feat(ri-050): RI-5-001 typed freshness states and stale-safe Mission Control surfaces (#1275)

Reviewed-on: #1270

apps/web/src/components/freshness/freshness-notices.tsx

@@ -0,0 +1,110 @@
+'use client';
+
+import type { ReactElement } from 'react';
+import { formatAge, type FreshnessLabel } from '@/lib/freshness/model';
+
+/**
+ * Rendering rules for non-current freshness states (RI-5-001).
+ *
+ * - `unavailable` renders an explicit failure panel — never an empty
+ *   healthy collection.
+ * - `stale` may render last-known data, but only under a visible label
+ *   carrying source identity, snapshot version, and age.
+ * - `partial` renders the verified parts plus an explicit list of what is
+ *   missing.
+ */
+
+interface RetryableNoticeProps {
+  readonly onRetry?: () => void;
+  readonly retryLabel?: string;
+}
+
+function RetryButton({ onRetry, retryLabel }: RetryableNoticeProps): ReactElement | null {
+  if (!onRetry) return null;
+  return (
+    <button
+      type="button"
+      onClick={onRetry}
+      className="mt-2 rounded-lg border border-surface-border px-3 py-1.5 text-xs transition-colors hover:border-gray-500"
+    >
+      {retryLabel ?? 'Retry'}
+    </button>
+  );
+}
+
+export interface UnavailableDataNoticeProps extends RetryableNoticeProps {
+  /** What is unavailable, e.g. "Tasks". */
+  readonly title: string;
+  /** Optional underlying failure detail (network message, invalidation reason). */
+  readonly detail?: string | null;
+}
+
+/** Explicit `unavailable` state. Never renders as an empty healthy collection. */
+export function UnavailableDataNotice({
+  title,
+  detail,
+  onRetry,
+  retryLabel,
+}: UnavailableDataNoticeProps): ReactElement {
+  return (
+    <div role="alert" className="rounded-lg border border-error/40 px-4 py-3 text-sm">
+      <p className="font-medium text-text-primary">{title} are unavailable</p>
+      <p className="mt-1 text-text-muted">
+        This is not an empty result — the data could not be verified from the gateway.
+        {detail ? ` ${detail}` : ''}
+      </p>
+      <RetryButton onRetry={onRetry} retryLabel={retryLabel} />
+    </div>
+  );
+}
+
+export interface StaleDataNoticeProps extends RetryableNoticeProps {
+  /** Provenance of the last-known snapshot being displayed. */
+  readonly label: FreshnessLabel;
+}
+
+/**
+ * Situational-awareness banner for `stale` data: last-known data may render,
+ * but visibly labeled with source identity, snapshot version, and age.
+ */
+export function StaleDataNotice({
+  label,
+  onRetry,
+  retryLabel,
+}: StaleDataNoticeProps): ReactElement {
+  return (
+    <div role="status" className="rounded-lg border border-warning/40 px-4 py-3 text-sm">
+      <p className="font-medium text-warning">Showing last-known data — it may be out of date</p>
+      <p className="mt-1 text-xs text-text-muted">
+        Source {label.source} · snapshot v{label.version} · fetched{' '}
+        {formatAge(label.fetchedAt, Date.now())}. Verdicts derived from this data are unknown and
+        changes are disabled until it is revalidated.
+      </p>
+      <RetryButton onRetry={onRetry} retryLabel={retryLabel ?? 'Revalidate'} />
+    </div>
+  );
+}
+
+export interface PartialDataNoticeProps extends RetryableNoticeProps {
+  /** Display names of the sections whose collections are unavailable. */
+  readonly missing: readonly string[];
+}
+
+/** `partial` surface banner: verified parts render, missing parts are explicit. */
+export function PartialDataNotice({
+  missing,
+  onRetry,
+  retryLabel,
+}: PartialDataNoticeProps): ReactElement {
+  return (
+    <div role="status" className="rounded-lg border border-warning/40 px-4 py-3 text-sm">
+      <p className="font-medium text-warning">Some data could not be loaded</p>
+      <p className="mt-1 text-xs text-text-muted">
+        {missing.join(', ')} {missing.length === 1 ? 'is' : 'are'} unavailable — sections below show
+        an explicit unavailable state instead of an empty list. Derived verdicts remain unknown
+        until every collection is revalidated.
+      </p>
+      <RetryButton onRetry={onRetry} retryLabel={retryLabel ?? 'Revalidate'} />
+    </div>
+  );
+}

apps/web/src/lib/freshness/model.spec.ts

@@ -0,0 +1,324 @@
+import { describe, expect, it } from 'vitest';
+import type { Task } from '@/lib/types';
+import {
+  acceptSnapshot,
+  assertMutable,
+  canMutate,
+  combineFreshness,
+  computeDigest,
+  computeFreshness,
+  DEFAULT_FRESHNESS_POLICY,
+  formatAge,
+  type FreshSnapshot,
+  invalidationReasonLabels,
+  StaleMutationError,
+  UNKNOWN_VERDICT,
+  verdictValue,
+} from './model';
+import { validateProjectCollection, validateTaskCollection } from './validators';
+
+const NOW = 1_800_000_000_000;
+
+const policy = { ...DEFAULT_FRESHNESS_POLICY, staleAfterMs: 60_000 };
+
+const taskPayload: Task[] = [
+  {
+    id: 'task-1',
+    title: 'T1',
+    description: null,
+    status: 'not-started',
+    priority: 'high',
+    projectId: 'project-1',
+    missionId: null,
+    assignee: null,
+    tags: null,
+    dueDate: null,
+    metadata: null,
+    createdAt: '2026-08-01T00:00:00.000Z',
+    updatedAt: '2026-08-01T00:00:00.000Z',
+  },
+];
+
+function acceptedTaskSnapshot(
+  overrides: Partial<FreshSnapshot<typeof taskPayload>> = {},
+): FreshSnapshot<typeof taskPayload> {
+  const result = acceptSnapshot({
+    value: taskPayload,
+    validate: validateTaskCollection,
+    previous: null,
+    policy,
+    source: 'gateway:/api/tasks',
+    now: NOW,
+  });
+  if (result.outcome !== 'accepted') {
+    throw new Error(`fixture setup failed: ${result.reason}`);
+  }
+  return { ...result.snapshot, ...overrides };
+}
+
+describe('computeFreshness', () => {
+  it('treats a missing snapshot as unavailable, never as an empty healthy collection', () => {
+    expect(computeFreshness({ snapshot: null, policy, now: NOW })).toBe('unavailable');
+  });
+
+  it('returns current for a fresh verified snapshot regardless of data emptiness', () => {
+    const empty = acceptSnapshot({
+      value: [],
+      validate: validateTaskCollection,
+      previous: null,
+      policy,
+      source: 'gateway:/api/tasks',
+      now: NOW,
+    });
+    if (empty.outcome !== 'accepted') throw new Error('expected acceptance');
+    expect(computeFreshness({ snapshot: empty.snapshot, policy, now: NOW })).toBe('current');
+  });
+
+  it('degrades to stale once the snapshot ages past staleAfterMs', () => {
+    const snapshot = acceptedTaskSnapshot();
+    expect(computeFreshness({ snapshot, policy, now: NOW + 60_001 })).toBe('stale');
+    expect(computeFreshness({ snapshot, policy, now: NOW + 59_999 })).toBe('current');
+  });
+
+  it('degrades to stale when the latest revalidation failed', () => {
+    const snapshot = acceptedTaskSnapshot();
+    expect(computeFreshness({ snapshot, policy, now: NOW, degraded: true })).toBe('stale');
+  });
+});
+
+describe('mutation guard', () => {
+  it('permits mutations only on current data', () => {
+    expect(canMutate('current')).toBe(true);
+    for (const state of ['stale', 'partial', 'unknown', 'unavailable'] as const) {
+      expect(canMutate(state)).toBe(false);
+    }
+  });
+
+  it('refuses mutations on non-current data via assertMutable', () => {
+    expect(() => assertMutable('current')).not.toThrow();
+    for (const state of ['stale', 'partial', 'unknown', 'unavailable'] as const) {
+      let thrown: unknown;
+      try {
+        assertMutable(state);
+      } catch (caught) {
+        thrown = caught;
+      }
+      expect(thrown).toBeInstanceOf(StaleMutationError);
+      expect(thrown).toBeInstanceOf(Error);
+      if (thrown instanceof StaleMutationError) {
+        expect(thrown.name).toBe('StaleMutationError');
+        expect(thrown.freshness).toBe(state);
+        expect(thrown.message).toContain(state);
+        expect(thrown.message).toContain('revalidat');
+      }
+    }
+  });
+});
+
+describe('acceptSnapshot', () => {
+  it('accepts a valid payload with provenance', () => {
+    const result = acceptSnapshot({
+      value: taskPayload,
+      validate: validateTaskCollection,
+      previous: null,
+      policy,
+      source: 'gateway:/api/tasks',
+      now: NOW,
+    });
+    expect(result.outcome).toBe('accepted');
+    if (result.outcome !== 'accepted') return;
+    expect(result.snapshot.source).toBe('gateway:/api/tasks');
+    expect(result.snapshot.version).toBe(1);
+    expect(result.snapshot.fetchedAt).toBe(NOW);
+    expect(result.snapshot.data).toEqual(taskPayload);
+  });
+
+  it('invalidates a schema-mismatched payload instead of rendering it', () => {
+    const result = acceptSnapshot({
+      value: { not: 'an array' },
+      validate: validateTaskCollection,
+      previous: acceptedTaskSnapshot(),
+      policy,
+      source: 'gateway:/api/tasks',
+      now: NOW,
+    });
+    expect(result).toEqual({ outcome: 'invalidated', reason: 'schema-mismatch' });
+    expect(invalidationReasonLabels['schema-mismatch']).toContain('schema');
+  });
+
+  it('invalidates cross-workspace payloads', () => {
+    const userOne = acceptSnapshot({
+      value: [
+        {
+          id: 'p1',
+          name: 'P1',
+          description: null,
+          status: 'active',
+          userId: 'user-1',
+          metadata: null,
+          createdAt: '2026-08-01T00:00:00.000Z',
+          updatedAt: '2026-08-01T00:00:00.000Z',
+        },
+      ],
+      validate: validateProjectCollection,
+      previous: null,
+      policy,
+      source: 'gateway:/api/projects',
+      now: NOW,
+    });
+    if (userOne.outcome !== 'accepted') throw new Error('expected acceptance');
+
+    const switched = acceptSnapshot({
+      value: [
+        {
+          id: 'p9',
+          name: 'P9',
+          description: null,
+          status: 'active',
+          userId: 'user-2',
+          metadata: null,
+          createdAt: '2026-08-01T00:00:00.000Z',
+          updatedAt: '2026-08-01T00:00:00.000Z',
+        },
+      ],
+      validate: validateProjectCollection,
+      previous: userOne.snapshot,
+      policy,
+      source: 'gateway:/api/projects',
+      now: NOW,
+    });
+    expect(switched).toEqual({ outcome: 'invalidated', reason: 'cross-workspace' });
+  });
+
+  it('keeps the previous workspace for collections with no intrinsic identity', () => {
+    const userOne = acceptSnapshot({
+      value: [
+        {
+          id: 'p1',
+          name: 'P1',
+          description: null,
+          status: 'active',
+          userId: 'user-1',
+          metadata: null,
+          createdAt: '2026-08-01T00:00:00.000Z',
+          updatedAt: '2026-08-01T00:00:00.000Z',
+        },
+      ],
+      validate: validateProjectCollection,
+      previous: null,
+      policy,
+      source: 'gateway:/api/projects',
+      now: NOW,
+    });
+    if (userOne.outcome !== 'accepted') throw new Error('expected acceptance');
+
+    // Empty list after the user deleted every project: no identity to check,
+    // so the verified scope is retained and the empty state stays healthy.
+    const emptied = acceptSnapshot({
+      value: [],
+      validate: validateProjectCollection,
+      previous: userOne.snapshot,
+      policy,
+      source: 'gateway:/api/projects',
+      now: NOW,
+    });
+    expect(emptied.outcome).toBe('accepted');
+    if (emptied.outcome === 'accepted') {
+      expect(emptied.snapshot.data).toEqual([]);
+      expect(emptied.snapshot.workspace).toBe('user-1');
+    }
+  });
+
+  it('invalidates version regressions', () => {
+    const previous = acceptedTaskSnapshot({ version: 7 });
+    const regressed = acceptSnapshot({
+      value: taskPayload,
+      validate: validateTaskCollection,
+      previous,
+      policy,
+      source: 'gateway:/api/tasks',
+      now: NOW,
+      incomingVersion: 3,
+    });
+    expect(regressed).toEqual({ outcome: 'invalidated', reason: 'version-regression' });
+
+    const newerSchema = acceptedTaskSnapshot({ schemaVersion: 4 });
+    const downgradedClient = acceptSnapshot({
+      value: taskPayload,
+      validate: validateTaskCollection,
+      previous: newerSchema,
+      policy: { ...policy, schemaVersion: 2 },
+      source: 'gateway:/api/tasks',
+      now: NOW,
+    });
+    expect(downgradedClient).toEqual({ outcome: 'invalidated', reason: 'version-regression' });
+  });
+
+  it('increments the version monotonically across accepted snapshots', () => {
+    const first = acceptedTaskSnapshot();
+    const second = acceptSnapshot({
+      value: taskPayload,
+      validate: validateTaskCollection,
+      previous: first,
+      policy,
+      source: 'gateway:/api/tasks',
+      now: NOW,
+    });
+    expect(second.outcome).toBe('accepted');
+    if (second.outcome === 'accepted') {
+      expect(second.snapshot.version).toBe(first.version + 1);
+    }
+  });
+});
+
+describe('combineFreshness', () => {
+  it('gates the surface on the primary collection', () => {
+    expect(combineFreshness('unavailable', ['current'])).toBe('unavailable');
+    expect(combineFreshness('unknown', ['current'])).toBe('unknown');
+    expect(combineFreshness('current', [])).toBe('current');
+  });
+
+  it('degrades to partial when a secondary is unavailable', () => {
+    expect(combineFreshness('current', ['current', 'unavailable'])).toBe('partial');
+  });
+
+  it('degrades to unknown while a secondary is still loading', () => {
+    expect(combineFreshness('current', ['unknown'])).toBe('unknown');
+  });
+
+  it('degrades to stale when any collection is stale', () => {
+    expect(combineFreshness('current', ['stale'])).toBe('stale');
+    expect(combineFreshness('stale', ['current'])).toBe('stale');
+  });
+
+  it('propagates partial secondaries', () => {
+    expect(combineFreshness('current', ['partial'])).toBe('partial');
+  });
+});
+
+describe('computeDigest', () => {
+  it('is stable across key order and changes with data', () => {
+    const a = computeDigest({ x: 1, y: [1, 2] });
+    const b = computeDigest({ y: [1, 2], x: 1 });
+    expect(a).toBe(b);
+    expect(computeDigest({ x: 1, y: [1, 3] })).not.toBe(a);
+  });
+});
+
+describe('verdictValue', () => {
+  it('returns the value only for verified inputs', () => {
+    expect(verdictValue(true, '5')).toBe('5');
+    expect(verdictValue(false, '5')).toBe(UNKNOWN_VERDICT);
+    expect(verdictValue(false, '5')).not.toBe('5');
+  });
+});
+
+describe('formatAge', () => {
+  it('labels age in human terms', () => {
+    expect(formatAge(NOW, NOW)).toBe('just now');
+    expect(formatAge(NOW, NOW + 15_000)).toBe('under a minute ago');
+    expect(formatAge(NOW, NOW + 120_000)).toBe('2m ago');
+    expect(formatAge(NOW, NOW + 3 * 3_600_000)).toBe('3h ago');
+    expect(formatAge(NOW, NOW + 2 * 86_400_000)).toBe('2d ago');
+  });
+});

apps/web/src/lib/freshness/model.ts

@@ -0,0 +1,261 @@
+/**
+ * Typed freshness model for gateway-fetched collections (RI-5-001).
+ *
+ * A failed or stale fetch must never be indistinguishable from an empty
+ * healthy collection. Every fetched surface carries an explicit freshness
+ * state, a verified snapshot identity (source, workspace, version, age), and
+ * a mutation guard that refuses state-changing operations unless the data is
+ * verified current.
+ */
+
+/** Freshness states for fetched data. Never inferred from emptiness. */
+export type FreshnessState = 'current' | 'stale' | 'partial' | 'unknown' | 'unavailable';
+
+/**
+ * Reasons a snapshot is invalidated. An invalidated snapshot is treated as
+ * unavailable and is never rendered as current.
+ */
+export type InvalidationReason =
+  | 'cache-corruption'
+  | 'cross-workspace'
+  | 'schema-mismatch'
+  | 'version-regression';
+
+/** Human-readable labels for invalidation reasons (UI + error messages). */
+export const invalidationReasonLabels: Record<InvalidationReason, string> = {
+  'cache-corruption': 'cached snapshot failed integrity checks',
+  'cross-workspace': 'data belongs to a different workspace',
+  'schema-mismatch': 'response did not match the expected schema',
+  'version-regression': 'snapshot version regressed below the accepted version',
+};
+
+/** A verified snapshot of fetched data with full provenance. */
+export interface FreshSnapshot<T> {
+  readonly data: T;
+  /** Source identity of the fetch, e.g. `gateway:/api/tasks`. */
+  readonly source: string;
+  /** Workspace scope the data belongs to. */
+  readonly workspace: string;
+  /** Monotonic snapshot sequence number for this surface. */
+  readonly version: number;
+  /** Schema version of the validator that accepted this snapshot. */
+  readonly schemaVersion: number;
+  /** Epoch ms at which the data was verified. */
+  readonly fetchedAt: number;
+  /** Integrity digest of `data`, used to detect cache corruption. */
+  readonly digest: string;
+}
+
+/** Provenance label rendered next to last-known data. */
+export interface FreshnessLabel {
+  readonly source: string;
+  readonly version: number;
+  readonly fetchedAt: number;
+}
+
+/** Policy governing freshness for a surface. */
+export interface FreshnessPolicy {
+  /** Active workspace scope. Snapshots from other scopes are invalidated. */
+  readonly workspace: string;
+  /** Schema version of the current validator. */
+  readonly schemaVersion: number;
+  /** Age after which a verified snapshot degrades from current to stale. */
+  readonly staleAfterMs: number;
+}
+
+export const DEFAULT_FRESHNESS_POLICY: FreshnessPolicy = {
+  workspace: 'default',
+  schemaVersion: 1,
+  staleAfterMs: 60_000,
+};
+
+/** Payload returned by a successful schema validation. */
+export interface FreshPayload<T> {
+  readonly data: T;
+  /**
+   * Workspace identity extracted from the payload itself when the collection
+   * carries one (e.g. a uniform `userId` on projects). `null` when the
+   * collection has no intrinsic workspace identity.
+   */
+  readonly workspace: string | null;
+}
+
+/** Error thrown when a mutation is attempted on non-current data. */
+export class StaleMutationError extends Error {
+  readonly freshness: FreshnessState;
+
+  constructor(freshness: FreshnessState) {
+    super(`Refused mutation on ${freshness} data: revalidation is required before mutating.`);
+    this.name = 'StaleMutationError';
+    this.freshness = freshness;
+  }
+}
+
+/** Stable JSON digest used for snapshot integrity checks. */
+export function computeDigest(value: unknown): string {
+  // FNV-1a 32-bit over the stable JSON serialization. This is an integrity
+  // check against corruption, not a cryptographic guarantee.
+  let hash = 0x811c9dc5;
+  for (const byte of stableStringify(value)) {
+    hash ^= byte.charCodeAt(0);
+    hash = Math.imul(hash, 0x01000193) >>> 0;
+  }
+  return hash.toString(16).padStart(8, '0');
+}
+
+function stableStringify(value: unknown): string {
+  return serialize(value);
+}
+
+function serialize(value: unknown): string {
+  if (value === null || typeof value !== 'object') return JSON.stringify(value) ?? 'null';
+  if (Array.isArray(value)) return `[${value.map(serialize).join(',')}]`;
+  const entries = Object.entries(value as Record<string, unknown>)
+    .filter(([, item]) => item !== undefined)
+    .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))
+    .map(([key, item]) => `${JSON.stringify(key)}:${serialize(item)}`);
+  return `{${entries.join(',')}}`;
+}
+
+export type AcceptSnapshotResult<T> =
+  | { readonly outcome: 'accepted'; readonly snapshot: FreshSnapshot<T> }
+  | { readonly outcome: 'invalidated'; readonly reason: InvalidationReason };
+
+export interface AcceptSnapshotOptions<T> {
+  /** Raw fetched value (untrusted JSON). */
+  readonly value: unknown;
+  /** Schema validator; returns `null` when the value does not match. */
+  readonly validate: (value: unknown) => FreshPayload<T> | null;
+  /** Previously accepted snapshot for this surface, if any. */
+  readonly previous: FreshSnapshot<T> | null;
+  readonly policy: FreshnessPolicy;
+  readonly source: string;
+  /**
+   * Version carried by the incoming payload when the transport exposes one.
+   * Must not regress below the accepted snapshot's version.
+   */
+  readonly incomingVersion?: number;
+  readonly now: number;
+}
+
+/**
+ * Validate and accept a fetched value as a snapshot, or invalidate it.
+ *
+ * Invalidation rules (each treated as unavailable, never rendered current):
+ * - schema mismatch: the payload fails validation
+ * - cross-workspace: the payload's workspace differs from the verified one
+ * - version regression: payload/schema version is below the accepted one
+ */
+export function acceptSnapshot<T>(options: AcceptSnapshotOptions<T>): AcceptSnapshotResult<T> {
+  const payload = options.validate(options.value);
+  if (payload === null) {
+    return { outcome: 'invalidated', reason: 'schema-mismatch' };
+  }
+
+  // Workspace identity: the payload's own scope wins; a collection with no
+  // intrinsic identity (e.g. an empty list after every project was deleted)
+  // keeps the previously verified scope rather than resetting to the policy
+  // default, so a legitimately empty response is not mistaken for a scope
+  // change.
+  const workspace = payload.workspace ?? options.previous?.workspace ?? options.policy.workspace;
+  if (options.previous !== null && options.previous.workspace !== workspace) {
+    return { outcome: 'invalidated', reason: 'cross-workspace' };
+  }
+  if (options.previous !== null && options.policy.schemaVersion < options.previous.schemaVersion) {
+    return { outcome: 'invalidated', reason: 'version-regression' };
+  }
+  if (
+    options.incomingVersion !== undefined &&
+    options.previous !== null &&
+    options.incomingVersion < options.previous.version
+  ) {
+    return { outcome: 'invalidated', reason: 'version-regression' };
+  }
+
+  const snapshot: FreshSnapshot<T> = {
+    data: payload.data,
+    source: options.source,
+    workspace,
+    version: options.incomingVersion ?? (options.previous?.version ?? 0) + 1,
+    schemaVersion: options.policy.schemaVersion,
+    fetchedAt: options.now,
+    digest: computeDigest(payload.data),
+  };
+  return { outcome: 'accepted', snapshot };
+}
+
+export interface ComputeFreshnessOptions {
+  readonly snapshot: FreshSnapshot<unknown> | null;
+  readonly policy: FreshnessPolicy;
+  readonly now: number;
+  /**
+   * True when the snapshot cannot be trusted as current regardless of age:
+   * the latest revalidation failed, or the snapshot was restored from cache
+   * and has not been verified by a fetch in this session.
+   */
+  readonly degraded?: boolean;
+}
+
+/**
+ * Compute the freshness state of a snapshot. A missing snapshot is
+ * `unavailable` (never "empty and healthy"); a degraded or aged snapshot is
+ * `stale` (situational awareness only).
+ */
+export function computeFreshness(options: ComputeFreshnessOptions): FreshnessState {
+  const { snapshot, policy, now, degraded = false } = options;
+  if (snapshot === null) return 'unavailable';
+  if (degraded) return 'stale';
+  if (now - snapshot.fetchedAt > policy.staleAfterMs) return 'stale';
+  return 'current';
+}
+
+/** Only verified-current data may back a state-changing action. */
+export function canMutate(state: FreshnessState): boolean {
+  return state === 'current';
+}
+
+/** Defense in depth: reject the mutation call itself on non-current data. */
+export function assertMutable(state: FreshnessState): void {
+  if (!canMutate(state)) {
+    throw new StaleMutationError(state);
+  }
+}
+
+/**
+ * Combine freshness across a multi-collection surface (primary + secondaries).
+ * The primary collection gates the surface: unknown while it loads,
+ * unavailable when it fails. Missing secondaries degrade the surface to
+ * `partial`; aged collections degrade it to `stale`.
+ */
+export function combineFreshness(
+  primary: FreshnessState,
+  secondaries: readonly FreshnessState[],
+): FreshnessState {
+  if (primary === 'unavailable') return 'unavailable';
+  if (primary === 'unknown') return 'unknown';
+  if (secondaries.includes('unavailable')) return 'partial';
+  if (secondaries.includes('unknown')) return 'unknown';
+  if (secondaries.includes('stale') || primary === 'stale') return 'stale';
+  if (secondaries.includes('partial')) return 'partial';
+  return 'current';
+}
+
+/** Render-safe age label for snapshot provenance. */
+export function formatAge(fetchedAt: number, now: number): string {
+  const ageMs = Math.max(0, now - fetchedAt);
+  if (ageMs < 10_000) return 'just now';
+  const minutes = Math.floor(ageMs / 60_000);
+  if (minutes < 1) return 'under a minute ago';
+  if (minutes < 60) return `${minutes}m ago`;
+  const hours = Math.floor(minutes / 60);
+  if (hours < 24) return `${hours}h ago`;
+  const days = Math.floor(hours / 24);
+  return `${days}d ago`;
+}
+
+/** Derived verdict placeholder for non-current inputs — never a green value. */
+export const UNKNOWN_VERDICT = '?';
+
+export function verdictValue(verified: boolean, value: string): string {
+  return verified ? value : UNKNOWN_VERDICT;
+}

apps/web/src/lib/freshness/snapshot-cache.spec.ts

@@ -0,0 +1,197 @@
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { acceptSnapshot, DEFAULT_FRESHNESS_POLICY } from './model';
+import { clearSnapshotCache, readSnapshotCache, writeSnapshotCache } from './snapshot-cache';
+import { validateProjectCollection, validateTaskCollection } from './validators';
+import { projectFixtures, taskFixtures } from '@/spa/pages/page-fixtures';
+import type { Project, Task } from '@/lib/types';
+
+const KEY = 'test:tasks';
+const NOW = 1_800_000_000_000;
+const policy = { ...DEFAULT_FRESHNESS_POLICY, staleAfterMs: 60_000 };
+
+function storedTaskSnapshot() {
+  const result = acceptSnapshot({
+    value: taskFixtures,
+    validate: validateTaskCollection,
+    previous: null,
+    policy,
+    source: 'gateway:/api/tasks',
+    now: NOW,
+  });
+  if (result.outcome !== 'accepted') throw new Error('fixture setup failed');
+  return result.snapshot;
+}
+
+function storedProjectSnapshot() {
+  const result = acceptSnapshot({
+    value: projectFixtures,
+    validate: validateProjectCollection,
+    previous: null,
+    policy,
+    source: 'gateway:/api/projects',
+    now: NOW,
+  });
+  if (result.outcome !== 'accepted') throw new Error('fixture setup failed');
+  return result.snapshot;
+}
+
+function readTasks() {
+  return readSnapshotCache({
+    key: KEY,
+    workspace: policy.workspace,
+    policy,
+    validate: validateTaskCollection,
+  });
+}
+
+/** Write an arbitrary value directly at the raw cache slot. */
+function writeRaw(key: string, value: unknown): void {
+  sessionStorage.setItem(`mosaic:freshness:v1:${key}`, JSON.stringify(value));
+}
+
+/** Parse and re-write the stored entry (for tampering with internals). */
+function tamperStored<T>(key: string, mutate: (stored: T) => void): void {
+  const parsed = JSON.parse(sessionStorage.getItem(`mosaic:freshness:v1:${key}`) ?? '{}') as T;
+  mutate(parsed);
+  writeRaw(key, parsed);
+}
+
+beforeEach(() => {
+  sessionStorage.clear();
+});
+
+afterEach(() => {
+  sessionStorage.clear();
+});
+
+describe('readSnapshotCache', () => {
+  it('misses when nothing is stored', () => {
+    expect(readTasks()).toEqual({ outcome: 'miss' });
+  });
+
+  it('hits for a well-formed entry and preserves provenance', () => {
+    const snapshot = storedTaskSnapshot();
+    writeSnapshotCache(KEY, snapshot);
+
+    const result = readTasks();
+    expect(result.outcome).toBe('hit');
+    if (result.outcome === 'hit') {
+      expect(result.snapshot.data).toEqual(taskFixtures);
+      expect(result.snapshot.source).toBe('gateway:/api/tasks');
+      expect(result.snapshot.version).toBe(snapshot.version);
+      expect(result.snapshot.fetchedAt).toBe(snapshot.fetchedAt);
+      expect(result.snapshot.workspace).toBe(snapshot.workspace);
+    }
+  });
+
+  it('invalidates unparsable entries as cache corruption', () => {
+    sessionStorage.setItem(`mosaic:freshness:v1:${KEY}`, '{not json');
+    expect(readTasks()).toEqual({ outcome: 'invalidated', reason: 'cache-corruption' });
+  });
+
+  it('invalidates structurally wrong entries as cache corruption', () => {
+    const malformed: unknown[] = [
+      'nested but not a snapshot',
+      { data: taskFixtures }, // missing provenance fields
+      {
+        data: taskFixtures,
+        source: 1,
+        workspace: 'w',
+        version: 1,
+        schemaVersion: 1,
+        fetchedAt: 1,
+        digest: 'x',
+      },
+      null,
+      17,
+    ];
+    for (const entry of malformed) {
+      writeRaw(KEY, entry);
+      expect(readTasks()).toEqual({ outcome: 'invalidated', reason: 'cache-corruption' });
+    }
+  });
+
+  it('invalidates digest mismatches as cache corruption (tampered data)', () => {
+    writeSnapshotCache(KEY, storedTaskSnapshot());
+    tamperStored<{ data: Task[] }>(KEY, (stored) => {
+      stored.data = [...stored.data, { ...stored.data[0]!, id: 'injected-task' }];
+    });
+    expect(readTasks()).toEqual({ outcome: 'invalidated', reason: 'cache-corruption' });
+  });
+
+  it('invalidates entries scoped to another workspace', () => {
+    const snapshot = storedTaskSnapshot();
+    writeSnapshotCache(KEY, { ...snapshot, workspace: 'someone-else' });
+    expect(readTasks()).toEqual({ outcome: 'invalidated', reason: 'cross-workspace' });
+  });
+
+  it('invalidates entries written by a newer schema as a version regression', () => {
+    const snapshot = storedTaskSnapshot();
+    writeSnapshotCache(KEY, { ...snapshot, schemaVersion: policy.schemaVersion + 1 });
+    expect(readTasks()).toEqual({ outcome: 'invalidated', reason: 'version-regression' });
+  });
+
+  it('invalidates entries whose data no longer validates (schema mismatch)', () => {
+    writeSnapshotCache(KEY, storedTaskSnapshot());
+    tamperStored<{ data: unknown }>(KEY, (stored) => {
+      stored.data = { malformed: true };
+    });
+    expect(readTasks()).toEqual({ outcome: 'invalidated', reason: 'schema-mismatch' });
+  });
+
+  it('never reports a corrupted raw entry as a hit (negative control)', () => {
+    for (const raw of ['{oops', 'null', '"string"', '[]', '12']) {
+      sessionStorage.setItem(`mosaic:freshness:v1:${KEY}`, raw);
+      const result = readTasks();
+      expect(result.outcome).not.toBe('hit');
+      expect(result.outcome).toBe('invalidated');
+    }
+  });
+
+  it('scopes project collections by their workspace identity', () => {
+    const snapshot = storedProjectSnapshot();
+    writeSnapshotCache('test:projects', snapshot);
+
+    const sameScope = readSnapshotCache({
+      key: 'test:projects',
+      workspace: 'user-1',
+      policy,
+      validate: validateProjectCollection,
+    });
+    expect(sameScope.outcome).toBe('hit');
+
+    const foreignScope = readSnapshotCache({
+      key: 'test:projects',
+      workspace: 'user-2',
+      policy,
+      validate: validateProjectCollection,
+    });
+    expect(foreignScope).toEqual({ outcome: 'invalidated', reason: 'cross-workspace' });
+  });
+});
+
+describe('writeSnapshotCache round-trip', () => {
+  it('round-trips an accepted project snapshot', () => {
+    const snapshot = storedProjectSnapshot();
+    writeSnapshotCache('test:projects', snapshot);
+    const result = readSnapshotCache({
+      key: 'test:projects',
+      workspace: snapshot.workspace,
+      policy,
+      validate: validateProjectCollection,
+    });
+    expect(result.outcome).toBe('hit');
+    if (result.outcome === 'hit') {
+      expect(result.snapshot.data).toEqual(projectFixtures as Project[]);
+    }
+  });
+});
+
+describe('clearSnapshotCache', () => {
+  it('drops the entry so the next read misses', () => {
+    writeSnapshotCache(KEY, storedTaskSnapshot());
+    expect(readTasks().outcome).toBe('hit');
+    clearSnapshotCache(KEY);
+    expect(readTasks()).toEqual({ outcome: 'miss' });
+  });
+});

apps/web/src/lib/freshness/snapshot-cache.ts

@@ -0,0 +1,154 @@
+import {
+  computeDigest,
+  type FreshPayload,
+  type FreshSnapshot,
+  type FreshnessPolicy,
+  type InvalidationReason,
+} from './model';
+
+/**
+ * Session-scoped last-known snapshot cache (RI-5-001).
+ *
+ * Restored snapshots are situational awareness only: they surface as `stale`
+ * until a fetch re-verifies them. A cache entry that is corrupted, belongs to
+ * another workspace, was written by a newer schema, or no longer validates is
+ * invalidated (treated as unavailable, never rendered as current).
+ */
+
+const CACHE_PREFIX = 'mosaic:freshness:v1';
+
+interface StoredSnapshot {
+  data: unknown;
+  source: string;
+  workspace: string;
+  version: number;
+  schemaVersion: number;
+  fetchedAt: number;
+  digest: string;
+}
+
+export type SnapshotCacheRead<T> =
+  | { readonly outcome: 'hit'; readonly snapshot: FreshSnapshot<T> }
+  | { readonly outcome: 'miss' }
+  | { readonly outcome: 'invalidated'; readonly reason: InvalidationReason };
+
+export interface ReadSnapshotCacheOptions<T> {
+  readonly key: string;
+  readonly workspace: string;
+  readonly policy: FreshnessPolicy;
+  readonly validate: (value: unknown) => FreshPayload<T> | null;
+}
+
+function cacheKey(key: string): string {
+  return `${CACHE_PREFIX}:${key}`;
+}
+
+function isStoredSnapshot(value: unknown): value is StoredSnapshot {
+  if (typeof value !== 'object' || value === null) return false;
+  const candidate = value as Record<string, unknown>;
+  return (
+    typeof candidate['data'] === 'object' &&
+    candidate['data'] !== null &&
+    typeof candidate['source'] === 'string' &&
+    typeof candidate['workspace'] === 'string' &&
+    typeof candidate['version'] === 'number' &&
+    typeof candidate['schemaVersion'] === 'number' &&
+    typeof candidate['fetchedAt'] === 'number' &&
+    typeof candidate['digest'] === 'string'
+  );
+}
+
+function getStorage(): Storage | null {
+  try {
+    return globalThis.sessionStorage ?? null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Restore a cached snapshot under the active workspace scope. Every failure
+ * mode maps to an explicit invalidation reason or a miss — never to data
+ * that renders as current.
+ */
+export function readSnapshotCache<T>(options: ReadSnapshotCacheOptions<T>): SnapshotCacheRead<T> {
+  const storage = getStorage();
+  if (storage === null) return { outcome: 'miss' };
+
+  let raw: string | null;
+  try {
+    raw = storage.getItem(cacheKey(options.key));
+  } catch {
+    return { outcome: 'miss' };
+  }
+  if (raw === null) return { outcome: 'miss' };
+
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { outcome: 'invalidated', reason: 'cache-corruption' };
+  }
+  if (!isStoredSnapshot(parsed)) {
+    return { outcome: 'invalidated', reason: 'cache-corruption' };
+  }
+  if (parsed.workspace !== options.workspace) {
+    return { outcome: 'invalidated', reason: 'cross-workspace' };
+  }
+  if (parsed.schemaVersion > options.policy.schemaVersion) {
+    // Written by a newer build than the running client: version regression.
+    return { outcome: 'invalidated', reason: 'version-regression' };
+  }
+
+  const payload = options.validate(parsed.data);
+  if (payload === null) {
+    return { outcome: 'invalidated', reason: 'schema-mismatch' };
+  }
+  if (computeDigest(payload.data) !== parsed.digest) {
+    return { outcome: 'invalidated', reason: 'cache-corruption' };
+  }
+
+  return {
+    outcome: 'hit',
+    snapshot: {
+      data: payload.data,
+      source: parsed.source,
+      workspace: parsed.workspace,
+      version: parsed.version,
+      schemaVersion: parsed.schemaVersion,
+      fetchedAt: parsed.fetchedAt,
+      digest: parsed.digest,
+    },
+  };
+}
+
+/** Persist a verified snapshot. Failures are non-fatal (cache is best-effort). */
+export function writeSnapshotCache<T>(key: string, snapshot: FreshSnapshot<T>): void {
+  const storage = getStorage();
+  if (storage === null) return;
+  const stored: StoredSnapshot = {
+    data: snapshot.data,
+    source: snapshot.source,
+    workspace: snapshot.workspace,
+    version: snapshot.version,
+    schemaVersion: snapshot.schemaVersion,
+    fetchedAt: snapshot.fetchedAt,
+    digest: snapshot.digest,
+  };
+  try {
+    storage.setItem(cacheKey(key), JSON.stringify(stored));
+  } catch {
+    // Quota or serialization failures simply skip caching.
+  }
+}
+
+/** Drop a cached snapshot (used when a surface invalidates its cache entry). */
+export function clearSnapshotCache(key: string): void {
+  const storage = getStorage();
+  if (storage === null) return;
+  try {
+    storage.removeItem(cacheKey(key));
+  } catch {
+    // Ignorable: a wedged storage entry is detected as corruption on read.
+  }
+}

apps/web/src/lib/freshness/use-fresh-collection.spec.tsx

@@ -0,0 +1,372 @@
+import { act } from 'react';
+import { createRoot, type Root } from 'react-dom/client';
+import { afterEach, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest';
+import type { Task } from '@/lib/types';
+import { acceptSnapshot, StaleMutationError, DEFAULT_FRESHNESS_POLICY } from './model';
+import type { FreshnessFailure } from './use-fresh-collection';
+import {
+  describeFailure,
+  useFreshCollection,
+  type FreshCollection,
+  type UseFreshCollectionOptions,
+} from './use-fresh-collection';
+import { validateProjectCollection, validateTaskCollection } from './validators';
+import { projectFixtures, taskFixtures } from '@/spa/pages/page-fixtures';
+
+/**
+ * Failure-matrix coverage for the freshness seam (RI-5-001): network failure,
+ * auth failure, malformed response, cache corruption, stale age, schema
+ * mismatch, cross-workspace, recovery, and stale-action rejection — with
+ * negative controls proving no case yields current data or an enabled
+ * mutation.
+ */
+
+const NOW = 1_800_000_000_000;
+
+interface Deferred<T> {
+  promise: Promise<T>;
+  resolve: (value: T) => void;
+  reject: (reason?: unknown) => void;
+}
+
+function createDeferred<T>(): Deferred<T> {
+  let resolve!: (value: T) => void;
+  let reject!: (reason?: unknown) => void;
+  const promise = new Promise<T>((res, rej) => {
+    resolve = res;
+    reject = rej;
+  });
+  return { promise, resolve, reject };
+}
+
+let root: Root | null = null;
+let container: HTMLDivElement;
+let latest: FreshCollection<Task[]> | null = null;
+
+function Probe({
+  options,
+}: {
+  options: UseFreshCollectionOptions<Task[]>;
+}): React.ReactElement | null {
+  latest = useFreshCollection<Task[]>(options);
+  return null;
+}
+
+beforeAll(() => {
+  Object.defineProperty(globalThis, 'IS_REACT_ACT_ENVIRONMENT', {
+    configurable: true,
+    value: true,
+  });
+});
+
+beforeEach(() => {
+  sessionStorage.clear();
+});
+
+afterEach(async () => {
+  await act(async () => {
+    root?.unmount();
+  });
+  document.body.replaceChildren();
+  root = null;
+  latest = null;
+  sessionStorage.clear();
+  vi.restoreAllMocks();
+});
+
+async function renderCollection(
+  options: UseFreshCollectionOptions<Task[]>,
+): Promise<FreshCollection<Task[]>> {
+  container = document.createElement('div');
+  document.body.append(container);
+  root = createRoot(container);
+  await act(async () => {
+    root?.render(<Probe options={options} />);
+  });
+  if (latest === null) throw new Error('hook did not run');
+  return latest;
+}
+
+function taskOptions(
+  overrides: Partial<UseFreshCollectionOptions<Task[]>> = {},
+): UseFreshCollectionOptions<Task[]> {
+  return {
+    source: 'gateway:/api/tasks',
+    fetcher: () => Promise.resolve(taskFixtures),
+    validate: validateTaskCollection,
+    cacheKey: 'tasks',
+    clock: () => NOW,
+    ...overrides,
+  };
+}
+
+function authError(statusCode: number): Error & { statusCode: number } {
+  return Object.assign(new Error(`Request failed with ${statusCode}`), { statusCode });
+}
+
+function seedCache(key: string): number {
+  const result = acceptSnapshot({
+    value: taskFixtures,
+    validate: validateTaskCollection,
+    previous: null,
+    policy: DEFAULT_FRESHNESS_POLICY,
+    source: 'gateway:/api/tasks',
+    now: NOW,
+  });
+  if (result.outcome !== 'accepted') throw new Error('fixture setup failed');
+  sessionStorage.setItem(`mosaic:freshness:v1:${key}`, JSON.stringify({ ...result.snapshot }));
+  return result.snapshot.version;
+}
+
+describe('useFreshCollection failure matrix', () => {
+  it('is unknown (not empty) while the first validation is in flight', async () => {
+    const deferred = createDeferred<Task[]>();
+    const collection = await renderCollection(taskOptions({ fetcher: () => deferred.promise }));
+
+    expect(collection.freshness).toBe('unknown');
+    expect(collection.validating).toBe(true);
+    expect(collection.data).toBeNull();
+    expect(collection.canMutate).toBe(false);
+
+    await act(async () => {
+      deferred.resolve(taskFixtures);
+      await deferred.promise;
+    });
+  });
+
+  it('becomes current with provenance after a verified fetch', async () => {
+    const collection = await renderCollection(taskOptions());
+
+    expect(collection.freshness).toBe('current');
+    expect(collection.data).toEqual(taskFixtures);
+    expect(collection.snapshot?.source).toBe('gateway:/api/tasks');
+    expect(collection.snapshot?.version).toBe(1);
+    expect(collection.failure).toBeNull();
+    expect(collection.canMutate).toBe(true);
+    // Verified snapshot is persisted for last-known restore.
+    expect(sessionStorage.getItem('mosaic:freshness:v1:tasks')).toBeTruthy();
+  });
+
+  it('treats a network failure as unavailable — never an empty healthy collection', async () => {
+    const collection = await renderCollection(
+      taskOptions({ fetcher: () => Promise.reject(new Error('network down')) }),
+    );
+
+    expect(collection.freshness).toBe('unavailable');
+    expect(collection.data).toBeNull();
+    expect(collection.failure).toEqual({ kind: 'fetch', message: 'network down' });
+    expect(collection.canMutate).toBe(false);
+    expect(describeFailure(collection.failure)).toBe('network down');
+  });
+
+  it('treats an auth failure as unavailable and drops the last-known snapshot', async () => {
+    let call = 0;
+    const collection = await renderCollection(
+      taskOptions({
+        fetcher: () => {
+          call += 1;
+          return call === 1 ? Promise.resolve(taskFixtures) : Promise.reject(authError(401));
+        },
+      }),
+    );
+    expect(collection.freshness).toBe('current');
+
+    await act(async () => {
+      await collection.revalidate();
+    });
+
+    expect(latest?.freshness).toBe('unavailable');
+    expect(latest?.data).toBeNull();
+    expect(latest?.failure?.kind).toBe('fetch');
+    // The previous user's data must not linger in the session cache.
+    expect(sessionStorage.getItem('mosaic:freshness:v1:tasks')).toBeNull();
+  });
+
+  it('invalidates a malformed response as a schema mismatch', async () => {
+    const collection = await renderCollection(
+      taskOptions({ fetcher: () => Promise.resolve({ malformed: true }) }),
+    );
+
+    expect(collection.freshness).toBe('unavailable');
+    expect(collection.data).toBeNull();
+    expect(collection.failure).toEqual({ kind: 'invalidated', reason: 'schema-mismatch' });
+    expect(collection.canMutate).toBe(false);
+  });
+
+  it('keeps the previous snapshot as labeled stale when a later payload mismatches', async () => {
+    let call = 0;
+    const collection = await renderCollection(
+      taskOptions({
+        fetcher: () => {
+          call += 1;
+          return call === 1 ? Promise.resolve(taskFixtures) : Promise.resolve('garbage');
+        },
+      }),
+    );
+    expect(collection.freshness).toBe('current');
+
+    await act(async () => {
+      await collection.revalidate();
+    });
+
+    expect(latest?.freshness).toBe('stale');
+    expect(latest?.data).toEqual(taskFixtures);
+    expect(latest?.failure).toEqual({ kind: 'invalidated', reason: 'schema-mismatch' });
+    expect(latest?.canMutate).toBe(false);
+  });
+
+  it('drops the snapshot when the workspace changes under it (cross-workspace)', async () => {
+    let call = 0;
+    const collection = await renderCollection(
+      taskOptions({
+        fetcher: () => {
+          call += 1;
+          return Promise.resolve(
+            call === 1 ? projectFixtures : [{ ...projectFixtures[0], userId: 'user-2' }],
+          );
+        },
+        validate: validateProjectCollection as unknown as (value: unknown) => {
+          data: Task[];
+          workspace: string | null;
+        },
+        source: 'gateway:/api/projects',
+      }),
+    );
+    expect(collection.freshness).toBe('current');
+
+    await act(async () => {
+      await collection.revalidate();
+    });
+
+    expect(latest?.freshness).toBe('unavailable');
+    expect(latest?.data).toBeNull();
+    expect(latest?.failure).toEqual({ kind: 'invalidated', reason: 'cross-workspace' });
+  });
+
+  it('ages from current to stale and refuses mutations on stale data', async () => {
+    let fakeNow = NOW;
+    const collection = await renderCollection(
+      taskOptions({
+        clock: () => fakeNow,
+        policy: { staleAfterMs: 40 },
+        tickMs: 10,
+      }),
+    );
+    expect(collection.freshness).toBe('current');
+
+    // Age the snapshot past the policy and let the tick recompute.
+    fakeNow = NOW + 60;
+    await act(async () => {
+      await new Promise((resolve) => setTimeout(resolve, 25));
+    });
+
+    expect(latest?.freshness).toBe('stale');
+    expect(latest?.data).toEqual(taskFixtures);
+    expect(latest?.canMutate).toBe(false);
+
+    const operation = vi.fn(async () => 'result');
+    await expect(latest?.mutate(operation)).rejects.toBeInstanceOf(StaleMutationError);
+    expect(operation).not.toHaveBeenCalled();
+  });
+
+  it('recovers to current after a successful revalidation', async () => {
+    let call = 0;
+    const collection = await renderCollection(
+      taskOptions({
+        fetcher: () => {
+          call += 1;
+          return call === 1
+            ? Promise.reject(new Error('first attempt failed'))
+            : Promise.resolve(taskFixtures);
+        },
+      }),
+    );
+    expect(collection.freshness).toBe('unavailable');
+
+    await act(async () => {
+      await collection.revalidate();
+    });
+
+    expect(latest?.freshness).toBe('current');
+    expect(latest?.failure).toBeNull();
+
+    const operation = vi.fn(async (data: Task[]) => data.length);
+    await expect(latest?.mutate(operation)).resolves.toBe(taskFixtures.length);
+    expect(operation).toHaveBeenCalledOnce();
+  });
+
+  it('restores a cached snapshot as unverified stale data, then verifies it', async () => {
+    const seededVersion = seedCache('tasks');
+    const deferred = createDeferred<Task[]>();
+    const collection = await renderCollection(taskOptions({ fetcher: () => deferred.promise }));
+
+    // Restored data is situational awareness only: labeled stale, never
+    // current, and mutations are refused before verification.
+    expect(collection.freshness).toBe('stale');
+    expect(collection.data).toEqual(taskFixtures);
+    expect(collection.canMutate).toBe(false);
+    await expect(collection.mutate(vi.fn())).rejects.toBeInstanceOf(StaleMutationError);
+
+    await act(async () => {
+      deferred.resolve(taskFixtures);
+      await deferred.promise;
+    });
+
+    expect(latest?.freshness).toBe('current');
+    expect(latest?.snapshot?.version).toBe(seededVersion + 1);
+  });
+
+  it('never promotes corrupted cache data to current (cache corruption)', async () => {
+    sessionStorage.setItem('mosaic:freshness:v1:tasks', '{"data":');
+    const collection = await renderCollection(
+      taskOptions({ fetcher: () => Promise.reject(new Error('still down')) }),
+    );
+
+    expect(collection.freshness).toBe('unavailable');
+    expect(collection.data).toBeNull();
+    expect(collection.canMutate).toBe(false);
+    // The corrupted entry is dropped so it cannot come back.
+    expect(sessionStorage.getItem('mosaic:freshness:v1:tasks')).toBeNull();
+  });
+
+  it('refuses mutations while unknown or unavailable — the call itself, not just the button', async () => {
+    const deferred = createDeferred<Task[]>();
+    const unknown = await renderCollection(taskOptions({ fetcher: () => deferred.promise }));
+    const operation = vi.fn(async () => 'result');
+    await expect(unknown.mutate(operation)).rejects.toBeInstanceOf(StaleMutationError);
+    expect(operation).not.toHaveBeenCalled();
+    await act(async () => {
+      deferred.reject(new Error('failed'));
+      await deferred.promise.catch(() => undefined);
+    });
+
+    const unavailable = latest!;
+    await expect(unavailable.mutate(operation)).rejects.toBeInstanceOf(StaleMutationError);
+    expect(operation).not.toHaveBeenCalled();
+    expect(unavailable.canMutate).toBe(false);
+  });
+
+  it('degrades to stale with last-known data when a revalidation fails after success', async () => {
+    let call = 0;
+    const collection = await renderCollection(
+      taskOptions({
+        fetcher: () => {
+          call += 1;
+          return call === 1
+            ? Promise.resolve(taskFixtures)
+            : Promise.reject(new Error('connection lost'));
+        },
+      }),
+    );
+    expect(collection.freshness).toBe('current');
+
+    await act(async () => {
+      await collection.revalidate();
+    });
+
+    expect(latest?.freshness).toBe('stale');
+    expect(latest?.data).toEqual(taskFixtures);
+    const failure: FreshnessFailure | null = latest?.failure ?? null;
+    expect(failure).toEqual({ kind: 'fetch', message: 'connection lost' });
+  });
+});

apps/web/src/lib/freshness/use-fresh-collection.ts

@@ -0,0 +1,281 @@
+import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
+import {
+  acceptSnapshot,
+  assertMutable,
+  computeFreshness,
+  DEFAULT_FRESHNESS_POLICY,
+  invalidationReasonLabels,
+  type FreshPayload,
+  type FreshSnapshot,
+  type FreshnessPolicy,
+  type FreshnessState,
+  type InvalidationReason,
+  StaleMutationError,
+} from './model';
+import { clearSnapshotCache, readSnapshotCache, writeSnapshotCache } from './snapshot-cache';
+
+/**
+ * Freshness-aware collection fetch hook (RI-5-001).
+ *
+ * One hook owns one gateway collection end to end: fetch, schema validation,
+ * snapshot acceptance with provenance, session-scoped last-known caching,
+ * aging, and the mutation guard. Pages consume `freshness` and never infer
+ * health from emptiness.
+ */
+
+/** Why the latest validation did not produce a current snapshot. */
+export type FreshnessFailure =
+  | { readonly kind: 'fetch'; readonly message: string }
+  | { readonly kind: 'invalidated'; readonly reason: InvalidationReason };
+
+export interface UseFreshCollectionOptions<T> {
+  /** Source identity for provenance labels, e.g. `gateway:/api/tasks`. */
+  readonly source: string;
+  /** Performs the unvalidated fetch. The hook owns abort and verification. */
+  readonly fetcher: (signal: AbortSignal) => Promise<unknown>;
+  /**
+   * Runtime schema validator. Returning `null` invalidates the payload
+   * (`schema-mismatch`) instead of letting malformed JSON flow into render.
+   */
+  readonly validate: (value: unknown) => FreshPayload<T> | null;
+  /** Overrides of the default freshness policy. */
+  readonly policy?: Partial<FreshnessPolicy>;
+  /**
+   * Session cache key for last-known snapshots. `null`/omitted disables
+   * restore. Restored snapshots are unverified: they render only as
+   * labeled `stale` data until a fetch re-verifies them.
+   */
+  readonly cacheKey?: string | null;
+  /** Injectable clock for deterministic age transitions in tests. */
+  readonly clock?: () => number;
+  /** Aging tick interval override (default derived from `staleAfterMs`). */
+  readonly tickMs?: number;
+  /** When false, no fetch runs (surfaces stay `unavailable`/`unknown`). */
+  readonly enabled?: boolean;
+}
+
+export interface FreshCollection<T> {
+  /** Last verified (or restored-unverified) snapshot, or `null`. */
+  readonly snapshot: FreshSnapshot<T> | null;
+  /** Snapshot data or `null` — never a fabricated empty collection. */
+  readonly data: T | null;
+  readonly freshness: FreshnessState;
+  /** True while a validation request is in flight. */
+  readonly validating: boolean;
+  /** Outcome of the latest failed validation, `null` when healthy. */
+  readonly failure: FreshnessFailure | null;
+  /** False unless freshness is `current`; drives disabled UI affordances. */
+  readonly canMutate: boolean;
+  /** Re-run the fetch and re-verify. Always allowed (it is a read). */
+  readonly revalidate: () => Promise<void>;
+  /**
+   * Run a state-changing operation against verified-current data only.
+   * Rejects with `StaleMutationError` on any other state — the guard fires
+   * even if a disabled button was bypassed (defense in depth).
+   */
+  readonly mutate: <R>(operation: (data: T) => Promise<R>) => Promise<R>;
+}
+
+const defaultClock = (): number => Date.now();
+
+function resolveTickMs(policy: FreshnessPolicy, override?: number): number {
+  if (override !== undefined && override > 0) return override;
+  return Math.min(5_000, Math.max(250, Math.floor(policy.staleAfterMs / 4)));
+}
+
+function isAuthFailure(caught: unknown): boolean {
+  return (
+    typeof caught === 'object' &&
+    caught !== null &&
+    'statusCode' in caught &&
+    ((caught as { statusCode?: unknown }).statusCode === 401 ||
+      (caught as { statusCode?: unknown }).statusCode === 403)
+  );
+}
+
+function fetchFailureMessage(caught: unknown): string {
+  if (caught instanceof Error && caught.message.trim().length > 0) return caught.message;
+  return 'The request failed.';
+}
+
+/** Human-readable summary of a failure for unavailable/stale notices. */
+export function describeFailure(failure: FreshnessFailure | null): string | null {
+  if (failure === null) return null;
+  if (failure.kind === 'fetch') return failure.message;
+  return `The snapshot was invalidated: ${invalidationReasonLabels[failure.reason]}.`;
+}
+
+export function useFreshCollection<T>(options: UseFreshCollectionOptions<T>): FreshCollection<T> {
+  const optionsRef = useRef(options);
+  optionsRef.current = options;
+
+  const policy = useMemo<FreshnessPolicy>(
+    () => ({ ...DEFAULT_FRESHNESS_POLICY, ...options.policy }),
+    [options.policy],
+  );
+  const policyRef = useRef(policy);
+  policyRef.current = policy;
+
+  const clockRef = useRef(options.clock ?? defaultClock);
+  clockRef.current = options.clock ?? defaultClock;
+
+  const [snapshot, setSnapshot] = useState<FreshSnapshot<T> | null>(null);
+  const [failure, setFailure] = useState<FreshnessFailure | null>(null);
+  const [unverified, setUnverified] = useState(false);
+  const [validating, setValidating] = useState(options.enabled !== false);
+  const [now, setNow] = useState(() => (options.clock ?? defaultClock)());
+
+  const snapshotRef = useRef(snapshot);
+  snapshotRef.current = snapshot;
+  const failureRef = useRef(failure);
+  failureRef.current = failure;
+  const unverifiedRef = useRef(unverified);
+  unverifiedRef.current = unverified;
+
+  const runRef = useRef(0);
+  const abortRef = useRef<AbortController | null>(null);
+
+  const revalidate = useCallback(async (): Promise<void> => {
+    const current = optionsRef.current;
+    if (current.enabled === false) {
+      setValidating(false);
+      return;
+    }
+
+    const runId = ++runRef.current;
+    abortRef.current?.abort();
+    const controller = new AbortController();
+    abortRef.current = controller;
+    setValidating(true);
+
+    let value: unknown;
+    try {
+      value = await current.fetcher(controller.signal);
+    } catch (caught) {
+      if (runRef.current !== runId || controller.signal.aborted) return;
+      if (isAuthFailure(caught)) {
+        // An unauthenticated viewer must not keep (or be served) the
+        // previous user's last-known data.
+        setSnapshot(null);
+        setUnverified(false);
+        if (current.cacheKey) clearSnapshotCache(current.cacheKey);
+      }
+      setFailure({ kind: 'fetch', message: fetchFailureMessage(caught) });
+      setValidating(false);
+      return;
+    }
+
+    if (runRef.current !== runId) return;
+
+    const result = acceptSnapshot({
+      value,
+      validate: current.validate,
+      previous: snapshotRef.current,
+      policy: policyRef.current,
+      source: current.source,
+      now: clockRef.current(),
+    });
+
+    if (result.outcome === 'accepted') {
+      setSnapshot(result.snapshot);
+      setUnverified(false);
+      setFailure(null);
+      if (current.cacheKey) writeSnapshotCache(current.cacheKey, result.snapshot);
+    } else {
+      if (result.reason === 'cross-workspace') {
+        // Data verified for a different workspace must not linger as
+        // last-known situational awareness either.
+        setSnapshot(null);
+        setUnverified(false);
+      }
+      if (current.cacheKey) clearSnapshotCache(current.cacheKey);
+      setFailure({ kind: 'invalidated', reason: result.reason });
+    }
+    setValidating(false);
+  }, []);
+
+  // Restore the last-known snapshot (unverified) and run the first fetch.
+  useEffect(() => {
+    if (optionsRef.current.enabled === false) {
+      setValidating(false);
+      return;
+    }
+
+    const cacheKey = optionsRef.current.cacheKey;
+    if (cacheKey) {
+      const restored = readSnapshotCache<T>({
+        key: cacheKey,
+        workspace: policyRef.current.workspace,
+        policy: policyRef.current,
+        validate: optionsRef.current.validate,
+      });
+      if (restored.outcome === 'hit') {
+        setSnapshot(restored.snapshot);
+        setUnverified(true);
+      } else if (restored.outcome === 'invalidated') {
+        // A corrupted/foreign/regressed entry is dropped immediately; it must
+        // never surface as data. The fetch decides the visible state.
+        clearSnapshotCache(cacheKey);
+      }
+    }
+
+    void revalidate();
+
+    return () => {
+      abortRef.current?.abort();
+    };
+    // Mount-once by design: `revalidate` is stable and reads live options
+    // through refs, so it never needs to re-run when options change.
+    // Route-param pages remount this hook via an identity `key` instead.
+  }, [revalidate]);
+
+  // Aging tick: recomputes freshness as the snapshot ages past the policy.
+  useEffect(() => {
+    const interval = setInterval(
+      () => {
+        setNow(clockRef.current());
+      },
+      resolveTickMs(policyRef.current, optionsRef.current.tickMs),
+    );
+    return () => clearInterval(interval);
+  }, []);
+
+  const freshness = useMemo<FreshnessState>(() => {
+    if (snapshot === null) return validating ? 'unknown' : 'unavailable';
+    return computeFreshness({
+      snapshot,
+      policy,
+      now,
+      degraded: failure !== null || unverified,
+    });
+    // `now` from state covers age; refs inside computeFreshness are pure.
+  }, [snapshot, validating, failure, unverified, now, policy]);
+
+  const canMutate = freshness === 'current';
+
+  const mutate = useCallback(async <R>(operation: (data: T) => Promise<R>): Promise<R> => {
+    const currentSnapshot = snapshotRef.current;
+    // No verified snapshot at all: with nothing verified there is nothing
+    // current to mutate, regardless of the recorded failure.
+    if (currentSnapshot === null) throw new StaleMutationError('unavailable');
+    const state = computeFreshness({
+      snapshot: currentSnapshot,
+      policy: policyRef.current,
+      now: clockRef.current(),
+      degraded: failureRef.current !== null || unverifiedRef.current,
+    });
+    assertMutable(state);
+    return operation(currentSnapshot.data);
+  }, []);
+
+  return {
+    snapshot,
+    data: snapshot === null ? null : snapshot.data,
+    freshness,
+    validating,
+    failure,
+    canMutate,
+    revalidate,
+    mutate,
+  };
+}

apps/web/src/lib/freshness/validators.spec.ts

@@ -0,0 +1,103 @@
+import { describe, expect, it } from 'vitest';
+import type { Mission, Project, Task } from '@/lib/types';
+import {
+  validateMissionCollection,
+  validateProjectCollection,
+  validateProjectEntity,
+  validateTaskCollection,
+} from './validators';
+import { missionFixtures, projectFixtures, taskFixtures } from '@/spa/pages/page-fixtures';
+
+describe('validateTaskCollection', () => {
+  it('accepts a well-formed task collection', () => {
+    expect(validateTaskCollection(taskFixtures)).toEqual({
+      data: taskFixtures,
+      workspace: null,
+    });
+  });
+
+  it('accepts an empty collection (a healthy empty state is a valid payload)', () => {
+    expect(validateTaskCollection([])).toEqual({ data: [], workspace: null });
+  });
+
+  it.each([
+    ['not an array', { items: [] }],
+    ['item is not an object', ['nope']],
+    ['missing id', [{ ...(taskFixtures[0] as Task), id: undefined }]],
+    ['missing title', [{ ...(taskFixtures[0] as Task), title: undefined }]],
+    ['unknown status enum', [{ ...(taskFixtures[0] as Task), status: 'finished' }]],
+    ['unknown priority enum', [{ ...(taskFixtures[0] as Task), priority: 'urgent' }]],
+    ['tags of the wrong type', [{ ...(taskFixtures[0] as Task), tags: 'spa' }]],
+    ['metadata of the wrong type', [{ ...(taskFixtures[0] as Task), metadata: 'notes' }]],
+    ['createdAt of the wrong type', [{ ...(taskFixtures[0] as Task), createdAt: 1234 }]],
+    ['null sneaks past a required string', [{ ...(taskFixtures[0] as Task), title: null }]],
+  ])('rejects a malformed payload: %s', (_label, value) => {
+    expect(validateTaskCollection(value)).toBeNull();
+  });
+});
+
+describe('validateMissionCollection', () => {
+  it('accepts a well-formed mission collection', () => {
+    expect(validateMissionCollection(missionFixtures)).toEqual({
+      data: missionFixtures,
+      workspace: null,
+    });
+  });
+
+  it.each([
+    ['not an array', null],
+    ['item missing name', [{ ...(missionFixtures[0] as Mission), name: 42 }]],
+    ['unknown status enum', [{ ...(missionFixtures[0] as Mission), status: 'canceled' }]],
+    ['projectId of the wrong type', [{ ...(missionFixtures[0] as Mission), projectId: 7 }]],
+  ])('rejects a malformed payload: %s', (_label, value) => {
+    expect(validateMissionCollection(value)).toBeNull();
+  });
+});
+
+describe('validateProjectCollection', () => {
+  it('accepts a uniform workspace-scoped collection and reports its workspace', () => {
+    expect(validateProjectCollection(projectFixtures)).toEqual({
+      data: projectFixtures,
+      workspace: 'user-1',
+    });
+  });
+
+  it('accepts an empty collection with no workspace identity', () => {
+    expect(validateProjectCollection([])).toEqual({ data: [], workspace: null });
+  });
+
+  it.each([
+    ['not an array', 42],
+    ['item missing userId', [{ ...(projectFixtures[0] as Project), userId: undefined }]],
+    ['unknown status enum', [{ ...(projectFixtures[0] as Project), status: 'live' }]],
+    ['description of the wrong type', [{ ...(projectFixtures[0] as Project), description: 1 }]],
+  ])('rejects a malformed payload: %s', (_label, value) => {
+    expect(validateProjectCollection(value)).toBeNull();
+  });
+
+  it('rejects a collection mixing workspace identities (cross-workspace leak)', () => {
+    const mixed = [
+      projectFixtures[0] as Project,
+      { ...(projectFixtures[1] as Project), userId: 'user-2' },
+    ];
+    expect(validateProjectCollection(mixed)).toBeNull();
+  });
+});
+
+describe('validateProjectEntity', () => {
+  it('accepts a well-formed project and reports its workspace', () => {
+    expect(validateProjectEntity(projectFixtures[0])).toEqual({
+      data: projectFixtures[0],
+      workspace: 'user-1',
+    });
+  });
+
+  it.each([
+    ['not an object', 'project-1'],
+    ['null', null],
+    ['array', [projectFixtures[0]]],
+    ['missing userId', [{ ...(projectFixtures[0] as Project), userId: null }]],
+  ])('rejects a malformed entity: %s', (_label, value) => {
+    expect(validateProjectEntity(value)).toBeNull();
+  });
+});

apps/web/src/lib/freshness/validators.ts

@@ -0,0 +1,135 @@
+import type { Mission, Project, Task, MissionStatus, TaskPriority, TaskStatus } from '@/lib/types';
+import type { FreshPayload } from './model';
+
+/**
+ * Runtime schema validators for gateway collections (RI-5-001).
+ *
+ * `api<T>()` returns untrusted JSON cast to `T`; these validators are the
+ * seam where a malformed response becomes an explicit schema mismatch
+ * instead of flowing into the render path as if it were healthy data.
+ */
+
+const taskStatuses: readonly TaskStatus[] = [
+  'not-started',
+  'in-progress',
+  'blocked',
+  'done',
+  'cancelled',
+];
+const taskPriorities: readonly TaskPriority[] = ['critical', 'high', 'medium', 'low'];
+const missionStatuses: readonly MissionStatus[] = [
+  'planning',
+  'active',
+  'paused',
+  'completed',
+  'failed',
+];
+const projectStatuses: readonly Project['status'][] = ['active', 'paused', 'completed', 'archived'];
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+function isString(value: unknown): value is string {
+  return typeof value === 'string';
+}
+
+function isNullableString(value: unknown): value is string | null {
+  return value === null || typeof value === 'string';
+}
+
+function isOneOf<T extends string>(value: unknown, allowed: readonly T[]): value is T {
+  return typeof value === 'string' && (allowed as readonly string[]).includes(value);
+}
+
+function isNullableRecord(value: unknown): value is Record<string, unknown> | null {
+  return value === null || isRecord(value);
+}
+
+function isNullableStringArray(value: unknown): value is string[] | null {
+  if (value === null) return true;
+  if (!Array.isArray(value)) return false;
+  return value.every((item) => typeof item === 'string');
+}
+
+function isIsoLike(value: unknown): value is string {
+  return typeof value === 'string' && value.length > 0;
+}
+
+function isTask(value: unknown): value is Task {
+  if (!isRecord(value)) return false;
+  return (
+    isString(value['id']) &&
+    isString(value['title']) &&
+    isOneOf(value['status'], taskStatuses) &&
+    isOneOf(value['priority'], taskPriorities) &&
+    isNullableString(value['projectId']) &&
+    isNullableString(value['missionId']) &&
+    isNullableString(value['assignee']) &&
+    isNullableStringArray(value['tags']) &&
+    isNullableRecord(value['metadata']) &&
+    isNullableString(value['dueDate']) &&
+    isIsoLike(value['createdAt']) &&
+    isIsoLike(value['updatedAt'])
+  );
+}
+
+/** Tasks carry no workspace identity; scope falls back to the policy. */
+export function validateTaskCollection(value: unknown): FreshPayload<Task[]> | null {
+  if (!Array.isArray(value) || !value.every(isTask)) return null;
+  return { data: value as Task[], workspace: null };
+}
+
+function isMission(value: unknown): value is Mission {
+  if (!isRecord(value)) return false;
+  return (
+    isString(value['id']) &&
+    isString(value['name']) &&
+    isOneOf(value['status'], missionStatuses) &&
+    isNullableString(value['projectId']) &&
+    isNullableString(value['description']) &&
+    isNullableRecord(value['metadata']) &&
+    isIsoLike(value['createdAt']) &&
+    isIsoLike(value['updatedAt'])
+  );
+}
+
+/** Missions carry no workspace identity; scope falls back to the policy. */
+export function validateMissionCollection(value: unknown): FreshPayload<Mission[]> | null {
+  if (!Array.isArray(value) || !value.every(isMission)) return null;
+  return { data: value as Mission[], workspace: null };
+}
+
+function isProject(value: unknown): value is Project {
+  if (!isRecord(value)) return false;
+  return (
+    isString(value['id']) &&
+    isString(value['name']) &&
+    isOneOf(value['status'], projectStatuses) &&
+    isString(value['userId']) &&
+    isNullableString(value['description']) &&
+    isNullableRecord(value['metadata']) &&
+    isIsoLike(value['createdAt']) &&
+    isIsoLike(value['updatedAt'])
+  );
+}
+
+/**
+ * Projects are workspace-scoped: every item must carry the same `userId`.
+ * A collection mixing identities (cross-workspace leak) is a schema
+ * mismatch; the uniform `userId` becomes the snapshot workspace.
+ */
+export function validateProjectCollection(value: unknown): FreshPayload<Project[]> | null {
+  if (!Array.isArray(value) || !value.every(isProject)) return null;
+  const projects = value as Project[];
+  const workspaces = new Set(projects.map((project) => project.userId));
+  if (workspaces.size > 1) return null;
+  return { data: projects, workspace: projects.length > 0 ? projects[0]!.userId : null };
+}
+
+/** Single project entity (project detail primary collection). */
+export function validateProjectEntity(value: unknown): FreshPayload<Project> | null {
+  if (!isProject(value)) return null;
+  const project = value as Project;
+  return { data: project, workspace: project.userId };
+}

apps/web/src/spa/pages/project-detail.spec.tsx

@@ -35,6 +35,7 @@ afterEach(async () => {
   document.body.replaceChildren();
   root = null;
   apiMock.mockReset();
+  sessionStorage.clear();
 });
 
 async function renderProjectDetailPage(): Promise<ReturnType<typeof createMemoryRouter>> {
@@ -64,21 +65,49 @@ function clickButtonByText(text: string): void {
   button.dispatchEvent(new MouseEvent('click', { bubbles: true }));
 }
 
+async function flushAct(): Promise<void> {
+  await act(async () => {
+    await Promise.resolve();
+  });
+}
+
+interface Deferred<T> {
+  promise: Promise<T>;
+  resolve: (value: T) => void;
+}
+
+function createDeferred<T>(): Deferred<T> {
+  let resolve!: (value: T) => void;
+  const promise = new Promise<T>((res) => {
+    resolve = res;
+  });
+  return { promise, resolve };
+}
+
+const projectOneTasks = taskFixtures.filter((task) => task.projectId === 'project-1');
+
+function mockHealthyLoad(): void {
+  apiMock
+    .mockResolvedValueOnce(projectFixtures[0])
+    .mockResolvedValueOnce(missionFixtures)
+    .mockResolvedValueOnce(projectOneTasks);
+}
+
 describe('ProjectDetailPage', () => {
   it('loads the project, tasks, missions, and optional PRD content for the active project', async () => {
-    apiMock
-      .mockResolvedValueOnce(projectFixtures[0])
-      .mockResolvedValueOnce(missionFixtures)
-      .mockResolvedValueOnce(taskFixtures.filter((task) => task.projectId === 'project-1'));
+    mockHealthyLoad();
 
     await renderProjectDetailPage();
 
-    expect(apiMock.mock.calls).toEqual([
-      ['/api/projects/project-1'],
-      ['/api/missions'],
-      ['/api/tasks?projectId=project-1'],
+    expect(apiMock.mock.calls.map((call) => call[0])).toEqual([
+      '/api/projects/project-1',
+      '/api/missions',
+      '/api/tasks?projectId=project-1',
     ]);
 
+    expect(container.querySelector('[data-freshness]')?.getAttribute('data-freshness')).toBe(
+      'current',
+    );
     expect(container.textContent).toContain('Mosaic Stack');
     expect(container.textContent).toContain('Route /projects/:id');
     expect(container.textContent).toContain('Tasks');
@@ -101,10 +130,7 @@ describe('ProjectDetailPage', () => {
   });
 
   it('opens and closes the existing read-only task modal from the tasks tab', async () => {
-    apiMock
-      .mockResolvedValueOnce(projectFixtures[0])
-      .mockResolvedValueOnce(missionFixtures)
-      .mockResolvedValueOnce(taskFixtures.filter((task) => task.projectId === 'project-1'));
+    mockHealthyLoad();
 
     await renderProjectDetailPage();
 
@@ -134,35 +160,153 @@ describe('ProjectDetailPage', () => {
     expect(container.querySelector('[role="dialog"]')).toBeNull();
   });
 
-  it('renders the project with an empty missions tab when the missions request fails', async () => {
-    apiMock
-      .mockResolvedValueOnce(projectFixtures[0])
-      .mockRejectedValueOnce(new Error('Missions request failed'))
-      .mockResolvedValueOnce(taskFixtures.filter((task) => task.projectId === 'project-1'));
+  it('shows verified completion verdicts when the task collection is current', async () => {
+    mockHealthyLoad();
 
     await renderProjectDetailPage();
 
-    expect(container.textContent).toContain('Mosaic Stack');
-    expect(container.querySelector('[role="alert"]')).toBeNull();
-
-    await act(async () => {
-      clickButtonByText('Missions (0)');
-    });
-
-    expect(container.textContent).toContain('No missions for this project');
+    const doneCard = [...container.querySelectorAll('div')].find(
+      (candidate) => candidate.textContent === 'Done1',
+    );
+    expect(doneCard).toBeTruthy();
+    const inProgressCard = [...container.querySelectorAll('div')].find(
+      (candidate) => candidate.textContent === 'In Progress1',
+    );
+    expect(inProgressCard).toBeTruthy();
   });
 
-  it('renders a visible alert when the project request fails and lets the user navigate back', async () => {
+  it('renders an explicit unavailable missions tab when the missions request fails (partial, not empty)', async () => {
+    apiMock
+      .mockResolvedValueOnce(projectFixtures[0])
+      .mockRejectedValueOnce(new Error('Missions request failed'))
+      .mockResolvedValueOnce(projectOneTasks);
+
+    await renderProjectDetailPage();
+
+    // Secondary failure degrades the surface to partial; the project itself
+    // still renders.
+    expect(container.querySelector('[data-freshness]')?.getAttribute('data-freshness')).toBe(
+      'partial',
+    );
+    expect(container.textContent).toContain('Mosaic Stack');
+    const partial = container.querySelector('[role="status"]');
+    expect(partial?.textContent).toContain('Missions');
+    expect(partial?.textContent).toContain('unavailable');
+
+    await act(async () => {
+      clickButtonByText('Missions (?)');
+    });
+
+    const alert = container.querySelector('[role="alert"]');
+    expect(alert?.textContent).toContain('Missions request failed');
+    // Negative control: a failed fetch must not look like an empty list.
+    expect(container.textContent).not.toContain('No missions for this project');
+  });
+
+  it('marks derived verdicts unknown when the tasks collection is unavailable', async () => {
+    apiMock
+      .mockResolvedValueOnce(projectFixtures[0])
+      .mockResolvedValueOnce(missionFixtures)
+      .mockRejectedValueOnce(new Error('Tasks request failed'));
+
+    await renderProjectDetailPage();
+
+    expect(container.querySelector('[data-freshness]')?.getAttribute('data-freshness')).toBe(
+      'partial',
+    );
+
+    // Completion verdicts become unknown ('?') — never green counts.
+    for (const label of ['Done', 'In Progress', 'Blocked', 'Tasks']) {
+      const unknownCard = [...container.querySelectorAll('div')].find(
+        (candidate) => candidate.textContent === `${label}?`,
+      );
+      expect(unknownCard, `expected ${label} card to render ?`).toBeTruthy();
+    }
+    // Negative control: no green "Done 1" verdict anywhere.
+    expect(
+      [...container.querySelectorAll('div')].some((candidate) => candidate.textContent === 'Done1'),
+    ).toBe(false);
+
+    await act(async () => {
+      clickButtonByText('Tasks (?)');
+    });
+
+    const alert = container.querySelector('[role="alert"]');
+    expect(alert?.textContent).toContain('Tasks request failed');
+    // Negative control: no healthy empty task list from a failed fetch.
+    expect(container.textContent).not.toContain('No tasks found');
+    expect(container.querySelector('table')).toBeNull();
+  });
+
+  it('recovers a partial surface to current after revalidation', async () => {
+    apiMock
+      .mockResolvedValueOnce(projectFixtures[0])
+      .mockResolvedValueOnce(missionFixtures)
+      .mockRejectedValueOnce(new Error('Tasks request failed'))
+      .mockResolvedValueOnce(projectFixtures[0])
+      .mockResolvedValueOnce(missionFixtures)
+      .mockResolvedValueOnce(projectOneTasks);
+
+    await renderProjectDetailPage();
+    expect(container.querySelector('[data-freshness]')?.getAttribute('data-freshness')).toBe(
+      'partial',
+    );
+
+    await act(async () => {
+      clickButtonByText('Revalidate');
+    });
+    await flushAct();
+
+    expect(container.querySelector('[data-freshness]')?.getAttribute('data-freshness')).toBe(
+      'current',
+    );
+    expect(
+      [...container.querySelectorAll('div')].some((candidate) => candidate.textContent === 'Done1'),
+    ).toBe(true);
+  });
+
+  it("never shows one project's data on another project's route after navigation", async () => {
+    mockHealthyLoad();
+
+    const router = await renderProjectDetailPage();
+    expect(container.textContent).toContain('Mosaic Stack');
+
+    const deferred = createDeferred<(typeof projectFixtures)[number]>();
+    apiMock
+      .mockResolvedValueOnce(deferred.promise)
+      .mockResolvedValueOnce([])
+      .mockResolvedValueOnce([]);
+
+    await act(async () => {
+      await router.navigate('/projects/project-2');
+    });
+
+    // While project-2 loads, nothing from project-1 may render on its route.
+    expect(container.textContent).toContain('Loading project...');
+    expect(container.textContent).not.toContain('Mosaic Stack');
+    expect(container.textContent).not.toContain('Route /projects/:id');
+
+    await act(async () => {
+      deferred.resolve(projectFixtures[1]!);
+      await deferred.promise;
+    });
+
+    expect(container.textContent).toContain('Agent Runtime');
+    expect(apiMock.mock.calls[3]?.[0]).toBe('/api/projects/project-2');
+  });
+
+  it('renders a visible unavailable state when the project request fails and lets the user navigate back', async () => {
     apiMock
       .mockRejectedValueOnce(new Error('Project request failed'))
       .mockResolvedValueOnce(missionFixtures)
-      .mockResolvedValueOnce(taskFixtures.filter((task) => task.projectId === 'project-1'));
+      .mockResolvedValueOnce(projectOneTasks);
 
     const router = await renderProjectDetailPage();
 
     const alert = container.querySelector('[role="alert"]');
     expect(alert).toBeTruthy();
     expect(alert?.textContent).toContain('Project request failed');
+    expect(alert?.textContent).toContain('not an empty result');
     expect(container.textContent).not.toContain('Mosaic Stack');
 
     await act(async () => {

apps/web/src/spa/pages/project-detail.tsx

@@ -1,14 +1,30 @@
-import { useEffect, useState, type ReactElement } from 'react';
+import { useState, type ReactElement } from 'react';
 import { useNavigate, useParams } from 'react-router-dom';
 import { MissionTimeline } from '@/components/projects/mission-timeline';
 import { PrdViewer } from '@/components/projects/prd-viewer';
 import { TaskDetailModal } from '@/components/tasks/task-detail-modal';
 import { TaskListView } from '@/components/tasks/task-list-view';
 import { TaskStatusSummary } from '@/components/tasks/task-status-summary';
+import {
+  PartialDataNotice,
+  StaleDataNotice,
+  UnavailableDataNotice,
+} from '@/components/freshness/freshness-notices';
 import { api } from '@/lib/api';
 import { cn } from '@/lib/cn';
 import type { Mission, Project, Task, TaskStatus } from '@/lib/types';
-import { getErrorMessage } from './page-errors';
+import {
+  combineFreshness,
+  UNKNOWN_VERDICT,
+  verdictValue,
+  type FreshSnapshot,
+} from '@/lib/freshness/model';
+import { describeFailure, useFreshCollection } from '@/lib/freshness/use-fresh-collection';
+import {
+  validateMissionCollection,
+  validateProjectEntity,
+  validateTaskCollection,
+} from '@/lib/freshness/validators';
 
 type Tab = 'overview' | 'tasks' | 'missions' | 'prd';
 
@@ -51,73 +67,62 @@ function TabButton({ id, label, activeTab, onClick }: TabButtonProps): ReactElem
   );
 }
 
+/** Remounts per project id so no state from one project renders for another. */
 export function ProjectDetailPage(): ReactElement {
   const { id = '' } = useParams();
+  return <ProjectDetail id={id} key={id} />;
+}
+
+function ProjectDetail({ id }: { id: string }): ReactElement {
   const navigate = useNavigate();
-  const [project, setProject] = useState<Project | null>(null);
-  const [missions, setMissions] = useState<Mission[]>([]);
-  const [tasks, setTasks] = useState<Task[]>([]);
-  const [loading, setLoading] = useState(true);
-  const [error, setError] = useState<string | null>(null);
+  const enabled = id.length > 0;
+
+  // Primary collection gates the surface; missions and tasks are secondaries
+  // whose failures degrade the surface to `partial` instead of rendering
+  // empty healthy lists.
+  const project = useFreshCollection<Project>({
+    source: `gateway:/api/projects/${id}`,
+    fetcher: (signal) => api<unknown>(`/api/projects/${id}`, { signal }),
+    validate: validateProjectEntity,
+    // No last-known restore: the entity carries workspace identity that
+    // cannot be scope-checked before display (see ProjectsPage note).
+    enabled,
+  });
+  const missions = useFreshCollection<Mission[]>({
+    source: 'gateway:/api/missions',
+    fetcher: (signal) => api<unknown>('/api/missions', { signal }),
+    validate: validateMissionCollection,
+    cacheKey: enabled ? 'missions' : null,
+    enabled,
+  });
+  const tasks = useFreshCollection<Task[]>({
+    source: `gateway:/api/tasks?projectId=${id}`,
+    fetcher: (signal) => api<unknown>(`/api/tasks?projectId=${id}`, { signal }),
+    validate: validateTaskCollection,
+    cacheKey: enabled ? `project-tasks:${id}` : null,
+    enabled,
+  });
+
   const [activeTab, setActiveTab] = useState<Tab>('overview');
   const [taskFilter, setTaskFilter] = useState<TaskStatus | 'all'>('all');
   const [selectedTask, setSelectedTask] = useState<Task | null>(null);
 
-  useEffect(() => {
-    if (!id) {
-      setError('Project id is missing.');
-      setLoading(false);
-      return;
-    }
+  const surface = combineFreshness(project.freshness, [missions.freshness, tasks.freshness]);
+  const tasksVerified = tasks.freshness === 'current';
+  const projectMissions = missions.data?.filter((mission) => mission.projectId === id) ?? null;
 
-    let cancelled = false;
-    setLoading(true);
-    setError(null);
+  const retryAll = (): void => {
+    void Promise.all([project.revalidate(), missions.revalidate(), tasks.revalidate()]);
+  };
 
-    void Promise.all([
-      api<Project>('/api/projects/' + id),
-      api<Mission[]>('/api/missions').catch(() => [] as Mission[]),
-      api<Task[]>('/api/tasks?projectId=' + id).catch(() => [] as Task[]),
-    ])
-      .then(([loadedProject, allMissions, loadedTasks]) => {
-        if (cancelled) return;
-        setProject(loadedProject);
-        setMissions(allMissions.filter((mission) => mission.projectId === id));
-        setTasks(loadedTasks);
-      })
-      .catch((caught: unknown) => {
-        if (cancelled) return;
-        setError(getErrorMessage(caught, 'Failed to load project.'));
-      })
-      .finally(() => {
-        if (cancelled) return;
-        setLoading(false);
-      });
-
-    return () => {
-      cancelled = true;
-    };
-  }, [id]);
-
-  if (loading) {
-    return (
-      <div className="flex min-h-screen flex-col px-4 py-6 sm:px-6">
-        <header className="mb-6 border-b px-1 pb-3">
-          <h1 className="text-2xl font-semibold">Project</h1>
-        </header>
-        <p className="py-16 text-center text-sm text-text-muted">Loading project...</p>
-      </div>
-    );
-  }
-
-  if (error || !project) {
+  if (!enabled) {
     return (
       <div className="flex min-h-screen flex-col px-4 py-6 sm:px-6">
         <header className="mb-6 border-b px-1 pb-3">
           <h1 className="text-2xl font-semibold">Project</h1>
         </header>
         <div role="alert" className="rounded-lg border border-error/40 px-4 py-3 text-sm">
-          {error ?? 'Project not found.'}
+          Project id is missing.
         </div>
         <button
           type="button"
@@ -130,18 +135,81 @@ export function ProjectDetailPage(): ReactElement {
     );
   }
 
+  if (project.freshness === 'unknown') {
+    return (
+      <div className="flex min-h-screen flex-col px-4 py-6 sm:px-6">
+        <header className="mb-6 border-b px-1 pb-3">
+          <h1 className="text-2xl font-semibold">Project</h1>
+        </header>
+        <p className="py-16 text-center text-sm text-text-muted">Loading project...</p>
+      </div>
+    );
+  }
+
+  if (project.freshness === 'unavailable' || project.data === null) {
+    return (
+      <div className="flex min-h-screen flex-col px-4 py-6 sm:px-6">
+        <header className="mb-6 border-b px-1 pb-3">
+          <h1 className="text-2xl font-semibold">Project</h1>
+        </header>
+        <UnavailableDataNotice
+          title="This project"
+          detail={describeFailure(project.failure)}
+          onRetry={retryAll}
+        />
+        <button
+          type="button"
+          onClick={() => navigate('/projects')}
+          className="mt-4 w-fit text-sm underline"
+        >
+          Back to projects
+        </button>
+      </div>
+    );
+  }
+
+  const projectTasks = tasks.data ?? null;
   const filteredTasks =
-    taskFilter === 'all' ? tasks : tasks.filter((task) => task.status === taskFilter);
-  const prdContent = getPrdContent(project);
+    projectTasks === null
+      ? []
+      : taskFilter === 'all'
+        ? projectTasks
+        : projectTasks.filter((task) => task.status === taskFilter);
+
+  // Derived completion verdicts: unknown (never green) unless the task
+  // collection is verified current.
+  const doneCount = projectTasks?.filter((task) => task.status === 'done').length ?? 0;
+  const inProgressCount = projectTasks?.filter((task) => task.status === 'in-progress').length ?? 0;
+  const blockedCount = projectTasks?.filter((task) => task.status === 'blocked').length ?? 0;
+
+  const prdContent = getPrdContent(project.data);
   const tabs: Array<{ id: Tab; label: string }> = [
     { id: 'overview', label: 'Overview' },
-    { id: 'tasks', label: `Tasks (${tasks.length})` },
-    { id: 'missions', label: `Missions (${missions.length})` },
+    {
+      id: 'tasks',
+      label: `Tasks (${projectTasks === null ? UNKNOWN_VERDICT : projectTasks.length})`,
+    },
+    {
+      id: 'missions',
+      label: `Missions (${projectMissions === null ? UNKNOWN_VERDICT : projectMissions.length})`,
+    },
     ...(prdContent ? [{ id: 'prd' as const, label: 'PRD' }] : []),
   ];
 
+  const staleSnapshot: FreshSnapshot<unknown> | null =
+    project.freshness === 'stale'
+      ? project.snapshot
+      : missions.freshness === 'stale'
+        ? missions.snapshot
+        : tasks.freshness === 'stale'
+          ? tasks.snapshot
+          : null;
+  const missingSections: string[] = [];
+  if (missions.freshness === 'unavailable') missingSections.push('Missions');
+  if (tasks.freshness === 'unavailable') missingSections.push('Tasks');
+
   return (
-    <div className="flex min-h-screen flex-col px-4 py-6 sm:px-6">
+    <div data-freshness={surface} className="flex min-h-screen flex-col px-4 py-6 sm:px-6">
       <header className="mb-6 border-b px-1 pb-3">
         <nav className="mb-4 flex items-center gap-2 text-sm text-text-muted">
           <button
@@ -152,49 +220,64 @@ export function ProjectDetailPage(): ReactElement {
             Projects
           </button>
           <span>/</span>
-          <span className="text-text-primary">{project.name}</span>
+          <span className="text-text-primary">{project.data.name}</span>
         </nav>
 
         <div className="flex items-start justify-between gap-4">
           <div>
             <div className="flex items-center gap-3">
-              <h1 className="text-2xl font-semibold text-text-primary">{project.name}</h1>
+              <h1 className="text-2xl font-semibold text-text-primary">{project.data.name}</h1>
               <span
                 className={cn(
                   'rounded-full px-2 py-0.5 text-xs',
-                  projectStatusColors[project.status] ?? 'bg-gray-600/20 text-gray-400',
+                  projectStatusColors[project.data.status] ?? 'bg-gray-600/20 text-gray-400',
                 )}
               >
-                {project.status}
+                {project.data.status}
               </span>
             </div>
-            {project.description ? (
-              <p className="mt-1 text-sm text-text-muted">{project.description}</p>
+            {project.data.description ? (
+              <p className="mt-1 text-sm text-text-muted">{project.data.description}</p>
             ) : null}
             <p className="mt-2 text-xs text-text-muted">
-              Created {new Date(project.createdAt).toLocaleDateString()} · Updated{' '}
-              {new Date(project.updatedAt).toLocaleDateString()}
+              Created {new Date(project.data.createdAt).toLocaleDateString()} · Updated{' '}
+              {new Date(project.data.updatedAt).toLocaleDateString()}
             </p>
           </div>
         </div>
       </header>
 
+      {staleSnapshot !== null ? (
+        <div className="mb-6">
+          <StaleDataNotice label={staleSnapshot} onRetry={retryAll} />
+        </div>
+      ) : null}
+
+      {missingSections.length > 0 ? (
+        <div className="mb-6">
+          <PartialDataNotice missing={missingSections} onRetry={retryAll} />
+        </div>
+      ) : null}
+
       <div className="mb-6 grid grid-cols-2 gap-3 sm:grid-cols-4">
-        <StatCard label="Tasks" value={String(tasks.length)} />
+        <StatCard
+          label="Tasks"
+          value={projectTasks === null ? UNKNOWN_VERDICT : String(projectTasks.length)}
+        />
         <StatCard
           label="Done"
-          value={String(tasks.filter((task) => task.status === 'done').length)}
-          valueClass="text-success"
+          value={verdictValue(tasksVerified, String(doneCount))}
+          valueClass={tasksVerified ? 'text-success' : undefined}
         />
         <StatCard
           label="In Progress"
-          value={String(tasks.filter((task) => task.status === 'in-progress').length)}
-          valueClass="text-blue-400"
+          value={verdictValue(tasksVerified, String(inProgressCount))}
+          valueClass={tasksVerified ? 'text-blue-400' : undefined}
         />
         <StatCard
           label="Blocked"
-          value={String(tasks.filter((task) => task.status === 'blocked').length)}
-          valueClass={tasks.some((task) => task.status === 'blocked') ? 'text-error' : undefined}
+          value={verdictValue(tasksVerified, String(blockedCount))}
+          valueClass={tasksVerified && blockedCount > 0 ? 'text-error' : undefined}
         />
       </div>
 
@@ -211,23 +294,43 @@ export function ProjectDetailPage(): ReactElement {
       </div>
 
       {activeTab === 'overview' ? (
-        <OverviewTab project={project} missions={missions} tasks={tasks} />
+        <OverviewTab project={project.data} missions={projectMissions} tasks={projectTasks} />
       ) : null}
 
       {activeTab === 'tasks' ? (
         <div>
-          <div className="mb-4">
-            <TaskStatusSummary
-              tasks={tasks}
-              activeFilter={taskFilter}
-              onFilterChange={setTaskFilter}
+          {projectTasks === null ? (
+            <UnavailableDataNotice
+              title="Tasks"
+              detail={describeFailure(tasks.failure)}
+              onRetry={retryAll}
             />
-          </div>
-          <TaskListView tasks={filteredTasks} onTaskClick={setSelectedTask} />
+          ) : (
+            <>
+              <div className="mb-4">
+                <TaskStatusSummary
+                  tasks={projectTasks}
+                  activeFilter={taskFilter}
+                  onFilterChange={setTaskFilter}
+                />
+              </div>
+              <TaskListView tasks={filteredTasks} onTaskClick={setSelectedTask} />
+            </>
+          )}
         </div>
       ) : null}
 
-      {activeTab === 'missions' ? <MissionTimeline missions={missions} /> : null}
+      {activeTab === 'missions' ? (
+        projectMissions === null ? (
+          <UnavailableDataNotice
+            title="Missions"
+            detail={describeFailure(missions.failure)}
+            onRetry={retryAll}
+          />
+        ) : (
+          <MissionTimeline missions={projectMissions} />
+        )
+      ) : null}
 
       {activeTab === 'prd' && prdContent ? (
         <div className="rounded-lg border border-surface-border bg-surface-card p-6">
@@ -248,18 +351,26 @@ function OverviewTab({
   tasks,
 }: {
   project: Project;
-  missions: Mission[];
-  tasks: Task[];
+  missions: Mission[] | null;
+  tasks: Task[] | null;
 }): ReactElement {
-  const recentTasks = [...tasks]
-    .sort((left, right) => new Date(right.updatedAt).getTime() - new Date(left.updatedAt).getTime())
-    .slice(0, 5);
+  const recentTasks =
+    tasks === null
+      ? null
+      : [...tasks]
+          .sort(
+            (left, right) =>
+              new Date(right.updatedAt).getTime() - new Date(left.updatedAt).getTime(),
+          )
+          .slice(0, 5);
 
   return (
     <div className="grid gap-6 lg:grid-cols-2">
       <section>
         <h2 className="mb-3 text-sm font-semibold text-text-secondary">Recent Tasks</h2>
-        {recentTasks.length === 0 ? (
+        {recentTasks === null ? (
+          <UnavailableDataNotice title="Tasks" />
+        ) : recentTasks.length === 0 ? (
           <div className="rounded-lg border border-surface-border bg-surface-card p-4 text-center">
             <p className="text-sm text-text-muted">No tasks yet</p>
           </div>
@@ -287,7 +398,9 @@ function OverviewTab({
 
       <section>
         <h2 className="mb-3 text-sm font-semibold text-text-secondary">Missions</h2>
-        {missions.length === 0 ? (
+        {missions === null ? (
+          <UnavailableDataNotice title="Missions" />
+        ) : missions.length === 0 ? (
           <div className="rounded-lg border border-surface-border bg-surface-card p-4 text-center">
             <p className="text-sm text-text-muted">No missions yet</p>
           </div>

apps/web/src/spa/pages/projects.spec.tsx

@@ -51,6 +51,7 @@ afterEach(async () => {
   document.body.replaceChildren();
   root = null;
   apiMock.mockReset();
+  sessionStorage.clear();
 });
 
 async function renderProjectsPage(): Promise<ReturnType<typeof createMemoryRouter>> {
@@ -71,6 +72,22 @@ async function renderProjectsPage(): Promise<ReturnType<typeof createMemoryRoute
   return router;
 }
 
+function clickButtonByText(text: string): void {
+  const button = [...container.querySelectorAll('button')].find((candidate) =>
+    candidate.textContent?.includes(text),
+  );
+  if (!button) {
+    throw new Error(`Button containing "${text}" not found`);
+  }
+  button.dispatchEvent(new MouseEvent('click', { bubbles: true }));
+}
+
+async function flushAct(): Promise<void> {
+  await act(async () => {
+    await Promise.resolve();
+  });
+}
+
 describe('ProjectsPage', () => {
   it('shows a visible loading state while the project request is in flight', async () => {
     const deferred = createDeferred<typeof projectFixtures>();
@@ -91,7 +108,7 @@ describe('ProjectsPage', () => {
 
     const router = await renderProjectsPage();
 
-    expect(apiMock).toHaveBeenCalledWith('/api/projects');
+    expect(apiMock.mock.calls[0]?.[0]).toBe('/api/projects');
     expect(container.textContent).toContain('Mosaic Stack');
     expect(container.textContent).toContain('Agent Runtime');
 
@@ -108,7 +125,7 @@ describe('ProjectsPage', () => {
     expect(container.textContent).toContain('Project detail target');
   });
 
-  it('renders the empty state when the API returns no projects', async () => {
+  it('renders the empty state only for a verified empty collection', async () => {
     apiMock.mockResolvedValueOnce([]);
 
     await renderProjectsPage();
@@ -117,9 +134,12 @@ describe('ProjectsPage', () => {
     expect(container.textContent).toContain(
       'Projects will appear here when created via the gateway API',
     );
+    expect(container.querySelector('[data-freshness]')?.getAttribute('data-freshness')).toBe(
+      'current',
+    );
   });
 
-  it('renders a visible alert when the projects request fails', async () => {
+  it('renders a failed fetch as an explicit unavailable state, never an empty collection', async () => {
     apiMock.mockRejectedValueOnce(new Error('Projects are unavailable'));
 
     await renderProjectsPage();
@@ -127,5 +147,51 @@ describe('ProjectsPage', () => {
     const alert = container.querySelector('[role="alert"]');
     expect(alert).toBeTruthy();
     expect(alert?.textContent).toContain('Projects are unavailable');
+    expect(alert?.textContent).toContain('not an empty result');
+
+    // Negative controls: no healthy empty state and no project cards render
+    // from a failed fetch.
+    expect(container.textContent).not.toContain('No projects yet');
+    expect(container.textContent).not.toContain('Mosaic Stack');
+    expect(container.querySelector('[data-freshness]')?.getAttribute('data-freshness')).toBe(
+      'unavailable',
+    );
+  });
+
+  it('renders an auth failure as unavailable and recovers after retry', async () => {
+    apiMock
+      .mockRejectedValueOnce(Object.assign(new Error('Unauthorized'), { statusCode: 401 }))
+      .mockResolvedValueOnce(projectFixtures);
+
+    await renderProjectsPage();
+
+    const alert = container.querySelector('[role="alert"]');
+    expect(alert?.textContent).toContain('Unauthorized');
+    expect(container.textContent).not.toContain('No projects yet');
+
+    await act(async () => {
+      clickButtonByText('Retry');
+    });
+    await flushAct();
+
+    expect(container.querySelector('[role="alert"]')).toBeNull();
+    expect(container.textContent).toContain('Mosaic Stack');
+    expect(container.querySelector('[data-freshness]')?.getAttribute('data-freshness')).toBe(
+      'current',
+    );
+  });
+
+  it('renders a schema-mismatched response as unavailable, never as data', async () => {
+    apiMock.mockResolvedValueOnce({ results: projectFixtures });
+
+    await renderProjectsPage();
+
+    const alert = container.querySelector('[role="alert"]');
+    expect(alert?.textContent).toContain('not an empty result');
+    expect(container.textContent).not.toContain('Mosaic Stack');
+    expect(container.textContent).not.toContain('No projects yet');
+    expect(container.querySelector('[data-freshness]')?.getAttribute('data-freshness')).toBe(
+      'unavailable',
+    );
   });
 });

apps/web/src/spa/pages/projects.tsx

@@ -1,53 +1,51 @@
-import { useEffect, useState, type ReactElement } from 'react';
+import { type ReactElement } from 'react';
 import { useNavigate } from 'react-router-dom';
 import { ProjectCard } from '@/components/projects/project-card';
+import { StaleDataNotice, UnavailableDataNotice } from '@/components/freshness/freshness-notices';
 import { api } from '@/lib/api';
 import type { Project } from '@/lib/types';
-import { getErrorMessage } from './page-errors';
+import { useFreshCollection, describeFailure } from '@/lib/freshness/use-fresh-collection';
+import { validateProjectCollection } from '@/lib/freshness/validators';
 
 export function ProjectsPage(): ReactElement {
   const navigate = useNavigate();
-  const [projects, setProjects] = useState<Project[]>([]);
-  const [loading, setLoading] = useState(true);
-  const [error, setError] = useState<string | null>(null);
-
-  useEffect(() => {
-    let cancelled = false;
-
-    void api<Project[]>('/api/projects')
-      .then((response) => {
-        if (cancelled) return;
-        setProjects(response);
-      })
-      .catch((caught: unknown) => {
-        if (cancelled) return;
-        setError(getErrorMessage(caught, 'Failed to load projects.'));
-      })
-      .finally(() => {
-        if (cancelled) return;
-        setLoading(false);
-      });
-
-    return () => {
-      cancelled = true;
-    };
-  }, []);
+  const projects = useFreshCollection<Project[]>({
+    source: 'gateway:/api/projects',
+    fetcher: (signal) => api<unknown>('/api/projects', { signal }),
+    validate: validateProjectCollection,
+    // Projects carry workspace identity (userId) that is only knowable from
+    // the payload itself, so a restored entry cannot be scope-checked before
+    // display. Conservative choice: no last-known restore for this surface;
+    // cross-workspace switching is still invalidated at verification time.
+  });
+  const retry = (): void => {
+    void projects.revalidate();
+  };
 
   return (
-    <div className="flex min-h-screen flex-col px-4 py-6 sm:px-6">
+    <div
+      data-freshness={projects.freshness}
+      className="flex min-h-screen flex-col px-4 py-6 sm:px-6"
+    >
       <header className="mb-6 border-b px-1 pb-3">
         <h1 className="text-2xl font-semibold">Projects</h1>
       </header>
 
-      {error ? (
-        <div role="alert" className="mb-6 rounded-lg border border-error/40 px-4 py-3 text-sm">
-          {error}
+      {projects.freshness === 'stale' && projects.snapshot ? (
+        <div className="mb-6">
+          <StaleDataNotice label={projects.snapshot} onRetry={retry} />
         </div>
       ) : null}
 
-      {loading ? (
+      {projects.freshness === 'unknown' ? (
         <p className="py-8 text-center text-sm text-text-muted">Loading projects...</p>
-      ) : projects.length === 0 ? (
+      ) : projects.freshness === 'unavailable' ? (
+        <UnavailableDataNotice
+          title="Projects"
+          detail={describeFailure(projects.failure)}
+          onRetry={retry}
+        />
+      ) : projects.data !== null && projects.data.length === 0 ? (
         <div className="py-12 text-center">
           <h2 className="text-lg font-medium text-text-secondary">No projects yet</h2>
           <p className="mt-1 text-sm text-text-muted">
@@ -56,7 +54,7 @@ export function ProjectsPage(): ReactElement {
         </div>
       ) : (
         <div className="grid gap-4 sm:grid-cols-2 lg:grid-cols-3">
-          {projects.map((project) => (
+          {(projects.data ?? []).map((project) => (
             <ProjectCard
               key={project.id}
               project={project}

apps/web/src/spa/pages/tasks.spec.tsx

@@ -3,6 +3,9 @@ import { createRoot, type Root } from 'react-dom/client';
 import { createMemoryRouter, RouterProvider, type RouteObject } from 'react-router-dom';
 import { afterAll, afterEach, beforeAll, describe, expect, it, vi } from 'vitest';
 import { taskFixtures } from './page-fixtures';
+import { acceptSnapshot, DEFAULT_FRESHNESS_POLICY } from '@/lib/freshness/model';
+import { writeSnapshotCache } from '@/lib/freshness/snapshot-cache';
+import { validateTaskCollection } from '@/lib/freshness/validators';
 
 const { apiMock } = vi.hoisted(() => ({
   apiMock: vi.fn(),
@@ -48,6 +51,7 @@ afterEach(async () => {
   document.body.replaceChildren();
   root = null;
   apiMock.mockReset();
+  sessionStorage.clear();
 });
 
 async function renderTasksPage(): Promise<void> {
@@ -72,6 +76,13 @@ function clickButtonByText(text: string): void {
   button.dispatchEvent(new MouseEvent('click', { bubbles: true }));
 }
 
+/** Flush pending promise callbacks inside the act environment. */
+async function flushAct(): Promise<void> {
+  await act(async () => {
+    await Promise.resolve();
+  });
+}
+
 describe('TasksPage', () => {
   it('shows a visible loading state before the tasks request settles', async () => {
     const deferred = createDeferred<typeof taskFixtures>();
@@ -132,7 +143,7 @@ describe('TasksPage', () => {
     expect(container.textContent).toContain('Wire list and kanban modal interactions');
   });
 
-  it('renders a visible alert when the tasks request fails', async () => {
+  it('renders a failed fetch as an explicit unavailable state, never an empty healthy board', async () => {
     apiMock.mockRejectedValueOnce(new Error('Tasks request failed'));
 
     await renderTasksPage();
@@ -140,5 +151,80 @@ describe('TasksPage', () => {
     const alert = container.querySelector('[role="alert"]');
     expect(alert).toBeTruthy();
     expect(alert?.textContent).toContain('Tasks request failed');
+    expect(alert?.textContent).toContain('not an empty result');
+
+    // Negative controls: no board, no healthy empty-state markers, and the
+    // surface is marked unavailable rather than current.
+    expect(container.textContent).not.toContain('Not Started');
+    expect(container.textContent).not.toContain('No tasks');
+    expect(container.querySelector('[data-freshness]')?.getAttribute('data-freshness')).toBe(
+      'unavailable',
+    );
+  });
+
+  it('recovers to a current board after retrying a failed fetch', async () => {
+    apiMock
+      .mockRejectedValueOnce(new Error('Tasks request failed'))
+      .mockResolvedValueOnce(taskFixtures);
+
+    await renderTasksPage();
+    expect(container.querySelector('[role="alert"]')).toBeTruthy();
+
+    await act(async () => {
+      clickButtonByText('Retry');
+    });
+    await flushAct();
+
+    expect(container.querySelector('[role="alert"]')).toBeNull();
+    expect(container.textContent).toContain('Not Started');
+    expect(container.querySelector('[data-freshness]')?.getAttribute('data-freshness')).toBe(
+      'current',
+    );
+  });
+
+  it('labels restored last-known data as stale with source, version, and age until verified', async () => {
+    // Seed a last-known snapshot fetched five minutes ago; the page must
+    // render it only under an explicit staleness label while the fetch is
+    // still in flight.
+    const restored = acceptSnapshot({
+      value: taskFixtures,
+      validate: validateTaskCollection,
+      previous: null,
+      policy: DEFAULT_FRESHNESS_POLICY,
+      source: 'gateway:/api/tasks',
+      now: Date.now() - 5 * 60_000,
+    });
+    if (restored.outcome !== 'accepted') throw new Error('fixture setup failed');
+    writeSnapshotCache('tasks', restored.snapshot);
+
+    const deferred = createDeferred<typeof taskFixtures>();
+    apiMock.mockReturnValueOnce(deferred.promise);
+
+    await renderTasksPage();
+
+    expect(container.querySelector('[data-freshness]')?.getAttribute('data-freshness')).toBe(
+      'stale',
+    );
+    const banner = container.querySelector('[role="status"]');
+    expect(banner?.textContent).toContain('last-known');
+    expect(banner?.textContent).toContain('may be out of date');
+    expect(banner?.textContent).toContain('gateway:/api/tasks');
+    expect(banner?.textContent).toContain('snapshot v1');
+    expect(banner?.textContent).toContain('5m ago');
+
+    // Last-known data still renders as situational awareness under the label.
+    expect(container.textContent).toContain('Route /tasks');
+    expect(container.textContent).not.toContain('Loading tasks...');
+
+    // Verification lands: the banner clears and the surface becomes current.
+    await act(async () => {
+      deferred.resolve(taskFixtures);
+      await deferred.promise;
+    });
+
+    expect(container.querySelector('[role="status"]')).toBeNull();
+    expect(container.querySelector('[data-freshness]')?.getAttribute('data-freshness')).toBe(
+      'current',
+    );
   });
 });

apps/web/src/spa/pages/tasks.tsx

@@ -1,45 +1,32 @@
-import { useEffect, useState, type ReactElement } from 'react';
+import { useState, type ReactElement } from 'react';
 import { KanbanBoard } from '@/components/tasks/kanban-board';
 import { TaskDetailModal } from '@/components/tasks/task-detail-modal';
 import { TaskListView } from '@/components/tasks/task-list-view';
+import { StaleDataNotice, UnavailableDataNotice } from '@/components/freshness/freshness-notices';
 import { api } from '@/lib/api';
 import { cn } from '@/lib/cn';
 import type { Task } from '@/lib/types';
-import { getErrorMessage } from './page-errors';
+import { useFreshCollection, describeFailure } from '@/lib/freshness/use-fresh-collection';
+import { validateTaskCollection } from '@/lib/freshness/validators';
 
 type ViewMode = 'list' | 'kanban';
 
 export function TasksPage(): ReactElement {
-  const [tasks, setTasks] = useState<Task[]>([]);
+  const tasks = useFreshCollection<Task[]>({
+    source: 'gateway:/api/tasks',
+    fetcher: (signal) => api<unknown>('/api/tasks', { signal }),
+    validate: validateTaskCollection,
+    cacheKey: 'tasks',
+  });
   const [view, setView] = useState<ViewMode>('kanban');
-  const [loading, setLoading] = useState(true);
-  const [error, setError] = useState<string | null>(null);
   const [selectedTask, setSelectedTask] = useState<Task | null>(null);
 
-  useEffect(() => {
-    let cancelled = false;
-
-    void api<Task[]>('/api/tasks')
-      .then((response) => {
-        if (cancelled) return;
-        setTasks(response);
-      })
-      .catch((caught: unknown) => {
-        if (cancelled) return;
-        setError(getErrorMessage(caught, 'Failed to load tasks.'));
-      })
-      .finally(() => {
-        if (cancelled) return;
-        setLoading(false);
-      });
-
-    return () => {
-      cancelled = true;
-    };
-  }, []);
+  const retry = (): void => {
+    void tasks.revalidate();
+  };
 
   return (
-    <div className="flex min-h-screen flex-col px-4 py-6 sm:px-6">
+    <div data-freshness={tasks.freshness} className="flex min-h-screen flex-col px-4 py-6 sm:px-6">
       <header className="mb-6 flex items-center justify-between gap-4 border-b px-1 pb-3">
         <h1 className="text-2xl font-semibold">Tasks</h1>
         <div className="flex rounded-lg border border-surface-border">
@@ -70,18 +57,24 @@ export function TasksPage(): ReactElement {
         </div>
       </header>
 
-      {error ? (
-        <div role="alert" className="mb-6 rounded-lg border border-error/40 px-4 py-3 text-sm">
-          {error}
+      {tasks.freshness === 'stale' && tasks.snapshot ? (
+        <div className="mb-6">
+          <StaleDataNotice label={tasks.snapshot} onRetry={retry} />
         </div>
       ) : null}
 
-      {loading ? (
+      {tasks.freshness === 'unknown' ? (
         <p className="py-8 text-center text-sm text-text-muted">Loading tasks...</p>
+      ) : tasks.freshness === 'unavailable' ? (
+        <UnavailableDataNotice
+          title="Tasks"
+          detail={describeFailure(tasks.failure)}
+          onRetry={retry}
+        />
       ) : view === 'kanban' ? (
-        <KanbanBoard tasks={tasks} onTaskClick={setSelectedTask} />
+        <KanbanBoard tasks={tasks.data ?? []} onTaskClick={setSelectedTask} />
       ) : (
-        <TaskListView tasks={tasks} onTaskClick={setSelectedTask} />
+        <TaskListView tasks={tasks.data ?? []} onTaskClick={setSelectedTask} />
       )}
 
       {selectedTask ? (

docs/ADMIN-GUIDE/README.md

@@ -9,19 +9,19 @@ This book is the canonical home for installation, configuration, deployment, rou
 - [Documentation atlas](../README.md) — placement rules and source-of-truth boundaries.
 - [Documentation sitemap](../SITEMAP.md) — resolvable current navigation and authority-gated migration summary.
 - [Product requirements](../PRD.md) — normative requirements, currently marked draft.
-- [Operations index](operations/README.md) — current local procedures, unattended fleet first-start handling, and explicitly held operational outlines.
+- [Operations index](operations/README.md) — current local procedures and explicitly held operational outlines.
 - [Security index](security/README.md) — current SSO provider configuration.
 
 ## Chapter map
 
-| Chapter                               | Scope                                                               | Status                                                                                         |
-| ------------------------------------- | ------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
-| `installation/`                       | Prerequisites, installation, and first deployment.                  | Scaffold only.                                                                                 |
-| `configuration/`                      | Environment, provider, tier, and runtime configuration.             | Scaffold only.                                                                                 |
-| `deployment/`                         | Topologies, rollout, migration, and upgrade procedures.             | Scaffold only.                                                                                 |
-| [`operations/`](operations/README.md) | Health, observability, routine operation, and maintenance.          | Local upgrade/recovery and fleet first start are current; connector lease operations are held. |
-| [`security/`](security/README.md)     | Authentication, authorization, SSO, secrets, and security controls. | SSO provider guide is current; other pages are planned.                                        |
-| `recovery/`                           | Incident response, backup, rollback, and recovery.                  | Scaffold only.                                                                                 |
+| Chapter                               | Scope                                                               | Status                                                                  |
+| ------------------------------------- | ------------------------------------------------------------------- | ----------------------------------------------------------------------- |
+| `installation/`                       | Prerequisites, installation, and first deployment.                  | Scaffold only.                                                          |
+| `configuration/`                      | Environment, provider, tier, and runtime configuration.             | Scaffold only.                                                          |
+| `deployment/`                         | Topologies, rollout, migration, and upgrade procedures.             | Scaffold only.                                                          |
+| [`operations/`](operations/README.md) | Health, observability, routine operation, and maintenance.          | Local upgrade/recovery is current; connector lease operations are held. |
+| [`security/`](security/README.md)     | Authentication, authorization, SSO, secrets, and security controls. | SSO provider guide is current; other pages are planned.                 |
+| `recovery/`                           | Incident response, backup, rollback, and recovery.                  | Scaffold only.                                                          |
 
 Every promoted page must be added to this index and to [`SITEMAP.md`](../SITEMAP.md) in the same migration slice.
 

docs/ADMIN-GUIDE/operations/README.md

@@ -5,7 +5,6 @@
 ## Current procedures
 
 - [Upgrade safety and recovery](upgrade-safety-and-recovery.md) — installed-CLI and local-PGlite upgrade, rollback, and framework-configuration recovery.
-- [Fleet unattended first start](fleet-unattended-first-start.md) — systemd/no-TTY identity initialization, failure handling, and isolated verification.
 
 ## Held procedures
 

docs/ADMIN-GUIDE/operations/fleet-unattended-first-start.md

@@ -1,70 +0,0 @@
-# Fleet Unattended First-Start Operations
-
-> **Status:** Current after issue #1264 lands. This runbook covers only Mosaic's first-run identity
-> gate; it does not install runtimes or credentials.
-
-## Operational contract
-
-A systemd fleet unit launches under a sanitized environment with no TTY. The generated environment
-sets `MOSAIC_AGENT_NAME`; Mosaic resolves that exact value against the canonical installed roster
-before writing identity files.
-
-If top-level identity contracts are missing, Mosaic atomically seeds them from the shipped generic
-sources:
-
-| Destination            | Source                          | New-file mode |
-| ---------------------- | ------------------------------- | ------------- |
-| `$MOSAIC_HOME/SOUL.md` | `$MOSAIC_HOME/defaults/SOUL.md` | `0600`        |
-| `$MOSAIC_HOME/USER.md` | `$MOSAIC_HOME/defaults/USER.md` | `0600`        |
-
-Creation is no-clobber and safe under concurrent seat starts. Existing regular files remain
-byte-for-byte and mode-for-mode unchanged. The runtime composer then injects the exact roster name
-and class; the generic source files grant no seat authority.
-
-## Failure handling
-
-The fleet path never falls back to an interactive wizard. It exits nonzero before runtime execution
-when:
-
-- `MOSAIC_AGENT_NAME` is not an exact roster member;
-- a defined ambient `MOSAIC_AGENT_CLASS` is blank/whitespace or disagrees with that member's
-  canonical class;
-- a missing destination has no safe regular default source;
-- a source or existing destination is a symlink (including dangling), directory, unavailable, or over the bounded size;
-- the fleet communications helper/roster cannot be validated; or
-- `USER.md` cannot be securely re-read at the point where its content is composed.
-
-Diagnostics begin with:
-
-```text
-[mosaic] ERROR: unattended fleet identity initialization failed: ...
-```
-
-Repair the exact named source, destination, roster, or helper and retry only that roster member. Do
-not delete or replace an existing personalized `SOUL.md`/`USER.md` merely to clear the check.
-
-## Verification without a live seat
-
-The source gate is:
-
-```bash
-pnpm --filter @mosaicstack/mosaic... build && \
-  pnpm --filter @mosaicstack/mosaic exec vitest run \
-    src/commands/launch-first-start.spec.ts
-```
-
-The build leg is load-bearing: `dist/` is ignored, so a direct Vitest invocation could otherwise run
-absent or stale CLI output. The gate runs the exact-source built CLI in subprocesses with piped stdin,
-temporary homes, a canonical fixture roster, fake runtime/broker executables, and no provider call. It
-covers no-TTY launch, exact identity,
-private modes, no-clobber, missing/symlink defaults, unknown members, blank/mismatched class,
-portable standalone composition/wizard preservation, and concurrent first start.
-
-Do not use this fixture as proof that a real provider credential is present or that a package has
-been deployed. Those require separate environment-specific evidence.
-
-## Related
-
-- [User workflow](../../USER-GUIDE/workflows/fleet-unattended-first-start.md)
-- [Developer architecture](../../DEVELOPER-GUIDE/architecture/fleet-first-start-identity.md)
-- [Verification report](../../reports/qa/2026-08-16-1264-unattended-first-start.md)

docs/DEVELOPER-GUIDE/README.md

@@ -26,7 +26,6 @@ This book is the canonical home for architecture, package and application guides
 
 - [Lease-broker operations and verification](testing/lease-broker-operations.md) — safe static/test commands plus explicitly held live operations.
 - [Channel adapters](integrations/channel-adapters.md) — current shared contracts and Discord reference boundary; future adapter parity is draft.
-- [Fleet first-start identity](architecture/fleet-first-start-identity.md) — no-TTY launch boundary, roster authority, and no-clobber filesystem design.
 
 Every promoted page must be added to this index and to [`SITEMAP.md`](../SITEMAP.md) in the same migration slice.
 

docs/DEVELOPER-GUIDE/architecture/README.md

@@ -11,7 +11,6 @@ This chapter is the canonical home for Mosaic Stack's system model, component bo
 - [`mutator-class-gate.md`](mutator-class-gate.md) — default-deny tool authorization, runtime adapters, launch choke point, and parser assurance boundary.
 - [`compaction-revocation.md`](compaction-revocation.md) — Claude/Pi observer lifecycle, runtime generations, revocation, and the bounded residual stale window.
 - [`channel-protocol.md`](channel-protocol.md) — current shared channel DTOs and Discord compatibility baseline, with unimplemented adapter work explicitly marked draft.
-- [`fleet-first-start-identity.md`](fleet-first-start-identity.md) — roster-owned identity bootstrap for concurrent no-TTY fleet launches.
 - [`decisions/mos-runtime-portability-m1.md`](decisions/mos-runtime-portability-m1.md) — current logical identity, connector lease, grant, audit, and fencing decision; connector activation remains held.
 
 These pages are current security-contract references and are consumed by the lease-broker acceptance suites. Their live deployment gaps remain explicitly labeled in the pages; this migration does not change runtime behavior.

docs/DEVELOPER-GUIDE/architecture/fleet-first-start-identity.md

@@ -1,81 +0,0 @@
-# Fleet First-Start Identity Boundary
-
-> **Status:** Implemented by issue #1264. Requirements: `FCM-REQ-12`, `AC-FCM-10`.
-
-## Problem
-
-`launchRuntime()` called `checkSoul()` before runtime execution. A missing top-level `SOUL.md`
-caused `checkSoul()` to spawn a child `mosaic wizard` with inherited stdio. Under a systemd-created
-fleet pane with no TTY, that child blocked or failed before the runtime boundary even though generic
-`defaults/SOUL.md` and `defaults/USER.md` already shipped in the same `MOSAIC_HOME`.
-
-## Chosen boundary
-
-The fix remains at `checkSoul()` and does not add flags to `yolo`, fleet commands, systemd units, or
-`start-agent-session.sh`:
-
-1. A present, nonblank, whitespace-exact `MOSAIC_AGENT_NAME` selects the fleet path.
-2. `resolveFleetIdentity()` must resolve that exact member through the existing roster/helper
-   boundary, and any defined `MOSAIC_AGENT_CLASS` (including blank/whitespace) must canonicalize to
-   the roster class, before any identity seed. Only undefined means absent.
-3. `lstatSync()` preflights every destination directory entry without following links, so a dangling
-   link is rejected before its counterpart can be published.
-4. Safe bounded snapshots are read from only the missing contracts under `defaults/`.
-5. Each snapshot is written to a random owner-private temporary file in `MOSAIC_HOME`.
-6. `linkSync()` publishes the complete file without overwriting an existing path. `EEXIST` means a
-   concurrent seat or operator won; the existing path is preserved and revalidated.
-7. Temporary files are removed, and both installed contracts are re-opened through the no-symlink
-   secure-file reader before launch continues.
-8. `composeContract()` independently re-resolves the roster, securely reads fleet `USER.md` through
-   a Linux descriptor at the point of use, and injects exact member identity and communications data.
-
-A standalone launch with no `MOSAIC_AGENT_NAME` retains the portable tolerant USER read and the
-interactive wizard. Fleet-only no-follow enforcement must not make supported standalone macOS
-composition depend on Linux `/proc` descriptor traversal.
-
-## Identity and authority
-
-The copied defaults deliberately say “Mosaic agent”; they are a generic behavioral base. They are
-not the source of a fleet seat's identity. The canonical roster controls:
-
-- exact agent/session name;
-- canonical role/class and persona;
-- peer rows and point of contact;
-- tmux socket and helper target; and
-- communications generation.
-
-An unknown/padded ambient name, mismatched class, or explicitly blank/whitespace class fails before
-any file is seeded. This avoids replacing the interactive wall with a fleet of indistinguishable or
-ambiently invented identities.
-
-## Concurrency and filesystem properties
-
-- Sources and final destinations are bounded regular files beneath `MOSAIC_HOME`; target and dangling
-  symlinks are not followed.
-- New files have mode `0600`.
-- Hard-link publication is same-filesystem, atomic, and no-clobber.
-- A temporary path is removed only when this process successfully created it.
-- All required source snapshots are validated before the first destination is published, preventing
-  a missing second default from leaving a partial seed.
-- Existing operator files are never chmodded or rewritten.
-
-## Verification
-
-`src/commands/launch-first-start.spec.ts` uses the production-kind boundary: the real built CLI in a
-no-TTY subprocess, not a direct wizard test. The package `test:vitest` gate builds Mosaic before
-Vitest, while the clean-checkout command builds its workspace dependencies first, so ignored
-`dist/cli.js` cannot be absent or stale. A fake lease launcher records whether execution reached the
-runtime boundary and captures the composed prompt.
-Positive and negative cases prove the check can both proceed and refuse. Fleet composition coverage
-replaces a previously validated `USER.md` with an external symlink and proves point-of-use refusal;
-a standalone unreadable-optional-USER case proves the portable tolerant branch remains separate.
-
-Real Pi authentication and provider task execution remain environment tests, not claims of this
-fixture.
-
-## Non-goals
-
-- Runtime installation or pane-PATH resolution (#1256/#1258).
-- The held `~/.mosaic` launch-composition layer in PR #1213.
-- Personalizing the operator's standalone identity without a wizard.
-- Changing fleet systemd or shell launcher code.

docs/PRD.md

@@ -146,29 +146,6 @@ lands. M0 consists only of these normative requirements, the complete task DAG,
 documentation IA checklist, and the legacy example/profile disposition inventory. Subsequent cards
 are defined in [docs/TASKS.md](./TASKS.md) and must remain one card/one PR.
 
-### Unattended fleet first-start amendment (#1264)
-
-`FCM-REQ-11` is reserved by #1256's concurrent runtime-preflight delivery. This amendment therefore
-uses the next non-colliding identifiers.
-
-1. `FCM-REQ-12`: A roster-owned fleet launch SHALL NOT invoke an interactive identity wizard when
-   top-level `SOUL.md` or `USER.md` is absent. It SHALL initialize only missing top-level identity
-   contracts from the shipped generic `defaults/` contracts without overwriting operator-owned
-   bytes. The canonical roster member remains the sole source of the seat's exact name and class;
-   generic defaults grant no fleet identity or authority. Missing or unsafe defaults SHALL fail
-   closed with actionable diagnostics before runtime execution. Non-fleet launches retain the
-   interactive identity flow.
-2. `AC-FCM-10`: A systemd-equivalent no-TTY test with a clean temporary Mosaic home SHALL prove a
-   named fleet seat reaches the runtime boundary without starting `mosaic wizard`, creates
-   byte-equal owner-private `SOUL.md` and `USER.md` seeds, and receives its exact roster name/class in
-   composed context. Tests SHALL also prove no-clobber behavior, concurrent/idempotent first start,
-   fail-closed invalid defaults, and preservation of the standalone interactive path.
-
-`ASSUMPTION:` `MOSAIC_AGENT_NAME` is the existing launch discriminator for roster-owned fleet
-processes. This amendment does not add a second fleet flag because generated fleet environments
-already set that value and the runtime composer independently resolves it against the canonical
-roster before execution.
-
 ---
 
 ## Exact Cross-Harness Fleet Communications Contract (#766)

docs/SITEMAP.md

@@ -38,13 +38,11 @@ These paths remain canonical because current source/tests consume them or becaus
 - [Quickstart](USER-GUIDE/getting-started/quickstart.md) — installed-CLI first-use route with local PGlite safety boundaries.
 - [Web dashboard](USER-GUIDE/product/web-dashboard.md) — current routes, views, chat persistence, settings, and admin behavior.
 - [Discord conversations](USER-GUIDE/workflows/discord-conversations.md) — current authorized parent-channel, thread, attachment, and control workflow.
-- [Fleet unattended first start](USER-GUIDE/workflows/fleet-unattended-first-start.md) — no-TTY identity bootstrap and exact roster identity.
 
 ## Administrator documentation
 
 - [Administrator operations](ADMIN-GUIDE/operations/README.md) — current local procedures and explicitly held outlines.
 - [Upgrade safety and recovery](ADMIN-GUIDE/operations/upgrade-safety-and-recovery.md) — installed-CLI/local-PGlite upgrade and framework recovery.
-- [Fleet unattended first-start operations](ADMIN-GUIDE/operations/fleet-unattended-first-start.md) — systemd identity initialization, refusal paths, and isolated verification.
 - [Mos connector lease operations](ADMIN-GUIDE/operations/mos-connector-lease-operations.md) — held/non-operative M1 outline while policy remains deny-all.
 - [Administrator security](ADMIN-GUIDE/security/README.md) — current security chapter index.
 - [SSO providers](ADMIN-GUIDE/security/sso-providers.md) — Authentik, WorkOS, and Keycloak configuration and discovery.
@@ -58,7 +56,6 @@ These paths remain canonical because current source/tests consume them or becaus
 - [Lease-broker security](DEVELOPER-GUIDE/architecture/lease-broker-security.md) — identity, ancestry, filesystem, observer, and residual boundaries.
 - [Whole mutator-class gate](DEVELOPER-GUIDE/architecture/mutator-class-gate.md) — default-deny tool authorization and launch choke point.
 - [Compaction revocation](DEVELOPER-GUIDE/architecture/compaction-revocation.md) — lifecycle observers, generation fencing, and residual stale window.
-- [Fleet first-start identity](DEVELOPER-GUIDE/architecture/fleet-first-start-identity.md) — roster authority and atomic no-clobber identity seeding.
 - [Architecture decisions](DEVELOPER-GUIDE/architecture/decisions/README.md) — implemented and accepted boundaries.
 - [Mos runtime portability M1](DEVELOPER-GUIDE/architecture/decisions/mos-runtime-portability-m1.md) — logical identity, connector lease, grants, audit, and fencing.
 - [Architecture RFCs](DEVELOPER-GUIDE/architecture/rfcs/README.md) — draft proposals without operational authority.
@@ -78,7 +75,6 @@ These paths remain canonical because current source/tests consume them or becaus
 - [Archived planning](archive/planning/README.md) — historical briefs, board reviews, and work-package specifications.
 - [Archived work records](archive/work-records/README.md) — historical task scratchpads without live consumers.
 - [P8-003 performance report](reports/qa/p8-003-performance-optimization.md) — historical implementation evidence, not a current SLO.
-- [Issue #1264 unattended fleet first-start verification](reports/qa/2026-08-16-1264-unattended-first-start.md) — RED/GREEN no-TTY CLI evidence and explicit untested bounds.
 - [Plans index](plans/README.md) — approved intent and implementation/audit plans.
 - [Documentation information-architecture design](plans/2026-08-10-docs-information-architecture-design.md) — approved documentation structure decision.
 - [Documentation catalog-audit plan](plans/2026-08-10-docs-catalog-audit.md) — evidence method and migration acceptance criteria.

docs/USER-GUIDE/README.md

@@ -11,7 +11,6 @@ This book is the canonical home for end-user workflows, user-visible behavior, p
 - [Quickstart](getting-started/quickstart.md) — install Mosaic, complete setup, and launch a session.
 - [Web dashboard](product/web-dashboard.md) — current routes, navigation, chat persistence, projects/tasks views, settings, and admin behavior.
 - [Discord conversations](workflows/discord-conversations.md) — current authorized parent-channel, thread, attachment, and control workflow.
-- [Fleet unattended first start](workflows/fleet-unattended-first-start.md) — no-TTY identity bootstrap, exact roster identity, and separate runtime prerequisites.
 
 ## Chapter map
 
@@ -19,7 +18,7 @@ This book is the canonical home for end-user workflows, user-visible behavior, p
 | ------------------ | ------------------------------------------------------------- | ---------------------------------------------------- |
 | `getting-started/` | First-use setup, orientation, and quickstarts.                | Quickstart is current; additional pages are planned. |
 | `concepts/`        | User-facing terminology, product concepts, and mental models. | Scaffold only.                                       |
-| `workflows/`       | Task-oriented procedures for using Mosaic Stack.              | Discord and fleet first-start workflows are current. |
+| `workflows/`       | Task-oriented procedures for using Mosaic Stack.              | Discord conversation workflow is current.            |
 | `product/`         | Current product surfaces and visible behavior.                | Web dashboard reference is current.                  |
 | `troubleshooting/` | User-visible failures, diagnostics, and fixes.                | Scaffold only.                                       |
 
@@ -28,7 +27,6 @@ This book is the canonical home for end-user workflows, user-visible behavior, p
 - [Quickstart](getting-started/quickstart.md) — the verified installed-CLI first-use path.
 - [Web dashboard](product/web-dashboard.md) — verified current Next.js dashboard behavior and limitations.
 - [Discord conversations](workflows/discord-conversations.md) — verified current Discord user workflow.
-- [Fleet unattended first start](workflows/fleet-unattended-first-start.md) — verified no-TTY first-start behavior and prerequisite boundaries.
 
 Every promoted page must be added to this index and to [`SITEMAP.md`](../SITEMAP.md) in the same migration slice.
 

docs/USER-GUIDE/workflows/fleet-unattended-first-start.md

@@ -1,61 +0,0 @@
-# Fleet Unattended First Start
-
-> **Status:** Current for roster-owned local fleet launches after issue #1264 lands. Runtime
-> installation and provider authentication remain separate prerequisites.
-
-A fleet seat started by systemd has no operator at its pane. On its first launch, Mosaic must not
-stop at the interactive identity wizard.
-
-## What happens on first start
-
-When `MOSAIC_AGENT_NAME` names an exact member of the installed fleet roster and top-level identity
-contracts are absent, the launcher:
-
-1. validates the exact roster member, its canonical class, and the installed fleet communications
-   helper;
-2. reads the shipped generic contracts from
-   `~/.config/mosaic/defaults/SOUL.md` and `defaults/USER.md`;
-3. creates only the missing top-level `SOUL.md` and `USER.md` as owner-private files;
-4. preserves any existing top-level identity file byte-for-byte; and
-5. launches the runtime with the roster member's exact agent/session name and role/class in composed
-   context.
-
-The generic defaults do **not** make every seat the same identity. They provide a shared behavioral
-base. The canonical roster row supplies each seat's exact name, class, peers, socket, and authority.
-
-## Operator behavior
-
-A normal standalone launch without a fleet identity retains its portable configuration path and still
-uses the interactive wizard when `SOUL.md` is absent:
-
-```bash
-mosaic pi
-```
-
-A roster-owned seat may be started without attaching to its pane:
-
-```bash
-mosaic fleet start <exact-roster-name>
-```
-
-Mosaic refuses before runtime execution if the requested member is absent, its explicitly supplied
-ambient class is blank or conflicts with the roster, a required default is missing or unsafe, or an existing identity contract
-is not a safe regular file. Repair the named component and retry the same exact roster member; do not
-copy another seat's personalized identity.
-
-## Separate prerequisites
-
-This behavior clears the Mosaic identity-wizard wall only. A clean host still needs:
-
-- the declared runtime installed on the pane PATH;
-- the fleet transport and generated unit assets; and
-- runtime/provider authentication appropriate to that seat.
-
-Those checks are separate so a successful identity bootstrap is not reported as a fully authenticated
-agent session.
-
-## Related
-
-- [Administrator runbook](../../ADMIN-GUIDE/operations/fleet-unattended-first-start.md)
-- [Developer architecture](../../DEVELOPER-GUIDE/architecture/fleet-first-start-identity.md)
-- [Verification report](../../reports/qa/2026-08-16-1264-unattended-first-start.md)

docs/reports/README.md

@@ -12,13 +12,11 @@ Use the canonical guide, API contract, source, and tests to determine current be
 - [Issue #756 documentation checklist](documentation/756-discord-plugin-checklist.md) — historical completion checklist for the official Discord plugin workstream.
 - [Framework consistency audit — 2026-02-17](documentation/AUDIT-2026-02-17-framework-consistency.md) — historical framework consistency and remediation snapshot.
 - [Compaction-refresh #830 checklist](compaction-refresh/830-documentation-checklist.md) — historical incomplete-at-snapshot documentation checklist.
-- [Issue #1264 documentation checklist](documentation/1264-documentation-checklist.md) — current in-repo user/admin/developer/report coverage and review gate.
 
 ## Code-review evidence
 
 - [Issue #756 independent code review](code-review/756-code-review.md) — historical exact-scope review of the official Discord plugin workstream.
 - [Gateway security-hardening code review — 2026-03-13](code-review/gateway-security-20260313.md) — historical no-blocker review snapshot.
-- [Issue #1264 independent code and security review](code-review/1264-code-review.md) — initial finding, remediation, clean re-review, and remaining formal PR-review gate.
 
 ## Security evidence
 
@@ -28,7 +26,6 @@ Use the canonical guide, API contract, source, and tests to determine current be
 
 - [P8-003 performance optimization report](qa/p8-003-performance-optimization.md) — historical implementation evidence; not a current SLO or production benchmark.
 - [Gateway security-hardening QA report — 2026-03-13](qa/gateway-security-20260313.md) — historical test report with its original live-smoke-test limitation.
-- [Issue #1264 unattended fleet first-start verification](qa/2026-08-16-1264-unattended-first-start.md) — RED/GREEN no-TTY CLI evidence, baseline gates, and explicit real-provider limitation.
 
 ## Native Kanban/SOT evidence
 

docs/reports/code-review/1264-code-review.md

@@ -1,97 +0,0 @@
-# Issue #1264 Code and Security Review
-
-> Branch: `fix/1264-fleet-unattended-first-start` | Base:
-> `origin/next@476db12b92971634b67fd2057b7577ee5894e449`
-
-## Initial automated review
-
-Codex reviewed the pre-PR uncommitted delta with:
-
-```bash
-~/.config/mosaic/tools/codex/codex-code-review.sh --uncommitted \
-  -o /tmp/1264-codex-code-review.json
-```
-
-Result: `request-changes`, confidence `0.93`, 20 files, one should-fix. `checkSoul()` trimmed
-`MOSAIC_AGENT_NAME` for pre-seed resolution while composition used the original value, so a padded
-name could seed files before later refusal.
-
-Remediation rejected blank/leading/trailing-whitespace values before roster lookup or writes and
-added three built-CLI no-side-effect regressions. Automated re-review approved that delta with no
-findings (confidence `0.86`). Initial security review reported risk `none` (confidence `0.91`).
-
-## Formal exact-head review
-
-Daphne reviewed PR #1268 at exact head `43fa0477877e0d0f110da8d11c3033b40ddeb191` and filed Gitea
-review ID 168 as `REQUEST_CHANGES`. The review was source/PR-only; the canary remained untouched.
-
-Blocking groups:
-
-1. class mismatch was validated after first-start mutation;
-2. secure `USER.md` validation was discarded before ordinary path-following composition;
-3. `existsSync()` treated a dangling destination symlink as missing, allowing counterpart partial
-   publication; and
-4. the built-CLI/evidence chain allowed stale ignored `dist/`, cited an unshipped canary object, and
-   carried conflicting test totals/pane wording.
-
-The diagnostic's defaults-only repair advice was also inaccurate for roster/class/destination
-failures.
-
-## Formal-review remediation
-
-All four blocking groups received regressions before production changes. The RED run produced four
-failures while 1,568 existing tests passed. Remediation then:
-
-- validates canonical name and class before seeding;
-- preflights destination directory entries with `lstatSync()` so target and dangling symlinks fail
-  before publication;
-- securely reads `USER.md` through an `O_NOFOLLOW` descriptor at composition time;
-- adds a Mosaic build before package Vitest and a dependency build in the clean-checkout command;
-- replaces defaults-only advice with neutral named-component repair guidance; and
-- reconciles shipping canary provenance, pane chronology, commands, and totals.
-
-Remediation code review:
-
-```bash
-~/.config/mosaic/tools/codex/codex-code-review.sh --uncommitted \
-  -o /tmp/1264-remediation-code-review.json
-```
-
-Result: `approve`, confidence `0.88`, 6 files, no findings. Summary: the fail-closed destination
-checks, class-validation order, secure composition, and build-before-Vitest path are coherent.
-
-Remediation security review:
-
-```bash
-~/.config/mosaic/tools/codex/codex-security-review.sh --uncommitted \
-  -o /tmp/1264-remediation-security-review.json
-```
-
-Result: risk `none`, confidence `0.93`, 9 files, no critical/high/medium/low findings. The sandbox
-could not run Vitest because Vite attempted to create a temporary config artifact on its read-only
-mount (`EROFS`); executor-owned focused and full results are recorded in the QA report.
-
-## Second exact-head review
-
-Daphne reviewed exact head `9dc90be7e13b1cd609f6df97d43d890ef5392ca0` and filed Gitea review
-ID 169 as `REQUEST_CHANGES`. Review 169 confirmed all review-168 closures, then found:
-
-1. the new point-of-use reader was Linux-only but had been applied to every standalone USER read,
-   breaking supported non-fleet macOS composition; and
-2. explicit blank/whitespace `MOSAIC_AGENT_CLASS` was treated as absent and could seed before
-   runtime, while only undefined should mean absent.
-
-Red-first remediation preserves legacy `readOptional()` for standalone composition, keeps descriptor
-no-follow consumption fleet-only, moves the replacement-symlink case under a valid fleet identity,
-and rejects defined blank/whitespace classes before seeding. Three blank-class CLI cases and one
-tolerant standalone composition case failed before the source change and pass after it.
-
-Review-169 remediation code review approved at confidence `0.90` (4 files, no findings). Security
-review reported risk `none` at confidence `0.90` (4 files, no findings). The review sandbox retained
-its known Vite `EROFS` limitation; executor-owned tests are in the QA report.
-
-## Remaining review gate
-
-Daphne must re-review the next exact pushed head. This report cannot record that future verdict
-without changing the reviewed head, so the authoritative terminal verdict belongs to PR #1268's
-Gitea review record. Fred and goals are excluded as reviewers.

docs/reports/documentation/1264-documentation-checklist.md

@@ -1,32 +0,0 @@
-# #1264 Documentation Completion Checklist
-
-## Required artifacts
-
-- [x] `docs/PRD.md` updated with `FCM-REQ-12` and `AC-FCM-10`.
-- [x] User workflow documents unattended fleet first start and separate prerequisites.
-- [x] Administrator operations page documents source/destination ownership, failure handling, and an
-      exact-source build-before-Vitest verification gate.
-- [x] Developer architecture page documents control flow, identity authority, concurrency, and non-goals.
-- [x] `docs/SITEMAP.md` and book indexes updated.
-- [x] QA evidence is under `docs/reports/qa/`; working notes are under `docs/scratchpads/`.
-- [x] Framework defaults README reflects fleet-versus-standalone behavior.
-
-## API coverage
-
-- [x] No HTTP/API endpoint or DTO changed; OpenAPI and endpoint indexes are not applicable.
-
-## Structural standards
-
-- [x] User, administrator, developer, report, and sitemap indexes link the new pages.
-- [x] No noncanonical file was added at the `docs/` root.
-- [x] Canonical documentation remains in-repo; no external publication was requested or performed.
-
-## Review gate
-
-- [x] Initial padded-name finding remediated and automated re-review approved.
-- [x] Daphne formal review ID 168 completed on exact first head `43fa0477` and requested changes.
-- [x] Four review-168 groups reproduced red and remediated; automated reviews are clean.
-- [x] Daphne review ID 169 completed on exact head `9dc90be7` and confirmed review-168 closures.
-- [x] Review-169 standalone-portability and blank-class blockers reproduced red and remediated;
-      automated reviews are clean.
-- [ ] Daphne exact-second-remediation-head re-review completed after push (Fred/goals excluded).

docs/reports/qa/2026-08-16-1264-unattended-first-start.md

@@ -1,220 +0,0 @@
-# #1264 Unattended Fleet First-Start Verification
-
-> Status: **IN PROGRESS — review-169 remediation complete locally; push/re-review pending** |
-> Executor: goals | Date: 2026-08-16 | Target: isolated local fixtures only
-
-## Objective
-
-Verify that a named fleet seat launched through a systemd-equivalent, no-TTY environment on a clean
-host reaches its runtime boundary without an interactive Mosaic identity wizard. Preserve standalone
-wizard behavior and canonical-roster ownership of exact seat identity.
-
-## Source evidence accepted for local verification
-
-Daphne's canary Run-7 report is reachable from jarvis-brain `origin/main` at
-`8bf94afeb8c7d5df96cdd4a4508e75a1d2999710`,
-`docs/reports/2026-08-16_sbx-canary-greenfield-e2e.md`. The earlier local object
-`6c0b6fc70ae6a179a1b7ff9dedfc54e9adccd19a` is not reachable from an origin ref and is not used as
-shipping provenance. Run 7 measured:
-
-```text
-systemd -> start-agent-session.sh -> mosaic yolo pi (PID 3726)
-                                  -> child mosaic wizard (PID 3762)
-```
-
-The pane was preserved when Run 7 was captured. Formal review ID 168 records that an authorized
-rollback occurred later. This task never accessed or altered the canary VM, pane, snapshot, or
-rollback state. Product behavior is independently tested here with temporary roots and fake runtime
-executables.
-
-## Controls
-
-- Original base: `origin/next@476db12b92971634b67fd2057b7577ee5894e449`.
-- PR: #1268, first pushed head `43fa0477877e0d0f110da8d11c3033b40ddeb191`.
-- `DATABASE_URL` remains unset for local tests.
-- No runtime/provider credential or token value, VM, installed Mosaic tree, unit, timer, PATH profile,
-  or live tmux session is read or mutated. Standard Gitea/Woodpecker wrappers authenticate metadata
-  reads/writes without exposing credential values.
-- Tiny's runtime-preflight and `start-agent-session.sh` PATH work remain out of scope.
-- Held PR #1213 is not a dependency.
-
-## Requirements-to-evidence map
-
-| Acceptance criterion                                                   | Method                                                          | Evidence                      |
-| ---------------------------------------------------------------------- | --------------------------------------------------------------- | ----------------------------- |
-| No-TTY fleet first start avoids wizard and reaches runtime             | Exact-source built CLI with piped stdin                         | CLI GREEN                     |
-| Missing top-level identity files are initialized from shipped defaults | Exact-byte and `0600` assertions                                | CLI + filesystem GREEN        |
-| Exact seat identity remains roster-owned                               | Captured argv; mismatched/blank class no-side-effect refusals   | CLI GREEN                     |
-| Existing operator identity is never overwritten                        | Custom bytes/mode with defaults removed                         | CLI + filesystem GREEN        |
-| Concurrent/repeated first start is safe                                | Four parallel CLIs plus repeated launch                         | CLI GREEN                     |
-| Missing/unsafe defaults and destinations fail before partial mutation  | Missing, target/dangling symlink, oversized, invalid-root cases | Filesystem/CLI GREEN          |
-| Validated `USER.md` cannot be replaced by an external symlink          | Seed, replace, compose at point of use                          | Composition GREEN             |
-| Standalone launch retains wizard                                       | Same built CLI without fleet identity                           | CLI GREEN                     |
-| Built-CLI evidence cannot use stale ignored `dist/`                    | Build-with-dependencies gate before Vitest                      | Package script + command gate |
-
-## Initial RED
-
-Production source remained unchanged after adding the first reproducer. The CLI was built from
-`origin/next@476db12` before the test.
-
-```bash
-env -u DATABASE_URL pnpm --filter @mosaicstack/mosaic exec vitest run \
-  src/commands/launch-first-start.spec.ts
-```
-
-Exit `1`; one file and one test failed. Output included:
-
-```text
-[mosaic] SOUL.md not found. Running setup wizard...
-◆  What would you like to do?
-[mosaic] Setup failed. Run: mosaic wizard
-AssertionError: expected 1 to be +0
-```
-
-The fake runtime-boundary capture was not created. Complete stdout/stderr was retained at
-`/tmp/1264-red.out` during that work session.
-
-## Formal-review remediation RED
-
-Daphne's exact-head review ID 168 requested changes at `43fa0477`. Before changing production code,
-new regressions were run against an exact-source build. Four tests failed while the existing 1,568
-passed:
-
-1. valid roster name plus mismatched ambient class seeded both files before refusal;
-2. dangling `SOUL.md` allowed `USER.md` to be published before refusal;
-3. dangling `USER.md` allowed `SOUL.md` to be published before refusal; and
-4. replacing a securely validated `USER.md` with an external symlink was followed by composition.
-
-This establishes that all four review-168 findings were observable on the pushed implementation.
-
-Daphne's review ID 169 then found two more exact-head failures at `9dc90be7`. Before production
-changes, four new assertions failed:
-
-1. standalone composition routed an unreadable optional `USER.md` through the Linux-only descriptor
-   reader instead of the legacy portable tolerant path; and
-2. explicit `MOSAIC_AGENT_CLASS` values `""`, `" "`, and tab were treated as absent, seeded both
-   identity files, and reached runtime.
-
-The replacement-symlink case was also moved under a valid roster identity so it tests the fleet-only
-security boundary rather than standalone behavior.
-
-## Final GREEN
-
-The production-kind command builds Mosaic and all workspace dependencies before invoking Vitest,
-because `dist/` is ignored and may otherwise be absent or stale:
-
-```bash
-env -u DATABASE_URL sh -c '
-  pnpm --filter @mosaicstack/mosaic... build &&
-  pnpm --filter @mosaicstack/mosaic exec vitest run \
-    src/commands/fleet-first-start-identity.spec.ts \
-    src/commands/launch-first-start.spec.ts \
-    src/commands/launch.spec.ts \
-    src/commands/compose-contract.spec.ts \
-    src/config/file-adapter.test.ts \
-    src/cli-smoke.spec.ts
-'
-```
-
-Exit `0`: `6/6` files, `128/128` tests.
-
-- 15 real-CLI/no-TTY tests cover exact roster name/class, byte-equal `0600` seeds, no-clobber,
-  partial seed, missing/symlink defaults, unknown/padded/blank name, mismatched or explicitly blank
-  class, standalone wizard preservation, and four concurrent starts.
-- 12 direct filesystem tests cover complete publication, existing operators, idempotence, source
-  prevalidation, target and dangling destination links, invalid roots, oversized input, and
-  unexpected link errors.
-- Composition coverage deterministically replaces a valid fleet seat's validated `USER.md` with an
-  external symlink and requires refusal at point of use. A separate standalone case proves tolerant
-  optional composition remains outside the Linux-only fleet reader.
-
-Full package gate (which rebuilds Mosaic itself after the clean-checkout dependency build):
-
-```bash
-env -u DATABASE_URL pnpm --filter @mosaicstack/mosaic run test:vitest
-```
-
-Exit `0`: `88/88` files, `1,577/1,577` tests.
-
-Focused helper + point-of-use coverage:
-
-```text
-2 files, 53/53 tests
-Statements 97.84% | Branches 91.66% | Functions 100% | Lines 97.84%
-Exit 0
-```
-
-Final repository gates after remediation:
-
-```text
-pnpm preflight    exit 0
-pnpm typecheck    45/45 tasks, exit 0
-pnpm lint         25/25 tasks, exit 0
-pnpm build        25/25 tasks, exit 0
-pnpm format:check exit 0
-git diff --check  exit 0
-```
-
-Pre-PR targeted shell runs on the unchanged shell surfaces also passed:
-
-```text
-bash framework/tools/fleet/test-start-agent-session.sh                 exit 0 locally
-bash framework/tools/quality/scripts/test-install-migration.sh         21 passed, 0 failed
-bash framework/tools/_scripts/test-mosaic-init-rce.sh                   PASS
-```
-
-The aggregate local `test:framework-shell` run stopped at `invariant_r_unittest.py`: installed
-operator-global Pi is `0.84.2`, while the invariant is measured for `0.84.1`. Later aggregate stages
-remain unmeasured except the targeted suites above. Root `pnpm test` remains locally **UNTESTED**
-because this checkout prohibits the PostgreSQL-dependent gateway isolation path.
-
-## Review and security evidence
-
-- Initial Codex review found padded-name mutation-before-refusal; it was fixed with three
-  no-side-effect regressions.
-- Codex review of the formal-review remediation: `approve`, confidence `0.88`, 6 files, no findings.
-- Codex security review of the remediation: risk `none`, confidence `0.93`, 9 files, no findings.
-  Its sandbox could not execute Vitest because Vite attempted a write on a read-only mount; the
-  executor-owned results above are the test evidence.
-- Daphne formal review ID 168 at exact head `43fa0477`: `REQUEST_CHANGES`, four blocking groups; all
-  closed by review 169.
-- Daphne formal review ID 169 at exact head `9dc90be7`: `REQUEST_CHANGES`, two blocking groups
-  (standalone portability and explicit blank class). Both now have red-first regressions and local
-  green remediation.
-- Codex review of review-169 remediation: `approve`, confidence `0.90`, 4 files, no findings.
-- Codex security review of review-169 remediation: risk `none`, confidence `0.90`, 4 files, no
-  findings. Exact-new-head Daphne re-review is pending until that head is pushed.
-
-## CI evidence and external blocker
-
-Pipeline 2445 ran against exact first head `43fa0477`:
-
-- install, sanitization, upgrade guard, typecheck, lint, and format passed;
-- Mosaic Vitest passed `88/88`, `1,568/1,568`; and
-- the test step emitted exactly one `FAIL:` line:
-
-```text
-FAIL: host provides 'pi' in the system path; missing-binary cases are not measurable here
-```
-
-That line comes from the inherited `test-start-agent-session.sh` CI-fit guard, not #1264. Fred filed
-the correction as PR #1270. Its pipeline 2448 is terminal green and proves the four formerly masked
-suites execute, but #1270 is not merged, so `next` still carries the failing chain. A new #1268
-pipeline 2449 at `9dc90be7` reproduced the same single inherited `FAIL:` after Mosaic passed
-`1,573/1,573`. A new pipeline is pending the review-169 remediation push. Terminal-green #1268 CI is
-not claimed.
-
-PR #1268's envelope was read back as `user.login=mos-dt-0`; its commit is explicitly authored and
-committed by `goals <[email protected]>`. No goals Gitea login exists on this host, and no
-other principal was borrowed. The cross-wrapper principal defect is tracked in #1272.
-
-## Explicitly untested
-
-- Canary VM remediation/restart: **UNTESTED and prohibited**.
-- Real Pi authentication/provider prompt and task execution: **UNTESTED**.
-- PR #1213 composition layer: **UNTESTED and not required**.
-- Deployment/published npm behavior: **UNTESTED until merge/release**.
-- Local PostgreSQL execution/migration: **UNTESTED and prohibited**.
-
-The local gate proves Mosaic crosses its identity boundary and reaches a fake lease-runtime boundary;
-it does not claim provider readiness, deployment, or a currently running canary seat.

docs/scratchpads/1264-unattended-first-start.md

@@ -1,104 +0,0 @@
-# #1264 — Unattended fleet first start
-
-## Tracking
-
-- Issue: `mosaicstack/stack#1264`
-- PR: `mosaicstack/stack#1268`
-- Branch: `fix/1264-fleet-unattended-first-start`
-- Base: `origin/next@476db12b92971634b67fd2057b7577ee5894e449`
-- First pushed head: `43fa0477877e0d0f110da8d11c3033b40ddeb191`
-- Current remediation worktree: `/var/home/jason.woltje/agent-work/1264-review2-remediation`
-- Coordinator: Fred; reviewer must be neither Fred nor this implementation seat.
-- `docs/TASKS.md` is orchestrator-owned and is not modified by this worker.
-
-The original `/var/home/jason.woltje/agent-work/1264-unattended-first-start` and first remediation
-worktrees were removed without force after each pushed head and clean state were verified. The
-Fred-authorized plain-Git worktree exception was reused for exact-head review remediation because
-`/src` remains unavailable.
-
-## Objective
-
-A roster-owned fleet seat launched from systemd on a clean host must cross Mosaic's first-run identity
-gate without a human or TTY, while retaining exact name/class from the canonical roster and
-preserving the standalone interactive wizard.
-
-## Intake and boundaries
-
-- Shipping canary provenance is jarvis-brain `origin/main` commit
-  `8bf94afeb8c7d5df96cdd4a4508e75a1d2999710`. The earlier local `6c0b6fc...` object is not used.
-- The Run-7 pane was preserved when evidence was captured; formal review records a later authorized
-  rollback. This task never accessed or altered the canary.
-- Tiny's concurrent runtime-preflight, `start-agent-session.sh`, and #1258 PATH seam remain untouched.
-- Held PR #1213 is not a dependency.
-- No runtime/provider credential values or provider calls, installed-host changes, PostgreSQL, unit,
-  timer, or profile mutation. Tests use temporary roots and fake executables only; Gitea/Woodpecker
-  metadata operations use standard wrappers without exposing credentials.
-
-## Requirements and design
-
-- PRD IDs: `FCM-REQ-12`, `AC-FCM-10`; `FCM-REQ-11` is reserved by #1256.
-- A present fleet name must be nonblank, whitespace-exact, and resolve through the canonical roster.
-- Any defined ambient class, including blank/whitespace, must canonicalize to the roster class before
-  mutation; only undefined means absent.
-- Preflight all destination directory entries with no-follow existence semantics so dangling links
-  fail before counterpart publication.
-- Seed only missing top-level files from bounded regular defaults with owner-private, atomic,
-  no-clobber hard links.
-- Generic defaults are behavior, not identity or authority.
-- Securely consume fleet `USER.md` through a Linux descriptor at composition time.
-- Standalone composition retains the portable tolerant USER read and missing identity retains the
-  wizard.
-
-## Progress
-
-- [x] Issue, canary report, Tiny collision state, and PRD read/amended.
-- [x] Initial production-kind RED captured with a real built CLI and no TTY.
-- [x] Implementation, tests, user/admin/developer docs, QA, and indexes delivered.
-- [x] Initial automated review finding (padded name before write) remediated.
-- [x] Commit `43fa0477` pushed; PR #1268 opened against `next`; original worktree removed cleanly.
-- [x] Daphne formal review ID 168 completed on exact first head: `REQUEST_CHANGES` with four groups.
-- [x] All four review-168 groups reproduced red before remediation and passed at `9dc90be7`.
-- [x] Daphne review ID 169 completed on `9dc90be7`: review-168 closures confirmed; two new blockers.
-- [x] Review-169 portability and blank-class blockers reproduced red and now pass locally.
-- [x] Review-169 Codex review approved; security review risk `none`.
-- [ ] Commit/push second remediation with explicit goals author/committer; verify remote object/content.
-- [ ] Daphne exact-new-head re-review.
-- [ ] Terminal #1268 CI. Pipeline 2445's only `FAIL:` was the inherited Pi-PATH CI-fit guard; PR
-  #1270's pipeline 2448 is green, but #1270 is not merged.
-- [ ] Remove the clean remediation worktree after push.
-
-## Test evidence
-
-### Initial RED
-
-The built `origin/next` CLI entered `mosaic wizard`, rendered `What would you like to do?`, exited 1,
-and never created the fake runtime-boundary capture.
-
-### Formal-review RED
-
-Against exact first-head production code, four new tests failed while 1,568 existing tests passed:
-class mismatch mutated before refusal; each dangling destination left its counterpart; and a
-replacement `USER.md` symlink was consumed by composition. Review-169 RED then proved standalone
-composition hit the Linux-only reader and three explicit blank/whitespace class cases seeded and
-launched.
-
-### Final local GREEN
-
-- Exact-source focused gate: `6/6` files, `128/128` tests.
-- Full exact-source Mosaic Vitest: `88/88` files, `1,577/1,577` tests.
-- Helper + point-of-use coverage: `53/53`; 97.84% statements/lines, 91.66% branches, 100% functions.
-- Root preflight passed; typecheck `45/45`, lint `25/25`, build `25/25`.
-- Initial targeted shell gates passed: start-agent-session, install migration `21/21`, init-RCE.
-- Local aggregate framework shell stops at operator-global Pi `0.84.2` versus measured `0.84.1`.
-- Local root `pnpm test` remains unrun because the checkout prohibits its PostgreSQL-dependent path.
-
-The full evidence and command boundaries are in
-`docs/reports/qa/2026-08-16-1264-unattended-first-start.md`.
-
-## Review / delivery notes
-
-- Review-168 remediation Codex review: approve `0.88`; security risk `none` `0.93`.
-- Review-169 remediation Codex review: approve `0.90`; security risk `none` `0.90`.
-- PR envelope reads `mos-dt-0`; the commit reads goals/goals. No goals Gitea principal exists on this
-  host, so no other principal will be borrowed. Tracked in #1272.
-- PR #1270 is pushed, not merged. Do not represent `next` or #1268 CI as green until measured.

docs/scratchpads/README.md

@@ -7,10 +7,6 @@
 - [DOCS-IA-001 — information architecture](DOCS-IA-001.md) — completed structure-design and documentation-contract record.
 - [DOCS-IA-002 — catalog audit and migration](DOCS-IA-002-catalog-audit.md) — active coordinator progress, autonomous lane state, verification evidence, and authority blockers.
 
-## Active implementation records
-
-- [Issue #1264 — unattended fleet first start](1264-unattended-first-start.md) — plan, RED/GREEN evidence, collision boundaries, and PR lifecycle state.
-
 Completed scratchpads may remain here when they provide useful delivery provenance. Their conclusions must be reflected in the owning canonical page before the scratchpad is treated as complete.
 
 ## Related

packages/mosaic/framework/defaults/README.md

@@ -102,7 +102,7 @@ mosaic yolo pi             # Launch Pi in yolo mode
 The launcher:
 
 1. Verifies `~/.config/mosaic` exists
-2. Resolves identity: standalone launches auto-run `mosaic init` when `SOUL.md` is missing; exact roster-owned fleet launches validate name/class, atomically seed only missing `SOUL.md`/`USER.md` from generic `defaults/`, securely consume `USER.md`, and never prompt
+2. Verifies `SOUL.md` exists (auto-runs `mosaic init` if missing)
 3. Injects `AGENTS.md` into the runtime
 4. Forwards all arguments to the runtime CLI
 

packages/mosaic/framework/tools/quality/test-enumeration-exclusions.txt

@@ -39,3 +39,20 @@ packages/mosaic/framework/tools/tmux/test-send-message-verdict.sh | requires rea
 # recorded judgement. These lines ARE that judgement, signed.)
 packages/mosaic/framework/tools/orchestrator/smoke-test.sh | behavior smoke checks for coord continue/run workflows, run manually by orchestrator seats; unmeasured in CI; #1017 burndown
 packages/mosaic/framework/tools/wake/validate-973/microtest-wake-assert.sh | #973 instrument self-test, run as a precondition of the validate-973 evidence procedure rather than as a standing CI suite; #1017 burndown candidate
+
+# --- tools/fleet: precondition is unsatisfiable in the CI image (#1271) ---
+# Signed by fred (sb-it-1-dt, 2026-08-16) at origin/next 476db12.
+# This suite asserts the launcher's behaviour when `mosaic` and `pi` are MISSING.
+# It shims fakes into $FAKE_BIN, but the constructed PANE_PATH always ends in the
+# real system path, so on a host that installs those binaries the missing-binary
+# cases cannot be measured at all. The suite's own guard (line 103) says so and
+# fails rather than reporting a pass it cannot back. That guard is correct.
+# The error was wiring the suite into CI: #1017 (c56483eb) enumerated it and
+# dropped this exclusion, and the CI image provides `pi` in the system path, so
+# it has failed on every pipeline since. Measured 2026-08-16 across pipelines
+# 2444 (#1256), 2438 (#1240) and 2441 (#1017-quality): exactly one FAIL line in
+# each full log, identical, this assertion; control `zzz-not-present-zzz` -> 0.
+# Burn-down and the full measurement are tracked in #1271; unwired by PR #1270.
+# Because test:framework-shell is one && chain and this sat at position 44 of 48,
+# the four suites after it had not run at all since the merge.
+packages/mosaic/framework/tools/fleet/test-start-agent-session.sh | precondition unsatisfiable in the CI image: asserts missing-binary behaviour, but PANE_PATH always ends in the system path and the image provides `pi` there; guard at line 103 fails by design rather than passing unmeasured. Burn down by controlling the tail of PANE_PATH inside the test. NOT by removing `pi` from the image: the CI image installs @earendil-works/[email protected] deliberately (measured in pipeline 2444's test-step log), and other suites depend on that pin. Burn-down tracked in #1271

packages/mosaic/package.json

@@ -24,9 +24,8 @@
     "build": "tsc",
     "lint": "eslint src",
     "typecheck": "tsc --noEmit",
-    "test": "pnpm run test:vitest && pnpm run test:framework-shell",
-    "test:vitest": "pnpm run build && vitest run --passWithNoTests",
-    "test:framework-shell": "bash framework/tools/quality/scripts/check-test-enumeration.sh && bash framework/tools/quality/scripts/test-check-test-enumeration.sh && python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/promotion_binding_unittest.py && python3 src/lease-broker/promotion_trigger_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/receipt_observer_client_unittest.py && python3 src/lease-broker/invariant_r_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 src/mutator-gate/version_coupling_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh && bash framework/tools/git/test-pr-review-repo-host-override.sh && bash framework/tools/git/test-ci-queue-wait-branch-absent.sh && bash framework/tools/git/test-ci-queue-wait-tristate.sh && bash framework/tools/git/test-ci-queue-wait-github-checks.sh && bash framework/tools/git/test-pr-merge-queue-branch.sh && bash framework/tools/git/test-pr-merge-head-pin.sh && bash framework/tools/git/test-pr-merge-message-field.sh && bash framework/tools/git/test-git-credential-mosaic.sh && bash framework/tools/git/test-gitea-token-identity.sh && bash framework/tools/woodpecker/test-terminal-green-contract.sh && bash framework/tools/_scripts/test-install-ordering-guard.sh && bash framework/tools/_scripts/test-mosaic-init-rce.sh && bash framework/tools/tmux/agent-send.test.sh && bash framework/tools/wake/test-wake-store-ack.sh && bash framework/tools/wake/test-wake-store-enqueue-race.sh && bash framework/tools/wake/test-wake-digest-hmac.sh && bash framework/tools/wake/test-wake-digest-quarantine.sh && bash framework/tools/wake/test-wake-detector.sh && bash framework/tools/wake/test-wake-fn-oracle.sh && bash framework/tools/wake/test-wake-reconcile.sh && bash framework/tools/wake/test-wake-beacon.sh && bash framework/tools/wake/test-wake-preimage.sh && bash framework/tools/wake/test-wake-install.sh && bash framework/tools/fleet/test-start-agent-session.sh && bash framework/tools/glpi/test-list-http-status.sh && bash framework/tools/orchestrator/test-board-roll.sh && bash framework/tools/woodpecker/test-ci-wait-exit-matrix.sh && bash framework/tools/_scripts/test-fleet-transport-check.sh"
+    "test": "vitest run --passWithNoTests && pnpm run test:framework-shell",
+    "test:framework-shell": "bash framework/tools/quality/scripts/check-test-enumeration.sh && bash framework/tools/quality/scripts/test-check-test-enumeration.sh && python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/promotion_binding_unittest.py && python3 src/lease-broker/promotion_trigger_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/receipt_observer_client_unittest.py && python3 src/lease-broker/invariant_r_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 src/mutator-gate/version_coupling_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh && bash framework/tools/git/test-pr-review-repo-host-override.sh && bash framework/tools/git/test-ci-queue-wait-branch-absent.sh && bash framework/tools/git/test-ci-queue-wait-tristate.sh && bash framework/tools/git/test-ci-queue-wait-github-checks.sh && bash framework/tools/git/test-pr-merge-queue-branch.sh && bash framework/tools/git/test-pr-merge-head-pin.sh && bash framework/tools/git/test-pr-merge-message-field.sh && bash framework/tools/git/test-git-credential-mosaic.sh && bash framework/tools/git/test-gitea-token-identity.sh && bash framework/tools/woodpecker/test-terminal-green-contract.sh && bash framework/tools/_scripts/test-install-ordering-guard.sh && bash framework/tools/_scripts/test-mosaic-init-rce.sh && bash framework/tools/tmux/agent-send.test.sh && bash framework/tools/wake/test-wake-store-ack.sh && bash framework/tools/wake/test-wake-store-enqueue-race.sh && bash framework/tools/wake/test-wake-digest-hmac.sh && bash framework/tools/wake/test-wake-digest-quarantine.sh && bash framework/tools/wake/test-wake-detector.sh && bash framework/tools/wake/test-wake-fn-oracle.sh && bash framework/tools/wake/test-wake-reconcile.sh && bash framework/tools/wake/test-wake-beacon.sh && bash framework/tools/wake/test-wake-preimage.sh && bash framework/tools/wake/test-wake-install.sh && bash framework/tools/glpi/test-list-http-status.sh && bash framework/tools/orchestrator/test-board-roll.sh && bash framework/tools/woodpecker/test-ci-wait-exit-matrix.sh && bash framework/tools/_scripts/test-fleet-transport-check.sh"
   },
   "dependencies": {
     "@mosaicstack/brain": "workspace:*",

packages/mosaic/src/commands/compose-contract.spec.ts

@@ -15,7 +15,6 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { FileConfigAdapter } from '../config/file-adapter.js';
-import { seedFleetIdentityDefaults } from './fleet-first-start-identity.js';
 import { composeContract } from './launch.js';
 
 /**
@@ -320,7 +319,6 @@ describe('composeContract — overlay composer', () => {
         ].join('\n'),
       );
       process.env['MOSAIC_AGENT_NAME'] = 'exact-self';
-      expect(seedFleetIdentityDefaults(installedHome)).toEqual(['SOUL.md', 'USER.md']);
 
       const composed = composeContract('pi', installedHome);
       expect(composed).toContain(sourceTools);
@@ -334,49 +332,6 @@ describe('composeContract — overlay composer', () => {
     }
   });
 
-  it('refuses a fleet USER.md replacement symlink at the point of composition', () => {
-    mkdirSync(join(fixture.home, 'fleet'), { recursive: true });
-    writeFileSync(
-      join(fixture.home, 'fleet', 'roster.yaml'),
-      [
-        'version: 1',
-        'transport: tmux',
-        'agents:',
-        '  - name: exact-user-seat',
-        '    runtime: pi',
-        '    class: worker',
-        '',
-      ].join('\n'),
-    );
-    process.env['MOSAIC_AGENT_NAME'] = 'exact-user-seat';
-    process.env['MOSAIC_AGENT_CLASS'] = 'worker';
-    writeFileSync(join(fixture.home, 'defaults', 'SOUL.md'), '# Generic soul\n');
-    writeFileSync(join(fixture.home, 'defaults', 'USER.md'), '# Generic user\n');
-    expect(seedFleetIdentityDefaults(fixture.home)).toEqual(['SOUL.md']);
-
-    const userPath = join(fixture.home, 'USER.md');
-    const external = join(fixture.root, 'attacker-user.md');
-    writeFileSync(external, 'UNSAFE-REPLACEMENT-USER-CONTENT\n');
-    rmSync(userPath);
-    symlinkSync(external, userPath);
-
-    expect(() => composeContract('pi', fixture.home)).toThrow(
-      `fleet identity installed is unavailable or unsafe: ${userPath}`,
-    );
-    expect(readFileSync(external, 'utf8')).toBe('UNSAFE-REPLACEMENT-USER-CONTENT\n');
-  });
-
-  it('preserves tolerant standalone composition when optional USER.md is unreadable', () => {
-    const userPath = join(fixture.home, 'USER.md');
-    rmSync(userPath);
-    mkdirSync(userPath);
-
-    const out = composeContract('pi', fixture.home);
-
-    expect(out).toContain(AGENTS);
-    expect(out).not.toContain('# User Profile');
-  });
-
   it.each(['claude', 'codex', 'opencode', 'pi'] as const)(
     'never injects installed TOOLS.md through a target symlink for %s',
     (runtime) => {

packages/mosaic/src/commands/fleet-first-start-identity.spec.ts

@@ -1,182 +0,0 @@
-import {
-  chmodSync,
-  existsSync,
-  mkdirSync,
-  mkdtempSync,
-  lstatSync,
-  readFileSync,
-  readdirSync,
-  rmSync,
-  statSync,
-  symlinkSync,
-  writeFileSync,
-} from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { afterEach, describe, expect, it } from 'vitest';
-import {
-  linkIdentityContractNoClobber,
-  seedFleetIdentityDefaults,
-} from './fleet-first-start-identity.js';
-
-const roots: string[] = [];
-const DEFAULT_SOUL = '# Generic soul\n';
-const DEFAULT_USER = '# Generic user\n';
-
-function writeFixture(path: string, content: string | Buffer, mode: number = 0o600): void {
-  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-  writeFileSync(path, content, { mode });
-  chmodSync(path, mode);
-}
-
-function createMosaicHome(): string {
-  const root = mkdtempSync(join(tmpdir(), 'mosaic-identity-seed-'));
-  roots.push(root);
-  const mosaicHome = join(root, 'home', '.config', 'mosaic');
-  writeFixture(join(mosaicHome, 'defaults', 'SOUL.md'), DEFAULT_SOUL);
-  writeFixture(join(mosaicHome, 'defaults', 'USER.md'), DEFAULT_USER);
-  return mosaicHome;
-}
-
-function temporarySeeds(mosaicHome: string): string[] {
-  return readdirSync(mosaicHome).filter((entry) => entry.includes('.fleet-seed-'));
-}
-
-afterEach((): void => {
-  for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
-});
-
-describe('linkIdentityContractNoClobber', () => {
-  it('returns false and preserves a destination that already exists', () => {
-    const mosaicHome = createMosaicHome();
-    const source = join(mosaicHome, 'source.tmp');
-    const destination = join(mosaicHome, 'destination.md');
-    writeFixture(source, 'candidate\n');
-    writeFixture(destination, 'operator\n');
-
-    expect(linkIdentityContractNoClobber(source, destination)).toBe(false);
-    expect(readFileSync(destination, 'utf8')).toBe('operator\n');
-  });
-
-  it('does not misclassify an unexpected link failure as a concurrent winner', () => {
-    const mosaicHome = createMosaicHome();
-    const missingSource = join(mosaicHome, 'missing.tmp');
-
-    expect(() =>
-      linkIdentityContractNoClobber(missingSource, join(mosaicHome, 'destination.md')),
-    ).toThrow();
-  });
-});
-
-describe('seedFleetIdentityDefaults', () => {
-  it('publishes complete owner-private default snapshots', () => {
-    const mosaicHome = createMosaicHome();
-
-    expect(seedFleetIdentityDefaults(mosaicHome)).toEqual(['SOUL.md', 'USER.md']);
-
-    for (const [entry, expected] of [
-      ['SOUL.md', DEFAULT_SOUL],
-      ['USER.md', DEFAULT_USER],
-    ] as const) {
-      const path = join(mosaicHome, entry);
-      expect(readFileSync(path, 'utf8')).toBe(expected);
-      expect(statSync(path).mode & 0o777).toBe(0o600);
-    }
-    expect(temporarySeeds(mosaicHome)).toEqual([]);
-  });
-
-  it('preserves an existing regular contract byte-for-byte and mode-for-mode', () => {
-    const mosaicHome = createMosaicHome();
-    const customSoul = '# Operator-owned soul\n';
-    writeFixture(join(mosaicHome, 'SOUL.md'), customSoul, 0o640);
-
-    expect(seedFleetIdentityDefaults(mosaicHome)).toEqual(['USER.md']);
-    expect(readFileSync(join(mosaicHome, 'SOUL.md'), 'utf8')).toBe(customSoul);
-    expect(statSync(join(mosaicHome, 'SOUL.md')).mode & 0o777).toBe(0o640);
-  });
-
-  it('is idempotent after both installed contracts exist', () => {
-    const mosaicHome = createMosaicHome();
-
-    expect(seedFleetIdentityDefaults(mosaicHome)).toEqual(['SOUL.md', 'USER.md']);
-    expect(seedFleetIdentityDefaults(mosaicHome)).toEqual([]);
-    expect(temporarySeeds(mosaicHome)).toEqual([]);
-  });
-
-  it('validates every required source before publishing any destination', () => {
-    const mosaicHome = createMosaicHome();
-    const missing = join(mosaicHome, 'defaults', 'USER.md');
-    rmSync(missing);
-
-    expect(() => seedFleetIdentityDefaults(mosaicHome)).toThrow(
-      `fleet identity default is unavailable or unsafe: ${missing}`,
-    );
-    expect(existsSync(join(mosaicHome, 'SOUL.md'))).toBe(false);
-    expect(existsSync(join(mosaicHome, 'USER.md'))).toBe(false);
-  });
-
-  it('fails closed when the configured Mosaic home is not a directory', () => {
-    const root = mkdtempSync(join(tmpdir(), 'mosaic-identity-invalid-home-'));
-    roots.push(root);
-    const mosaicHome = join(root, 'mosaic-home');
-    writeFixture(mosaicHome, 'not a directory\n');
-
-    expect(() => seedFleetIdentityDefaults(mosaicHome)).toThrow(
-      `fleet identity installed is unavailable or unsafe: ${join(mosaicHome, 'SOUL.md')}`,
-    );
-  });
-
-  it('refuses a symlinked default instead of following it', () => {
-    const mosaicHome = createMosaicHome();
-    const source = join(mosaicHome, 'defaults', 'SOUL.md');
-    rmSync(source);
-    symlinkSync(join(mosaicHome, 'defaults', 'USER.md'), source);
-
-    expect(() => seedFleetIdentityDefaults(mosaicHome)).toThrow(
-      `fleet identity default is unavailable or unsafe: ${source}`,
-    );
-    expect(existsSync(join(mosaicHome, 'SOUL.md'))).toBe(false);
-  });
-
-  it('refuses an existing symlinked destination without replacing it', () => {
-    const mosaicHome = createMosaicHome();
-    const destination = join(mosaicHome, 'SOUL.md');
-    symlinkSync(join(mosaicHome, 'defaults', 'SOUL.md'), destination);
-
-    expect(() => seedFleetIdentityDefaults(mosaicHome)).toThrow(
-      `fleet identity installed is unavailable or unsafe: ${destination}`,
-    );
-    expect(lstatSync(destination).isSymbolicLink()).toBe(true);
-    expect(existsSync(join(mosaicHome, 'USER.md'))).toBe(false);
-  });
-
-  it.each(['SOUL.md', 'USER.md'] as const)(
-    'rejects a dangling %s destination before publishing its counterpart',
-    (entry) => {
-      const mosaicHome = createMosaicHome();
-      const destination = join(mosaicHome, entry);
-      const counterpart = join(mosaicHome, entry === 'SOUL.md' ? 'USER.md' : 'SOUL.md');
-      symlinkSync(join(mosaicHome, 'missing-identity-target'), destination);
-
-      expect(existsSync(destination)).toBe(false);
-      expect(lstatSync(destination).isSymbolicLink()).toBe(true);
-      expect(() => seedFleetIdentityDefaults(mosaicHome)).toThrow(
-        `fleet identity installed is unavailable or unsafe: ${destination}`,
-      );
-      expect(lstatSync(destination).isSymbolicLink()).toBe(true);
-      expect(existsSync(counterpart)).toBe(false);
-    },
-  );
-
-  it('rejects an oversized source before publishing a partial identity', () => {
-    const mosaicHome = createMosaicHome();
-    const source = join(mosaicHome, 'defaults', 'USER.md');
-    writeFixture(source, Buffer.alloc(256 * 1024 + 1, 0x61));
-
-    expect(() => seedFleetIdentityDefaults(mosaicHome)).toThrow(
-      `fleet identity default is unavailable or unsafe: ${source}`,
-    );
-    expect(existsSync(join(mosaicHome, 'SOUL.md'))).toBe(false);
-    expect(existsSync(join(mosaicHome, 'USER.md'))).toBe(false);
-  });
-});

packages/mosaic/src/commands/fleet-first-start-identity.ts

@@ -1,120 +0,0 @@
-import { randomBytes } from 'node:crypto';
-import { linkSync, lstatSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { readRegularFileSecure } from '../fleet/secure-file.js';
-
-const MAX_IDENTITY_CONTRACT_BYTES = 256 * 1024;
-export const FLEET_IDENTITY_DEFAULTS = ['SOUL.md', 'USER.md'] as const;
-
-function isFilesystemError(error: unknown, code: string): boolean {
-  return error instanceof Error && 'code' in error && error.code === code;
-}
-
-/** @internal Publish a complete temporary file without replacing any path. */
-export function linkIdentityContractNoClobber(source: string, destination: string): boolean {
-  try {
-    linkSync(source, destination);
-    return true;
-  } catch (error: unknown) {
-    if (isFilesystemError(error, 'EEXIST')) return false;
-    throw error;
-  }
-}
-
-function unsafeIdentityError(kind: 'default' | 'installed', path: string, error: unknown): Error {
-  const reason = error instanceof Error ? error.message : String(error);
-  return new Error(`fleet identity ${kind} is unavailable or unsafe: ${path} (${reason})`);
-}
-
-function readIdentityContract(
-  mosaicHome: string,
-  path: string,
-  kind: 'default' | 'installed',
-): Buffer {
-  try {
-    return readRegularFileSecure(path, {
-      root: mosaicHome,
-      maxBytes: MAX_IDENTITY_CONTRACT_BYTES,
-    }).content;
-  } catch (error: unknown) {
-    throw unsafeIdentityError(kind, path, error);
-  }
-}
-
-function installedEntryExists(path: string): boolean {
-  try {
-    lstatSync(path);
-    return true;
-  } catch (error: unknown) {
-    if (isFilesystemError(error, 'ENOENT')) return false;
-    throw unsafeIdentityError('installed', path, error);
-  }
-}
-
-/** Secure fleet point-of-use read for a top-level identity contract. */
-export function readInstalledIdentityContractAtPointOfUse(
-  mosaicHome: string,
-  entry: (typeof FLEET_IDENTITY_DEFAULTS)[number],
-): Buffer {
-  const configuredPath = join(mosaicHome, entry);
-  try {
-    // Preserve the launcher's established support for a symlinked Mosaic home,
-    // while pinning this read to the resolved directory. O_NOFOLLOW still
-    // rejects replacement of the identity file itself (or any child ancestor).
-    const canonicalHome = realpathSync(mosaicHome);
-    return readRegularFileSecure(join(canonicalHome, entry), {
-      root: canonicalHome,
-      maxBytes: MAX_IDENTITY_CONTRACT_BYTES,
-    }).content;
-  } catch (error: unknown) {
-    throw unsafeIdentityError('installed', configuredPath, error);
-  }
-}
-
-/**
- * Seed the generic identity base required by unattended fleet launches.
- *
- * Exact seat identity remains roster-owned and is injected later by the
- * runtime composer. Each destination appears atomically through a hard link to
- * a complete owner-private temporary file; a concurrent first seat may win the
- * link without allowing either process to overwrite operator content.
- */
-export function seedFleetIdentityDefaults(mosaicHome: string): string[] {
-  const snapshots = new Map<(typeof FLEET_IDENTITY_DEFAULTS)[number], Buffer>();
-
-  for (const entry of FLEET_IDENTITY_DEFAULTS) {
-    const destination = join(mosaicHome, entry);
-    if (installedEntryExists(destination)) {
-      readIdentityContract(mosaicHome, destination, 'installed');
-      continue;
-    }
-    const source = join(mosaicHome, 'defaults', entry);
-    snapshots.set(entry, readIdentityContract(mosaicHome, source, 'default'));
-  }
-
-  const seeded: string[] = [];
-  for (const [entry, content] of snapshots) {
-    const destination = join(mosaicHome, entry);
-    const temporary = join(
-      mosaicHome,
-      `.${entry}.fleet-seed-${process.pid.toString()}-${randomBytes(6).toString('hex')}`,
-    );
-    let temporaryCreated = false;
-    try {
-      writeFileSync(temporary, content, { flag: 'wx', mode: 0o600 });
-      temporaryCreated = true;
-      if (linkIdentityContractNoClobber(temporary, destination)) {
-        seeded.push(entry);
-      } else {
-        readIdentityContract(mosaicHome, destination, 'installed');
-      }
-    } finally {
-      if (temporaryCreated) rmSync(temporary, { force: true });
-    }
-  }
-
-  for (const entry of FLEET_IDENTITY_DEFAULTS) {
-    readIdentityContract(mosaicHome, join(mosaicHome, entry), 'installed');
-  }
-  return seeded;
-}

packages/mosaic/src/commands/launch-first-start.spec.ts

@@ -1,393 +0,0 @@
-import { spawn, spawnSync, type SpawnSyncReturns } from 'node:child_process';
-import {
-  chmodSync,
-  existsSync,
-  mkdirSync,
-  mkdtempSync,
-  readFileSync,
-  readdirSync,
-  rmSync,
-  statSync,
-  symlinkSync,
-  writeFileSync,
-} from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { afterEach, describe, expect, it } from 'vitest';
-
-const CLI_PATH = fileURLToPath(new URL('../../dist/cli.js', import.meta.url));
-const DEFAULT_SOUL_PATH = fileURLToPath(
-  new URL('../../framework/defaults/SOUL.md', import.meta.url),
-);
-const DEFAULT_USER_PATH = fileURLToPath(
-  new URL('../../framework/defaults/USER.md', import.meta.url),
-);
-
-interface GreenfieldFixture {
-  readonly root: string;
-  readonly home: string;
-  readonly mosaicHome: string;
-  readonly binDir: string;
-  readonly capturePath: string;
-}
-
-interface AsyncLaunchResult {
-  readonly status: number | null;
-  readonly signal: NodeJS.Signals | null;
-  readonly stdout: string;
-  readonly stderr: string;
-}
-
-const fixtures: string[] = [];
-
-function writeFixture(path: string, content: string, mode: number = 0o600): void {
-  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-  writeFileSync(path, content, { encoding: 'utf8', mode });
-  chmodSync(path, mode);
-}
-
-function createGreenfieldFixture(): GreenfieldFixture {
-  const root = mkdtempSync(join(tmpdir(), 'mosaic-first-start-'));
-  fixtures.push(root);
-  const home = join(root, 'home');
-  const mosaicHome = join(home, '.config', 'mosaic');
-  const binDir = join(root, 'bin');
-  const capturePath = join(root, 'runtime-boundary.json');
-
-  mkdirSync(binDir, { recursive: true, mode: 0o700 });
-  writeFixture(join(mosaicHome, 'AGENTS.md'), '# Agent dispatcher\n');
-  writeFixture(join(mosaicHome, 'runtime', 'pi', 'RUNTIME.md'), '# Pi runtime\n');
-  writeFixture(join(mosaicHome, 'defaults', 'SOUL.md'), readFileSync(DEFAULT_SOUL_PATH, 'utf8'));
-  writeFixture(join(mosaicHome, 'defaults', 'USER.md'), readFileSync(DEFAULT_USER_PATH, 'utf8'));
-  writeFixture(
-    join(mosaicHome, 'fleet', 'roster.yaml'),
-    `version: 1
-transport: tmux
-tmux:
-  socket_name: mosaic-fleet
-  holder_session: _holder
-defaults:
-  working_directory: ~
-runtimes:
-  pi:
-    reset_command: /new
-agents:
-  - name: unattended-seat
-    runtime: pi
-    class: worker
-`,
-  );
-  writeFixture(
-    join(mosaicHome, 'tools', 'tmux', 'agent-send.sh'),
-    '#!/usr/bin/env bash\nexit 0\n',
-    0o755,
-  );
-  writeFixture(
-    join(mosaicHome, 'tools', 'lease-broker', 'launch-runtime.py'),
-    `#!/usr/bin/env python3
-import json
-import os
-import pathlib
-import sys
-pathlib.Path(os.environ["MOSAIC_TEST_RUNTIME_CAPTURE"]).write_text(
-    json.dumps({"argv": sys.argv[1:]}), encoding="utf-8"
-)
-`,
-    0o755,
-  );
-  // checkRuntime() must find Pi, while the fake broker boundary prevents this
-  // executable from running or making a provider call.
-  writeFixture(join(binDir, 'pi'), '#!/usr/bin/env bash\nexit 97\n', 0o755);
-
-  return { root, home, mosaicHome, binDir, capturePath };
-}
-
-function launchEnvironment(
-  fixture: GreenfieldFixture,
-  capturePath: string,
-  fleet: boolean = true,
-  agentName: string = 'unattended-seat',
-  agentClass: string = 'worker',
-): NodeJS.ProcessEnv {
-  return {
-    HOME: fixture.home,
-    MOSAIC_HOME: fixture.mosaicHome,
-    ...(fleet
-      ? {
-          MOSAIC_AGENT_NAME: agentName,
-          MOSAIC_AGENT_CLASS: agentClass,
-        }
-      : {}),
-    MOSAIC_TEST_RUNTIME_CAPTURE: capturePath,
-    PATH: `${fixture.binDir}:/usr/bin:/bin`,
-  };
-}
-
-function launchSync(
-  fixture: GreenfieldFixture,
-  options: {
-    readonly capturePath?: string;
-    readonly fleet?: boolean;
-    readonly agentName?: string;
-    readonly agentClass?: string;
-  } = {},
-): SpawnSyncReturns<string> {
-  const capturePath = options.capturePath ?? fixture.capturePath;
-  return spawnSync(process.execPath, [CLI_PATH, 'yolo', 'pi'], {
-    cwd: fixture.root,
-    encoding: 'utf8',
-    input: '',
-    timeout: 10_000,
-    env: launchEnvironment(
-      fixture,
-      capturePath,
-      options.fleet ?? true,
-      options.agentName ?? 'unattended-seat',
-      options.agentClass ?? 'worker',
-    ),
-  });
-}
-
-function launchAsync(fixture: GreenfieldFixture, capturePath: string): Promise<AsyncLaunchResult> {
-  return new Promise<AsyncLaunchResult>((resolve, reject): void => {
-    const child = spawn(process.execPath, [CLI_PATH, 'yolo', 'pi'], {
-      cwd: fixture.root,
-      env: launchEnvironment(fixture, capturePath),
-      stdio: ['pipe', 'pipe', 'pipe'],
-    });
-    let stdout = '';
-    let stderr = '';
-    child.stdout.setEncoding('utf8');
-    child.stderr.setEncoding('utf8');
-    child.stdout.on('data', (chunk: string): void => {
-      stdout += chunk;
-    });
-    child.stderr.on('data', (chunk: string): void => {
-      stderr += chunk;
-    });
-    child.on('error', reject);
-    child.on('close', (status: number | null, signal: NodeJS.Signals | null): void => {
-      resolve({ status, signal, stdout, stderr });
-    });
-    child.stdin.end();
-  });
-}
-
-function outputOf(result: { readonly stdout: string; readonly stderr: string }): string {
-  return `${result.stdout}${result.stderr}`;
-}
-
-function assertPrivateDefaultSeeds(fixture: GreenfieldFixture): void {
-  const soul = join(fixture.mosaicHome, 'SOUL.md');
-  const user = join(fixture.mosaicHome, 'USER.md');
-  expect(readFileSync(soul, 'utf8')).toBe(readFileSync(DEFAULT_SOUL_PATH, 'utf8'));
-  expect(readFileSync(user, 'utf8')).toBe(readFileSync(DEFAULT_USER_PATH, 'utf8'));
-  expect(statSync(soul).mode & 0o777).toBe(0o600);
-  expect(statSync(user).mode & 0o777).toBe(0o600);
-}
-
-function capturedArguments(path: string): string[] {
-  const capture = JSON.parse(readFileSync(path, 'utf8')) as { argv: string[] };
-  return capture.argv;
-}
-
-afterEach((): void => {
-  for (const root of fixtures.splice(0)) {
-    rmSync(root, { recursive: true, force: true });
-  }
-});
-
-describe('fleet unattended first start (#1264)', () => {
-  it('reaches the runtime boundary without a TTY or identity wizard on a clean install', () => {
-    const fixture = createGreenfieldFixture();
-    const result = launchSync(fixture);
-    const output = outputOf(result);
-
-    expect(result.error, output).toBeUndefined();
-    expect(result.status, output).toBe(0);
-    expect(output).toContain('Initialized unattended fleet identity defaults: SOUL.md, USER.md');
-    expect(output).not.toContain('Running setup wizard');
-    expect(output).not.toContain('What would you like to do?');
-    expect(existsSync(fixture.capturePath), output).toBe(true);
-    assertPrivateDefaultSeeds(fixture);
-
-    const argv = capturedArguments(fixture.capturePath);
-    expect(argv).toContain('--runtime');
-    expect(argv.join('\n')).toContain('Agent/session: `unattended-seat`');
-    expect(argv.join('\n')).toContain('Role/class: `worker`');
-  });
-
-  it('preserves existing operator identity bytes without requiring defaults', () => {
-    const fixture = createGreenfieldFixture();
-    const customSoul = '# Operator soul\nNever replace this.\n';
-    const customUser = '# Operator user\nNever replace this either.\n';
-    writeFixture(join(fixture.mosaicHome, 'SOUL.md'), customSoul, 0o640);
-    writeFixture(join(fixture.mosaicHome, 'USER.md'), customUser, 0o600);
-    rmSync(join(fixture.mosaicHome, 'defaults'), { recursive: true, force: true });
-
-    const first = launchSync(fixture);
-    const secondCapture = join(fixture.root, 'runtime-boundary-second.json');
-    const second = launchSync(fixture, { capturePath: secondCapture });
-
-    expect(first.status, outputOf(first)).toBe(0);
-    expect(second.status, outputOf(second)).toBe(0);
-    expect(readFileSync(join(fixture.mosaicHome, 'SOUL.md'), 'utf8')).toBe(customSoul);
-    expect(readFileSync(join(fixture.mosaicHome, 'USER.md'), 'utf8')).toBe(customUser);
-    expect(statSync(join(fixture.mosaicHome, 'SOUL.md')).mode & 0o777).toBe(0o640);
-    expect(existsSync(fixture.capturePath)).toBe(true);
-    expect(existsSync(secondCapture)).toBe(true);
-  });
-
-  it('seeds only the missing identity contract and leaves a custom SOUL byte-exact', () => {
-    const fixture = createGreenfieldFixture();
-    const customSoul = '# Exact custom soul bytes\n';
-    writeFixture(join(fixture.mosaicHome, 'SOUL.md'), customSoul, 0o640);
-
-    const result = launchSync(fixture);
-
-    expect(result.status, outputOf(result)).toBe(0);
-    expect(outputOf(result)).toContain('Initialized unattended fleet identity defaults: USER.md');
-    expect(readFileSync(join(fixture.mosaicHome, 'SOUL.md'), 'utf8')).toBe(customSoul);
-    expect(statSync(join(fixture.mosaicHome, 'SOUL.md')).mode & 0o777).toBe(0o640);
-    expect(readFileSync(join(fixture.mosaicHome, 'USER.md'), 'utf8')).toBe(
-      readFileSync(DEFAULT_USER_PATH, 'utf8'),
-    );
-  });
-
-  it('fails closed without a wizard or partial seed when a required default is missing', () => {
-    const fixture = createGreenfieldFixture();
-    const missingDefault = join(fixture.mosaicHome, 'defaults', 'USER.md');
-    rmSync(missingDefault);
-
-    const result = launchSync(fixture);
-    const output = outputOf(result);
-
-    expect(result.status, output).toBe(1);
-    expect(output).toContain('unattended fleet identity initialization failed');
-    expect(output).toContain(missingDefault);
-    expect(output).not.toContain('Running setup wizard');
-    expect(output).not.toContain('What would you like to do?');
-    expect(existsSync(fixture.capturePath)).toBe(false);
-    expect(existsSync(join(fixture.mosaicHome, 'SOUL.md'))).toBe(false);
-    expect(existsSync(join(fixture.mosaicHome, 'USER.md'))).toBe(false);
-  });
-
-  it('rejects a symlinked identity default without following it or prompting', () => {
-    const fixture = createGreenfieldFixture();
-    const soulDefault = join(fixture.mosaicHome, 'defaults', 'SOUL.md');
-    rmSync(soulDefault);
-    symlinkSync(DEFAULT_SOUL_PATH, soulDefault);
-
-    const result = launchSync(fixture);
-    const output = outputOf(result);
-
-    expect(result.status, output).toBe(1);
-    expect(output).toContain(`fleet identity default is unavailable or unsafe: ${soulDefault}`);
-    expect(output).not.toContain('Running setup wizard');
-    expect(existsSync(fixture.capturePath)).toBe(false);
-  });
-
-  it('refuses an unknown ambient fleet name before seeding or prompting', () => {
-    const fixture = createGreenfieldFixture();
-
-    const result = launchSync(fixture, { agentName: 'not-in-the-roster' });
-    const output = outputOf(result);
-
-    expect(result.status, output).toBe(1);
-    expect(output).toContain('canonical fleet identity is unavailable');
-    expect(output).toContain('Agent "not-in-the-roster" is not in the fleet roster');
-    expect(output).not.toContain('Running setup wizard');
-    expect(existsSync(fixture.capturePath)).toBe(false);
-    expect(existsSync(join(fixture.mosaicHome, 'SOUL.md'))).toBe(false);
-    expect(existsSync(join(fixture.mosaicHome, 'USER.md'))).toBe(false);
-  });
-
-  it('refuses a mismatched ambient fleet class before seeding or prompting', () => {
-    const fixture = createGreenfieldFixture();
-
-    const result = launchSync(fixture, { agentClass: 'reviewer' });
-    const output = outputOf(result);
-
-    expect(result.status, output).toBe(1);
-    expect(output).toContain('Refusing split identity authority');
-    expect(output).not.toContain('Running setup wizard');
-    expect(existsSync(fixture.capturePath)).toBe(false);
-    expect(existsSync(join(fixture.mosaicHome, 'SOUL.md'))).toBe(false);
-    expect(existsSync(join(fixture.mosaicHome, 'USER.md'))).toBe(false);
-  });
-
-  it.each(['', ' ', '\t'])(
-    'refuses explicit blank ambient fleet class %j before seeding',
-    (agentClass: string) => {
-      const fixture = createGreenfieldFixture();
-
-      const result = launchSync(fixture, { agentClass });
-      const output = outputOf(result);
-
-      expect(result.status, output).toBe(1);
-      expect(output).toContain('Refusing split identity authority');
-      expect(output).not.toContain('Running setup wizard');
-      expect(existsSync(fixture.capturePath)).toBe(false);
-      expect(existsSync(join(fixture.mosaicHome, 'SOUL.md'))).toBe(false);
-      expect(existsSync(join(fixture.mosaicHome, 'USER.md'))).toBe(false);
-    },
-  );
-
-  it.each([' unattended-seat', 'unattended-seat ', ''])(
-    'refuses non-exact ambient fleet name %j before seeding',
-    (agentName: string) => {
-      const fixture = createGreenfieldFixture();
-
-      const result = launchSync(fixture, { agentName });
-      const output = outputOf(result);
-
-      expect(result.status, output).toBe(1);
-      expect(output).toContain(
-        'MOSAIC_AGENT_NAME must be a non-empty exact roster name with no surrounding whitespace',
-      );
-      expect(output).not.toContain('Running setup wizard');
-      expect(existsSync(fixture.capturePath)).toBe(false);
-      expect(existsSync(join(fixture.mosaicHome, 'SOUL.md'))).toBe(false);
-      expect(existsSync(join(fixture.mosaicHome, 'USER.md'))).toBe(false);
-    },
-  );
-
-  it('keeps the interactive wizard path for a standalone launch', () => {
-    const fixture = createGreenfieldFixture();
-
-    const result = launchSync(fixture, { fleet: false });
-    const output = outputOf(result);
-
-    expect(result.status, output).toBe(1);
-    expect(output).toContain('[mosaic] SOUL.md not found. Running setup wizard...');
-    expect(output).toContain('What would you like to do?');
-    expect(output).toContain('[mosaic] Setup failed. Run: mosaic wizard');
-    expect(existsSync(fixture.capturePath)).toBe(false);
-    expect(existsSync(join(fixture.mosaicHome, 'SOUL.md'))).toBe(false);
-  });
-
-  it('allows concurrent no-TTY seats to initialize the same defaults without clobber or residue', async () => {
-    const fixture = createGreenfieldFixture();
-    const captures = Array.from({ length: 4 }, (_, index) =>
-      join(fixture.root, `runtime-boundary-${index.toString()}.json`),
-    );
-
-    const results = await Promise.all(
-      captures.map(
-        async (capturePath): Promise<AsyncLaunchResult> => launchAsync(fixture, capturePath),
-      ),
-    );
-
-    for (const result of results) {
-      expect(result.status, outputOf(result)).toBe(0);
-      expect(result.signal, outputOf(result)).toBeNull();
-      expect(outputOf(result)).not.toContain('Running setup wizard');
-    }
-    assertPrivateDefaultSeeds(fixture);
-    expect(captures.every((capturePath) => existsSync(capturePath))).toBe(true);
-    expect(
-      readdirSync(fixture.mosaicHome).filter((entry) => entry.includes('.fleet-seed-')),
-    ).toEqual([]);
-  });
-});

packages/mosaic/src/commands/launch.ts

@@ -30,10 +30,6 @@ import { readRegularFileSecure } from '../fleet/secure-file.js';
 import { readPersonaContractBlock } from '../fleet/persona-contract.js';
 import { canonicalizeRoleClass } from './fleet-personas.js';
 import { launchClaudex, type ClaudexHarnessAdapter } from './claudex.js';
-import {
-  readInstalledIdentityContractAtPointOfUse,
-  seedFleetIdentityDefaults,
-} from './fleet-first-start-identity.js';
 import { runLeaseEnforcementDoctorCheck } from './lease-doctor-check.js';
 
 const MOSAIC_HOME = process.env['MOSAIC_HOME'] ?? join(homedir(), '.config', 'mosaic');
@@ -234,55 +230,8 @@ function checkRuntime(cmd: string): void {
   }
 }
 
-function assertAmbientFleetClassMatches(canonicalName: string, canonicalClass: string): void {
-  const configuredClass = process.env['MOSAIC_AGENT_CLASS'];
-  if (configuredClass === undefined) return;
-
-  const ambientClass = canonicalizeRoleClass(configuredClass).canonicalClass;
-  if (ambientClass !== canonicalClass) {
-    throw new Error(
-      `Ambient MOSAIC_AGENT_CLASS resolves to "${ambientClass}" but canonical roster member "${canonicalName}" resolves to "${canonicalClass}". Refusing split identity authority.`,
-    );
-  }
-}
-
 function checkSoul(): void {
   const soulPath = join(MOSAIC_HOME, 'SOUL.md');
-  const fleetAgentName = process.env['MOSAIC_AGENT_NAME'];
-  if (fleetAgentName !== undefined) {
-    try {
-      if (fleetAgentName.length === 0 || fleetAgentName !== fleetAgentName.trim()) {
-        throw new Error(
-          'MOSAIC_AGENT_NAME must be a non-empty exact roster name with no surrounding whitespace',
-        );
-      }
-      const fleetIdentity = resolveFleetIdentity(MOSAIC_HOME, fleetAgentName);
-      if (!fleetIdentity.ok || !fleetIdentity.identity) {
-        throw new Error(
-          `canonical fleet identity is unavailable: ${fleetIdentity.error ?? 'exact roster member was not resolved'}`,
-        );
-      }
-      assertAmbientFleetClassMatches(
-        fleetIdentity.identity.member.name,
-        fleetIdentity.identity.member.className,
-      );
-      const seeded = seedFleetIdentityDefaults(MOSAIC_HOME);
-      if (seeded.length > 0) {
-        console.log(
-          `[mosaic] Initialized unattended fleet identity defaults: ${seeded.join(', ')}. Exact seat identity remains roster-owned.`,
-        );
-      }
-      return;
-    } catch (error: unknown) {
-      const reason = error instanceof Error ? error.message : String(error);
-      console.error(`[mosaic] ERROR: unattended fleet identity initialization failed: ${reason}`);
-      console.error(
-        '[mosaic] Repair the named fleet roster, launch identity, installed contract, or shipped default, then retry.',
-      );
-      process.exit(1);
-    }
-  }
-
   if (!existsSync(soulPath)) {
     console.log('[mosaic] SOUL.md not found. Running setup wizard...');
 
@@ -583,27 +532,26 @@ For required push/merge/issue-close/release actions, execute without routine con
   parts.push(readFileSync(join(mosaicHome, 'AGENTS.md'), 'utf-8'));
 
   // USER.md (+ USER.local.md operator overlay, appended directly under the
-  // profile its base owns). Fleet first start is Linux/systemd-owned and uses
-  // the no-follow reader at point of use. Standalone launches retain the
-  // portable tolerant path used on macOS and other supported hosts.
-  const fleetAgentName = process.env['MOSAIC_AGENT_NAME'];
-  const user =
-    fleetAgentName === undefined
-      ? readOptional(join(mosaicHome, 'USER.md'))
-      : readInstalledIdentityContractAtPointOfUse(mosaicHome, 'USER.md').toString('utf8');
+  // profile its base owns).
+  const user = readOptional(join(mosaicHome, 'USER.md'));
   if (user) parts.push('\n\n# User Profile\n\n' + user);
   const userLocal = readOptional(join(mosaicHome, 'USER.local.md'));
   if (userLocal.trim()) {
     parts.push('\n\n## Operator Overlay (USER.local.md)\n\n' + userLocal);
   }
 
-  const fleetIdentity = resolveFleetIdentity(mosaicHome, fleetAgentName);
+  const fleetIdentity = resolveFleetIdentity(mosaicHome, process.env['MOSAIC_AGENT_NAME']);
   if (!fleetIdentity.ok) {
     throw new Error(`Fleet communications contract unavailable: ${fleetIdentity.error}`);
   }
   const canonicalMember = fleetIdentity.identity?.member;
-  if (canonicalMember) {
-    assertAmbientFleetClassMatches(canonicalMember.name, canonicalMember.className);
+  if (canonicalMember && process.env['MOSAIC_AGENT_CLASS']?.trim()) {
+    const ambientClass = canonicalizeRoleClass(process.env['MOSAIC_AGENT_CLASS']).canonicalClass;
+    if (ambientClass !== canonicalMember.className) {
+      throw new Error(
+        `Ambient MOSAIC_AGENT_CLASS resolves to "${ambientClass}" but canonical roster member "${canonicalMember.name}" resolves to "${canonicalMember.className}". Refusing split identity authority.`,
+      );
+    }
   }
 
   // TOOLS.md