Development may use #1258 as a local dependency, but the final PR diff must exclude #1258's separately owned Node change after that PR lands or after an agreed rebase order.
 ## Acceptance evidence
 | Requirement | Evidence |
 |---|---|
 | Missing Pi blocks install before effects | isolated CLI test: nonzero + no installed files/runner effects |
 | Operator PATH cannot create false green | test puts Pi only on operator PATH and omits it from constructed pane PATH |
 | Exact pane PATH reused | launcher and CLI call one shared shell helper; contract test exercises both |
 | Actionable diagnosis | runtime + roster rows + searched PATH + exact install command assertions |
 | Distinct runtimes | repeated rows produce one check with all row names |
 | Doctor reports named check | JSON assertion + nonzero exit for missing runtime |
 | Present runtime passes | isolated pane-path fixture with executable binary |
 | No host mutation | tests use temporary HOME/Mosaic home and fixture binaries only |
 | Baseline safety | focused tests, package typecheck/lint/format, full relevant suite, CI |
 ## Progress log
 - 2026-08-16: Dispatch received from fred; issue #1256 and PR #1258 measured.
 - 2026-08-16: Fresh clone created under `~/agent-work/tiny-fleet-runtime-preflight`; local Git identity pinned to tiny so retired global `mos-dt-0` identity cannot win.
 - 2026-08-16: Design inspection found the pane PATH exists only inside `start-agent-session.sh`; the right seam is a shared shell helper rather than a parallel TypeScript reconstruction.
 - 2026-08-16: RED measured on `origin/next@476db12b`: focused `fleet-roster-v2-dispatch.spec.ts` ran 11 tests; the new case failed because install returned success, wrote units for two agents, and emitted no `runtime=pi` diagnosis while Pi existed only on operator PATH.
 - 2026-08-16: Factored pane home/PATH/resolution into sourceable and executable `pane-runtime-path.sh`; install invokes it before the first effect, doctor emits the same named checks, and the launcher sources it.
 - 2026-08-16: Fred/rhodey review exposed the #1241 name-resolution blind spot: `mosaic` can resolve while its `#!/usr/bin/env node` interpreter cannot. Measurement confirmed every supported current Mosaic package shape is a Node-shebang script, but executing `mosaic --version` is not observational because CLI startup runs the cache-writing/network update checker before Commander handles the flag.
 - 2026-08-16: Final executable check reads and unwraps direct and `/usr/bin/env` shebangs (including `env -S`), resolves the declared dependency against pane PATH, and runs only side-effect-free `node --version` when Node is declared. Native binaries do not inherit a permanent Node requirement. Install, doctor, and launcher share this implementation.
 - 2026-08-16: Isolated greenfield fixture places resolved Mosaic and Pi Node-shebang scripts in pane-visible npm-global bin while using an empty system suffix; both checks become `unexecutable` with `dependency=node`, and install leaves holder/tools/units absent. No host binary or HOME is changed.
 - 2026-08-16: GREEN evidence before #1258 rebase: focused install/doctor/preflight suites pass; `fleet.spec.ts` 209/209; full Vitest 87 files / 1,557 tests; launcher shell suite, typecheck, lint, build, and focused format check pass. Full framework-shell reaches an unrelated host-measurement drift in unchanged `invariant_r_unittest.py` (expected Pi 0.84.1, host resolves 0.84.2); no invariant was changed in this lane.
 - 2026-08-16: Merge-order gate remains: `origin/next` is still `476db12b`; #1258 is unmerged at `6dc35e5`. Rebase after it lands, relocate its Node candidate into the helper with explicit provenance, rerun gates, then open the PR to `next` for an independent non-fred review.
@@ -51,12 +51,8 @@ See `docs/fleet/reference/generated-env-boundary.md` for the full contract.
 ## Manual canary sequence
 Use the roster and the supported installer; do not pre-create the agent environment directory or
-edit a generated projection. Before it writes any holder identity, tool, projection, or unit file,
+edit a generated projection. `mosaic fleet install` validates the roster, installs the units and
-`mosaic fleet install` validates the fleet CLI and every distinct roster runtime through the exact
+helpers, and writes private roster-derived projections before any service is started.
 pane PATH. The shared helper also unwraps `/usr/bin/env` shebangs, so a resolved Node script with no
 pane-visible Node fails before effects. `mosaic fleet doctor` reports the same named executable
 checks without mutation. After that preflight, install places the units and helpers and writes private
 roster-derived projections before any service starts.
 ```bash
 # Create a site-owned canary roster. Inspect an existing roster before using --force.
@@ -1,199 +0,0 @@
 #!/usr/bin/env bash
 # Canonical fleet-pane PATH construction and executable reachability checks.
 #
 # This file is both sourceable by start-agent-session.sh and executable by the
 # fleet CLI preflight. Keep the pane PATH in one implementation: provisioning
 # checks and the eventual pane must answer the same question.
 mosaic_fleet_pane_home() {
  local mosaic_home="$1"
  local fallback_home="$2"
  case "$mosaic_home" in
    */.config/mosaic) printf '%s' "${mosaic_home%/.config/mosaic}" ;;
    *) printf '%s' "$fallback_home" ;;
  esac
 }
 mosaic_fleet_build_runtime_bin_prefix() {
  local pane_home="$1"
  local runtime_bin="${2:-}"
  local candidates=()
  if [ -n "$runtime_bin" ]; then candidates+=("$runtime_bin"); fi
  if command -v npm >/dev/null 2>&1; then
    local npm_prefix
    npm_prefix=$(npm config get prefix 2>/dev/null) || true
    if [ -n "$npm_prefix" ]; then candidates+=("${npm_prefix}/bin"); fi
  fi
  candidates+=("$pane_home/.npm-global/bin" "$pane_home/.local/bin")
  local prefix="" dir
  for dir in "${candidates[@]}"; do
    [ -d "$dir" ] || continue
    case ":${prefix}:" in *":${dir}:"*) ;; *) prefix="${prefix:+$prefix:}$dir" ;; esac
  done
  printf '%s' "$prefix"
 }
 mosaic_fleet_build_pane_path() {
  local pane_home="$1"
  local runtime_bin="${2:-}"
  local system_path="${3:-/usr/local/bin:/usr/bin:/bin}"
  local prefix
  prefix=$(mosaic_fleet_build_runtime_bin_prefix "$pane_home" "$runtime_bin")
  printf '%s' "${prefix:+${prefix}:}${system_path}"
 }
 mosaic_fleet_resolve_in_pane_path() {
  local pane_path="$1"
  local binary="$2"
  PATH="$pane_path" command -v -- "$binary" 2>/dev/null
 }
 # Sets executable evidence in MOSAIC_FLEET_EXECUTABLE_* and returns nonzero when
 # a resolved script's shebang interpreter cannot run in the pane. Native/ELF
 # binaries have no PATH-resolved interpreter dependency and pass the executable
 # bit check. Node receives an additional side-effect-free `node --version`
 # execution check; invoking `mosaic --version` itself is intentionally avoided
 # because Mosaic performs a cache-writing/network update check at CLI startup.
 mosaic_fleet_check_resolved_executable() {
  local pane_path="$1"
  local resolved="$2"
  MOSAIC_FLEET_EXECUTABLE_DEPENDENCY=""
  MOSAIC_FLEET_EXECUTABLE_PROBE=""
  MOSAIC_FLEET_EXECUTABLE_EXIT=""
  MOSAIC_FLEET_EXECUTABLE_OUTPUT=""
  [ -x "$resolved" ] || {
    MOSAIC_FLEET_EXECUTABLE_OUTPUT="resolved path is not executable"
    return 70
  }
  local magic=""
  IFS= read -r -n 2 magic < "$resolved" || true
  [ "$magic" = '#!' ] || return 0
  local shebang
  IFS= read -r shebang < "$resolved" || true
  shebang=${shebang%$'\r'}
  shebang=${shebang#\#!}
  local parts=()
  read -r -a parts <<< "$shebang"
  local interpreter="${parts[0]:-}"
  [[ "$interpreter" = /* ]] && [ -x "$interpreter" ] || {
    MOSAIC_FLEET_EXECUTABLE_DEPENDENCY="$interpreter"
    MOSAIC_FLEET_EXECUTABLE_OUTPUT="shebang interpreter is absent or not executable"
    return 70
  }
  local dependency="$interpreter"
  local dependency_path="$interpreter"
  if [ "${interpreter##*/}" = env ]; then
    local index=1
    if [ "${parts[$index]:-}" = -S ]; then index=$((index + 1)); fi
    dependency="${parts[$index]:-}"
    if [ -z "$dependency" ] || [[ "$dependency" = -* ]]; then
      MOSAIC_FLEET_EXECUTABLE_DEPENDENCY="$dependency"
      MOSAIC_FLEET_EXECUTABLE_OUTPUT="unsupported env shebang"
      return 70
    fi
  fi
  MOSAIC_FLEET_EXECUTABLE_DEPENDENCY="$dependency"
  if [ "${dependency##*/}" = node ]; then
    MOSAIC_FLEET_EXECUTABLE_PROBE="node --version"
  fi
  if [ "${interpreter##*/}" = env ]; then
    if ! dependency_path=$(mosaic_fleet_resolve_in_pane_path "$pane_path" "$dependency"); then
      MOSAIC_FLEET_EXECUTABLE_OUTPUT="shebang command is not on the pane PATH"
      return 70
    fi
  fi
  if [ "${dependency##*/}" = node ]; then
    if MOSAIC_FLEET_EXECUTABLE_OUTPUT=$(PATH="$pane_path" "$dependency_path" --version 2>&1); then
      MOSAIC_FLEET_EXECUTABLE_EXIT=0
    else
      MOSAIC_FLEET_EXECUTABLE_EXIT=$?
      return 70
    fi
  fi
  return 0
 }
 mosaic_fleet_runtime_path_main() {
  local mosaic_home=""
  local runtime_bin=""
  local system_path="/usr/local/bin:/usr/bin:/bin"
  local binary=""
  local check_executable=0
  while [ "$#" -gt 0 ]; do
    case "$1" in
      --mosaic-home)
        [ "$#" -ge 2 ] || return 64
        mosaic_home="$2"
        shift 2
        ;;
      --runtime-bin)
        [ "$#" -ge 2 ] || return 64
        runtime_bin="$2"
        shift 2
        ;;
      --binary)
        [ "$#" -ge 2 ] || return 64
        binary="$2"
        shift 2
        ;;
      --check-executable)
        check_executable=1
        shift
        ;;
      # Test seam for measuring a greenfield host with no system Node. The
      # launcher and production CLI omit it and retain the fixed system suffix.
      --system-path)
        [ "$#" -ge 2 ] || return 64
        system_path="$2"
        shift 2
        ;;
      *) return 64 ;;
    esac
  done
  [ -n "$mosaic_home" ] && [ -n "$binary" ] || return 64
  local pane_home pane_path resolved
  pane_home=$(mosaic_fleet_pane_home "$mosaic_home" "${HOME:-}")
  # npm config is HOME-sensitive. Pin it to the derived pane home before asking
  # for its prefix so an operator's unrelated npmrc cannot influence preflight.
  HOME=$pane_home
  export HOME
  pane_path=$(mosaic_fleet_build_pane_path "$pane_home" "$runtime_bin" "$system_path")
  if ! resolved=$(mosaic_fleet_resolve_in_pane_path "$pane_path" "$binary"); then
    printf 'pane_path\0%s\0status\0missing\0binary_path\0\0dependency\0\0probe_command\0\0probe_exit\0\0probe_output\0\0' \
      "$pane_path"
    return 69
  fi
  if [ "$check_executable" -eq 1 ]; then
    if mosaic_fleet_check_resolved_executable "$pane_path" "$resolved"; then
      printf 'pane_path\0%s\0status\0present\0binary_path\0%s\0dependency\0%s\0probe_command\0%s\0probe_exit\0%s\0probe_output\0%s\0' \
        "$pane_path" "$resolved" "$MOSAIC_FLEET_EXECUTABLE_DEPENDENCY" \
        "$MOSAIC_FLEET_EXECUTABLE_PROBE" "$MOSAIC_FLEET_EXECUTABLE_EXIT" \
        "$MOSAIC_FLEET_EXECUTABLE_OUTPUT"
      return 0
    fi
    printf 'pane_path\0%s\0status\0unexecutable\0binary_path\0%s\0dependency\0%s\0probe_command\0%s\0probe_exit\0%s\0probe_output\0%s\0' \
      "$pane_path" "$resolved" "$MOSAIC_FLEET_EXECUTABLE_DEPENDENCY" \
      "$MOSAIC_FLEET_EXECUTABLE_PROBE" "$MOSAIC_FLEET_EXECUTABLE_EXIT" \
      "$MOSAIC_FLEET_EXECUTABLE_OUTPUT"
    return 70
  fi
  printf 'pane_path\0%s\0status\0present\0binary_path\0%s\0dependency\0\0probe_command\0\0probe_exit\0\0probe_output\0\0' \
    "$pane_path" "$resolved"
  return 0
 }
 if [[ "${BASH_SOURCE[0]}" == "$0" ]]; then
  set -euo pipefail
  mosaic_fleet_runtime_path_main "$@"
 fi
@@ -258,22 +258,46 @@ if _tmux has-session -t "=${AGENT_NAME}:0.0" 2>/dev/null; then
 fi
 # Systemd passes HOME as %h, and the installed service fixes MOSAIC_HOME under
-# that home. The provisioning preflight executes this same helper under the
+# that home. Derive the pane home from the canonical path when available so an
-# unit's clean launcher environment, so operator PATH cannot produce a false
+# inherited pane/session HOME cannot become runtime authority.
-# green result for a binary the pane will never see.
+PANE_HOME=$HOME
-SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
+case "$MOSAIC_HOME" in
-# shellcheck source=pane-runtime-path.sh
+  */.config/mosaic) PANE_HOME=${MOSAIC_HOME%/.config/mosaic} ;;
-. "$SCRIPT_DIR/pane-runtime-path.sh"
+esac
 PANE_HOME=$(mosaic_fleet_pane_home "$MOSAIC_HOME" "$HOME")
 PANE_PATH=$(mosaic_fleet_build_pane_path "$PANE_HOME" "$MOSAIC_RUNTIME_BIN")
-# #1241/#1256. The pane runs `mosaic yolo <runtime>` under PANE_PATH with a
+_build_runtime_bin_prefix() {
-# cleared environment. Resolve both names and validate any shebang interpreter
+  local candidates=()
-# here, before an effect, where the failure remains attributable. Name
+  if [ -n "$MOSAIC_RUNTIME_BIN" ]; then candidates+=("$MOSAIC_RUNTIME_BIN"); fi
-# resolution alone is insufficient: an `#!/usr/bin/env node` script resolves
+  if command -v npm >/dev/null 2>&1; then
-# even when the pane cannot execute it because Node is absent.
+    local npm_prefix
    npm_prefix=$(npm config get prefix 2>/dev/null) || true
    if [ -n "$npm_prefix" ]; then candidates+=("${npm_prefix}/bin"); fi
  fi
  candidates+=("$PANE_HOME/.npm-global/bin" "$PANE_HOME/.local/bin")
  local prefix="" dir
  for dir in "${candidates[@]}"; do
    [ -d "$dir" ] || continue
    case ":${prefix}:" in *":${dir}:"*) ;; *) prefix="${prefix:+$prefix:}$dir" ;; esac
  done
  printf '%s' "$prefix"
 }
 MOSAIC_RUNTIME_BIN_PREFIX=$(_build_runtime_bin_prefix)
 PANE_PATH=${MOSAIC_RUNTIME_BIN_PREFIX:+${MOSAIC_RUNTIME_BIN_PREFIX}:}/usr/local/bin:/usr/bin:/bin
 # #1241. The pane runs `mosaic yolo <runtime>` under PANE_PATH with a cleared
 # environment. A binary missing from *that* path is a pane that dies in under a
 # second, inside a session nobody is attached to, with its diagnostic scrolled
 # into a pane tmux then destroys. Resolve both here, before any effect, where
 # the failure is still attributable to the thing that caused it.
 #
 # `mosaic yolo <runtime>` runs checkRuntime(runtime) and the binary it looks for
 # is named exactly like the runtime, so resolving the runtime name is the same
 # question the pane will ask a moment later — asked while an operator can still
 # see the answer.
 _resolve_in_pane_path() {
-  mosaic_fleet_resolve_in_pane_path "$PANE_PATH" "$1"
+  PATH="$PANE_PATH" command -v -- "$1" 2>/dev/null
 }
 # Exit 69 (EX_UNAVAILABLE): the seat cannot be provided. Distinguished from the
@@ -288,15 +312,8 @@ fail_launch() {
 }
 for required_binary in mosaic "$MOSAIC_AGENT_RUNTIME"; do
-  resolved_binary=$(_resolve_in_pane_path "$required_binary") ||
+  _resolve_in_pane_path "$required_binary" >/dev/null ||
    fail_launch missing-binary "'${required_binary}' is not on the pane PATH (${PANE_PATH})"
  if mosaic_fleet_check_resolved_executable "$PANE_PATH" "$resolved_binary"; then
    continue
  else
    executable_exit=$?
  fi
  fail_launch unexecutable-binary \
    "'${required_binary}' resolves to '${resolved_binary}' but dependency '${MOSAIC_FLEET_EXECUTABLE_DEPENDENCY:-unknown}' is not executable on the pane PATH (${PANE_PATH}); check_exit=${executable_exit} detail=${MOSAIC_FLEET_EXECUTABLE_OUTPUT:-unavailable}"
 done
 _ensure_claude_workdir_trusted() {
@@ -484,27 +484,6 @@ assert_missing_pane_binary_rejected() {
 assert_missing_pane_binary_rejected mosaic
 assert_missing_pane_binary_rejected pi
 # #1256. Name resolution is not executable reachability. A script can resolve
 # while its /usr/bin/env shebang command is absent from PANE_PATH; reject that
 # before tmux creates the doomed session.
 : > "$TMUX_CALLS"
 HOME_UNEXECUTABLE="$ROOT/unexecutable-shebang"
 write_generated "$HOME_UNEXECUTABLE" "coder-unexecutable"
 rm -f "$HOME_UNEXECUTABLE/.npm-global/bin/mosaic"
 printf '#!/usr/bin/env mosaic-test-absent-interpreter\n' > \
  "$HOME_UNEXECUTABLE/.npm-global/bin/mosaic"
 chmod +x "$HOME_UNEXECUTABLE/.npm-global/bin/mosaic"
 if output=$(MOSAIC_TEST_PANE_PID=$$ run_start "$HOME_UNEXECUTABLE" coder-unexecutable 2>&1); then
  fail "launcher accepted a resolved mosaic script with an absent shebang command"
 fi
 echo "$output" | grep -qF 'code=unexecutable-binary' || \
  fail "unexecutable shebang diagnostic missing: $output"
 echo "$output" | grep -qF 'mosaic-test-absent-interpreter' || \
  fail "unexecutable shebang diagnostic did not name the missing dependency"
 if tr '\0' '\n' < "$TMUX_CALLS" | grep -qF new-session; then
  fail "launcher created a session after its shebang dependency check failed"
 fi
 # #1241. tmux destroys a session when its pane command exits, so no pane PID a
 # second after new-session means the runtime died on startup. This used to be a
 # WARNING about the heartbeat sidecar followed by exit 0 — three layers above it
@@ -97,13 +97,34 @@ printf '%s' "$MSG" | "${tmux_cmd[@]}" load-buffer -b "$BUF" -
 #   would otherwise accumulate forever.
 sleep 0.5
-# 2) Submit, then POSITIVELY confirm submission; flush with another Enter if it is
+# 2) Submit, then POSITIVELY confirm submission by DRAFT TRANSITION, not by prompt
-#    still a draft. Success requires positive evidence — the queued banner, OR the
+#    glyph. The historical bug was treating ABSENCE of a draft as delivery; the
-#    REPL input box located AND clear of our message tail. The historical bug was
+#    2026-08 fix over-corrected to glyph inference (grep '❯|^>|│ >'), which locates
-#    treating ABSENCE of a draft as delivery: if the prompt glyph was never matched
+#    only Claude Code's box and false-NEGATIVES every glyphless REPL (pi renders a
-#    (wrong pane / prompt-glyph drift), an unsubmitted message read as "delivered"
+#    U+2500 rule, no glyph) — a delivered message reported "UNDELIVERED", driving a
-#    and worker->lead relays stalled silently. We now default to UNCONFIRMED and only
+#    retry that duplicates it. Runtime-agnostic evidence: our message tail sits on
-#    upgrade to delivered on positive evidence; anything we cannot confirm fails loud.
+#    the INPUT line (located by the cursor row, not a glyph) BEFORE Enter, and has
 #    LEFT it AFTER — that transition is positive proof of submission and needs no
 #    glyph. Absence alone still never means delivered: if we never saw our draft on
 #    the input line we stay UNCONFIRMED (wrong/dead pane), and a draft that never
 #    leaves the input line stays a DRAFT (exit 2), preserving both historical guards.
 _cursor_line() { # echo the pane's current input (cursor) line, glyph-free
  local cy line
  cy=$("${tmux_cmd[@]}" display-message -p -t "$EFFECTIVE_TARGET" -F '#{cursor_y}' 2>/dev/null) || return 1
  [ -n "$cy" ] || return 1
  "${tmux_cmd[@]}" capture-pane -t "$EFFECTIVE_TARGET" -p 2>/dev/null | sed -n "$((cy + 1))p"
 }
 _draft_on_input() { # true iff our message tail is sitting on the input line now
  [ -n "$snippet" ] || return 1
  printf '%s' "$(_cursor_line)" | grep -qF "$snippet"
 }
 # Baseline: after the paste, our draft must be on the input line. This is positive
 # proof we are on the right pane and the paste landed — the anchor the transition
 # check measures against.
 saw_draft=0
 _draft_on_input && saw_draft=1
 status="unconfirmed"
 for attempt in $(seq 1 $((RETRIES + 1))); do
  "${tmux_cmd[@]}" send-keys -t "$EFFECTIVE_TARGET" Enter
@@ -113,20 +134,26 @@ for attempt in $(seq 1 $((RETRIES + 1))); do
  if printf '%s' "$pane" | grep -qF "$QUEUED_RE"; then
    status="queued"; break
  fi
-  # Locate the REPL input box (prompt glyph). If we cannot see it, we have NO
+  # POSITIVE draft evidence from a located prompt box, when one exists. This is the
-  # evidence of submission state — stay UNCONFIRMED and retry; never infer delivery.
+  # cursor-row check's blind spot: a pane in COOKED mode (a plain shell whose
  # foreground process never reads stdin) echoes our paste via the kernel line
  # discipline and moves the cursor off it on Enter, which is indistinguishable from
  # a real submit by cursor row alone. If a prompt box IS locatable and still carries
  # our tail, that is affirmative proof the message was not consumed. Absence of a
  # glyph is still never used for anything — that inference is the original E7 bug.
  promptline=$(printf '%s' "$pane" | grep -E '❯|^>|│ >' | tail -1)
-  if [ -z "$promptline" ]; then
+  if [ -n "$promptline" ] && [ -n "$snippet" ] && printf '%s' "$promptline" | grep -qF "$snippet"; then
    status="unconfirmed"; continue
  fi
  # Input box located AND still carrying our tail => unsubmitted draft. Flush + retry.
  # (Submitted messages scroll up into history; a draft stays on the ❯ line.)
  if [ -n "$snippet" ] && printf '%s' "$promptline" | grep -qF "$snippet"; then
    status="draft"; continue
  fi
-  # Input box located AND clear of our tail => positively submitted. This is the
+  if [ "$saw_draft" = 1 ]; then
-  # only path to success besides the queued banner.
+    if _draft_on_input; then
-  status="delivered"; break
+      status="draft"; continue      # still on the input line => not submitted; flush + retry
    fi
    status="delivered"; break        # left the input line => positively submitted
  fi
  # No confirmed baseline yet: try to (re)acquire it; never infer delivery from absence.
  if _draft_on_input; then saw_draft=1; status="draft"; continue; fi
  status="unconfirmed"; continue
 done
 [ "$VERBOSE" = 1 ] && { echo "--- pane tail ($TARGET) ---"; printf '%s\n' "$pane" | tail -4; echo "---"; }
@@ -0,0 +1,97 @@
 #!/usr/bin/env bash
 # Red-first regression test for E7 (#1017 task 2): the confirm-check must bind
 # "delivered" to WHETHER THE MESSAGE WAS SUBMITTED, not to which runtime's prompt
 # glyph is present. A pi seat renders a U+2500 rule input box with no ❯/^>/│ >
 # glyph; send-message.sh:118 locates the box only by glyph, so a genuinely
 # delivered message on a glyphless REPL falsely reports exit 2 "may be UNDELIVERED",
 # and the operator's rc=2-driven retry duplicates it.
 #
 # Parameterized on $SEND: RED against the shipping blob (B and D fail), GREEN
 # against a candidate patch. No pi; no fake HOME; hermetic throwaway socket.
 #
 # Submission counting is EXACT and terminal-echo-independent: the fixture message
 # is `echo <tok> >>SINK`; each real submission appends one line. wc -l SINK ==
 # number of times the REPL actually executed the send. This does not depend on how
 # many times the marker string is painted on screen.
 set -u
 SEND="${SEND:?set SEND=/path/to/send-message.sh}"
 SOCKET="glyphagnostic-$$"
 TMP="$(mktemp -d)"
 tmux() { command tmux -L "$SOCKET" "$@"; }
 cleanup() { command tmux -L "$SOCKET" kill-server 2>/dev/null; rm -rf "$TMP"; }
 trap cleanup EXIT
 pass=0; fail=0
 ok() { printf 'ok   %s\n' "$1"; pass=$((pass+1)); }
 no() { printf 'FAIL %s -- %s\n' "$1" "$2"; fail=$((fail+1)); }
 mk() { tmux new-session -d -s "$1" -x 120 -y 40 -c "$TMP" "PS1='$2' exec bash --noprofile --norc -i"; sleep 0.5; }
 subs() { [ -f "$1" ] && wc -l <"$1" | tr -d ' ' || echo 0; }  # exact submission count
 echo "SEND=$SEND    tmux $(command tmux -V | awk '{print $2}')"
 # --- A (control): glyph box (❯) that submits => exit 0, exactly one submission.
 mk ctl '❯ '
 SINK="$TMP/sink.ctl"
 out=$("$SEND" -L "$SOCKET" -t ctl -m "echo x >>'$SINK'" 2>"$TMP/e.ctl"); rc=$?; sleep 0.4
 if [ "$rc" = 0 ] && [ "$(subs "$SINK")" = 1 ]; then
  ok "control: ❯-box submits => exit 0, exactly one submission"
 else no "control: ❯-box submits => exit 0, one submission" "rc=$rc subs=$(subs "$SINK") err=[$(cat "$TMP/e.ctl")]"; fi
 # --- B (THE false-rc regression): glyphless U+2500 box that SUBMITS. Message lands
 #     (subs==1) yet shipping reports exit 2. Must be exit 0.
 mk sub $'──────── \n'
 SINK="$TMP/sink.sub"
 out=$("$SEND" -L "$SOCKET" -t sub -m "echo x >>'$SINK'" 2>"$TMP/e.sub"); rc=$?; sleep 0.4
 if [ "$rc" = 0 ] && [ "$(subs "$SINK")" = 1 ]; then
  ok "glyphless: U+2500 box that submits => exit 0 (delivered, not 'UNDELIVERED')"
 else no "glyphless: U+2500 box that submits => exit 0" \
        "rc=$rc subs=$(subs "$SINK")(delivered=$([ "$(subs "$SINK")" -ge 1 ] && echo yes||echo no)) err=[$(cat "$TMP/e.sub")]"; fi
 # --- D (duplicate arm): operator follows the rc=2 stderr and retries once. On the
 #     glyphless box, shipping => two submissions (the reported duplicate). The
 #     property: one logical send => exactly one submission. Same fix closes it.
 mk dup $'──────── \n'
 SINK="$TMP/sink.dup"
 tries=0
 for attempt in 1 2; do
  tries=$((tries+1))
  out=$("$SEND" -L "$SOCKET" -t dup -m "echo x >>'$SINK'" 2>/dev/null); rc=$?
  sleep 0.4
  [ "$rc" = 0 ] && break   # operator stops retrying only when told delivered
 done
 if [ "$(subs "$SINK")" = 1 ]; then
  ok "duplicate: one logical send (rc-driven retry) => exactly one submission (tries=$tries)"
 else no "duplicate: one logical send => exactly one submission" "submissions=$(subs "$SINK") tries=$tries"; fi
 # --- E (faithful hung managed TUI, NOT a cooked shell): raw/no-echo, paints nothing.
 #     A cooked `sleep infinity` echoes the paste via the kernel line discipline and
 #     false-passes a cursor-row fix that is correct on real seats (measured). So: raw.
 mk_rawstuck() { tmux new-session -d -s "$1" -x 120 -y 40 -c "$TMP" \
  "bash --noprofile --norc -c 'stty -echo -icanon min 1 time 0 2>/dev/null; exec sleep infinity'"; sleep 0.5; }
 mk_rawstuck estuck
 SINK="$TMP/sink.estuck"
 out=$("$SEND" -L "$SOCKET" -t estuck -r 1 -m "this stuck draft was never submitted" 2>/dev/null); rc=$?
 sleep 0.3
 if [ "$rc" != 0 ] && [ "$(subs "$SINK")" = 0 ]; then
  ok "raw/no-echo stuck TUI (not submitted) => non-zero (no false delivered)"
 else no "raw stuck TUI must NOT report delivered" "rc=$rc subs=$(subs "$SINK")"; fi
 # --- F (busy/queued branch, your BUSY-not-runtime finding): glyphless pane rendering the
 #     queued banner, never consuming. QUEUED_RE :113 fires before the glyph grep => rc=0.
 mk_busy() { tmux new-session -d -s "$1" -x 120 -y 40 -c "$TMP" \
  "bash --noprofile --norc -c 'printf \"Press up to edit queued messages\n\"; exec sleep infinity'"; sleep 0.5; }
 mk_busy ebusy
 SINK="$TMP/sink.ebusy"
 out=$("$SEND" -L "$SOCKET" -t ebusy -m "echo x >>'$SINK'" 2>/dev/null); rc=$?; sleep 0.3
 if [ "$rc" = 0 ]; then
  ok "busy/queued-banner glyphless => exit 0 (queued is delivery; runtime owns custody)"
 else no "busy/queued-banner must report delivered" "rc=$rc"; fi
 # --- C (historical-bug guard): unresolvable target. No pane ever carried our draft
 #     => must fail, never infer delivered from absence of a glyph/snippet.
 if out=$("$SEND" -L "$SOCKET" -t "nonexistent-$$" -m "echo x >>'$TMP/sink.wrong'" 2>/dev/null); then
  no "wrong-pane: unresolvable target must NOT report success" "expected non-zero, got 0"
 else ok "wrong-pane: unresolvable target => non-zero (no false delivered)"; fi
 echo "---"; echo "pass=$pass fail=$fail"
 [ "$fail" = 0 ]
@@ -4,10 +4,13 @@
 #
 #   1. DELIVERED   — a REPL that renders a `❯ ` input box and submits on Enter
 #                    (text scrolls to history, box clears) => exit 0 "✓ delivered".
-#   2. UNCONFIRMED — a pane with NO locatable prompt glyph. This is the exact
+#   2. DELIVERED   — a pane with NO prompt glyph that DOES submit => exit 0. A pi
-#                    historical FALSE POSITIVE: pre-patch it printed "✓ delivered"
+#                    seat is this fixture (U+2500 rule, no glyph). Reshaped for
-#                    exit 0; post-patch it MUST fail loud (exit 2, stderr
+#                    #1257; see the note at the fixture for why the old exit-2
-#                    "could not confirm submission").
+#                    assertion was wrong.
 #   2b. UNCONFIRMED— a glyphless pane that never submits (raw/no-echo hung TUI)
 #                    => must fail loud. This carries the historical
 #                    false-positive guard that fixture 2 used to be credited with.
 #   3. DRAFT       — a `❯ `-prompt pane that never submits (message stays on the
 #                    input line) => exit 2, stderr "unsubmitted draft".
 set -uo pipefail
@@ -37,19 +40,44 @@ else
  no "delivered: ❯-prompt REPL that submits => exit 0 ✓ delivered" "rc=$rc out=[$out] err=[$(cat "$TMP/e1")]"
 fi
-# --- Fixture 2: NO prompt glyph (default bash PS1). THE regression: pre-patch this
+# --- Fixture 2: NO prompt glyph, and the pane DOES submit (interactive bash).
-#     was a silent false-positive "delivered"; post-patch it must be unconfirmed→exit 2.
+#     RESHAPED 2026-08-16 (#1257), deliberately. This fixture previously asserted
 #     exit 2 here and was labelled "false-positive FIXED". That assertion was wrong,
 #     and locking it in is what kept E7 alive: the pane submits, so "delivered" is
 #     the truth, and a pi seat — whose input box is a bare U+2500 rule with no glyph
 #     — IS this fixture. Reporting exit 2 for it told operators a delivered message
 #     may be undelivered, and the retry that advice invites is the duplicate.
 #
 #     The guard this fixture was reaching for is real and is NOT dropped: "never
 #     infer delivered from absence" is now enforced positively by fixture 2b below
 #     (glyphless AND not submitting => must fail) and by fixture 3 (locatable box
 #     still carrying our tail => draft). Absence alone decides nothing either way.
 tmux -L "$SOCKET" new-session -d -s noglyph -c "$TMP" \
  'PS1="sh-noglyph$ " exec bash --noprofile --norc -i'
 sleep 0.3
-if out=$("$SEND" -L "$SOCKET" -t "=noglyph" -m "verdict fixture two must fail loud" 2>"$TMP/e2"); then
+out=$("$SEND" -L "$SOCKET" -t "=noglyph" -m "verdict fixture two must fail loud" 2>"$TMP/e2"); rc=$?
-  no "unconfirmed: glyphless pane must NOT report success" "expected exit 2, got 0 (out=[$out])"
+if [ "$rc" -eq 0 ] && printf '%s' "$out" | grep -qF "✓ delivered"; then
  ok "delivered: glyphless pane that submits => exit 0 (runtime-agnostic, E7 FIXED)"
 else
  no "delivered: glyphless pane that submits => exit 0" "rc=$rc out=[$out] err=[$(cat "$TMP/e2")]"
 fi
 # --- Fixture 2b: NO prompt glyph AND never submits — a hung managed TUI holding the
 #     terminal in raw/no-echo, which is what a stuck agent seat actually is (measured
 #     on live pi: stty -echo -icanon). Nothing is echoed, nothing is consumed, so
 #     there is no positive evidence of submission and the tool MUST fail loud. This
 #     is the historical false-positive guard, kept as a positive test.
 tmux -L "$SOCKET" new-session -d -s rawstuck -c "$TMP" \
  'bash --noprofile --norc -c "stty -echo -icanon min 1 time 0 2>/dev/null; exec sleep infinity"'
 sleep 0.3
 if out=$("$SEND" -L "$SOCKET" -t "=rawstuck" -r 1 -m "verdict fixture two-b never submitted" 2>"$TMP/e2b"); then
  no "unconfirmed: glyphless hung TUI must NOT report success" "expected non-zero, got 0 (out=[$out])"
 else
  rc=$?
-  if [ "$rc" -eq 2 ] && grep -qF "could not confirm submission" "$TMP/e2"; then
+  if [ "$rc" -ne 0 ] && grep -qF "could not confirm submission" "$TMP/e2b"; then
-    ok "unconfirmed: glyphless pane => exit 2 + 'could not confirm submission' (false-positive FIXED)"
+    ok "unconfirmed: glyphless hung TUI (raw/no-echo) => non-zero + 'could not confirm submission'"
  else
-    no "unconfirmed: glyphless pane => exit 2 + stderr" "rc=$rc err=[$(cat "$TMP/e2")]"
+    no "unconfirmed: glyphless hung TUI => non-zero + stderr" "rc=$rc err=[$(cat "$TMP/e2b")]"
  fi
 fi
@@ -1,13 +1,9 @@
 import { chmod, mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
-import { join, resolve } from 'node:path';
+import { join } from 'node:path';
 import { Command } from 'commander';
 import { afterEach, describe, expect, it, vi } from 'vitest';
 import { type FleetReconcileDeps } from '../fleet/fleet-reconciler.js';
 import {
  type FleetRuntimeProbeResult,
  type FleetRuntimeProbeRunner,
 } from '../fleet/fleet-runtime-preflight.js';
 import { registerFleetCommand, type CommandResult, type FleetCommandDeps } from './fleet.js';
 const roster = `
@@ -69,15 +65,12 @@ function program(
  mosaicHome: string,
  runner: FleetCommandDeps['runner'],
  reconcileOverrides: Partial<FleetReconcileDeps> = {},
  runtimeProbeRunner: FleetRuntimeProbeRunner = runtimeProbe('present'),
 ): Command {
  const result = new Command();
  result.exitOverride();
  registerFleetCommand(result, {
    mosaicHome,
    runner,
    frameworkRoot: resolve(process.cwd(), 'framework'),
    runtimeProbeRunner,
    reconcileDeps: {
      homeDirectory: '/home/mosaic',
      readHolderIdentity: async () => '11111111-1111-4111-8111-111111111111',
@@ -90,24 +83,6 @@ function program(
  return result;
 }
 function runtimeProbe(status: 'present' | 'missing'): FleetRuntimeProbeRunner {
  return async (_command, args): Promise<FleetRuntimeProbeResult> => {
    const binaryFlag = args.indexOf('--binary');
    const binary = binaryFlag >= 0 ? args[binaryFlag + 1] : undefined;
    const effectiveStatus = binary === 'mosaic' ? 'present' : status;
    return {
      stdout:
        `pane_path\u0000/fixture/runtime-bin:/usr/bin:/bin\u0000status\u0000${effectiveStatus}\u0000` +
        `binary_path\u0000${effectiveStatus === 'present' ? `/fixture/runtime-bin/${binary ?? 'unknown'}` : ''}\u0000` +
        `dependency\u0000${effectiveStatus === 'present' ? 'node' : ''}\u0000` +
        `probe_command\u0000${effectiveStatus === 'present' ? 'node --version' : ''}\u0000` +
        `probe_exit\u0000${effectiveStatus === 'present' ? '0' : ''}\u0000probe_output\u0000\u0000`,
      stderr: '',
      exitCode: effectiveStatus === 'present' ? 0 : 69,
    };
  };
 }
 function capture(): string[] {
  const lines: string[] = [];
  vi.spyOn(console, 'log').mockImplementation((value: string): void => {
@@ -177,64 +152,13 @@ describe('mosaic fleet reconciler commands', (): void => {
    expect(lines.map((line: string): unknown => JSON.parse(line))).toMatchObject([
      { applied: false, lifecycle: 'not-applied' },
-      {
+      { applied: false, lifecycle: 'not-applied' },
        applied: false,
        lifecycle: 'not-applied',
        checks: {
          fleetCliExecutable: [
            {
              check: 'fleet-cli-executable',
              status: 'ok',
              requestedBy: ['coder0'],
              dependency: 'node',
              probeCommand: 'node --version',
            },
          ],
          fleetRuntimeAvailability: [
            {
              check: 'fleet-runtime-available',
              runtime: 'pi',
              status: 'ok',
              requestedBy: ['coder0'],
            },
          ],
        },
      },
    ]);
    expect(
      calls.every((call: string[]): boolean => call[0] !== 'systemctl' || call[2] === 'show'),
    ).toBe(true);
  });
  it('reports a missing roster runtime as a named non-green doctor check', async (): Promise<void> => {
    const home = await fleetHome();
    const lines = capture();
    await program(home, ownedRunner([]), {}, runtimeProbe('missing')).parseAsync([
      'node',
      'mosaic',
      'fleet',
      'doctor',
    ]);
    expect(JSON.parse(lines.pop() ?? '')).toMatchObject({
      applied: false,
      checks: {
        fleetRuntimeAvailability: [
          {
            check: 'fleet-runtime-available',
            runtime: 'pi',
            status: 'missing',
            requestedBy: ['coder0'],
            panePath: '/fixture/runtime-bin:/usr/bin:/bin',
            installCommand: 'npm install -g @earendil-works/pi-coding-agent',
          },
        ],
      },
    });
    expect(process.exitCode).toBe(1);
  });
  it.each(['start', 'stop', 'restart'] as const)(
    'uses exact roster-owned systemd targeting for %s',
    async (operation: 'start' | 'stop' | 'restart'): Promise<void> => {
@@ -8,18 +8,10 @@ import {
  type FleetReconcileCommand,
  type FleetReconcileDeps,
 } from '../fleet/fleet-reconciler.js';
 import {
  inspectFleetRuntimeAvailability,
  type FleetRuntimeInspection,
  type FleetRuntimePreflightCheck,
  type FleetRuntimeProbeRunner,
 } from '../fleet/fleet-runtime-preflight.js';
 import { parseRosterV2 } from '../fleet/roster-v2.js';
 export interface FleetReconcilerCommandDeps {
  readonly runner: CommandRunner;
  readonly runtimeProbeRunner?: FleetRuntimeProbeRunner;
  readonly frameworkRoot?: string;
  readonly mosaicHome?: string;
  readonly reconcileDeps?: Omit<FleetReconcileDeps, 'runner' | 'mosaicHome'>;
 }
@@ -79,10 +71,6 @@ export async function executeReconcilerCommand(
  const mosaicHome = resolveMosaicHome(fleetCommand, deps);
  const rosterPath = resolveRosterPath(fleetCommand, mosaicHome);
  const roster = parseRosterV2(await readFile(rosterPath, 'utf8'), 'yaml');
  const runtimeInspection =
    operation === 'doctor'
      ? await inspectRuntimeAvailability(roster.agents, mosaicHome, deps)
      : undefined;
  const mutating = operation === 'apply' || operation === 'reconcile' || isLifecycle(operation);
  const expectedGeneration = mutating
    ? parseExpectedGeneration(opts.expectedGeneration)
@@ -102,31 +90,8 @@ export async function executeReconcilerCommand(
      ...(deps.reconcileDeps ?? {}),
    },
  });
-  printJson(operation === 'doctor' ? { ...result, checks: runtimeInspection } : result);
+  printJson(result);
-  const executableFailure =
+  process.exitCode = result.recovery === undefined && result.cleanup === undefined ? 0 : 1;
    runtimeInspection !== undefined &&
    [...runtimeInspection.fleetCliExecutable, ...runtimeInspection.fleetRuntimeAvailability].some(
      (check: FleetRuntimePreflightCheck): boolean => check.status !== 'ok',
    );
  process.exitCode =
    result.recovery === undefined && result.cleanup === undefined && !executableFailure ? 0 : 1;
 }
 async function inspectRuntimeAvailability(
  agents: readonly { readonly name: string; readonly runtime: string }[],
  mosaicHome: string,
  deps: FleetReconcilerCommandDeps,
 ): Promise<FleetRuntimeInspection> {
  if (deps.frameworkRoot === undefined || deps.runtimeProbeRunner === undefined) {
    throw new Error('Fleet doctor runtime preflight dependencies are unavailable.');
  }
  return inspectFleetRuntimeAvailability({
    mosaicHome,
    agentEnvDir: join(mosaicHome, 'fleet', 'agents'),
    helperPath: join(deps.frameworkRoot, 'tools', 'fleet', 'pane-runtime-path.sh'),
    agents,
    runner: deps.runtimeProbeRunner,
  });
 }
 function isLifecycle(operation: FleetReconcileCommand): boolean {
@@ -4,7 +4,6 @@ import { tmpdir } from 'node:os';
 import { join, resolve } from 'node:path';
 import { Command } from 'commander';
 import { afterEach, describe, expect, it, vi } from 'vitest';
 import type { FleetRuntimeProbeRunner } from '../fleet/fleet-runtime-preflight.js';
 import { registerFleetCommand, type CommandResult, type CommandRunner } from './fleet.js';
 /**
@@ -70,7 +69,6 @@ agents:
 let tempHome: string | undefined;
 const savedHome = process.env.HOME;
 const savedMosaicHome = process.env.MOSAIC_HOME;
 const savedPath = process.env.PATH;
 afterEach(async (): Promise<void> => {
  vi.restoreAllMocks();
@@ -79,8 +77,6 @@ afterEach(async (): Promise<void> => {
  else process.env.HOME = savedHome;
  if (savedMosaicHome === undefined) delete process.env.MOSAIC_HOME;
  else process.env.MOSAIC_HOME = savedMosaicHome;
  if (savedPath === undefined) delete process.env.PATH;
  else process.env.PATH = savedPath;
  if (tempHome) await rm(tempHome, { recursive: true, force: true });
  tempHome = undefined;
 });
@@ -89,7 +85,7 @@ afterEach(async (): Promise<void> => {
 * A HOME with a roster-v2 fleet and nothing else — the greenfield shape, before
 * anything has been installed, applied or started.
 */
-async function v2Home(options: { withPaneRuntime?: boolean } = {}): Promise<string> {
+async function v2Home(): Promise<string> {
  tempHome = await mkdtemp(join(tmpdir(), 'mosaic-fleet-v2-dispatch-'));
  process.env.HOME = tempHome;
  delete process.env.MOSAIC_HOME;
@@ -101,12 +97,6 @@ async function v2Home(options: { withPaneRuntime?: boolean } = {}): Promise<stri
  await writeFile(join(mosaicHome, 'fleet', 'roles', 'code.md'), '`class: code`\n\n# code\n', {
    mode: 0o600,
  });
  const runtimeDir = join(tempHome, '.npm-global', 'bin');
  await mkdir(runtimeDir, { recursive: true });
  await writeFile(join(runtimeDir, 'mosaic'), '#!/bin/sh\nexit 0\n', { mode: 0o755 });
  if (options.withPaneRuntime !== false) {
    await writeFile(join(runtimeDir, 'pi'), '#!/bin/sh\nexit 0\n', { mode: 0o755 });
  }
  return mosaicHome;
 }
@@ -123,17 +113,10 @@ const greenfieldRunner: CommandRunner = async (command): Promise<CommandResult>
  return { stdout: '', stderr: '', exitCode: 1 };
 };
-function program(
+function program(runner: CommandRunner = greenfieldRunner): Command {
  runner: CommandRunner = greenfieldRunner,
  runtimeProbeRunner?: FleetRuntimeProbeRunner,
 ): Command {
  const result = new Command();
  result.exitOverride();
-  registerFleetCommand(result, {
+  registerFleetCommand(result, { runner, frameworkRoot: resolve(process.cwd(), 'framework') });
    runner,
    frameworkRoot: resolve(process.cwd(), 'framework'),
    ...(runtimeProbeRunner === undefined ? {} : { runtimeProbeRunner }),
  });
  return result;
 }
@@ -183,93 +166,6 @@ describe('mosaic fleet ps — roster v2', (): void => {
 });
 describe('mosaic fleet install — roster v2', (): void => {
  it('rejects a roster runtime missing from the pane PATH before installing any files', async (): Promise<void> => {
    const mosaicHome = await v2Home({ withPaneRuntime: false });
    const operatorBin = join(tempHome!, 'operator-bin');
    await mkdir(operatorBin, { recursive: true });
    await writeFile(join(operatorBin, 'pi'), '#!/bin/sh\nexit 0\n', { mode: 0o755 });
    process.env.PATH = `${operatorBin}:${savedPath ?? '/usr/bin:/bin'}`;
    let message = '';
    try {
      await program().parseAsync([
        'node',
        'mosaic',
        'fleet',
        '--mosaic-home',
        mosaicHome,
        'install',
        '--no-enable',
      ]);
    } catch (error: unknown) {
      message = error instanceof Error ? error.message : String(error);
    }
    expect(message).toContain('runtime=pi');
    expect(message).toContain('requested_by=coder0,coder1');
    expect(message).toContain('pane_path=');
    expect(message).toContain('npm install -g @earendil-works/pi-coding-agent');
    expect(message).not.toContain(operatorBin);
    expect(
      await exists(join(tempHome!, '.config', 'systemd', 'user', '[email protected]')),
    ).toBe(false);
    expect(await exists(join(mosaicHome, 'fleet', 'holder.id'))).toBe(false);
    expect(await exists(join(mosaicHome, 'tools'))).toBe(false);
  });
  it('rejects resolved Node-shebang commands when Node is absent from the pane PATH', async (): Promise<void> => {
    const mosaicHome = await v2Home();
    const runtimeDir = join(tempHome!, '.npm-global', 'bin');
    const nodeScript = '#!/usr/bin/env node\nconsole.log("should-not-run");\n';
    await writeFile(join(runtimeDir, 'mosaic'), nodeScript, { mode: 0o755 });
    await writeFile(join(runtimeDir, 'pi'), nodeScript, { mode: 0o755 });
    await writeFile(join(tempHome!, '.npmrc'), `prefix=${join(tempHome!, 'absent-prefix')}\n`);
    const isolatedSystemPath = join(tempHome!, 'system-bin');
    await mkdir(isolatedSystemPath, { recursive: true });
    const isolatedProbeRunner: FleetRuntimeProbeRunner = async (
      command,
      args,
    ): Promise<CommandResult> =>
      new Promise((settle) => {
        const child = execFile(
          command,
          [...args, '--system-path', isolatedSystemPath],
          { encoding: 'utf8' },
          (error, stdout, stderr) => {
            settle({
              stdout,
              stderr,
              exitCode: child.exitCode ?? (error === null ? 0 : 1),
            });
          },
        );
      });
    let message = '';
    try {
      await program(greenfieldRunner, isolatedProbeRunner).parseAsync([
        'node',
        'mosaic',
        'fleet',
        '--mosaic-home',
        mosaicHome,
        'install',
        '--no-enable',
      ]);
    } catch (error: unknown) {
      message = error instanceof Error ? error.message : String(error);
    }
    expect(message).toContain('check=fleet-cli-executable');
    expect(message).toContain('binary=mosaic');
    expect(message).toContain('dependency=node');
    expect(message).toContain('check=fleet-runtime-available');
    expect(message).toContain('runtime=pi');
    expect(message).not.toContain('/usr/bin');
    expect(await exists(join(mosaicHome, 'fleet', 'holder.id'))).toBe(false);
    expect(await exists(join(mosaicHome, 'tools'))).toBe(false);
  });
  it('places the tool files and unit templates', async (): Promise<void> => {
    const mosaicHome = await v2Home();
    capture();
@@ -287,11 +183,9 @@ describe('mosaic fleet install — roster v2', (): void => {
    ]) {
      expect(await exists(join(systemdUserDir, unit))).toBe(true);
    }
-    for (const tool of ['start-agent-session.sh', 'pane-runtime-path.sh']) {
+    const launcher = join(mosaicHome, 'tools', 'fleet', 'start-agent-session.sh');
-      const toolPath = join(mosaicHome, 'tools', 'fleet', tool);
+    expect(await exists(launcher)).toBe(true);
-      expect(await exists(toolPath)).toBe(true);
+    expect((await stat(launcher)).mode & 0o777).toBe(0o755);
      expect((await stat(toolPath)).mode & 0o777).toBe(0o755);
    }
  });
  it('writes NO generated env — that file belongs to the reconciler (#791)', async (): Promise<void> => {
@@ -1277,10 +1277,6 @@ describe('fleet command construction', () => {
    const home = await tempDir();
    process.env.HOME = home;
    delete process.env.MOSAIC_HOME;
    const runtimeDir = join(home, '.npm-global', 'bin');
    await mkdir(runtimeDir, { recursive: true });
    await writeFile(join(runtimeDir, 'pi'), '#!/bin/sh\nexit 0\n', { mode: 0o755 });
    await writeFile(join(runtimeDir, 'mosaic'), '#!/bin/sh\nexit 0\n', { mode: 0o755 });
    const mosaicHome = join(home, '.config', 'mosaic');
    const program = new Command();
    program.exitOverride();
@@ -1319,10 +1315,6 @@ describe('fleet command construction', () => {
    const originalHome = process.env.HOME;
    const home = await tempDir();
    process.env.HOME = home;
    const runtimeDir = join(home, '.npm-global', 'bin');
    await mkdir(runtimeDir, { recursive: true });
    await writeFile(join(runtimeDir, 'pi'), '#!/bin/sh\nexit 0\n', { mode: 0o755 });
    await writeFile(join(runtimeDir, 'mosaic'), '#!/bin/sh\nexit 0\n', { mode: 0o755 });
    const mosaicHome = join(home, '.config', 'mosaic');
    const agentEnvDir = join(mosaicHome, 'fleet', 'agents');
    const fleetDir = join(mosaicHome, 'fleet');
@@ -60,12 +60,6 @@ import {
  writeAgentEnvironmentProjection,
  writeManagedFleetRoster,
 } from '../fleet/generated-env-boundary.js';
 import {
  assertFleetRuntimeAvailability,
  FleetRuntimePreflightError,
  inspectFleetRuntimeAvailability,
  type FleetRuntimeProbeRunner,
 } from '../fleet/fleet-runtime-preflight.js';
 import { registerFleetBacklogCommand } from './fleet-backlog.js';
 import { registerFleetPersonaCommand } from './fleet-personas.js';
 import { registerFleetProfileCommand } from './fleet-profiles.js';
@@ -95,8 +89,6 @@ export type SleepFn = (ms: number) => Promise<void>;
 export interface FleetCommandDeps {
  runner?: CommandRunner;
  /** Executes the pane-PATH helper under a clean launcher environment. */
  runtimeProbeRunner?: FleetRuntimeProbeRunner;
  /** Injectable interactive runner for commands needing inherited TTY (e.g., `tmux attach`). */
  interactiveRunner?: InteractiveRunner;
  /**
@@ -1437,10 +1429,6 @@ export function isSendAccepted(capturedOutput: string): SendVerifyResult {
 export function registerFleetCommand(program: Command, deps: FleetCommandDeps = {}): Command {
  const runner = deps.runner ?? runCommand;
  const runtimeProbeRunner: FleetRuntimeProbeRunner =
    deps.runtimeProbeRunner ??
    (async (command: string, args: readonly string[]): Promise<CommandResult> =>
      runCommand(command, [...args]));
  const sleepFn = deps.sleepFn ?? defaultSleep;
  const paths = resolveFleetPaths(deps.mosaicHome);
  const frameworkRoot = deps.frameworkRoot ?? resolveFrameworkRoot();
@@ -1539,7 +1527,7 @@ export function registerFleetCommand(program: Command, deps: FleetCommandDeps =
    .description('Install local fleet tools and user systemd units')
    .option('--no-enable', 'Skip enabling units for boot-survival')
    .action(async (opts: { enable?: boolean }) => {
-      await installFleet(cmd, frameworkRoot, runtimeProbeRunner);
+      await installFleet(cmd, frameworkRoot);
      // Unit enablement needs agent names only, so it reads either version.
      const roster = await loadRosterReadModel(cmd);
      await enableFleetUnits(runner, roster, opts);
@@ -1550,7 +1538,7 @@ export function registerFleetCommand(program: Command, deps: FleetCommandDeps =
    .description('Install local fleet tools and user systemd units')
    .option('--no-enable', 'Skip enabling units for boot-survival')
    .action(async (opts: { enable?: boolean }) => {
-      await installFleet(cmd, frameworkRoot, runtimeProbeRunner);
+      await installFleet(cmd, frameworkRoot);
      // Unit enablement needs agent names only, so it reads either version.
      const roster = await loadRosterReadModel(cmd);
      await enableFleetUnits(runner, roster, opts);
@@ -2096,8 +2084,6 @@ export function registerFleetCommand(program: Command, deps: FleetCommandDeps =
  });
  registerFleetReconcilerCommands(cmd, {
    runner,
    runtimeProbeRunner,
    frameworkRoot,
    mosaicHome: deps.mosaicHome,
    reconcileDeps: deps.reconcileDeps,
  });
@@ -2363,68 +2349,18 @@ export function registerFleetAgentCommands(
    });
 }
-async function installFleet(
+async function installFleet(cmd: Command, frameworkRoot: string): Promise<void> {
  cmd: Command,
  frameworkRoot: string,
  runtimeProbeRunner: FleetRuntimeProbeRunner,
 ): Promise<void> {
  const activePaths = resolveFleetPaths(cmd.opts<{ mosaicHome: string }>().mosaicHome);
  assertDefaultMosaicHomeForSystemd(activePaths.mosaicHome);
-  // Read and preflight before the first mkdir/copy/chmod/write. A successful
+  // Read model first: every file this function places is roster-independent, and
-  // install must mean every roster runtime is executable in the eventual pane,
+  // the v1 parser would reject a v2 roster before any of them were written.
  // not merely visible to the operator who invoked this command.
  const roster = await loadRosterReadModel(cmd);
  const v1Roster = roster.version === 1 ? await loadRosterForCommand(cmd) : undefined;
  const preflightV1Projections =
    v1Roster === undefined
      ? []
      : await Promise.all(
          v1Roster.agents.map((agent: FleetAgent) =>
            prepareAgentEnvironmentProjection({
              mosaicHome: activePaths.mosaicHome,
              agentEnvDir: activePaths.agentEnvDir,
              agentName: agent.name,
              generated: generateAgentEnvValues(v1Roster, agent),
            }),
          ),
        );
  const preflightAgents =
    v1Roster === undefined
      ? roster.agents
      : v1Roster.agents.map((agent: FleetAgent, index: number) => {
          const prepared = preflightV1Projections[index];
          if (prepared === undefined) {
            throw new Error(`Missing prepared environment projection for ${agent.name}.`);
          }
          const local = parseAgentEnvironment(prepared.local, 'local');
          return {
            name: agent.name,
            runtime: agent.runtime,
            runtimeBin: local['MOSAIC_RUNTIME_BIN'] ?? '',
          };
        });
  const runtimeInspection = await inspectFleetRuntimeAvailability({
    mosaicHome: activePaths.mosaicHome,
    agentEnvDir: activePaths.agentEnvDir,
    helperPath: join(frameworkRoot, 'tools', 'fleet', 'pane-runtime-path.sh'),
    agents: preflightAgents,
    runner: runtimeProbeRunner,
  });
  try {
    assertFleetRuntimeAvailability(runtimeInspection);
  } catch (error: unknown) {
    if (error instanceof FleetRuntimePreflightError) {
      cmd.error(error.message, { code: 'fleet.runtime-preflight', exitCode: 1 });
    }
    throw error;
  }
  await ensureFleetHolderIdentity(activePaths.mosaicHome);
  await mkdir(activePaths.fleetToolsDir, { recursive: true });
  await mkdir(activePaths.tmuxToolsDir, { recursive: true });
  await mkdir(activePaths.systemdUserDir, { recursive: true });
  const startAgentSessionPath = join(activePaths.fleetToolsDir, 'start-agent-session.sh');
  const paneRuntimePath = join(activePaths.fleetToolsDir, 'pane-runtime-path.sh');
  const startInteractionServicePath = join(
    activePaths.fleetToolsDir,
    'start-interaction-service.sh',
@@ -2438,7 +2374,6 @@ async function installFleet(
  const agentSendPath = join(activePaths.tmuxToolsDir, 'agent-send.sh');
  const executableToolPaths = [
    startAgentSessionPath,
    paneRuntimePath,
    startInteractionServicePath,
    startTmuxHolderPath,
    printInteractionPolicyPath,
@@ -2449,7 +2384,6 @@ async function installFleet(
    join(frameworkRoot, 'tools', 'fleet', 'start-agent-session.sh'),
    startAgentSessionPath,
  );
  await copyFile(join(frameworkRoot, 'tools', 'fleet', 'pane-runtime-path.sh'), paneRuntimePath);
  await copyFile(
    join(frameworkRoot, 'tools', 'fleet', 'start-interaction-service.sh'),
    startInteractionServicePath,
@@ -2493,9 +2427,7 @@ async function installFleet(
    return;
  }
-  if (v1Roster === undefined) {
+  const v1Roster = await loadRosterForCommand(cmd);
    throw new Error('Roster version changed while installing fleet files.');
  }
  for (const agent of v1Roster.agents) {
    await writeAgentEnvironmentProjection({
      mosaicHome: activePaths.mosaicHome,
@@ -1,328 +0,0 @@
 import { spawn } from 'node:child_process';
 import { chmod, mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join, resolve } from 'node:path';
 import { afterEach, describe, expect, it } from 'vitest';
 import {
  inspectFleetRuntimeAvailability,
  type FleetRuntimeProbeResult,
  type FleetRuntimeProbeRunner,
 } from './fleet-runtime-preflight.js';
 const helperPath = resolve(process.cwd(), 'framework', 'tools', 'fleet', 'pane-runtime-path.sh');
 let cleanup: string | undefined;
 afterEach(async (): Promise<void> => {
  if (cleanup !== undefined) await rm(cleanup, { recursive: true, force: true });
  cleanup = undefined;
 });
 interface FleetFixture {
  readonly root: string;
  readonly mosaicHome: string;
  readonly agentEnvDir: string;
  readonly runtimeDir: string;
 }
 async function fleetHome(): Promise<FleetFixture> {
  const root = await mkdtemp(join(tmpdir(), 'mosaic-fleet-runtime-preflight-'));
  cleanup = root;
  const mosaicHome = join(root, '.config', 'mosaic');
  const agentEnvDir = join(mosaicHome, 'fleet', 'agents');
  const runtimeDir = join(root, '.npm-global', 'bin');
  await mkdir(agentEnvDir, { recursive: true, mode: 0o700 });
  await mkdir(runtimeDir, { recursive: true });
  for (const directory of [mosaicHome, join(mosaicHome, 'fleet'), agentEnvDir]) {
    await chmod(directory, 0o700);
  }
  await writeExecutable(runtimeDir, 'mosaic', '#!/bin/sh\nexit 0\n');
  return { root, mosaicHome, agentEnvDir, runtimeDir };
 }
 async function writeExecutable(directory: string, name: string, content: string): Promise<void> {
  await mkdir(directory, { recursive: true });
  await writeFile(join(directory, name), content, { mode: 0o755 });
 }
 const processRunner: FleetRuntimeProbeRunner = async (
  command: string,
  args: readonly string[],
 ): Promise<FleetRuntimeProbeResult> =>
  new Promise((settle) => {
    const child = spawn(command, [...args], { stdio: ['ignore', 'pipe', 'pipe'] });
    let stdout = '';
    let stderr = '';
    child.stdout.setEncoding('utf8');
    child.stderr.setEncoding('utf8');
    child.stdout.on('data', (chunk: string): void => {
      stdout += chunk;
    });
    child.stderr.on('data', (chunk: string): void => {
      stderr += chunk;
    });
    child.on('error', (error: Error): void => {
      settle({ stdout, stderr: `${stderr}${error.message}`, exitCode: 127 });
    });
    child.on('close', (code: number | null): void => {
      settle({ stdout, stderr, exitCode: code ?? 1 });
    });
  });
 describe('fleet runtime preflight', (): void => {
  it('executes one distinct pane runtime and aggregates every requesting roster row', async (): Promise<void> => {
    const fixture = await fleetHome();
    await writeExecutable(fixture.runtimeDir, 'pi', '#!/bin/sh\nexit 0\n');
    let probes = 0;
    const inspection = await inspectFleetRuntimeAvailability({
      mosaicHome: fixture.mosaicHome,
      agentEnvDir: fixture.agentEnvDir,
      helperPath,
      agents: [
        { name: 'coder1', runtime: 'pi' },
        { name: 'coder0', runtime: 'pi' },
      ],
      runner: async (command, args): Promise<FleetRuntimeProbeResult> => {
        probes += 1;
        return processRunner(command, args);
      },
    });
    expect(probes).toBe(2);
    expect(inspection.fleetCliExecutable).toEqual([
      expect.objectContaining({
        check: 'fleet-cli-executable',
        status: 'ok',
        requestedBy: ['coder0', 'coder1'],
        binaryPath: join(fixture.runtimeDir, 'mosaic'),
        dependency: '/bin/sh',
      }),
    ]);
    expect(inspection.fleetRuntimeAvailability).toEqual([
      expect.objectContaining({
        check: 'fleet-runtime-available',
        runtime: 'pi',
        status: 'ok',
        requestedBy: ['coder0', 'coder1'],
        binaryPath: join(fixture.runtimeDir, 'pi'),
        dependency: '/bin/sh',
        installCommand: 'npm install -g @earendil-works/pi-coding-agent',
      }),
    ]);
    expect(inspection.fleetRuntimeAvailability[0]?.panePath).toContain(fixture.runtimeDir);
  });
  it('returns an actionable non-green check when the pane PATH lacks the runtime', async (): Promise<void> => {
    const fixture = await fleetHome();
    const inspection = await inspectFleetRuntimeAvailability({
      mosaicHome: fixture.mosaicHome,
      agentEnvDir: fixture.agentEnvDir,
      helperPath,
      agents: [{ name: 'coder0', runtime: 'pi' }],
      runner: processRunner,
    });
    expect(inspection.fleetCliExecutable[0]?.status).toBe('ok');
    expect(inspection.fleetRuntimeAvailability).toEqual([
      expect.objectContaining({
        check: 'fleet-runtime-available',
        runtime: 'pi',
        status: 'missing',
        requestedBy: ['coder0'],
        installCommand: 'npm install -g @earendil-works/pi-coding-agent',
      }),
    ]);
    expect(inspection.fleetRuntimeAvailability[0]?.panePath).not.toContain(
      process.env['PATH'] ?? 'operator-path-absent',
    );
  });
  it('executes the side-effect-free Node version probe for Node-shebang commands', async (): Promise<void> => {
    const fixture = await fleetHome();
    const nodeScript = '#!/usr/bin/env node\nconsole.log("should-not-run");\n';
    await writeExecutable(fixture.runtimeDir, 'mosaic', nodeScript);
    await writeExecutable(fixture.runtimeDir, 'pi', nodeScript);
    await writeExecutable(
      fixture.runtimeDir,
      'node',
      '#!/bin/sh\n[ "$1" = --version ] || exit 9\nprintf "v-fixture-node\\n"\n',
    );
    const inspection = await inspectFleetRuntimeAvailability({
      mosaicHome: fixture.mosaicHome,
      agentEnvDir: fixture.agentEnvDir,
      helperPath,
      agents: [{ name: 'coder0', runtime: 'pi' }],
      runner: processRunner,
    });
    for (const check of [
      ...inspection.fleetCliExecutable,
      ...inspection.fleetRuntimeAvailability,
    ]) {
      expect(check).toMatchObject({
        status: 'ok',
        dependency: 'node',
        probeCommand: 'node --version',
        probeExit: 0,
        probeOutput: 'v-fixture-node',
      });
    }
  });
  it('reddens when resolved Node-shebang commands cannot execute without pane Node', async (): Promise<void> => {
    const fixture = await fleetHome();
    const isolatedSystemPath = join(fixture.root, 'system-bin');
    await mkdir(isolatedSystemPath, { recursive: true });
    await writeFile(
      join(fixture.root, '.npmrc'),
      `prefix=${join(fixture.root, 'absent-prefix')}\n`,
    );
    const nodeScript = '#!/usr/bin/env node\nconsole.log("should-not-run");\n';
    await writeExecutable(fixture.runtimeDir, 'mosaic', nodeScript);
    await writeExecutable(fixture.runtimeDir, 'pi', nodeScript);
    const inspection = await inspectFleetRuntimeAvailability({
      mosaicHome: fixture.mosaicHome,
      agentEnvDir: fixture.agentEnvDir,
      helperPath,
      agents: [{ name: 'coder0', runtime: 'pi' }],
      runner: processRunner,
      systemPath: isolatedSystemPath,
    });
    expect(inspection.fleetCliExecutable).toEqual([
      expect.objectContaining({
        check: 'fleet-cli-executable',
        status: 'unexecutable',
        binaryPath: join(fixture.runtimeDir, 'mosaic'),
        dependency: 'node',
        probeCommand: 'node --version',
      }),
    ]);
    expect(inspection.fleetRuntimeAvailability).toEqual([
      expect.objectContaining({
        check: 'fleet-runtime-available',
        runtime: 'pi',
        status: 'unexecutable',
        binaryPath: join(fixture.runtimeDir, 'pi'),
        dependency: 'node',
        probeCommand: 'node --version',
      }),
    ]);
    expect(inspection.fleetCliExecutable[0]?.probeOutput).toBe(
      'shebang command is not on the pane PATH',
    );
    expect(inspection.fleetCliExecutable[0]?.panePath).not.toContain('/usr/bin');
  });
  it('keeps distinct effective local runtime-bin paths as distinct checks', async (): Promise<void> => {
    const fixture = await fleetHome();
    const firstBin = join(fixture.root, 'first-bin');
    const secondBin = join(fixture.root, 'second-bin');
    for (const override of [
      { agent: 'coder0', runtimeBin: firstBin },
      { agent: 'coder1', runtimeBin: secondBin },
    ]) {
      await writeExecutable(override.runtimeBin, 'pi', '#!/bin/sh\nexit 0\n');
      await writeFile(
        join(fixture.agentEnvDir, `${override.agent}.env.local`),
        `MOSAIC_RUNTIME_BIN=${override.runtimeBin}\n`,
        { mode: 0o600 },
      );
    }
    const inspection = await inspectFleetRuntimeAvailability({
      mosaicHome: fixture.mosaicHome,
      agentEnvDir: fixture.agentEnvDir,
      helperPath,
      agents: [
        { name: 'coder0', runtime: 'pi' },
        { name: 'coder1', runtime: 'pi' },
      ],
      runner: processRunner,
    });
    expect(inspection.fleetCliExecutable).toHaveLength(2);
    expect(inspection.fleetRuntimeAvailability).toHaveLength(2);
    expect(inspection.fleetRuntimeAvailability.map((check) => check.requestedBy)).toEqual([
      ['coder0'],
      ['coder1'],
    ]);
    expect(inspection.fleetRuntimeAvailability.map((check) => check.binaryPath)).toEqual([
      join(firstBin, 'pi'),
      join(secondBin, 'pi'),
    ]);
  });
  it('reports each distinct roster runtime with its exact install command', async (): Promise<void> => {
    const fixture = await fleetHome();
    let probes = 0;
    const inspection = await inspectFleetRuntimeAvailability({
      mosaicHome: fixture.mosaicHome,
      agentEnvDir: fixture.agentEnvDir,
      helperPath,
      agents: [
        { name: 'pi-seat', runtime: 'pi' },
        { name: 'claude-seat', runtime: 'claude' },
        { name: 'codex-seat', runtime: 'codex' },
        { name: 'opencode-seat', runtime: 'opencode' },
      ],
      runner: async (): Promise<FleetRuntimeProbeResult> => {
        probes += 1;
        return {
          stdout:
            'pane_path\u0000/fixture/bin:/usr/bin:/bin\u0000status\u0000missing\u0000' +
            'binary_path\u0000\u0000probe_exit\u0000\u0000probe_output\u0000\u0000',
          stderr: '',
          exitCode: 69,
        };
      },
    });
    expect(probes).toBe(5);
    expect(
      inspection.fleetRuntimeAvailability.map((check) => ({
        runtime: check.runtime,
        installCommand: check.installCommand,
      })),
    ).toEqual([
      {
        runtime: 'claude',
        installCommand: 'curl -fsSL https://claude.ai/install.sh | bash',
      },
      {
        runtime: 'codex',
        installCommand: 'npm install -g @openai/codex',
      },
      {
        runtime: 'opencode',
        installCommand: 'npm install -g opencode-ai',
      },
      {
        runtime: 'pi',
        installCommand: 'npm install -g @earendil-works/pi-coding-agent',
      },
    ]);
  });
  it('fails closed when the shared helper returns malformed evidence', async (): Promise<void> => {
    const fixture = await fleetHome();
    await expect(
      inspectFleetRuntimeAvailability({
        mosaicHome: fixture.mosaicHome,
        agentEnvDir: fixture.agentEnvDir,
        helperPath,
        agents: [{ name: 'coder0', runtime: 'pi' }],
        runner: async (): Promise<FleetRuntimeProbeResult> => ({
          stdout: 'not-a-field-protocol',
          stderr: '',
          exitCode: 0,
        }),
      }),
    ).rejects.toThrow('malformed field output');
  });
 });
@@ -1,362 +0,0 @@
 import { homedir } from 'node:os';
 import { getInstallInstructions } from '../runtime/detector.js';
 import type { RuntimeName } from '../types.js';
 import { compareCodePoints } from './deterministic-order.js';
 import {
  GENERATED_AGENT_ENV_SUPPORTED_RUNTIMES,
  readAgentLocalEnvironment,
 } from './generated-env-boundary.js';
 const RUNTIME_SET = new Set<string>(GENERATED_AGENT_ENV_SUPPORTED_RUNTIMES);
 export interface FleetRuntimeRequestedAgent {
  readonly name: string;
  readonly runtime: string;
  /** Planned effective local override, when provisioning has already prepared it. */
  readonly runtimeBin?: string;
 }
 export interface FleetRuntimeProbeResult {
  readonly stdout: string;
  readonly stderr: string;
  readonly exitCode: number;
 }
 export type FleetRuntimeProbeRunner = (
  command: string,
  args: readonly string[],
 ) => Promise<FleetRuntimeProbeResult>;
 export interface FleetRuntimePreflightOptions {
  readonly mosaicHome: string;
  readonly agentEnvDir: string;
  readonly helperPath: string;
  readonly agents: readonly FleetRuntimeRequestedAgent[];
  readonly runner: FleetRuntimeProbeRunner;
  /** Test-only system suffix; production and the launcher use the helper default. */
  readonly systemPath?: string;
 }
 export type FleetExecutableStatus = 'ok' | 'missing' | 'unexecutable';
 interface FleetExecutableEvidence {
  readonly status: FleetExecutableStatus;
  readonly panePath: string;
  readonly binaryPath?: string;
  readonly dependency?: string;
  readonly probeCommand?: string;
  readonly probeExit?: number;
  readonly probeOutput?: string;
 }
 export interface FleetCliExecutableCheck extends FleetExecutableEvidence {
  readonly check: 'fleet-cli-executable';
  readonly binary: 'mosaic';
  readonly requestedBy: readonly string[];
 }
 export interface FleetRuntimeCheck extends FleetExecutableEvidence {
  readonly check: 'fleet-runtime-available';
  readonly runtime: RuntimeName;
  readonly requestedBy: readonly string[];
  readonly installCommand: string;
 }
 export type FleetRuntimePreflightCheck = FleetCliExecutableCheck | FleetRuntimeCheck;
 export interface FleetRuntimeInspection {
  readonly fleetCliExecutable: readonly FleetCliExecutableCheck[];
  readonly fleetRuntimeAvailability: readonly FleetRuntimeCheck[];
 }
 interface EffectiveAgent {
  readonly name: string;
  readonly runtime: RuntimeName;
  readonly runtimeBin: string;
 }
 interface PaneProbeGroup {
  readonly runtimeBin: string;
  readonly requestedBy: string[];
 }
 interface RuntimeProbeGroup extends PaneProbeGroup {
  readonly runtime: RuntimeName;
 }
 interface BinaryProbeRequest {
  readonly binary: string;
  readonly runtimeBin: string;
 }
 export class FleetRuntimePreflightError extends Error {
  readonly checks: readonly FleetRuntimePreflightCheck[];
  constructor(checks: readonly FleetRuntimePreflightCheck[]) {
    super(formatFleetRuntimePreflightError(checks));
    this.name = FleetRuntimePreflightError.name;
    this.checks = checks;
  }
 }
 export class FleetRuntimeProbeError extends Error {
  constructor(message: string) {
    super(message);
    this.name = FleetRuntimeProbeError.name;
  }
 }
 /**
 * Proves the fleet CLI and every distinct runtime/effective-bin pair resolve
 * with an executable shebang interpreter through the eventual pane PATH. The
 * helper runs under the unit's clean launcher environment, so operator PATH can
 * neither create a false green nor provide a hidden interpreter.
 */
 export async function inspectFleetRuntimeAvailability(
  options: FleetRuntimePreflightOptions,
 ): Promise<FleetRuntimeInspection> {
  const agents = await resolveEffectiveAgents(options);
  const paneGroups = groupPaneRequests(agents);
  const runtimeGroups = groupRuntimeRequests(agents);
  const fleetCliExecutable: FleetCliExecutableCheck[] = [];
  for (const group of paneGroups) {
    const evidence = await probeBinary(options, {
      binary: 'mosaic',
      runtimeBin: group.runtimeBin,
    });
    fleetCliExecutable.push({
      check: 'fleet-cli-executable',
      binary: 'mosaic',
      requestedBy: sortedRequestedBy(group.requestedBy),
      ...evidence,
    });
  }
  const fleetRuntimeAvailability: FleetRuntimeCheck[] = [];
  for (const group of runtimeGroups) {
    const evidence = await probeBinary(options, {
      binary: group.runtime,
      runtimeBin: group.runtimeBin,
    });
    fleetRuntimeAvailability.push({
      check: 'fleet-runtime-available',
      runtime: group.runtime,
      requestedBy: sortedRequestedBy(group.requestedBy),
      installCommand: getInstallInstructions(group.runtime),
      ...evidence,
    });
  }
  return Object.freeze({
    fleetCliExecutable: Object.freeze(fleetCliExecutable),
    fleetRuntimeAvailability: Object.freeze(fleetRuntimeAvailability),
  });
 }
 export function assertFleetRuntimeAvailability(inspection: FleetRuntimeInspection): void {
  const checks: FleetRuntimePreflightCheck[] = [
    ...inspection.fleetCliExecutable,
    ...inspection.fleetRuntimeAvailability,
  ];
  const failures = checks.filter(
    (check: FleetRuntimePreflightCheck): boolean => check.status !== 'ok',
  );
  if (failures.length > 0) throw new FleetRuntimePreflightError(failures);
 }
 export function formatFleetRuntimePreflightError(
  checks: readonly FleetRuntimePreflightCheck[],
 ): string {
  const lines = ['Fleet runtime preflight failed:'];
  for (const check of checks) {
    const dependency = check.dependency === undefined ? '' : ` dependency=${check.dependency}`;
    const probe = check.probeCommand === undefined ? '' : ` dependency_probe=${check.probeCommand}`;
    const execution =
      check.status === 'unexecutable'
        ? ` probe_exit=${check.probeExit?.toString() ?? 'not-run'} ` +
          `probe_output=${JSON.stringify(check.probeOutput ?? '')}`
        : '';
    if (check.check === 'fleet-cli-executable') {
      lines.push(
        `check=${check.check} binary=${check.binary} ` +
          `requested_by=${check.requestedBy.join(',')} pane_path=${check.panePath}` +
          `${dependency}${probe}${execution} ` +
          'action=repair the Mosaic installation until its pane dependencies resolve',
      );
      continue;
    }
    lines.push(
      `check=${check.check} runtime=${check.runtime} ` +
        `requested_by=${check.requestedBy.join(',')} pane_path=${check.panePath}` +
        `${dependency}${probe}${execution} install_command=${check.installCommand}`,
    );
  }
  return lines.join('\n');
 }
 async function resolveEffectiveAgents(
  options: FleetRuntimePreflightOptions,
 ): Promise<readonly EffectiveAgent[]> {
  const agents: EffectiveAgent[] = [];
  for (const agent of options.agents) {
    if (!isRuntimeName(agent.runtime)) {
      throw new FleetRuntimeProbeError(`Unsupported fleet runtime: ${agent.runtime}`);
    }
    const runtimeBin =
      agent.runtimeBin ??
      (
        await readAgentLocalEnvironment({
          mosaicHome: options.mosaicHome,
          agentEnvDir: options.agentEnvDir,
          agentName: agent.name,
        })
      )['MOSAIC_RUNTIME_BIN'] ??
      '';
    agents.push({ name: agent.name, runtime: agent.runtime, runtimeBin });
  }
  return agents;
 }
 function groupPaneRequests(agents: readonly EffectiveAgent[]): readonly PaneProbeGroup[] {
  const groups = new Map<string, PaneProbeGroup>();
  for (const agent of agents) {
    const current = groups.get(agent.runtimeBin);
    if (current === undefined) {
      groups.set(agent.runtimeBin, { runtimeBin: agent.runtimeBin, requestedBy: [agent.name] });
    } else {
      current.requestedBy.push(agent.name);
    }
  }
  return [...groups.values()].sort((left, right): number =>
    compareCodePoints(left.runtimeBin, right.runtimeBin),
  );
 }
 function groupRuntimeRequests(agents: readonly EffectiveAgent[]): readonly RuntimeProbeGroup[] {
  const groups = new Map<string, RuntimeProbeGroup>();
  for (const agent of agents) {
    const key = JSON.stringify([agent.runtime, agent.runtimeBin]);
    const current = groups.get(key);
    if (current === undefined) {
      groups.set(key, {
        runtime: agent.runtime,
        runtimeBin: agent.runtimeBin,
        requestedBy: [agent.name],
      });
    } else {
      current.requestedBy.push(agent.name);
    }
  }
  return [...groups.values()].sort((left, right): number =>
    compareCodePoints(
      `${left.runtime}\u0000${left.runtimeBin}`,
      `${right.runtime}\u0000${right.runtimeBin}`,
    ),
  );
 }
 async function probeBinary(
  options: FleetRuntimePreflightOptions,
  probe: BinaryProbeRequest,
 ): Promise<FleetExecutableEvidence> {
  const args = [
    '-i',
    `HOME=${process.env['HOME'] ?? homedir()}`,
    'PATH=/usr/bin:/bin',
    `MOSAIC_HOME=${options.mosaicHome}`,
    '/bin/bash',
    '--noprofile',
    '--norc',
    options.helperPath,
    '--mosaic-home',
    options.mosaicHome,
    '--binary',
    probe.binary,
    '--check-executable',
  ];
  if (probe.runtimeBin !== '') args.push('--runtime-bin', probe.runtimeBin);
  if (options.systemPath !== undefined) args.push('--system-path', options.systemPath);
  const result = await options.runner('/usr/bin/env', args);
  const fields = parseNulFields(result.stdout);
  const panePath = requiredField(fields, 'pane_path');
  const status = requiredField(fields, 'status');
  if (result.exitCode === 0 && status === 'present') {
    return executableEvidence('ok', panePath, fields);
  }
  if (result.exitCode === 69 && status === 'missing') {
    return { status: 'missing', panePath };
  }
  if (result.exitCode === 70 && status === 'unexecutable') {
    return executableEvidence('unexecutable', panePath, fields);
  }
  throw new FleetRuntimeProbeError(
    `Fleet executable probe failed: binary=${probe.binary} exit=${result.exitCode.toString()} ` +
      `stderr=${JSON.stringify(result.stderr.trim())}`,
  );
 }
 function executableEvidence(
  status: 'ok' | 'unexecutable',
  panePath: string,
  fields: ReadonlyMap<string, string>,
 ): FleetExecutableEvidence {
  const dependency = requiredField(fields, 'dependency');
  const probeCommand = requiredField(fields, 'probe_command');
  const probeExit = requiredField(fields, 'probe_exit');
  const probeOutput = requiredField(fields, 'probe_output');
  return {
    status,
    panePath,
    binaryPath: requiredField(fields, 'binary_path'),
    ...(dependency === '' ? {} : { dependency }),
    ...(probeCommand === '' ? {} : { probeCommand }),
    ...(probeExit === '' ? {} : { probeExit: parseProbeExit(probeExit) }),
    ...(probeOutput === '' ? {} : { probeOutput }),
  };
 }
 function sortedRequestedBy(requestedBy: readonly string[]): readonly string[] {
  return Object.freeze(
    [...requestedBy].sort((left: string, right: string): number => compareCodePoints(left, right)),
  );
 }
 function parseNulFields(source: string): ReadonlyMap<string, string> {
  const parts = source.split('\u0000');
  if (parts.at(-1) === '') parts.pop();
  if (parts.length % 2 !== 0) {
    throw new FleetRuntimeProbeError('Fleet runtime probe returned malformed field output.');
  }
  const fields = new Map<string, string>();
  for (let index = 0; index < parts.length; index += 2) {
    const key = parts[index];
    const value = parts[index + 1];
    if (key === undefined || value === undefined || key === '' || fields.has(key)) {
      throw new FleetRuntimeProbeError('Fleet runtime probe returned malformed field output.');
    }
    fields.set(key, value);
  }
  return fields;
 }
 function requiredField(fields: ReadonlyMap<string, string>, key: string): string {
  const value = fields.get(key);
  if (value === undefined) {
    throw new FleetRuntimeProbeError(`Fleet runtime probe omitted ${key}.`);
  }
  return value;
 }
 function parseProbeExit(value: string): number {
  const exitCode = Number(value);
  if (!Number.isSafeInteger(exitCode) || exitCode < 0) {
    throw new FleetRuntimeProbeError('Fleet runtime probe returned an invalid execution status.');
  }
  return exitCode;
 }
 function isRuntimeName(value: string): value is RuntimeName {
  return RUNTIME_SET.has(value);
 }
@@ -25,12 +25,6 @@ export interface AgentGeneratedProjectionDeletionOptions {
  readonly agentName: string;
 }
 export interface AgentLocalEnvironmentReadOptions {
  readonly mosaicHome: string;
  readonly agentEnvDir: string;
  readonly agentName: string;
 }
 export interface AgentEnvironmentProjectionResult {
  readonly generatedPath: string;
  readonly localPath: string;
@@ -151,23 +145,6 @@ export function parseAgentEnvironment(
  return Object.freeze(values);
 }
 /**
 * Reads one agent's optional local overrides through the same path, file-type,
 * permission, key, and value boundary used by projection/launch handling.
 */
 export async function readAgentLocalEnvironment(
  options: AgentLocalEnvironmentReadOptions,
 ): Promise<Readonly<Record<string, string>>> {
  if (!AGENT_NAME.test(options.agentName)) {
    throw new AgentEnvBoundaryError('unsafe-agent-name', 'MOSAIC_AGENT_NAME', options.agentName);
  }
  await validatePrivateProjectionDirectory(options.mosaicHome, options.agentEnvDir);
  const source = await readOptionalPrivateFile(
    join(options.agentEnvDir, `${options.agentName}.env.local`),
  );
  return source === undefined ? Object.freeze({}) : parseAgentEnvironment(source, 'local');
 }
 /** Renders the roster-derived generated projection in a stable, complete key order. */
 export function renderGeneratedAgentEnvironment(values: Readonly<Record<string, string>>): string {
  const normalized = normalizeGeneratedValues(values);
@@ -19,7 +19,7 @@ const RUNTIME_DEFS: Record<
    label: 'Claude Code',
    command: 'claude',
    versionFlag: '--version',
-    installHint: 'curl -fsSL https://claude.ai/install.sh | bash',
+    installHint: 'npm install -g @anthropic-ai/claude-code',
  },
  codex: {
    label: 'Codex',
@@ -31,13 +31,13 @@ const RUNTIME_DEFS: Record<
    label: 'OpenCode',
    command: 'opencode',
    versionFlag: 'version',
-    installHint: 'npm install -g opencode-ai',
+    installHint: 'See https://opencode.ai for install instructions',
  },
  pi: {
    label: 'Pi',
    command: 'pi',
    versionFlag: '--version',
-    installHint: 'npm install -g @earendil-works/pi-coding-agent',
+    installHint: 'curl -fsSL https://pi.dev/install.sh | sh',
  },
 };