fix(tools/git): restore executable bit on new per-agent-identity scripts

core.filemode=false in this worktree meant the initial commit recorded
git-credential-mosaic, test-git-credential-mosaic.sh, and
test-gitea-token-identity.sh as 100644. git invokes a path-configured
credential.helper directly (exec, not `sh <path>`), so git-credential-mosaic
must carry the executable bit; the two test scripts match the 100755
convention already used by the other test-*.sh harnesses in this directory.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packages/mosaic/framework/install.sh

@@ -639,6 +639,10 @@ reconcile_framework_files
 # Ensure tool scripts are executable
 find "$TARGET_DIR/tools" -name "*.sh" -exec chmod +x {} + 2>/dev/null || true
 find "$TARGET_DIR/tools/_scripts" -type f -exec chmod +x {} + 2>/dev/null || true
+# git-credential-mosaic (per-agent Gitea identity helper) ships without a .sh
+# suffix — git resolves credential helpers by exact name/path, not extension —
+# so the *.sh glob above does not cover it; chmod it explicitly.
+[[ -f "$TARGET_DIR/tools/git/git-credential-mosaic" ]] && chmod +x "$TARGET_DIR/tools/git/git-credential-mosaic" 2>/dev/null || true
 
 ok "Framework synced to $TARGET_DIR"
 

packages/mosaic/framework/systemd/user/mosaic-lease-broker.service

@@ -0,0 +1,22 @@
+[Unit]
+Description=Mosaic lease broker daemon (framework tools/lease-broker/daemon.py)
+Documentation=https://git.mosaicstack.dev/mosaicstack/stack
+After=default.target
+
+[Service]
+Type=simple
+# The broker socket lives under the runtime directory so it disappears with
+# the user session instead of surviving as stale state across logins.
+# daemon.py's secure_parent() fails closed unless this directory is exactly
+# 0700, so RuntimeDirectoryMode is not cosmetic.
+RuntimeDirectory=mosaic-lease
+RuntimeDirectoryMode=0700
+# Remove loader and noninteractive-shell controls before ExecStart loads env,
+# matching the tmux fleet units in this same directory.
+UnsetEnvironment=LD_PRELOAD BASH_ENV ENV
+ExecStart=/usr/bin/env -i HOME=%h PATH=/usr/bin:/bin XDG_RUNTIME_DIR=%t /bin/bash --noprofile --norc %h/.config/mosaic/tools/lease-broker/start-lease-broker.sh
+Restart=on-failure
+RestartSec=1
+
+[Install]
+WantedBy=default.target

packages/mosaic/framework/tools/git/README.md

@@ -33,3 +33,64 @@ The Gitea API token is **never passed on a curl command line.** An `Authorizatio
 Both `pr-review.sh` and `issue-comment.sh` accept an optional `--login <name>` flag that overrides the automatically detected Gitea login for that single invocation. The override selects **which credential the REST write, the `/user` identity lookup, and the read-back all use** — its token is resolved from the tea config for that login name (`get_gitea_token_for_login`), falling back to the repo host's credential when no login is named. The resolved login is **host- and port-bound**: the login's configured URL host **and effective port** (the scheme's default port — 80 for `http`, 443 for `https` — applies when a port is omitted, symmetrically on both sides) must match the repo remote's, so a login name shared across hosts (or an override configured for a different Gitea, including one on a different port of the same host) can never send one host's credential to another — a host or port mismatch fails closed rather than leaking a cross-host token. Resolving the acting identity and the read-back from the _same_ login that performs the write is essential: a write performed under an overridden login must be verified against that login's identity, not the host default's. Callers who need a different login than the host default should pass `--login <reviewer-login>`.
 
 As a durable successor to this mechanism, consider giving each reviewer/approver slot its own dedicated Gitea login credential, so that author≠reviewer holds at the credential level rather than relying on wrapper-level `--login` bookkeeping. This is a recommendation for future hardening, not something implemented by this flag.
+
+## Per-agent Gitea identity (Gate-16 author≠reviewer)
+
+By default, git push/fetch (via `git-credential-mosaic`) and the API wrappers above (via
+`detect-platform.sh`'s `get_gitea_token`) all authenticate as the single shared Gitea
+account/token configured through `tools/_lib/credentials.sh`. That means every agent in a
+fleet commits, pushes, and opens PRs under one identity — with no cryptographic
+separation between an author and a reviewer.
+
+Both `git-credential-mosaic` and `get_gitea_token()` resolve an optional **per-agent
+identity** before falling back to the shared account:
+
+1. `MOSAIC_GIT_IDENTITY` environment variable, or
+2. `git config --get mosaic.gitIdentity` (set per-worktree; persists on disk across
+   non-persistent shells — `git config mosaic.gitIdentity <agent-id>`), or
+3. (git-credential-mosaic only) the username git itself supplies for the credential
+   request.
+
+If the resolved identity has a token file at
+`~/.config/mosaic/secrets/gitea-tokens/gitea-{usc,mosaicstack}-<agent-id>.token`, that
+identity + token is used. **Nothing configured → nothing changes**: with no per-slot
+token file present, both tools fall through to the existing shared-account path
+unchanged, so this feature is a no-op on any host that hasn't provisioned per-slot
+tokens.
+
+### Enabling it for a clone
+
+The framework installer syncs `git-credential-mosaic` to
+`~/.config/mosaic/tools/git/git-credential-mosaic` (executable) on every install/update,
+but does **not** register it as git's credential helper automatically. Registration is a
+one-time, explicit step:
+
+```bash
+# Per-repo (recommended — scopes the helper to this clone only):
+git config credential.helper "$HOME/.config/mosaic/tools/git/git-credential-mosaic"
+
+# Per-worktree identity pin (Gate-16 separation):
+git config mosaic.gitIdentity <agent-id>
+```
+
+This is deliberately **not** auto-registered on install/update: `credential.helper` is
+global, order-sensitive git config (`~/.gitconfig`) that can already hold an
+operator-chosen credential manager (keychain, `store`, `manager-core`, …) for
+repositories unrelated to Mosaic. Silently inserting an entry on every framework
+install/upgrade risks reordering or shadowing that operator-owned surface across the
+whole host — the same operator-owned config the installer's manifest system is
+otherwise careful never to touch. Because identity is already resolved per-worktree
+(`mosaic.gitIdentity`), the correct granularity for registering the helper is per-clone
+too, so a documented manual step is the right shape here, not a global auto-write.
+
+### PowerShell parity
+
+`detect-platform.ps1`'s Gitea wrappers authenticate through `tea` CLI logins
+(`Get-GiteaLoginForHost`), not a raw-token `get_gitea_token`-equivalent function — there
+is nothing to prepend the identity-resolution block to on the PowerShell side. A native
+PowerShell git-credential helper is also unnecessary: `git-credential-mosaic` is invoked
+by git's credential-helper protocol (stdin/stdout), which works identically under Git for
+Windows' bundled `bash`/`sh` when configured via `credential.helper`, without a `.ps1`
+counterpart. A `tea`-login-based per-agent identity for the PowerShell wrappers is a
+separate, larger design (mapping identities to `tea login` profiles) and is out of scope
+here.

packages/mosaic/framework/tools/git/ci-queue-wait.ps1

@@ -185,6 +185,16 @@ switch ($platform) {
             $headSha = ($branchPayload.commit.id | Out-String).Trim()
         }
         catch {
+            # A not-yet-pushed feature branch has no in-flight pipeline, so the
+            # pre-push queue guard must treat 404 as "queue clear", not crash.
+            $statusCode = $null
+            if ($_.Exception.Response) {
+                $statusCode = [int]$_.Exception.Response.StatusCode
+            }
+            if ($statusCode -eq 404) {
+                Write-Host "[ci-queue-wait] branch $Branch not yet on remote — no in-flight pipeline; queue clear."
+                exit 0
+            }
             Write-Error "Could not resolve $Branch head SHA from Gitea API."
             exit 1
         }

packages/mosaic/framework/tools/git/ci-queue-wait.sh

@@ -137,7 +137,21 @@ gitea_get_branch_head_sha() {
     local branch="$3"
     local token="$4"
     local url="https://${host}/api/v1/repos/${repo}/branches/${branch}"
-    curl -fsSL -H "User-Agent: curl/8" -H "Authorization: token ${token}" "$url" | python3 -c '
+    # Capture HTTP status so an absent branch (404) is distinguished from an API
+    # error. A not-yet-pushed feature branch has no in-flight pipeline, so the
+    # pre-push queue guard must treat 404 as "queue clear", not crash.
+    local resp code body
+    resp=$(curl -sS -H "User-Agent: curl/8" -H "Authorization: token ${token}" -w $'\n%{http_code}' "$url")
+    code="${resp##*$'\n'}"
+    body="${resp%$'\n'*}"
+    if [[ "$code" == "404" ]]; then
+        echo "__BRANCH_ABSENT__"
+        return 0
+    fi
+    if [[ "$code" != "200" ]]; then
+        return 1
+    fi
+    printf '%s' "$body" | python3 -c '
 import json, sys
 data = json.load(sys.stdin)
 commit = data.get("commit") or {}
@@ -219,6 +233,10 @@ elif [[ "$PLATFORM" == "gitea" ]]; then
         exit 1
     }
     HEAD_SHA=$(gitea_get_branch_head_sha "$HOST" "$OWNER/$REPO" "$BRANCH" "$TOKEN")
+    if [[ "$HEAD_SHA" == "__BRANCH_ABSENT__" ]]; then
+        echo "[ci-queue-wait] branch ${BRANCH} not yet on remote — no in-flight pipeline; queue clear."
+        exit 0
+    fi
     if [[ -z "$HEAD_SHA" ]]; then
         echo "Error: Could not resolve ${BRANCH} head SHA." >&2
         exit 1

packages/mosaic/framework/tools/git/detect-platform.sh

@@ -505,6 +505,28 @@ get_gitea_token() {
     script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
     local cred_loader="$script_dir/../_lib/credentials.sh"
 
+    # 0. Per-agent identity (Gate-16 author≠reviewer). If MOSAIC_GIT_IDENTITY, or the
+    #    per-worktree `git config mosaic.gitIdentity`, resolves to an agent that has a
+    #    stored per-slot token for this host, act AS that agent so API tooling
+    #    (pr-create, issue-create, …) authors under the right identity — matching the
+    #    git credential helper. Backward-compatible: nothing resolvable → shared logic below.
+    local _ident="${MOSAIC_GIT_IDENTITY:-}"
+    [[ -z "$_ident" ]] && _ident="$(git config --get mosaic.gitIdentity 2>/dev/null || true)"
+    if [[ -n "$_ident" ]]; then
+        local _idpfx=""
+        case "$host" in
+            git.uscllc.com)      _idpfx=gitea-usc ;;
+            git.mosaicstack.dev) _idpfx=gitea-mosaicstack ;;
+        esac
+        if [[ -n "$_idpfx" ]]; then
+            local _idtok="$HOME/.config/mosaic/secrets/gitea-tokens/${_idpfx}-${_ident}.token"
+            if [[ -r "$_idtok" ]]; then
+                cat "$_idtok"
+                return 0
+            fi
+        fi
+    fi
+
     # 1. Mosaic credential loader (host → service mapping, run in subshell to avoid polluting env)
     if [[ -f "$cred_loader" ]]; then
         local token

packages/mosaic/framework/tools/git/git-credential-mosaic

@@ -0,0 +1,69 @@
+#!/bin/bash
+# git-credential-mosaic — git credential helper — resolves Gitea tokens from
+# the Mosaic credential store at runtime so remote URLs never embed secrets.
+#
+# Install (one-time, per clone or globally):
+#   git config credential.helper "$HOME/.config/mosaic/tools/git/git-credential-mosaic"
+#   # or, fleet-wide: git config --global credential.helper "$HOME/.config/mosaic/tools/git/git-credential-mosaic"
+#
+# Per-agent Gate-16 identity (author != reviewer separation):
+#   git config mosaic.gitIdentity <agent-id>   # per-worktree, persists on disk
+#   # or: export MOSAIC_GIT_IDENTITY=<agent-id>
+#
+# Resolution priority: MOSAIC_GIT_IDENTITY env > git config mosaic.gitIdentity
+# (per-worktree, survives across non-persistent shells) > git-supplied username
+# (credential.username / URL). When the resolved identity has a matching
+# per-agent token file, use it instead of the shared account. Backward
+# compatible: nothing resolvable -> shared token (unchanged behavior).
+[ "$1" = "get" ] || exit 0
+host=""; username_in=""
+while IFS= read -r line; do
+  [ -z "$line" ] && break
+  case "$line" in
+    host=*)     host=${line#host=};;
+    username=*) username_in=${line#username=};;
+  esac
+done
+# Per-agent identity resolution (Gate-16 author≠reviewer separation).
+# Priority: MOSAIC_GIT_IDENTITY env  >  git config mosaic.gitIdentity (per-worktree,
+# survives across non-persistent shells)  >  git-supplied username (credential.username
+# / URL). When the resolved identity has a matching per-agent token, use it instead of
+# the shared account. Backward-compatible: nothing resolvable → shared token.
+ident="$MOSAIC_GIT_IDENTITY"
+[ -z "$ident" ] && ident=$(git config --get mosaic.gitIdentity 2>/dev/null)
+[ -z "$ident" ] && ident="$username_in"
+if [ -n "$ident" ]; then
+  case "$host" in
+    git.uscllc.com)      idpfx=gitea-usc;;
+    git.mosaicstack.dev) idpfx=gitea-mosaicstack;;
+    *) idpfx="";;
+  esac
+  if [ -n "$idpfx" ]; then
+    idtok="$HOME/.config/mosaic/secrets/gitea-tokens/${idpfx}-${ident}.token"
+    if [ -r "$idtok" ]; then
+      echo "username=${ident}"
+      echo "password=$(cat "$idtok")"
+      exit 0
+    fi
+  fi
+fi
+case "$host" in
+  git.uscllc.com)      svc=gitea-usc;;
+  git.mosaicstack.dev) svc=gitea-mosaicstack;;
+  *) exit 0;;
+esac
+# Script-relative (not $HOME-absolute) so this resolves correctly regardless
+# of where the framework installer places tools/ under $HOME — mirrors
+# detect-platform.sh's own cred_loader resolution in this same directory.
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../_lib/credentials.sh
+source "$script_dir/../_lib/credentials.sh"
+load_credentials "$svc" >/dev/null 2>&1 || exit 0
+# GITEA_USER is not populated by load_credentials (it only exports
+# GITEA_URL/GITEA_TOKEN for gitea-*), so this fallback is normally taken. Gitea's
+# git-over-HTTP auth authenticates from the token itself (the password field),
+# not from the username string, so any non-empty placeholder works here — this
+# is deliberately NOT a real account name (framework files must stay
+# operator-agnostic; see tools/quality/scripts/verify-sanitized.sh).
+echo "username=${GITEA_USER:-git}"
+echo "password=$GITEA_TOKEN"

packages/mosaic/framework/tools/git/test-ci-queue-wait-branch-absent.sh

@@ -0,0 +1,153 @@
+#!/usr/bin/env bash
+# Regression harness for ci-queue-wait.sh's 404-branch-absent handling.
+#
+# gitea_get_branch_head_sha() resolves a branch's head SHA before the
+# pre-push queue guard runs. A branch that has never been pushed doesn't
+# exist on the remote yet, so Gitea's branches/<branch> endpoint 404s.
+# Before the fix, `curl -fsSL` failed on the 404, its empty stdout was piped
+# into `python3 -c 'json.load(sys.stdin)'`, and the resulting
+# JSONDecodeError crashed the guard -- blocking every new feature branch's
+# first push. The fix must treat 404 as "no in-flight pipeline" (queue
+# clear) while still failing closed on a genuine API error.
+#
+# Covers:
+#   (a) 404 branch-absent          -> exit 0, "queue clear" message.
+#   (b) 200 existing branch + a terminal CI state -> unchanged behavior.
+#   (c) genuine API error (500)    -> still fail-closed (nonzero exit).
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+WORK_DIR="${MOSAIC_TEST_WORK_DIR:-$PWD/.mosaic-test-work/ci-queue-wait-branch-absent}"
+REPO_DIR="$WORK_DIR/repo"
+STUB_DIR="$WORK_DIR/stubs"
+
+rm -rf "$WORK_DIR"
+mkdir -p "$REPO_DIR" "$STUB_DIR"
+
+git -C "$REPO_DIR" init -q
+git -C "$REPO_DIR" remote add origin https://git.example.test/acme/widgets.git
+
+# Minimal curl stub. Selects a canned response by inspecting which Gitea
+# endpoint is being hit (branches/<branch> vs commits/<sha>/status) and
+# whether -w '%{http_code}' was requested. Only the patched branch-lookup
+# call passes -w; the unpatched call and the (unchanged) status call both
+# use plain `curl -fsSL` semantics -- exit nonzero and print nothing on a
+# non-2xx response. This lets the same stub exercise both the pre-fix and
+# post-fix branch-lookup code paths faithfully.
+cat > "$STUB_DIR/curl" <<'SH'
+#!/usr/bin/env bash
+set -euo pipefail
+
+has_w=0
+url=""
+for arg in "$@"; do
+    case "$arg" in
+        -w) has_w=1 ;;
+        http://*|https://*) url="$arg" ;;
+    esac
+done
+
+case "$url" in
+    */branches/*) mode="${MOSAIC_STUB_BRANCH_MODE:?MOSAIC_STUB_BRANCH_MODE not set}" ;;
+    */status)     mode="${MOSAIC_STUB_STATUS_MODE:-terminal-success}" ;;
+    *)
+        echo "curl stub: unrecognized URL: $url" >&2
+        exit 2
+        ;;
+esac
+
+case "$mode" in
+    404)  code=404; body="" ;;
+    200)  code=200; body='{"commit":{"id":"deadbeefcafef00d0123456789abcdef01234567"}}' ;;
+    500)  code=500; body='{"message":"internal server error"}' ;;
+    no-status)         code=200; body='{}' ;;
+    terminal-success)  code=200; body='{"state":"success"}' ;;
+    *)
+        echo "curl stub: unknown mode=$mode" >&2
+        exit 2
+        ;;
+esac
+
+if [[ "$has_w" == 1 ]]; then
+    printf '%s\n%s' "$body" "$code"
+    exit 0
+fi
+
+# Unpatched branch-lookup call / status-endpoint call: real curl -fsSL
+# exits nonzero and emits nothing on stdout for a non-2xx response.
+if [[ "$code" != "200" ]]; then
+    exit 22
+fi
+printf '%s' "$body"
+SH
+chmod +x "$STUB_DIR/curl"
+
+run_ci_queue_wait() {
+    local branch="$1"
+    (
+        cd "$REPO_DIR"
+        export PATH="$STUB_DIR:$PATH"
+        export MOSAIC_CREDENTIALS_FILE="$WORK_DIR/no-credentials.json"
+        export GITEA_TOKEN="stub-token"
+        export GITEA_URL="https://git.example.test"
+        "$SCRIPT_DIR/ci-queue-wait.sh" -B "$branch" --purpose push -t 5 -i 1
+    )
+}
+
+fail=0
+
+# (a) 404 branch-absent -> queue clear, exit 0.
+set +e
+out_a=$(MOSAIC_STUB_BRANCH_MODE=404 run_ci_queue_wait "feat/not-pushed-yet" 2>&1)
+status_a=$?
+set -e
+if [[ "$status_a" -ne 0 ]]; then
+    echo "FAIL(a): expected exit 0 for 404 branch-absent, got $status_a" >&2
+    echo "$out_a" >&2
+    fail=1
+elif [[ "$out_a" != *"queue clear"* ]]; then
+    echo "FAIL(a): expected a queue-clear message, got:" >&2
+    echo "$out_a" >&2
+    fail=1
+fi
+
+# (b) 200 existing branch + terminal CI state -> unchanged behavior, exit 0.
+set +e
+out_b=$(MOSAIC_STUB_BRANCH_MODE=200 MOSAIC_STUB_STATUS_MODE=terminal-success run_ci_queue_wait "main" 2>&1)
+status_b=$?
+set -e
+if [[ "$status_b" -ne 0 ]]; then
+    echo "FAIL(b): expected exit 0 for existing branch with terminal status, got $status_b" >&2
+    echo "$out_b" >&2
+    fail=1
+elif [[ "$out_b" != *"sha=deadbeefcafef00d0123456789abcdef01234567"* ]]; then
+    echo "FAIL(b): expected the resolved HEAD SHA to be logged, got:" >&2
+    echo "$out_b" >&2
+    fail=1
+elif [[ "$out_b" == *"queue clear"* ]]; then
+    echo "FAIL(b): an existing branch must not take the branch-absent path" >&2
+    echo "$out_b" >&2
+    fail=1
+fi
+
+# (c) genuine API error (500) -> still fail-closed, exit nonzero.
+set +e
+out_c=$(MOSAIC_STUB_BRANCH_MODE=500 run_ci_queue_wait "feat/some-branch" 2>&1)
+status_c=$?
+set -e
+if [[ "$status_c" -eq 0 ]]; then
+    echo "FAIL(c): expected a nonzero exit for a genuine 500 API error, got 0" >&2
+    echo "$out_c" >&2
+    fail=1
+elif [[ "$out_c" == *"queue clear"* ]]; then
+    echo "FAIL(c): a genuine API error must not be reported as queue-clear" >&2
+    echo "$out_c" >&2
+    fail=1
+fi
+
+if [[ "$fail" -eq 0 ]]; then
+    echo "ci-queue-wait branch-absent regression passed (3/3 cases)"
+fi
+
+exit "$fail"

packages/mosaic/framework/tools/git/test-git-credential-mosaic.sh

@@ -0,0 +1,161 @@
+#!/usr/bin/env bash
+# Regression harness for `git-credential-mosaic` — per-agent Gitea identity
+# resolution (Gate-16 author≠reviewer separation).
+#
+# Covers:
+#   1. Identity resolution priority: MOSAIC_GIT_IDENTITY env > git config
+#      mosaic.gitIdentity (per-worktree) > git-supplied username.
+#   2. Correct per-slot token file path chosen per host
+#      (gitea-usc-<id>.token vs gitea-mosaicstack-<id>.token).
+#   3. Per-slot token present -> emits that identity + token.
+#   4. Per-slot token absent -> falls back to the shared account
+#      (backward-compat / no-op for hosts without per-slot tokens).
+#   5. Unknown/unrelated host -> exits 0 with no output (passthrough).
+#
+# Uses stubbed token files under a fake HOME + a real (throwaway) git repo.
+# NEVER reads real secrets or touches the real ~/.config/mosaic/secrets.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+WORK_DIR="${MOSAIC_TEST_WORK_DIR:-$PWD/.mosaic-test-work/git-credential-mosaic}"
+FAKE_HOME="$WORK_DIR/home"
+REPO_DIR="$WORK_DIR/repo"
+# Mirror the real deployed layout (~/.config/mosaic/tools/{git,_lib}/) under the
+# fake HOME: git-credential-mosaic resolves its credentials.sh sibling via a
+# script-relative path (BASH_SOURCE), so the copy must live next to a stubbed
+# _lib/credentials.sh, not the real one, to keep this test hermetic.
+HELPER="$FAKE_HOME/.config/mosaic/tools/git/git-credential-mosaic"
+
+rm -rf "$WORK_DIR"
+mkdir -p "$FAKE_HOME/.config/mosaic/secrets/gitea-tokens" \
+         "$FAKE_HOME/.config/mosaic/tools/git" \
+         "$FAKE_HOME/.config/mosaic/tools/_lib" \
+         "$REPO_DIR"
+
+cp "$SCRIPT_DIR/git-credential-mosaic" "$HELPER"
+chmod +x "$HELPER"
+
+git -C "$REPO_DIR" init -q
+git -C "$REPO_DIR" config user.email "test@example.invalid"
+git -C "$REPO_DIR" config user.name "Test"
+
+# Fake shared-account credential loader — stands in for
+# tools/_lib/credentials.sh's load_credentials(), scoped to this test only.
+cat > "$FAKE_HOME/.config/mosaic/tools/_lib/credentials.sh" <<'SH'
+load_credentials() {
+  case "$1" in
+    gitea-mosaicstack) GITEA_URL="https://git.mosaicstack.dev"; GITEA_TOKEN="shared-mosaicstack-token"; export GITEA_URL GITEA_TOKEN; return 0 ;;
+    gitea-usc)         GITEA_URL="https://git.uscllc.com"; GITEA_TOKEN="shared-usc-token"; export GITEA_URL GITEA_TOKEN; return 0 ;;
+    *) return 1 ;;
+  esac
+}
+SH
+
+fail=0
+assert_eq() {
+  local desc="$1" expected="$2" actual="$3"
+  if [[ "$expected" != "$actual" ]]; then
+    echo "FAIL: $desc — expected '$expected', got '$actual'" >&2
+    fail=1
+  fi
+}
+
+# Feed "host=<h>\nusername=<u>\n\n" on stdin (mirrors git's credential protocol)
+# and run the helper with the fake HOME, inside REPO_DIR (so `git config
+# mosaic.gitIdentity` resolves per-worktree), plus any extra env passed in $@.
+run_helper() {
+  local host="$1" username_in="$2"; shift 2
+  (
+    cd "$REPO_DIR"
+    env -i HOME="$FAKE_HOME" PATH="$PATH" "$@" bash "$HELPER" get <<EOF
+host=$host
+username=$username_in
+
+EOF
+  )
+}
+
+# ---------------------------------------------------------------------------
+# 1. No identity resolvable anywhere, no per-slot token -> shared fallback
+#    (backward-compat: unchanged behavior when nothing is configured).
+# ---------------------------------------------------------------------------
+git -C "$REPO_DIR" config --unset mosaic.gitIdentity 2>/dev/null || true
+out=$(run_helper "git.mosaicstack.dev" "")
+assert_eq "shared fallback: username" "username=git" "$(echo "$out" | grep '^username=')"
+assert_eq "shared fallback: password" "password=shared-mosaicstack-token" "$(echo "$out" | grep '^password=')"
+
+# ---------------------------------------------------------------------------
+# 2. git-supplied username resolves to an identity WITH a per-slot token ->
+#    that identity + token wins over the shared account.
+# ---------------------------------------------------------------------------
+echo -n "agentA-mosaicstack-token" > "$FAKE_HOME/.config/mosaic/secrets/gitea-tokens/gitea-mosaicstack-agentA.token"
+out=$(run_helper "git.mosaicstack.dev" "agentA")
+assert_eq "username-resolved identity: username" "username=agentA" "$(echo "$out" | grep '^username=')"
+assert_eq "username-resolved identity: password" "password=agentA-mosaicstack-token" "$(echo "$out" | grep '^password=')"
+
+# ---------------------------------------------------------------------------
+# 3. git config mosaic.gitIdentity (per-worktree) beats git-supplied username.
+# ---------------------------------------------------------------------------
+echo -n "agentB-mosaicstack-token" > "$FAKE_HOME/.config/mosaic/secrets/gitea-tokens/gitea-mosaicstack-agentB.token"
+git -C "$REPO_DIR" config mosaic.gitIdentity agentB
+out=$(run_helper "git.mosaicstack.dev" "agentA")
+assert_eq "git-config beats username: username" "username=agentB" "$(echo "$out" | grep '^username=')"
+assert_eq "git-config beats username: password" "password=agentB-mosaicstack-token" "$(echo "$out" | grep '^password=')"
+
+# ---------------------------------------------------------------------------
+# 4. MOSAIC_GIT_IDENTITY env beats git config mosaic.gitIdentity.
+# ---------------------------------------------------------------------------
+echo -n "agentC-mosaicstack-token" > "$FAKE_HOME/.config/mosaic/secrets/gitea-tokens/gitea-mosaicstack-agentC.token"
+out=$(run_helper "git.mosaicstack.dev" "agentA" MOSAIC_GIT_IDENTITY=agentC)
+assert_eq "env beats git-config: username" "username=agentC" "$(echo "$out" | grep '^username=')"
+assert_eq "env beats git-config: password" "password=agentC-mosaicstack-token" "$(echo "$out" | grep '^password=')"
+git -C "$REPO_DIR" config --unset mosaic.gitIdentity
+
+# ---------------------------------------------------------------------------
+# 5. Identity resolves, but no matching per-slot token file -> falls back to
+#    the shared account (per-agent identity is opt-in, not a hard requirement).
+# ---------------------------------------------------------------------------
+out=$(run_helper "git.mosaicstack.dev" "no-such-agent")
+assert_eq "no per-slot token: username" "username=git" "$(echo "$out" | grep '^username=')"
+assert_eq "no per-slot token: password" "password=shared-mosaicstack-token" "$(echo "$out" | grep '^password=')"
+
+# ---------------------------------------------------------------------------
+# 6. Correct per-slot token PATH is chosen per host: same agent id, different
+#    host prefix (gitea-usc- vs gitea-mosaicstack-).
+# ---------------------------------------------------------------------------
+echo -n "agentD-usc-token" > "$FAKE_HOME/.config/mosaic/secrets/gitea-tokens/gitea-usc-agentD.token"
+out=$(run_helper "git.uscllc.com" "agentD")
+assert_eq "host-scoped token path (usc): username" "username=agentD" "$(echo "$out" | grep '^username=')"
+assert_eq "host-scoped token path (usc): password" "password=agentD-usc-token" "$(echo "$out" | grep '^password=')"
+# agentD has NO mosaicstack token -> must fall back to shared mosaicstack, not
+# leak the usc token across hosts.
+out=$(run_helper "git.mosaicstack.dev" "agentD")
+assert_eq "host-scoped token path (cross-host must not leak): username" "username=git" "$(echo "$out" | grep '^username=')"
+assert_eq "host-scoped token path (cross-host must not leak): password" "password=shared-mosaicstack-token" "$(echo "$out" | grep '^password=')"
+
+# ---------------------------------------------------------------------------
+# 7. Unrelated/unknown host -> exit 0, no output (passthrough for non-Gitea
+#    remotes, e.g. github.com via a different credential helper).
+# ---------------------------------------------------------------------------
+out=$(run_helper "github.com" "agentA")
+assert_eq "unknown host: no output" "" "$out"
+
+# ---------------------------------------------------------------------------
+# 8. Non-"get" verb (store/erase) -> exit 0, no output (git-credential
+#    protocol: this helper only implements get).
+# ---------------------------------------------------------------------------
+store_out=$(cd "$REPO_DIR" && env -i HOME="$FAKE_HOME" PATH="$PATH" bash "$HELPER" store <<EOF
+host=git.mosaicstack.dev
+username=agentA
+password=whatever
+
+EOF
+)
+assert_eq "store verb: no output" "" "$store_out"
+
+if [[ "$fail" -eq 0 ]]; then
+  echo "git-credential-mosaic identity resolution regression passed"
+fi
+
+exit "$fail"

packages/mosaic/framework/tools/git/test-gitea-token-identity.sh

@@ -0,0 +1,122 @@
+#!/usr/bin/env bash
+# Regression harness for detect-platform.sh's get_gitea_token() per-agent
+# identity resolution (Gate-16 author≠reviewer separation) — the API-tooling
+# counterpart to git-credential-mosaic, so pr-create.sh/issue-create.sh/etc.
+# open records under the resolved agent identity, not the shared account.
+#
+# Covers:
+#   1. Identity resolution priority: MOSAIC_GIT_IDENTITY env > git config
+#      mosaic.gitIdentity (per-worktree).
+#   2. Correct per-slot token file path chosen per host
+#      (gitea-usc-<id>.token vs gitea-mosaicstack-<id>.token).
+#   3. Per-slot token present -> that token is returned (agent-authored calls).
+#   4. Per-slot token absent -> falls back to the shared credential-loader
+#      token (backward-compat / no-op for hosts without per-slot tokens).
+#   5. Unrelated host with no shared credentials configured -> failure
+#      (unchanged, existing behavior).
+#
+# Uses a stubbed credentials.json + stubbed per-slot token files under a fake
+# HOME. NEVER reads real secrets or touches the real ~/.config/mosaic/secrets.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+WORK_DIR="${MOSAIC_TEST_WORK_DIR:-$PWD/.mosaic-test-work/gitea-token-identity}"
+FAKE_HOME="$WORK_DIR/home"
+REPO_DIR="$WORK_DIR/repo"
+CREDENTIALS_FILE="$FAKE_HOME/.config/mosaic/credentials.json"
+
+rm -rf "$WORK_DIR"
+mkdir -p "$FAKE_HOME/.config/mosaic/secrets/gitea-tokens" "$REPO_DIR"
+
+git -C "$REPO_DIR" init -q
+git -C "$REPO_DIR" remote add origin https://git.mosaicstack.dev/mosaicstack/stack.git
+
+cat > "$CREDENTIALS_FILE" <<'JSON'
+{
+  "gitea": {
+    "mosaicstack": {
+      "url": "https://git.mosaicstack.dev",
+      "token": "shared-mosaicstack-token"
+    },
+    "usc": {
+      "url": "https://git.uscllc.com",
+      "token": "shared-usc-token"
+    }
+  }
+}
+JSON
+
+fail=0
+assert_eq() {
+  local desc="$1" expected="$2" actual="$3"
+  if [[ "$expected" != "$actual" ]]; then
+    echo "FAIL: $desc — expected '$expected', got '$actual'" >&2
+    fail=1
+  fi
+}
+
+# Runs get_gitea_token for $1=host inside REPO_DIR (per-worktree git config
+# resolves there) with a fake HOME + the stub credentials.json, plus any
+# extra env passed in $@.
+call_get_gitea_token() {
+  local host="$1"; shift
+  (
+    cd "$REPO_DIR"
+    # shellcheck disable=SC2016 # deliberately deferred: $DETECT_PLATFORM_SH is
+    # expanded by the INNER bash -c (via the exported env var below), not here.
+    env -i HOME="$FAKE_HOME" PATH="$PATH" MOSAIC_CREDENTIALS_FILE="$CREDENTIALS_FILE" \
+      DETECT_PLATFORM_SH="$SCRIPT_DIR/detect-platform.sh" "$@" \
+      bash -c 'source "$DETECT_PLATFORM_SH"; get_gitea_token "$1"' _ "$host"
+  )
+}
+
+# ---------------------------------------------------------------------------
+# 1. No identity resolvable -> shared credential-loader token (unchanged).
+# ---------------------------------------------------------------------------
+git -C "$REPO_DIR" config --unset mosaic.gitIdentity 2>/dev/null || true
+out=$(call_get_gitea_token "git.mosaicstack.dev")
+assert_eq "shared fallback (no identity)" "shared-mosaicstack-token" "$out"
+
+# ---------------------------------------------------------------------------
+# 2. git config mosaic.gitIdentity resolves to an agent WITH a per-slot
+#    token -> that token wins over the shared account.
+# ---------------------------------------------------------------------------
+echo -n "agentA-mosaicstack-token" > "$FAKE_HOME/.config/mosaic/secrets/gitea-tokens/gitea-mosaicstack-agentA.token"
+git -C "$REPO_DIR" config mosaic.gitIdentity agentA
+out=$(call_get_gitea_token "git.mosaicstack.dev")
+assert_eq "git-config identity token" "agentA-mosaicstack-token" "$out"
+
+# ---------------------------------------------------------------------------
+# 3. MOSAIC_GIT_IDENTITY env beats git config mosaic.gitIdentity.
+# ---------------------------------------------------------------------------
+echo -n "agentB-mosaicstack-token" > "$FAKE_HOME/.config/mosaic/secrets/gitea-tokens/gitea-mosaicstack-agentB.token"
+out=$(call_get_gitea_token "git.mosaicstack.dev" MOSAIC_GIT_IDENTITY=agentB)
+assert_eq "env beats git-config identity token" "agentB-mosaicstack-token" "$out"
+
+# ---------------------------------------------------------------------------
+# 4. Identity resolves but has no per-slot token for THIS host -> falls back
+#    to the shared token (per-agent identity is opt-in per host).
+# ---------------------------------------------------------------------------
+git -C "$REPO_DIR" config mosaic.gitIdentity no-such-agent
+out=$(call_get_gitea_token "git.mosaicstack.dev")
+assert_eq "no per-slot token falls back to shared" "shared-mosaicstack-token" "$out"
+
+# ---------------------------------------------------------------------------
+# 5. Correct per-slot token PATH per host: same agent id, only a usc token
+#    exists -> usc host returns it, mosaicstack host must NOT leak it and
+#    instead falls back to the shared mosaicstack token.
+# ---------------------------------------------------------------------------
+echo -n "agentD-usc-token" > "$FAKE_HOME/.config/mosaic/secrets/gitea-tokens/gitea-usc-agentD.token"
+git -C "$REPO_DIR" config mosaic.gitIdentity agentD
+out=$(call_get_gitea_token "git.uscllc.com")
+assert_eq "host-scoped token path (usc)" "agentD-usc-token" "$out"
+out=$(call_get_gitea_token "git.mosaicstack.dev")
+assert_eq "host-scoped token path (no cross-host leak)" "shared-mosaicstack-token" "$out"
+git -C "$REPO_DIR" config --unset mosaic.gitIdentity
+
+if [[ "$fail" -eq 0 ]]; then
+  echo "get_gitea_token identity resolution regression passed"
+fi
+
+exit "$fail"

packages/mosaic/framework/tools/lease-broker/start-lease-broker.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# Supervisor entry point for the Mosaic lease broker daemon (issue #869, C3).
+#
+# Resolves the broker socket path with the SAME precedence as
+# `defaultLeaseBrokerSocket` in `packages/mosaic/src/commands/launch.ts`, so a
+# gated runtime launched through that client always finds the socket this
+# supervisor creates:
+#   1. an explicit MOSAIC_LEASE_BROKER_SOCKET
+#   2. "$XDG_RUNTIME_DIR/mosaic-lease/broker.sock"
+#   3. "/run/user/<uid>/mosaic-lease/broker.sock"
+#
+# The state file is colocated next to the socket (same directory,
+# "state.json"), mirroring how the broker already colocates its per-session
+# generation files beside the socket.
+#
+# This script never installs, enables, or starts the systemd unit that calls
+# it; it is only ever invoked BY that unit (or by a human/test harness that
+# passes its own HOME/XDG_RUNTIME_DIR).
+set -euo pipefail
+
+SCRIPT_DIR=$(cd -- "$(dirname -- "$0")" && pwd)
+
+if [ -n "${MOSAIC_LEASE_BROKER_SOCKET:-}" ]; then
+  SOCKET="$MOSAIC_LEASE_BROKER_SOCKET"
+else
+  RUNTIME_DIR="${XDG_RUNTIME_DIR:-/run/user/$(id -u)}"
+  SOCKET="$RUNTIME_DIR/mosaic-lease/broker.sock"
+fi
+STATE="$(dirname -- "$SOCKET")/state.json"
+
+exec python3 "$SCRIPT_DIR/daemon.py" --socket "$SOCKET" --state "$STATE"

packages/mosaic/framework/tools/orchestrator/README.md

@@ -0,0 +1,92 @@
+# orchestrator/ tools
+
+Helper scripts for r0 coordinator / orchestrator sessions — mission lifecycle,
+session health, continuation, and board maintenance. See
+`framework/guides/ORCHESTRATOR-PROTOCOL.md` for the surrounding process.
+
+| Script               | Purpose                                                                                         |
+| -------------------- | ----------------------------------------------------------------------------------------------- |
+| `mission-init.sh`    | Initialize a new orchestration mission (manifest, scratchpad, TASKS.md).                        |
+| `mission-status.sh`  | Show the mission progress dashboard.                                                            |
+| `session-run.sh`     | Generate continuation context and launch the target runtime.                                    |
+| `session-resume.sh`  | Crash recovery for dead orchestrator sessions.                                                  |
+| `session-status.sh`  | Check agent session health.                                                                     |
+| `continue-prompt.sh` | Generate the continuation prompt for the next session.                                          |
+| `board-roll.sh`      | Keep a LIVE orchestration board under its byte cap by rolling the oldest entries to its LEDGER. |
+| `smoke-test.sh`      | Behavior smoke checks for the coord continue/run workflows.                                     |
+| `test-board-roll.sh` | Regression harness for `board-roll.sh`.                                                         |
+| `_lib.sh`            | Shared functions sourced by the above (state files, TASKS.md parsing, locks).                   |
+
+## board-roll.sh
+
+Coordinator boards (`MOS-ORCHESTRATION-BOARD-LIVE.md`, `MS-LEAD-BOARD-LIVE.md`)
+follow a **"< 8 KB LIVE"** discipline: the LIVE board is the only file loaded on
+resume, so it must stay small, and history lives in an append-only LEDGER. When a
+board write would push LIVE over its cap, coordinators otherwise hand-trim and
+retry every time — an observed 38 ABORT-OVER-CAP cycles in one 24 h window.
+`board-roll.sh` automates that trim mechanically and reversibly: the audit trail
+is moved to the LEDGER instead of being hand-deleted.
+
+### Contract (conservative — it never guesses what is safe to move)
+
+The LIVE board opts in by wrapping its aging archival ticks in an explicit roll
+zone. Everything **outside** the markers (title, protocol blockquote, curated
+always-current `##` sections) is pinned and never touched:
+
+```markdown
+# MOS ORCHESTRATION BOARD — LIVE state
+
+> protocol blockquote … (pinned)
+
+## 🟦 Curated always-current section (pinned)
+
+…
+
+<!-- BOARD-ROLL:START -->
+
+### 2026-07-22 (mid²²) — newest tick, stays longest
+
+…
+
+### 2026-07-20 (dawn) — oldest tick, rolled first
+
+…
+
+<!-- BOARD-ROLL:END -->
+```
+
+Inside the zone, entries are delimited by a heading marker (default `### `) and
+are assumed **newest-first (top) → oldest-last (bottom)**. `board-roll.sh` moves
+whole oldest (bottom-most) entry blocks out of the zone and appends them verbatim
+to the LEDGER, one at a time, until LIVE is back under the cap or the zone is
+empty. If the board has no markers, it exits `3` and changes nothing — adding the
+markers is a deliberate opt-in by the board owner.
+
+### Usage
+
+```bash
+board-roll.sh --live <LIVE.md> --ledger <LEDGER.md> [options]
+
+  --live   <path>    LIVE board file (required)
+  --ledger <path>    append-only LEDGER file (required; created if absent)
+  --cap    <bytes>   size ceiling for LIVE (default 8192)
+  --marker <prefix>  entry-heading prefix inside the roll zone (default "### ")
+  --dry-run          report what would move; change nothing
+  -h, --help         show help and exit 0
+```
+
+Only **one** roll zone is supported. If a board carries more than one
+`BOARD-ROLL:START`/`END` pair, `board-roll.sh` refuses (exit `3`, zero changes)
+rather than span first-START..last-END and relocate the curated content between
+the zones — consolidate the ticks into a single zone instead.
+
+Exit codes: `0` LIVE under cap (already, or after rolling) — on `--dry-run`, a
+plan exists or nothing to do · `2` usage / argument / IO error · `3` cannot meet
+the cap (no markers, **more than one marker pair**, or the pinned sections alone
+exceed the cap and need a manual trim).
+
+Writes are atomic (temp file + `mv`, LEDGER first) so a failure never leaves a
+board half-written; line endings are normalized to LF on rewrite. `--dry-run`
+first is recommended when wiring it into a board update protocol.
+
+Run the regression suite with `bash test-board-roll.sh`.

packages/mosaic/framework/tools/orchestrator/board-roll.sh

@@ -0,0 +1,277 @@
+#!/usr/bin/env bash
+#
+# board-roll.sh — keep a LIVE orchestration board under its byte cap by rolling
+#                 the oldest archival entries out to its append-only LEDGER.
+#
+# WHY: coordinator boards (MOS-ORCHESTRATION-BOARD-LIVE.md, MS-LEAD-BOARD-LIVE.md)
+# enforce a "< 8 KB LIVE" discipline via a self-guard that ABORTs the board write
+# when the file exceeds the cap. In practice the LIVE board keeps bumping the cap,
+# so coordinators hand-trim + retry every time (observed: 38 ABORT-OVER-CAP cycles
+# in a 24h window on one coordinator). This automates that trim, mechanically and
+# reversibly, so the audit trail is preserved in the LEDGER instead of hand-deleted.
+#
+# CONTRACT (conservative by design — it NEVER guesses what is safe to move):
+#   The LIVE board must declare an explicit ROLL ZONE with HTML-comment markers:
+#
+#       <!-- BOARD-ROLL:START -->
+#       ### 2026-07-22 (newest tick — stays longest)
+#       ...
+#       ### 2026-07-19 (oldest tick — rolled first)
+#       ...
+#       <!-- BOARD-ROLL:END -->
+#
+#   Everything OUTSIDE the markers (title, protocol blockquote, curated always-current
+#   `##` sections) is PINNED and never touched. Inside the zone, entries are delimited
+#   by a heading marker (default `### `) and are assumed newest-first (top) → oldest-last
+#   (bottom), matching board convention. board-roll moves whole oldest (bottom-most)
+#   entry blocks out of the zone and APPENDS them verbatim to the LEDGER, one block at a
+#   time, until the LIVE file is back under the cap or the zone is empty.
+#
+#   If no markers are present, it exits 3 without changing anything (safe default —
+#   adding the markers is a deliberate opt-in by the board owner).
+#
+# USAGE:
+#   board-roll.sh --live <LIVE.md> --ledger <LEDGER.md> [options]
+#
+# OPTIONS:
+#   --live   <path>   LIVE board file (required)
+#   --ledger <path>   append-only LEDGER file (required; created if absent)
+#   --cap    <bytes>  size ceiling for LIVE (default 8192)
+#   --marker <prefix> entry-heading prefix inside the roll zone (default "### ")
+#   --dry-run         report what would move + resulting size; change nothing
+#   -h, --help        print usage and exit 0
+#
+# EXIT CODES:
+#   0  LIVE is under cap (already, or after rolling); on --dry-run, 0 = a plan exists
+#      (or nothing to do)
+#   2  usage / argument / IO error (bad flag, missing file, unwritable target)
+#   3  cannot satisfy the cap: no roll markers present, MORE THAN ONE marker pair
+#      (multiple zones are refused, not guessed), OR the zone was emptied and LIVE
+#      is still over cap (curated pinned sections need a manual trim)
+#
+# NOTE: line endings are normalized to LF on rewrite (boards are LF markdown); a
+# trailing newline is always ensured. Writes are atomic (temp file + mv) so a
+# failure never leaves LIVE or LEDGER half-written.
+
+set -euo pipefail
+
+START_MARK='<!-- BOARD-ROLL:START -->'
+END_MARK='<!-- BOARD-ROLL:END -->'
+
+usage() {
+    cat <<'EOF'
+Usage: board-roll.sh --live <LIVE.md> --ledger <LEDGER.md> [options]
+
+Roll the oldest entries out of a LIVE orchestration board into its LEDGER
+until the LIVE file is under a byte cap. Conservative: only content inside
+explicit <!-- BOARD-ROLL:START -->/<!-- BOARD-ROLL:END --> markers is moved.
+
+Options:
+  --live   <path>    LIVE board file (required)
+  --ledger <path>    append-only LEDGER file (required; created if absent)
+  --cap    <bytes>   size ceiling for LIVE (default 8192)
+  --marker <prefix>  entry-heading prefix inside the roll zone (default "### ")
+  --dry-run          report what would move; change nothing
+  -h, --help         show this help and exit 0
+
+Exit: 0 under cap (or dry-run plan) · 2 usage/IO error · 3 cannot meet cap
+      (no markers, or pinned sections alone exceed the cap).
+EOF
+}
+
+die() { echo "board-roll: $*" >&2; exit 2; }
+
+LIVE=""; LEDGER=""; CAP=8192; MARKER='### '; DRYRUN=0
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --live)    LIVE="${2:-}"; shift 2 || die "--live needs a value" ;;
+        --ledger)  LEDGER="${2:-}"; shift 2 || die "--ledger needs a value" ;;
+        --cap)     CAP="${2:-}"; shift 2 || die "--cap needs a value" ;;
+        --marker)  MARKER="${2:-}"; shift 2 || die "--marker needs a value" ;;
+        --dry-run) DRYRUN=1; shift ;;
+        -h|--help) usage; exit 0 ;;
+        *) usage >&2; die "unknown option: $1" ;;
+    esac
+done
+
+[[ -n "$LIVE"   ]] || { usage >&2; die "--live is required"; }
+[[ -n "$LEDGER" ]] || { usage >&2; die "--ledger is required"; }
+[[ -f "$LIVE"   ]] || die "LIVE file not found: $LIVE"
+[[ "$CAP" =~ ^[0-9]+$ ]] || die "--cap must be a non-negative integer, got: $CAP"
+
+# --- read LIVE into a line array (newlines stripped; re-added on write) ---------
+mapfile -t LINES < "$LIVE"
+
+# byte size of an array rendered as LF-terminated text
+render_size() {
+    if [[ $# -eq 0 ]]; then printf 0; return; fi
+    printf '%s\n' "$@" | wc -c
+}
+
+orig_size=$(render_size "${LINES[@]}")
+
+# --- already under cap → nothing to do -----------------------------------------
+if (( orig_size < CAP )); then
+    echo "board-roll: LIVE is ${orig_size}B (< cap ${CAP}B) — nothing to roll."
+    exit 0
+fi
+
+# --- locate the roll-zone markers ----------------------------------------------
+# Exactly ONE marker pair is supported. If a board carries more than one START or
+# END marker we REFUSE (exit 3, zero changes) rather than guess: a naive
+# first-START..last-END span would swallow the curated content and the intermediate
+# markers sitting between two intended zones and silently relocate that pinned text
+# to the LEDGER — the exact data-loss this tool exists to prevent. Refusing matches
+# the "no markers = exit 3" conservative posture.
+start_idx=-1; end_idx=-1; start_count=0; end_count=0
+for i in "${!LINES[@]}"; do
+    if [[ "${LINES[$i]}" == "$START_MARK" ]]; then
+        if (( start_count == 0 )); then start_idx=$i; fi
+        start_count=$(( start_count + 1 ))
+    fi
+    if [[ "${LINES[$i]}" == "$END_MARK" ]]; then
+        end_idx=$i
+        end_count=$(( end_count + 1 ))
+    fi
+done
+if (( start_count > 1 || end_count > 1 )); then
+    echo "board-roll: LIVE is ${orig_size}B (>= cap ${CAP}B) but has ${start_count} START / ${end_count} END" >&2
+    echo "  markers — only a SINGLE '$START_MARK' … '$END_MARK' roll zone is supported." >&2
+    echo "  Multiple zones are refused (not guessed) so content between zones is never relocated." >&2
+    echo "  Consolidate the archival ticks into one zone, or trim manually." >&2
+    exit 3
+fi
+if (( start_idx < 0 || end_idx < 0 || end_idx <= start_idx )); then
+    echo "board-roll: LIVE is ${orig_size}B (>= cap ${CAP}B) but no usable roll zone" >&2
+    echo "  (need '$START_MARK' then '$END_MARK'). Add the markers around the" >&2
+    echo "  archival tick section to opt this board into automatic rolling." >&2
+    exit 3
+fi
+
+# preamble = lines [0 .. start_idx]   (inclusive of START marker)
+# zone     = lines (start_idx .. end_idx)  (exclusive of both markers)
+# footer   = lines [end_idx .. end]   (inclusive of END marker)
+preamble=(); zone=(); footer=()
+for i in "${!LINES[@]}"; do
+    if   (( i <= start_idx )); then preamble+=("${LINES[$i]}")
+    elif (( i <  end_idx  )); then zone+=("${LINES[$i]}")
+    else footer+=("${LINES[$i]}")
+    fi
+done
+
+# --- split the zone into a fixed head + entry blocks ----------------------------
+# zone_head = any zone lines before the first entry marker (kept, never rolled).
+# blocks[k] = newline-joined text of entry k (marker line .. line before next marker).
+zone_head=(); declare -a block_start=()
+first_block=-1
+for i in "${!zone[@]}"; do
+    if [[ "${zone[$i]}" == "$MARKER"* ]]; then
+        [[ $first_block -eq -1 ]] && first_block=$i
+        block_start+=("$i")
+    fi
+done
+if (( first_block == -1 )); then
+    echo "board-roll: LIVE is ${orig_size}B (>= cap ${CAP}B) but the roll zone has no" >&2
+    echo "  '${MARKER}' entries to move. Trim the pinned sections manually." >&2
+    exit 3
+fi
+for (( i=0; i<first_block; i++ )); do zone_head+=("${zone[$i]}"); done
+
+nblocks=${#block_start[@]}
+# block k spans zone[ block_start[k] .. (block_start[k+1]-1 or end-of-zone) ]
+block_text() {  # $1 = block index → prints the block's lines, LF-joined (no trailing)
+    local k=$1 s e
+    s=${block_start[$k]}
+    if (( k+1 < nblocks )); then e=$(( block_start[$((k+1))] - 1 )); else e=$(( ${#zone[@]} - 1 )); fi
+    local out=()
+    for (( j=s; j<=e; j++ )); do out+=("${zone[$j]}"); done
+    printf '%s\n' "${out[@]}"
+}
+
+# --- greedily roll oldest (bottom-most) blocks until under cap ------------------
+# keep = number of newest blocks retained; start with all, drop from the bottom.
+keep=$nblocks       # blocks [keep .. nblocks-1] are the oldest set that gets moved
+current_size=$orig_size
+build_live_size() {  # size of LIVE if we keep blocks [0 .. keep-1]
+    local acc=("${preamble[@]}" "${zone_head[@]}")
+    local k s e j
+    for (( k=0; k<keep; k++ )); do
+        s=${block_start[$k]}
+        if (( k+1 < nblocks )); then e=$(( block_start[$((k+1))] - 1 )); else e=$(( ${#zone[@]} - 1 )); fi
+        for (( j=s; j<=e; j++ )); do acc+=("${zone[$j]}"); done
+    done
+    acc+=("${footer[@]}")
+    render_size "${acc[@]}"
+}
+while (( current_size >= CAP && keep > 0 )); do
+    keep=$(( keep - 1 ))
+    current_size=$(build_live_size)
+done
+
+moved_count=$(( nblocks - keep ))
+if (( moved_count == 0 )); then
+    # zone had entries but none movable brought us under (shouldn't happen: keep hits 0)
+    echo "board-roll: could not reduce LIVE below cap (${current_size}B >= ${CAP}B)." >&2
+    exit 3
+fi
+
+# --- dry-run report -------------------------------------------------------------
+plan_headers() {
+    local k
+    for (( k=keep; k<nblocks; k++ )); do
+        # first line of each moved block
+        printf '    %s\n' "${zone[${block_start[$k]}]}"
+    done
+}
+if (( DRYRUN )); then
+    echo "board-roll: DRY RUN"
+    echo "  LIVE now:   ${orig_size}B (cap ${CAP}B) — over by $(( orig_size - CAP ))B"
+    echo "  would roll: ${moved_count} of ${nblocks} entr$([[ $moved_count -eq 1 ]] && echo y || echo ies) (oldest first):"
+    plan_headers
+    echo "  LIVE after: ${current_size}B"
+    if (( current_size >= CAP )); then
+        echo "  WARNING: still >= cap after emptying the zone; pinned sections need a manual trim." >&2
+        exit 3
+    fi
+    exit 0
+fi
+
+# --- commit the roll atomically -------------------------------------------------
+live_tmp="$(mktemp "${LIVE}.roll.XXXXXX")" || die "cannot create temp next to LIVE"
+ledger_tmp=""
+# shellcheck disable=SC2329  # invoked indirectly via `trap cleanup EXIT`
+cleanup() { rm -f "$live_tmp" "$ledger_tmp" 2>/dev/null || true; }
+trap cleanup EXIT
+
+# new LIVE = preamble + zone_head + kept blocks + footer
+{
+    printf '%s\n' "${preamble[@]}" "${zone_head[@]}"
+    for (( k=0; k<keep; k++ )); do block_text "$k"; done
+    printf '%s\n' "${footer[@]}"
+} > "$live_tmp"
+
+# LEDGER gets the moved blocks appended verbatim, in original top→bottom order,
+# under a provenance separator. LEDGER is append-only, so we only ever add at EOF.
+ledger_tmp="$(mktemp "${LEDGER}.roll.XXXXXX")" || die "cannot create temp next to LEDGER"
+if [[ -f "$LEDGER" ]]; then cat "$LEDGER" > "$ledger_tmp"; fi
+# ensure a trailing newline on existing content before appending
+if [[ -s "$ledger_tmp" && -n "$(tail -c1 "$ledger_tmp")" ]]; then printf '\n' >> "$ledger_tmp"; fi
+{
+    printf '\n<!-- board-roll: %d entr%s rolled from %s -->\n' \
+        "$moved_count" "$([[ $moved_count -eq 1 ]] && echo y || echo ies)" "$(basename "$LIVE")"
+    for (( k=keep; k<nblocks; k++ )); do block_text "$k"; done
+} >> "$ledger_tmp"
+
+# atomic swap (both, LEDGER first so a crash never drops content that left LIVE)
+mv "$ledger_tmp" "$LEDGER"; ledger_tmp=""
+mv "$live_tmp" "$LIVE"; live_tmp=""
+trap - EXIT
+
+# read the real on-disk size back (truthful, not the predicted value)
+final_size=$(wc -c < "$LIVE")
+echo "board-roll: rolled ${moved_count} entr$([[ $moved_count -eq 1 ]] && echo y || echo ies) to $(basename "$LEDGER"); LIVE ${orig_size}B → ${final_size}B (cap ${CAP}B)."
+if (( final_size >= CAP )); then
+    echo "board-roll: still >= cap after rolling all zone entries; pinned sections need a manual trim." >&2
+    exit 3
+fi
+exit 0

packages/mosaic/framework/tools/orchestrator/test-board-roll.sh

@@ -0,0 +1,156 @@
+#!/usr/bin/env bash
+# Regression harness for board-roll.sh — rolling oldest LIVE-board entries to LEDGER.
+#
+# Asserts:
+#   1. Under cap → no-op, exit 0, files unchanged.
+#   2. Over cap, no roll markers → exit 3, LIVE unchanged (never guesses).
+#   3. Over cap, markers present → rolls the fewest oldest entries to get under cap,
+#      LIVE ends under cap, pinned preamble/footer + newest entries preserved.
+#   4. Rolled blocks land in the LEDGER verbatim, oldest set in original order.
+#   5. --dry-run changes nothing and reports a plan.
+#   6. Zone emptied but pinned sections alone exceed cap → exit 3.
+#   7. --help exits 0 and prints usage; an unknown flag exits nonzero (#701 discipline).
+#   8. More than one marker pair → exit 3, unchanged; curated content between the two
+#      zones is never relocated to the LEDGER (rev0 #868 regression).
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SUT="$SCRIPT_DIR/board-roll.sh"
+
+fail=0
+note() { echo "FAIL: $*" >&2; fail=1; }
+
+WORK="$(mktemp -d)"
+trap 'rm -rf "$WORK"' EXIT
+
+# builds a LIVE board: pinned preamble + roll zone with N dated entries (newest first),
+# each entry padded to be individually large so the cap math is predictable.
+make_board() {  # $1 file  $2 n_entries  $3 with_markers(1/0)  $4 pad_bytes
+    local f=$1 n=$2 markers=$3 pad=$4 i padtxt
+    padtxt=$(head -c "$pad" < /dev/zero | tr '\0' 'x')
+    {
+        echo "# BOARD — LIVE"
+        echo "> pinned protocol blockquote, never rolled."
+        echo
+        echo "## Curated always-current section (pinned)"
+        echo "- this stays no matter what"
+        echo
+        [[ "$markers" == 1 ]] && echo '<!-- BOARD-ROLL:START -->'
+        # newest first (i=n .. 1); oldest (i=1) ends at the bottom
+        for (( i=n; i>=1; i-- )); do
+            echo "### 2026-07-$(printf '%02d' $i) tick number $i"
+            echo "- detail $i $padtxt"
+            echo
+        done
+        [[ "$markers" == 1 ]] && echo '<!-- BOARD-ROLL:END -->'
+    } > "$f"
+    return 0
+}
+
+# ── 1. under cap → no-op ───────────────────────────────────────────────────────
+L="$WORK/live1.md"; G="$WORK/ledger1.md"; : > "$G"
+make_board "$L" 2 1 10
+before=$(cat "$L")
+if ! out=$(bash "$SUT" --live "$L" --ledger "$G" --cap 100000 2>&1); then
+    note "under-cap should exit 0 (got nonzero): $out"
+fi
+[[ "$(cat "$L")" == "$before" ]] || note "under-cap modified LIVE"
+[[ -s "$G" ]] && note "under-cap wrote to LEDGER"
+
+# ── 2. over cap, no markers → exit 3, unchanged ────────────────────────────────
+L="$WORK/live2.md"; G="$WORK/ledger2.md"; : > "$G"
+make_board "$L" 6 0 400
+before=$(cat "$L")
+set +e; bash "$SUT" --live "$L" --ledger "$G" --cap 800 >/dev/null 2>&1; rc=$?; set -e
+[[ "$rc" -eq 3 ]] || note "no-markers over-cap should exit 3 (got $rc)"
+[[ "$(cat "$L")" == "$before" ]] || note "no-markers run modified LIVE (must never guess)"
+
+# ── 3+4. over cap with markers → rolls oldest, LIVE under cap, LEDGER gets them ─
+L="$WORK/live3.md"; G="$WORK/ledger3.md"; echo "# LEDGER" > "$G"
+make_board "$L" 6 1 400          # 6 entries, each ~>400B
+big=$(wc -c < "$L")
+[[ "$big" -ge 2000 ]] || note "fixture too small to test rolling ($big B)"
+if ! out=$(bash "$SUT" --live "$L" --ledger "$G" --cap 2000 2>&1); then
+    note "marker roll should exit 0 when it can get under cap: $out"
+fi
+after=$(wc -c < "$L")
+[[ "$after" -lt 2000 ]] || note "LIVE still >= cap after roll ($after B)"
+# pinned content survives
+grep -q "Curated always-current section" "$L" || note "roll dropped pinned section"
+grep -q 'BOARD-ROLL:START' "$L" || note "roll dropped START marker"
+grep -q 'BOARD-ROLL:END' "$L"   || note "roll dropped END marker"
+# newest entry (07-06) stays; oldest (07-01) is the first to leave
+grep -q "### 2026-07-06 tick number 6" "$L" || note "roll dropped the newest entry"
+grep -q "### 2026-07-01 tick number 1" "$L" && note "oldest entry not rolled out of LIVE"
+# oldest went to LEDGER
+grep -q "### 2026-07-01 tick number 1" "$G" || note "oldest entry not appended to LEDGER"
+grep -q "board-roll:.*rolled from live3.md" "$G" || note "LEDGER missing provenance separator"
+# a rolled entry must not be duplicated (present in exactly one of LIVE/LEDGER)
+if grep -q "### 2026-07-01 tick number 1" "$L"; then note "rolled entry duplicated in LIVE"; fi
+# LEDGER original content preserved
+grep -q "^# LEDGER" "$G" || note "roll clobbered existing LEDGER content"
+
+# ── 5. --dry-run changes nothing ───────────────────────────────────────────────
+L="$WORK/live5.md"; G="$WORK/ledger5.md"; echo "# LEDGER" > "$G"
+make_board "$L" 6 1 400
+before_l=$(cat "$L"); before_g=$(cat "$G")
+out=$(bash "$SUT" --live "$L" --ledger "$G" --cap 2000 --dry-run 2>&1) || note "dry-run exited nonzero: $out"
+echo "$out" | grep -qi "dry run" || note "dry-run did not announce itself"
+echo "$out" | grep -q "would roll" || note "dry-run did not report a plan"
+[[ "$(cat "$L")" == "$before_l" ]] || note "dry-run modified LIVE"
+[[ "$(cat "$G")" == "$before_g" ]] || note "dry-run modified LEDGER"
+
+# ── 6. zone emptied, pinned alone over cap → exit 3 ────────────────────────────
+# cap 120 is below the pinned preamble+footer size (~180B), so even after rolling
+# every zone entry the LIVE file stays over cap → must report the unsatisfiable case.
+L="$WORK/live6.md"; G="$WORK/ledger6.md"; echo "# LEDGER" > "$G"
+make_board "$L" 3 1 50
+set +e; bash "$SUT" --live "$L" --ledger "$G" --cap 120 >/dev/null 2>&1; rc=$?; set -e
+[[ "$rc" -eq 3 ]] || note "unsatisfiable cap should exit 3 (got $rc)"
+
+# ── 7. help exits 0, unknown flag exits nonzero (#701) ─────────────────────────
+if ! out=$(bash "$SUT" --help 2>&1); then note "--help exited nonzero"; fi
+[[ "$out" == Usage:* ]] || note "--help did not print usage"
+bash "$SUT" -h >/dev/null 2>&1 || note "-h exited nonzero"
+if bash "$SUT" --not-a-real-flag >/dev/null 2>&1; then note "unknown flag was accepted"; fi
+if bash "$SUT" --live "$WORK/live3.md" >/dev/null 2>&1; then note "missing --ledger was accepted"; fi
+
+# ── 8. multiple marker pairs → exit 3, unchanged (no cross-zone relocation) ─────
+# Two separately-marked zones with a curated pinned section BETWEEN them. A naive
+# first-START..last-END span would sweep that curated section (and the intermediate
+# markers) into the LEDGER. board-roll must refuse (exit 3) and touch nothing.
+L="$WORK/live8.md"; G="$WORK/ledger8.md"; echo "# LEDGER" > "$G"
+pad8=$(head -c 300 < /dev/zero | tr '\0' 'x')
+{
+    echo "# BOARD — LIVE"
+    echo "> pinned protocol blockquote"
+    echo
+    echo '<!-- BOARD-ROLL:START -->'
+    echo "### 2026-07-10 zone-A newest"
+    echo "- detail A2 $pad8"
+    echo "### 2026-07-09 zone-A oldest"
+    echo "- detail A1 $pad8"
+    echo '<!-- BOARD-ROLL:END -->'
+    echo
+    echo "## Curated-between-zones (pinned — must never move)"
+    echo "- CANARY-BETWEEN keep me"
+    echo
+    echo '<!-- BOARD-ROLL:START -->'
+    echo "### 2026-07-08 zone-B newest"
+    echo "- detail B2 $pad8"
+    echo "### 2026-07-07 zone-B oldest"
+    echo "- detail B1 $pad8"
+    echo '<!-- BOARD-ROLL:END -->'
+} > "$L"
+before8=$(cat "$L")
+set +e; bash "$SUT" --live "$L" --ledger "$G" --cap 80 >/dev/null 2>&1; rc=$?; set -e
+[[ "$rc" -eq 3 ]] || note "multi-pair board should exit 3 (got $rc)"
+[[ "$(cat "$L")" == "$before8" ]] || note "multi-pair run modified LIVE (must never guess across zones)"
+grep -q "CANARY-BETWEEN keep me" "$L" || note "multi-pair run relocated curated between-zones content"
+grep -q "CANARY-BETWEEN" "$G" && note "curated between-zones content leaked into LEDGER"
+
+if [[ "$fail" -eq 0 ]]; then
+    echo "board-roll regression passed (8 groups)"
+fi
+exit "$fail"

packages/mosaic/package.json

@@ -25,7 +25,7 @@
     "lint": "eslint src",
     "typecheck": "tsc --noEmit",
     "test": "vitest run --passWithNoTests && pnpm run test:framework-shell",
-    "test:framework-shell": "python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh"
+    "test:framework-shell": "python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh && bash framework/tools/git/test-ci-queue-wait-branch-absent.sh && bash framework/tools/git/test-git-credential-mosaic.sh && bash framework/tools/git/test-gitea-token-identity.sh"
   },
   "dependencies": {
     "@mosaicstack/brain": "workspace:*",

packages/mosaic/src/cli.ts

@@ -21,6 +21,7 @@ import { registerRestoreCommand } from './commands/restore.js';
 import { registerSkillCommand } from './commands/skill.js';
 // prdy is registered via launch.ts
 import { registerLaunchCommands } from './commands/launch.js';
+import { registerLeaseCapabilityProbe } from './commands/lease-activation-probe.js';
 import { registerAuthCommand } from './commands/auth.js';
 import { registerFederationCommand } from './commands/federation.js';
 import { registerGatewayCommand } from './commands/gateway.js';
@@ -78,6 +79,10 @@ Command Groups:
 
 registerLaunchCommands(program);
 
+// ─── lease activation capability probe (hidden; #869 Point-1 C1) ────────
+
+registerLeaseCapabilityProbe(program);
+
 // ─── login ──────────────────────────────────────────────────────────────
 
 program

packages/mosaic/src/commands/launch.ts

@@ -806,7 +806,14 @@ function launchRuntime(runtime: RuntimeName, args: string[], yolo: boolean): nev
   process.exit(0); // Unreachable but satisfies never
 }
 
-function defaultLeaseBrokerSocket(env: NodeJS.ProcessEnv = process.env): string {
+/**
+ * Resolve the lease broker's control socket path. Exported (in addition to
+ * being used internally by execLeaseGatedRuntime) so the C1 activation probe
+ * (lease-activation-probe.ts) can perform the same resolution when checking
+ * whether the broker supervisor is reachable — detection only, this never
+ * connects to the socket itself.
+ */
+export function defaultLeaseBrokerSocket(env: NodeJS.ProcessEnv = process.env): string {
   if (env['MOSAIC_LEASE_BROKER_SOCKET']) return env['MOSAIC_LEASE_BROKER_SOCKET'];
   const runtimeDir = env['XDG_RUNTIME_DIR'];
   if (runtimeDir) return join(runtimeDir, 'mosaic-lease', 'broker.sock');
@@ -895,7 +902,12 @@ function delegateToScript(scriptPath: string, args: string[], env?: Record<strin
  * bundled in the @mosaicstack/mosaic npm package (always matches the installed
  * CLI version) over the deployed copy in ~/.config/mosaic/ (may be stale).
  */
-function resolveTool(...segments: string[]): string {
+/**
+ * Exported so the C1 activation probe (lease-activation-probe.ts) can resolve
+ * the same lease-broker launcher/daemon artifacts execLeaseGatedRuntime()
+ * uses, for detection-only supervisor presence checks.
+ */
+export function resolveTool(...segments: string[]): string {
   try {
     const req = createRequire(import.meta.url);
     const mosaicPkg = dirname(req.resolve('@mosaicstack/mosaic/package.json'));

packages/mosaic/src/commands/lease-activation-probe.spec.ts

@@ -0,0 +1,243 @@
+import { describe, it, expect } from 'vitest';
+import { Command } from 'commander';
+import { existsSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { fileURLToPath } from 'node:url';
+import {
+  LEASE_ACTIVATION_CAPABILITY,
+  LEASE_CAPABILITY_PROBE_COMMAND,
+  defaultCapabilityProbe,
+  defaultResolveCliEntry,
+  defaultSupervisorProbe,
+  leaseEnforcementActivatable,
+  registerLeaseCapabilityProbe,
+  type LeaseActivationCapability,
+  type SupervisorProbeResult,
+} from './lease-activation-probe.js';
+
+/**
+ * Red-first tests for issue #869 Point-1 C1 — leaseEnforcementActivatable().
+ *
+ * Root cause under test: #828 shipped the lease broker's ENFORCEMENT half
+ * (hooks) and ACTIVATION half (execLeaseGatedRuntime + a running daemon.py
+ * broker) on different channels, and they drifted — the published CLI
+ * tarball lacked the activation half even though it existed in source. The
+ * predicate here must say NO when either half of activation is unavailable,
+ * and only YES when both are genuinely present — never based on "does the
+ * source file exist", but on a real capability signal + real supervisor
+ * detection.
+ */
+
+const compatibleCapability: LeaseActivationCapability = { ...LEASE_ACTIVATION_CAPABILITY };
+const presentSupervisor: SupervisorProbeResult = {
+  supervisorPresent: true,
+  socketPath: '/run/user/1000/mosaic-lease/broker.sock',
+};
+
+describe('leaseEnforcementActivatable', () => {
+  it('is false when the activation capability is absent (null)', () => {
+    const result = leaseEnforcementActivatable({
+      getCapability: () => null,
+      probeSupervisor: () => presentSupervisor,
+    });
+    expect(result).toBe(false);
+  });
+
+  it('is false when the activation capability name does not match', () => {
+    const result = leaseEnforcementActivatable({
+      getCapability: () => ({
+        name: 'some-other-capability',
+        version: LEASE_ACTIVATION_CAPABILITY.version,
+      }),
+      probeSupervisor: () => presentSupervisor,
+    });
+    expect(result).toBe(false);
+  });
+
+  it('is false when the activation capability version is incompatible (stale/newer build)', () => {
+    const result = leaseEnforcementActivatable({
+      getCapability: () => ({
+        name: LEASE_ACTIVATION_CAPABILITY.name,
+        version: LEASE_ACTIVATION_CAPABILITY.version + 1,
+      }),
+      probeSupervisor: () => presentSupervisor,
+    });
+    expect(result).toBe(false);
+  });
+
+  it('is false when the supervisor artifacts (launcher/daemon) are not present', () => {
+    const result = leaseEnforcementActivatable({
+      getCapability: () => compatibleCapability,
+      probeSupervisor: () => ({
+        supervisorPresent: false,
+        socketPath: presentSupervisor.socketPath,
+      }),
+    });
+    expect(result).toBe(false);
+  });
+
+  it('is false when the supervisor socket path is not resolvable', () => {
+    const result = leaseEnforcementActivatable({
+      getCapability: () => compatibleCapability,
+      probeSupervisor: () => ({ supervisorPresent: true, socketPath: null }),
+    });
+    expect(result).toBe(false);
+  });
+
+  it('is false when BOTH capability and supervisor are absent', () => {
+    const result = leaseEnforcementActivatable({
+      getCapability: () => null,
+      probeSupervisor: () => ({ supervisorPresent: false, socketPath: null }),
+    });
+    expect(result).toBe(false);
+  });
+
+  it('is true when a compatible capability AND a resolvable supervisor are both present', () => {
+    const result = leaseEnforcementActivatable({
+      getCapability: () => compatibleCapability,
+      probeSupervisor: () => presentSupervisor,
+    });
+    expect(result).toBe(true);
+  });
+
+  it('uses the real default probes when no deps are injected (does not throw)', () => {
+    // No live broker / built CLI is guaranteed in a test environment, so this
+    // only asserts the predicate degrades to a safe boolean rather than
+    // throwing — the fail-closed behavior itself is covered by the injected
+    // cases above.
+    expect(() => leaseEnforcementActivatable()).not.toThrow();
+    expect(typeof leaseEnforcementActivatable()).toBe('boolean');
+  });
+});
+
+describe('defaultCapabilityProbe', () => {
+  it('returns null (fail-closed) when no built CLI artifact is resolvable', () => {
+    // Deterministic regardless of ambient host state (e.g. a host that has
+    // already run `pnpm build`, which would otherwise make this pass or fail
+    // depending on whether dist/cli.js happens to exist) — inject a resolver
+    // pointing at a path that cannot exist, rather than relying on this
+    // checkout being unbuilt. The probe must report "no capability" rather
+    // than fabricate one from source-tree presence — this is the exact
+    // distinction #828's version skew needed: source existing is not the
+    // same as the published artifact advertising the capability.
+    const result = defaultCapabilityProbe({
+      resolveCliEntry: () => '/nonexistent/mosaic-lease-activation-probe-test/cli.js',
+    });
+    expect(result).toBeNull();
+  });
+
+  describe('positive path — injected resolver, isolated scratch dir (never the real dist/)', () => {
+    // A prior version of this test staged the stub cli.js at the package's
+    // REAL resolved dist/ path and relied on afterEach to clean up "only
+    // what it created" — which meant a host with a real pre-built
+    // dist/cli.js (ordinary `pnpm build && pnpm test`) would have its real
+    // ~26KB compiled CLI silently overwritten by an 87-byte stub, with no
+    // restoration of the original content. That is exactly the kind of
+    // build-artifact corruption #869 exists to prevent. This version uses
+    // dependency injection exclusively: defaultCapabilityProbe() is never
+    // called with its default resolver here, so it can never touch the real
+    // package dist/ at all — proven below by asserting that path's
+    // existence is unchanged by the test.
+    it('returns the real {name, version} capability from a stub cli.js in a temp dir, and leaves the real dist/ untouched', () => {
+      const packageRoot = join(dirname(fileURLToPath(import.meta.url)), '..', '..');
+      const realDistDir = join(packageRoot, 'dist');
+      const realDistPreexisted = existsSync(realDistDir);
+
+      const scratchDir = mkdtempSync(join(tmpdir(), 'mosaic-lease-capability-probe-'));
+      try {
+        const scratchCliPath = join(scratchDir, 'cli.js');
+        // Minimal stand-in for the built CLI's hidden __lease-capability
+        // subcommand — prints exactly what registerLeaseCapabilityProbe()
+        // wires the real `mosaic __lease-capability` command to print.
+        writeFileSync(
+          scratchCliPath,
+          `process.stdout.write(JSON.stringify(${JSON.stringify(LEASE_ACTIVATION_CAPABILITY)}));\n`,
+        );
+
+        const result = defaultCapabilityProbe({ resolveCliEntry: () => scratchCliPath });
+        expect(result).toEqual(LEASE_ACTIVATION_CAPABILITY);
+
+        // The real package dist/ must be byte-for-byte untouched: this test
+        // never invokes the default resolver, so the path's mere existence
+        // (created or not) must be unchanged by having run this test.
+        expect(existsSync(realDistDir)).toBe(realDistPreexisted);
+      } finally {
+        rmSync(scratchDir, { recursive: true, force: true });
+      }
+    });
+  });
+});
+
+describe('defaultResolveCliEntry', () => {
+  it('resolves the bare "@mosaicstack/mosaic" specifier (the exported "." entry), never the non-exported "./package.json" subpath', () => {
+    // Fully isolated from the real filesystem/package state (no dependency
+    // on whether @mosaicstack/mosaic has been built on this host) via an
+    // injected fake resolver that mirrors Node's real behavior: the "."
+    // export resolves fine, but "./package.json" is NOT in package.json's
+    // `exports` map, so real `require.resolve` throws
+    // ERR_PACKAGE_PATH_NOT_EXPORTED for it. This is genuinely red-first
+    // against the reviewer-found bug: the old implementation resolved the
+    // "./package.json" subpath here, which this fake throws on — the new
+    // implementation must resolve only the bare specifier.
+    const requestedSpecifiers: string[] = [];
+    const fakeResolve = (specifier: string): string => {
+      requestedSpecifiers.push(specifier);
+      if (specifier === '@mosaicstack/mosaic') return '/fake/pkg/dist/index.js';
+      throw new Error(`ERR_PACKAGE_PATH_NOT_EXPORTED: ${specifier}`);
+    };
+
+    const result = defaultResolveCliEntry(fakeResolve);
+
+    expect(result).toBe(join('/fake/pkg/dist', 'cli.js'));
+    expect(requestedSpecifiers).toEqual(['@mosaicstack/mosaic']);
+  });
+});
+
+describe('defaultSupervisorProbe', () => {
+  it('returns a well-shaped result without starting or connecting to anything', () => {
+    const result = defaultSupervisorProbe({});
+    expect(typeof result.supervisorPresent).toBe('boolean');
+    expect(result.socketPath === null || typeof result.socketPath === 'string').toBe(true);
+  });
+
+  it('resolves a socket path from an explicit MOSAIC_LEASE_BROKER_SOCKET override', () => {
+    const result = defaultSupervisorProbe({ MOSAIC_LEASE_BROKER_SOCKET: '/tmp/explicit.sock' });
+    expect(result.socketPath).toBe('/tmp/explicit.sock');
+  });
+});
+
+describe('registerLeaseCapabilityProbe', () => {
+  it('registers a hidden subcommand named __lease-capability', () => {
+    const program = new Command();
+    program.exitOverride();
+    registerLeaseCapabilityProbe(program);
+
+    const registered = program.commands.find((c) => c.name() === LEASE_CAPABILITY_PROBE_COMMAND);
+    expect(registered).toBeDefined();
+    // Commander exposes "hidden" only as help-output suppression (no public
+    // getter) — assert the observable behavior instead of a private field.
+    expect(program.helpInformation()).not.toContain(LEASE_CAPABILITY_PROBE_COMMAND);
+  });
+
+  it('prints the capability constant as JSON when invoked', () => {
+    const program = new Command();
+    program.exitOverride();
+    registerLeaseCapabilityProbe(program);
+
+    let written = '';
+    const originalWrite = process.stdout.write.bind(process.stdout);
+    process.stdout.write = ((chunk: string) => {
+      written += chunk;
+      return true;
+    }) as typeof process.stdout.write;
+
+    try {
+      program.parse(['node', 'mosaic', LEASE_CAPABILITY_PROBE_COMMAND]);
+    } finally {
+      process.stdout.write = originalWrite;
+    }
+
+    expect(JSON.parse(written)).toEqual(LEASE_ACTIVATION_CAPABILITY);
+  });
+});

packages/mosaic/src/commands/lease-activation-probe.ts

@@ -0,0 +1,232 @@
+/**
+ * Lease-enforcement activation probe (issue #869, Point-1 card C1).
+ *
+ * Root cause this exists to guard against (#828 version skew): the
+ * ENFORCEMENT half of the lease broker (PreToolUse/Stop hooks —
+ * `mutator-gate.py`, `receipt-observer-client.py` — wired via the framework
+ * reseed) and the ACTIVATION half (`execLeaseGatedRuntime()` in `launch.ts`,
+ * which chains the runtime through `launch-runtime.py`, injects
+ * `MOSAIC_LEASE_*`, and requires a running `daemon.py` broker) ship on
+ * different channels. When the published CLI tarball lags behind an
+ * enforcement reseed, the gate correctly fails CLOSED on absent identity —
+ * but every tool call then denies with GATE_UNAVAILABLE. That fail-closed
+ * behavior is intentional and must not change (see the C-REGRESS note in
+ * `runtime_tools_unittest.py`); this module exists so a downstream
+ * install-ordering guard (C2, out of scope here) can refuse to WIRE
+ * enforcement in the first place on a host that cannot ACTIVATE it.
+ *
+ * `leaseEnforcementActivatable()` answers one narrow question: "if
+ * enforcement were wired right now, could activation actually satisfy it?"
+ * It is a real capability probe — not a "does the source file exist" check
+ * — and both of its inputs are injectable so tests can drive every branch
+ * without a live broker or an installed CLI on PATH.
+ */
+
+import { execFileSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { dirname, join } from 'node:path';
+import type { Command } from 'commander';
+import { defaultLeaseBrokerSocket, resolveTool } from './launch.js';
+
+// ─── Capability signal (owned by the activation half) ──────────────────────
+
+/**
+ * Versioned identity for the activation contract `execLeaseGatedRuntime()`
+ * implements. OWNED by the activation half of the lease broker. Bump
+ * `version` only when the activation contract itself changes (env vars
+ * injected, chaining behavior, socket protocol, etc.) — deliberately
+ * independent of the package's npm semver, because #828 happened precisely
+ * because the npm version was NOT bumped even though the shipped artifact
+ * fell out of sync. A build that cannot advertise this exact
+ * `{ name, version }` pair does not implement the contract a caller is
+ * relying on, whatever its package.json claims.
+ */
+export interface LeaseActivationCapability {
+  readonly name: string;
+  readonly version: number;
+}
+
+export const LEASE_ACTIVATION_CAPABILITY: LeaseActivationCapability = {
+  name: 'lease-runtime-activation',
+  version: 1,
+};
+
+/** Hidden CLI probe subcommand name — wired via {@link registerLeaseCapabilityProbe}. */
+export const LEASE_CAPABILITY_PROBE_COMMAND = '__lease-capability';
+
+function capabilityMatches(candidate: LeaseActivationCapability | null): boolean {
+  return (
+    candidate !== null &&
+    candidate.name === LEASE_ACTIVATION_CAPABILITY.name &&
+    candidate.version === LEASE_ACTIVATION_CAPABILITY.version
+  );
+}
+
+/**
+ * Register the hidden `__lease-capability` probe subcommand. Prints the
+ * capability this BUILD advertises as compact JSON to stdout and exits 0.
+ * Deliberately undocumented (hidden from `--help`): it is an internal signal
+ * for {@link defaultCapabilityProbe}, not a user-facing command.
+ */
+export function registerLeaseCapabilityProbe(program: Command): void {
+  program
+    .command(LEASE_CAPABILITY_PROBE_COMMAND, { hidden: true })
+    .description('Internal: print the lease-activation capability this build advertises')
+    .action(() => {
+      process.stdout.write(JSON.stringify(LEASE_ACTIVATION_CAPABILITY));
+    });
+}
+
+/** Injectable Node module resolver — matches `require.resolve`'s signature
+ * narrowly (specifier in, absolute path out, or throws). Defaults to the
+ * real `createRequire(import.meta.url).resolve`. Injectable so tests can
+ * exercise WHICH specifier {@link defaultResolveCliEntry} resolves (the
+ * reviewer-found bug was resolving the wrong one) without depending on
+ * whether `@mosaicstack/mosaic` has actually been built on the test host —
+ * and without ever touching the real package's `dist/` to find out. */
+export type ModuleResolver = (specifier: string) => string;
+
+/**
+ * Resolve the CLI's built entrypoint (`dist/cli.js`). Resolves via the
+ * package's "." export (already present in package.json's `exports` map)
+ * rather than a "./package.json" subpath — the latter is NOT exported, so
+ * `require.resolve('@mosaicstack/mosaic/package.json')` throws
+ * ERR_PACKAGE_PATH_NOT_EXPORTED on every real install. The "." export
+ * resolves to `dist/index.js`; `cli.js` is its sibling in the same built
+ * `dist/` directory (see package.json's `bin.mosaic`).
+ *
+ * Exported standalone (and injectable via {@link CapabilityProbeDeps}) so
+ * tests can exercise this resolution logic in isolation, or point
+ * {@link defaultCapabilityProbe} at a scratch directory instead of ever
+ * touching the real installed package's `dist/` — a test corrupting a real
+ * build artifact is exactly the artifact-integrity failure class this card
+ * exists to prevent (#828).
+ */
+export function defaultResolveCliEntry(
+  resolve: ModuleResolver = createRequire(import.meta.url).resolve,
+): string {
+  const mainEntry = resolve('@mosaicstack/mosaic');
+  return join(dirname(mainEntry), 'cli.js');
+}
+
+/** Injectable inputs for {@link defaultCapabilityProbe}. */
+export interface CapabilityProbeDeps {
+  /** Resolve the CLI entrypoint (`cli.js`) to probe. Defaults to
+   * {@link defaultResolveCliEntry}. Inject to point at an isolated scratch
+   * location in tests — never at the real package's `dist/`. */
+  resolveCliEntry?: () => string;
+}
+
+/**
+ * Real capability lookup. Resolves the installed `@mosaicstack/mosaic`
+ * package's BUILT entrypoint (`dist/cli.js` — the published artifact a user
+ * actually runs, not this TypeScript source file) and executes its hidden
+ * `__lease-capability` probe subcommand out-of-process. A build that lacks
+ * the subcommand, fails to execute, or reports an incompatible
+ * `{ name, version }` is treated as having NO activation capability.
+ *
+ * This is the check that would have caught #828's version skew: the
+ * source-tree activation half existed, but the published tarball's `dist/`
+ * did not carry it, so this probe — reading the actually-resolvable built
+ * artifact rather than trusting source-tree presence — would report null.
+ */
+export function defaultCapabilityProbe(
+  deps: CapabilityProbeDeps = {},
+): LeaseActivationCapability | null {
+  try {
+    const resolveCliEntry = deps.resolveCliEntry ?? defaultResolveCliEntry;
+    const cliEntry = resolveCliEntry();
+    if (!existsSync(cliEntry)) return null;
+
+    const output = execFileSync(process.execPath, [cliEntry, LEASE_CAPABILITY_PROBE_COMMAND], {
+      encoding: 'utf-8',
+      timeout: 2000,
+      stdio: ['ignore', 'pipe', 'ignore'],
+    });
+
+    const parsed: unknown = JSON.parse(output);
+    if (
+      typeof parsed !== 'object' ||
+      parsed === null ||
+      typeof (parsed as Record<string, unknown>)['name'] !== 'string' ||
+      typeof (parsed as Record<string, unknown>)['version'] !== 'number'
+    ) {
+      return null;
+    }
+    const candidate = parsed as { name: string; version: number };
+    return { name: candidate.name, version: candidate.version };
+  } catch {
+    return null;
+  }
+}
+
+// ─── Supervisor / socket resolution (detection only) ───────────────────────
+
+/** Detection-only supervisor/socket probe result. Never starts the broker
+ * and never connects to the socket — presence and path resolution only. */
+export interface SupervisorProbeResult {
+  /** The lease-broker supervisor artifacts (launcher + daemon) are present. */
+  readonly supervisorPresent: boolean;
+  /** Resolved broker socket path, or null if it could not be resolved. */
+  readonly socketPath: string | null;
+}
+
+/**
+ * Real supervisor/socket resolution: checks that the lease-broker's launcher
+ * (`launch-runtime.py`) and supervisor (`daemon.py`) artifacts resolve on
+ * disk via the same tool-resolution `execLeaseGatedRuntime()` uses, and that
+ * a broker socket path resolves via the same logic as
+ * `defaultLeaseBrokerSocket()`. Detection only — this never starts the
+ * daemon and never connects to the socket.
+ */
+export function defaultSupervisorProbe(
+  env: NodeJS.ProcessEnv = process.env,
+): SupervisorProbeResult {
+  const launcherPath = resolveTool('lease-broker', 'launch-runtime.py');
+  const daemonPath = resolveTool('lease-broker', 'daemon.py');
+  const supervisorPresent = existsSync(launcherPath) && existsSync(daemonPath);
+
+  let socketPath: string | null = null;
+  try {
+    const resolved = defaultLeaseBrokerSocket(env);
+    socketPath = resolved.trim().length > 0 ? resolved : null;
+  } catch {
+    socketPath = null;
+  }
+
+  return { supervisorPresent, socketPath };
+}
+
+// ─── Predicate ───────────────────────────────────────────────────────────
+
+/** Injectable inputs for {@link leaseEnforcementActivatable}, so tests (and
+ * downstream callers such as the C2 install-ordering guard) can drive every
+ * branch without a live broker or an installed CLI on PATH. */
+export interface ActivationProbeDeps {
+  getCapability?: () => LeaseActivationCapability | null;
+  probeSupervisor?: () => SupervisorProbeResult;
+}
+
+/**
+ * True IFF lease enforcement can actually be ACTIVATED on this host:
+ *
+ *   (a) the resolvable CLI advertises a {@link LeaseActivationCapability}
+ *       compatible with {@link LEASE_ACTIVATION_CAPABILITY}, AND
+ *   (b) the broker supervisor is resolvable — launcher + `daemon.py`
+ *       artifacts present AND a broker socket path resolves.
+ *
+ * Pure/testable: both probes default to the real, side-effect-free lookups
+ * above but can be injected, so this predicate never itself starts a broker
+ * or performs enforcement — it only reports whether activation *could*
+ * satisfy enforcement if wired.
+ */
+export function leaseEnforcementActivatable(deps: ActivationProbeDeps = {}): boolean {
+  const getCapability = deps.getCapability ?? defaultCapabilityProbe;
+  const probeSupervisor = deps.probeSupervisor ?? defaultSupervisorProbe;
+
+  if (!capabilityMatches(getCapability())) return false;
+
+  const supervisor = probeSupervisor();
+  return supervisor.supervisorPresent && supervisor.socketPath !== null;
+}

packages/mosaic/src/lease-broker/broker-supervisor.spec.ts

@@ -0,0 +1,237 @@
+import { createServer, type Server } from 'node:net';
+import { mkdir, mkdtemp, readFile, rm, stat, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { afterEach, describe, expect, it } from 'vitest';
+
+import {
+  applyBrokerSupervisor,
+  checkBrokerSupervisorHealth,
+  isBrokerSupervisorHealthy,
+  resolveBrokerSupervisorPaths,
+  resolveLeaseBrokerSocketPath,
+  type BrokerSupervisorPaths,
+} from './broker-supervisor.js';
+
+const REAL_FRAMEWORK_ROOT = new URL('../../framework/', import.meta.url).pathname;
+
+const cleanupDirs: string[] = [];
+const cleanupServers: Server[] = [];
+
+async function tempDir(prefix: string): Promise<string> {
+  const dir = await mkdtemp(join(tmpdir(), prefix));
+  cleanupDirs.push(dir);
+  return dir;
+}
+
+afterEach(async () => {
+  for (const server of cleanupServers.splice(0)) {
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+  }
+  for (const dir of cleanupDirs.splice(0)) {
+    await rm(dir, { recursive: true, force: true });
+  }
+});
+
+describe('resolveLeaseBrokerSocketPath', () => {
+  it('honors an explicit MOSAIC_LEASE_BROKER_SOCKET override', () => {
+    expect(resolveLeaseBrokerSocketPath({ MOSAIC_LEASE_BROKER_SOCKET: '/tmp/explicit.sock' })).toBe(
+      '/tmp/explicit.sock',
+    );
+  });
+
+  it('falls back to $XDG_RUNTIME_DIR/mosaic-lease/broker.sock', () => {
+    expect(resolveLeaseBrokerSocketPath({ XDG_RUNTIME_DIR: '/run/user/1000' })).toBe(
+      join('/run/user/1000', 'mosaic-lease', 'broker.sock'),
+    );
+  });
+
+  it('falls back to /run/user/<uid>/mosaic-lease/broker.sock as a last resort', () => {
+    expect(resolveLeaseBrokerSocketPath({}, 4242)).toBe(
+      join('/run/user', '4242', 'mosaic-lease', 'broker.sock'),
+    );
+  });
+
+  it('prefers the explicit override over XDG_RUNTIME_DIR', () => {
+    expect(
+      resolveLeaseBrokerSocketPath({
+        MOSAIC_LEASE_BROKER_SOCKET: '/explicit.sock',
+        XDG_RUNTIME_DIR: '/run/user/1000',
+      }),
+    ).toBe('/explicit.sock');
+  });
+});
+
+describe('resolveBrokerSupervisorPaths', () => {
+  it('colocates the state file next to the resolved socket', () => {
+    const paths = resolveBrokerSupervisorPaths({
+      mosaicHome: '/home/x/.config/mosaic',
+      frameworkRoot: '/repo/framework',
+      env: { XDG_RUNTIME_DIR: '/run/user/1000' },
+    });
+    expect(paths.socketPath).toBe(join('/run/user/1000', 'mosaic-lease', 'broker.sock'));
+    expect(paths.statePath).toBe(join('/run/user/1000', 'mosaic-lease', 'state.json'));
+  });
+
+  it('targets the systemd --user dir under the given home, not mosaicHome', () => {
+    const paths = resolveBrokerSupervisorPaths({
+      mosaicHome: '/somewhere-else/.config/mosaic',
+      frameworkRoot: '/repo/framework',
+      homeDir: '/home/canary',
+      env: {},
+      uid: 0,
+    });
+    expect(paths.systemdUserDir).toBe(join('/home/canary', '.config', 'systemd', 'user'));
+    expect(paths.unitTargetPath).toBe(
+      join('/home/canary', '.config', 'systemd', 'user', 'mosaic-lease-broker.service'),
+    );
+  });
+
+  it('is a pure function: identical options resolve to identical paths', () => {
+    const options = {
+      mosaicHome: '/h/.config/mosaic',
+      frameworkRoot: '/repo/framework',
+      env: { XDG_RUNTIME_DIR: '/run/user/1000' },
+    };
+    expect(resolveBrokerSupervisorPaths(options)).toEqual(resolveBrokerSupervisorPaths(options));
+  });
+});
+
+describe('applyBrokerSupervisor', () => {
+  async function fakePaths(): Promise<BrokerSupervisorPaths> {
+    const home = await tempDir('mosaic-broker-supervisor-home-');
+    const mosaicHome = join(home, '.config', 'mosaic');
+    const runtimeDir = await tempDir('mosaic-broker-supervisor-runtime-');
+    return resolveBrokerSupervisorPaths({
+      mosaicHome,
+      frameworkRoot: REAL_FRAMEWORK_ROOT,
+      homeDir: home,
+      env: { XDG_RUNTIME_DIR: runtimeDir },
+    });
+  }
+
+  it('renders a unit that references the installed wrapper script and hardens the runtime dir', async () => {
+    const paths = await fakePaths();
+    const unitSource = await readFile(paths.unitSourcePath, 'utf8');
+    expect(unitSource).toContain('ExecStart=');
+    expect(unitSource).toContain('%h/.config/mosaic/tools/lease-broker/start-lease-broker.sh');
+    expect(unitSource).toContain('RuntimeDirectory=mosaic-lease');
+    expect(unitSource).toContain('RuntimeDirectoryMode=0700');
+    expect(unitSource).toContain('Restart=on-failure');
+    expect(unitSource).toContain('WantedBy=default.target');
+    // No ambient environment file preload, matching the other fleet units'
+    // strict-parsing convention.
+    expect(unitSource).not.toMatch(/^Environment(File)?=/m);
+  });
+
+  it('materializes the unit, wrapper script, and daemon sources on first apply', async () => {
+    const paths = await fakePaths();
+
+    const result = await applyBrokerSupervisor(paths);
+
+    expect(result.installedFiles).toContain(paths.unitTargetPath);
+    expect(result.installedFiles).toContain(paths.wrapperTargetPath);
+    for (const target of paths.daemonTargetPaths) {
+      expect(result.installedFiles).toContain(target);
+    }
+
+    const unitTargetContent = await readFile(paths.unitTargetPath, 'utf8');
+    const unitSourceContent = await readFile(paths.unitSourcePath, 'utf8');
+    expect(unitTargetContent).toBe(unitSourceContent);
+
+    const wrapperMode = (await stat(paths.wrapperTargetPath)).mode & 0o777;
+    expect(wrapperMode).toBe(0o755);
+
+    for (const target of paths.daemonTargetPaths) {
+      await expect(stat(target)).resolves.toBeDefined();
+    }
+  });
+
+  it('is idempotent: applying twice reproduces identical files with no error', async () => {
+    const paths = await fakePaths();
+
+    await applyBrokerSupervisor(paths);
+    const firstUnit = await readFile(paths.unitTargetPath, 'utf8');
+    const firstWrapper = await readFile(paths.wrapperTargetPath, 'utf8');
+    const firstWrapperMode = (await stat(paths.wrapperTargetPath)).mode & 0o777;
+
+    await expect(applyBrokerSupervisor(paths)).resolves.toBeDefined();
+
+    const secondUnit = await readFile(paths.unitTargetPath, 'utf8');
+    const secondWrapper = await readFile(paths.wrapperTargetPath, 'utf8');
+    const secondWrapperMode = (await stat(paths.wrapperTargetPath)).mode & 0o777;
+
+    expect(secondUnit).toBe(firstUnit);
+    expect(secondWrapper).toBe(firstWrapper);
+    expect(secondWrapperMode).toBe(firstWrapperMode);
+  });
+
+  it('never touches the real host: only writes under the supplied temp dirs', async () => {
+    const paths = await fakePaths();
+    await applyBrokerSupervisor(paths);
+    expect(paths.systemdUserDir.startsWith(tmpdir())).toBe(true);
+    expect(paths.mosaicHome.startsWith(tmpdir())).toBe(true);
+  });
+});
+
+describe('checkBrokerSupervisorHealth / isBrokerSupervisorHealthy', () => {
+  async function fakeHealthPaths(): Promise<
+    Pick<BrokerSupervisorPaths, 'unitTargetPath' | 'socketPath'>
+  > {
+    const runtimeDir = await tempDir('mosaic-broker-supervisor-health-');
+    await mkdir(join(runtimeDir, 'systemd-user'), { recursive: true });
+    return {
+      unitTargetPath: join(runtimeDir, 'systemd-user', 'mosaic-lease-broker.service'),
+      socketPath: join(runtimeDir, 'broker.sock'),
+    };
+  }
+
+  it('reports unhealthy when neither the unit nor the socket exist', async () => {
+    const paths = await fakeHealthPaths();
+
+    const health = await checkBrokerSupervisorHealth(paths);
+
+    expect(health).toEqual({ unitInstalled: false, socketPresent: false, healthy: false });
+    expect(await isBrokerSupervisorHealthy(paths)).toBe(false);
+  });
+
+  it('reports unhealthy when the unit is installed but no socket is listening', async () => {
+    const paths = await fakeHealthPaths();
+    await writeFile(paths.unitTargetPath, '[Unit]\n');
+
+    const health = await checkBrokerSupervisorHealth(paths);
+
+    expect(health.unitInstalled).toBe(true);
+    expect(health.socketPresent).toBe(false);
+    expect(health.healthy).toBe(false);
+  });
+
+  it('reports healthy=true once a real Unix socket exists at the resolved path, and false again once removed', async () => {
+    const paths = await fakeHealthPaths();
+
+    const server = createServer();
+    cleanupServers.push(server);
+    await new Promise<void>((resolve, reject) => {
+      server.once('error', reject);
+      server.listen(paths.socketPath, resolve);
+    });
+
+    expect(await isBrokerSupervisorHealthy(paths)).toBe(true);
+    const health = await checkBrokerSupervisorHealth(paths);
+    expect(health.socketPresent).toBe(true);
+    expect(health.healthy).toBe(true);
+
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+    await rm(paths.socketPath, { force: true });
+
+    expect(await isBrokerSupervisorHealthy(paths)).toBe(false);
+  });
+
+  it('does not confuse a stale regular file at the socket path with a live socket', async () => {
+    const paths = await fakeHealthPaths();
+    await writeFile(paths.socketPath, 'not actually a socket');
+
+    expect(await isBrokerSupervisorHealthy(paths)).toBe(false);
+  });
+});

packages/mosaic/src/lease-broker/broker-supervisor.ts

@@ -0,0 +1,223 @@
+/**
+ * Activation-side supervisor for the Mosaic lease broker (issue #869, Point-1
+ * C3). #828 shipped fail-closed enforcement hooks (`mutator-gate.py`,
+ * `receipt-observer-client.py`) with nothing that guaranteed `daemon.py` was
+ * running or that its socket existed before a gated runtime started. This
+ * module:
+ *
+ *  - resolves the broker socket/state paths and the on-disk locations of the
+ *    supervisor artifacts, deterministically and consistently with
+ *    `defaultLeaseBrokerSocket` in `../commands/launch.ts`;
+ *  - idempotently applies (materializes) a systemd `--user` unit plus the
+ *    wrapper script and daemon sources it execs, mirroring the tmux fleet
+ *    unit convention in `framework/systemd/user/`;
+ *  - exposes a health predicate other cards (e.g. the C1 activation probe)
+ *    can call to learn whether a broker supervisor is present and healthy.
+ *
+ * `applyBrokerSupervisor` only writes files under the paths it is given. It
+ * never runs `systemctl`, never starts `daemon.py`, and never touches a real
+ * host's `~/.config` unless the caller explicitly resolves paths there.
+ * Enabling/starting the unit is a separate, later, out-of-scope step.
+ */
+import { chmod, copyFile, mkdir, stat } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+
+const UNIT_NAME = 'mosaic-lease-broker.service';
+const WRAPPER_SCRIPT_NAME = 'start-lease-broker.sh';
+
+/** Co-located modules `daemon.py` imports at runtime; kept alongside it. */
+const DAEMON_SOURCE_FILE_NAMES = [
+  'daemon.py',
+  'lease_generation.py',
+  'normative_fragments.py',
+  'receipt_challenge.py',
+  'receipt_observer.py',
+] as const;
+
+export interface ResolveBrokerSupervisorPathsOptions {
+  /** `~/.config/mosaic` (or an override) — where installed tool copies live. */
+  mosaicHome: string;
+  /** Root of the checked-out `framework/` directory (canonical file source). */
+  frameworkRoot: string;
+  /** Defaults to `process.env`; pass a fake for tests. */
+  env?: NodeJS.ProcessEnv;
+  /** Defaults to `os.homedir()`; pass a temp dir in tests. */
+  homeDir?: string;
+  /** Defaults to `process.getuid()` (or 0); pass a fake for tests. */
+  uid?: number;
+}
+
+export interface BrokerSupervisorPaths {
+  readonly mosaicHome: string;
+  readonly frameworkRoot: string;
+  readonly systemdUserDir: string;
+  readonly leaseBrokerToolsDir: string;
+  readonly unitSourcePath: string;
+  readonly unitTargetPath: string;
+  readonly wrapperSourcePath: string;
+  readonly wrapperTargetPath: string;
+  readonly daemonSourcePaths: readonly string[];
+  readonly daemonTargetPaths: readonly string[];
+  /**
+   * Resolved with the same precedence as `defaultLeaseBrokerSocket` in
+   * `../commands/launch.ts`: an explicit `MOSAIC_LEASE_BROKER_SOCKET`, else
+   * `$XDG_RUNTIME_DIR/mosaic-lease/broker.sock`, else
+   * `/run/user/<uid>/mosaic-lease/broker.sock`.
+   */
+  readonly socketPath: string;
+  /** Colocated next to the socket, matching the broker's own generation-file convention. */
+  readonly statePath: string;
+}
+
+/**
+ * Resolve the lease broker socket path alone, with the same precedence as
+ * `defaultLeaseBrokerSocket` in `../commands/launch.ts`. Exported so callers
+ * (and tests) can assert the two stay in agreement without importing the CLI
+ * command module.
+ */
+export function resolveLeaseBrokerSocketPath(
+  env: NodeJS.ProcessEnv = process.env,
+  uid: number = typeof process.getuid === 'function' ? process.getuid() : 0,
+): string {
+  const explicit = env['MOSAIC_LEASE_BROKER_SOCKET'];
+  if (explicit) return explicit;
+  const runtimeDir = env['XDG_RUNTIME_DIR'];
+  if (runtimeDir) return join(runtimeDir, 'mosaic-lease', 'broker.sock');
+  return join('/run/user', String(uid), 'mosaic-lease', 'broker.sock');
+}
+
+/** Resolve every path the supervisor apply/health functions need, deterministically. */
+export function resolveBrokerSupervisorPaths(
+  options: ResolveBrokerSupervisorPathsOptions,
+): BrokerSupervisorPaths {
+  const { mosaicHome, frameworkRoot } = options;
+  const env = options.env ?? process.env;
+  const homeDir = options.homeDir ?? homedir();
+  const systemdUserDir = join(homeDir, '.config', 'systemd', 'user');
+  const leaseBrokerToolsDir = join(mosaicHome, 'tools', 'lease-broker');
+  const frameworkLeaseBrokerDir = join(frameworkRoot, 'tools', 'lease-broker');
+  const socketPath = resolveLeaseBrokerSocketPath(env, options.uid);
+  const statePath = join(dirname(socketPath), 'state.json');
+
+  return {
+    mosaicHome,
+    frameworkRoot,
+    systemdUserDir,
+    leaseBrokerToolsDir,
+    unitSourcePath: join(frameworkRoot, 'systemd', 'user', UNIT_NAME),
+    unitTargetPath: join(systemdUserDir, UNIT_NAME),
+    wrapperSourcePath: join(frameworkLeaseBrokerDir, WRAPPER_SCRIPT_NAME),
+    wrapperTargetPath: join(leaseBrokerToolsDir, WRAPPER_SCRIPT_NAME),
+    daemonSourcePaths: DAEMON_SOURCE_FILE_NAMES.map((name) => join(frameworkLeaseBrokerDir, name)),
+    daemonTargetPaths: DAEMON_SOURCE_FILE_NAMES.map((name) => join(leaseBrokerToolsDir, name)),
+    socketPath,
+    statePath,
+  };
+}
+
+export interface ApplyBrokerSupervisorResult {
+  readonly installedFiles: readonly string[];
+}
+
+/**
+ * Idempotently materialize the supervisor unit, its wrapper script, and the
+ * daemon sources it execs. Safe to call on every reseed: every write is a
+ * deterministic overwrite of the same target path from the same source, so a
+ * second call reproduces identical bytes/modes and never errors.
+ *
+ * Never runs `systemctl`; the caller decides separately whether/when to
+ * `daemon-reload`/`enable`/`start` the installed unit.
+ */
+export async function applyBrokerSupervisor(
+  paths: BrokerSupervisorPaths,
+): Promise<ApplyBrokerSupervisorResult> {
+  await mkdir(paths.leaseBrokerToolsDir, { recursive: true });
+  await mkdir(paths.systemdUserDir, { recursive: true });
+
+  const installedFiles: string[] = [];
+
+  for (let index = 0; index < paths.daemonSourcePaths.length; index += 1) {
+    const source = paths.daemonSourcePaths[index];
+    const target = paths.daemonTargetPaths[index];
+    if (source === undefined || target === undefined) continue;
+    await copyFile(source, target);
+    await chmod(target, 0o644);
+    installedFiles.push(target);
+  }
+
+  await copyFile(paths.wrapperSourcePath, paths.wrapperTargetPath);
+  await chmod(paths.wrapperTargetPath, 0o755);
+  installedFiles.push(paths.wrapperTargetPath);
+
+  await copyFile(paths.unitSourcePath, paths.unitTargetPath);
+  await chmod(paths.unitTargetPath, 0o644);
+  installedFiles.push(paths.unitTargetPath);
+
+  return { installedFiles };
+}
+
+export interface BrokerSupervisorHealth {
+  /** Whether the systemd unit file has been materialized at its target path. */
+  readonly unitInstalled: boolean;
+  /** Whether a Unix domain socket currently exists at the resolved socket path. */
+  readonly socketPresent: boolean;
+  /**
+   * The signal other cards (e.g. C1's activation probe) should treat as
+   * "a broker supervisor is present and healthy". Presence of a live socket
+   * is the authoritative signal: a gated runtime can only ever succeed by
+   * connecting to it, so this is what fail-closed callers must check.
+   */
+  readonly healthy: boolean;
+}
+
+/**
+ * Report the supervisor's on-disk/health signals. Never throws for an
+ * absent unit or socket — both simply report `false`; unexpected filesystem
+ * errors (permission issues, etc.) still propagate.
+ */
+export async function checkBrokerSupervisorHealth(
+  paths: Pick<BrokerSupervisorPaths, 'unitTargetPath' | 'socketPath'>,
+): Promise<BrokerSupervisorHealth> {
+  const [unitInstalled, socketPresent] = await Promise.all([
+    pathExists(paths.unitTargetPath),
+    isUnixSocket(paths.socketPath),
+  ]);
+  return { unitInstalled, socketPresent, healthy: socketPresent };
+}
+
+/** Convenience boolean form of {@link checkBrokerSupervisorHealth} for simple call sites. */
+export async function isBrokerSupervisorHealthy(
+  paths: Pick<BrokerSupervisorPaths, 'unitTargetPath' | 'socketPath'>,
+): Promise<boolean> {
+  return (await checkBrokerSupervisorHealth(paths)).healthy;
+}
+
+async function pathExists(path: string): Promise<boolean> {
+  try {
+    await stat(path);
+    return true;
+  } catch (error) {
+    if (isEnoent(error)) return false;
+    throw error;
+  }
+}
+
+async function isUnixSocket(path: string): Promise<boolean> {
+  try {
+    const info = await stat(path);
+    return info.isSocket();
+  } catch (error) {
+    if (isEnoent(error)) return false;
+    throw error;
+  }
+}
+
+function isEnoent(error: unknown): boolean {
+  return (
+    typeof error === 'object' &&
+    error !== null &&
+    'code' in error &&
+    (error as NodeJS.ErrnoException).code === 'ENOENT'
+  );
+}

packages/mosaic/src/mutator-gate/fail-closed-regression.spec.ts

@@ -0,0 +1,41 @@
+import { spawnSync } from 'node:child_process';
+import { join } from 'node:path';
+
+import { describe, expect, it } from 'vitest';
+
+/**
+ * C-REGRESS (issue #869, Point-1) — proves the fail-closed gate is untouched
+ * by the C1 activation probe added alongside this test.
+ *
+ * `mutator-gate.py`'s fail-closed-on-absent-identity behavior is INTENTIONAL
+ * and TEST-LOCKED: #869 C1 gates the WIRING decision for enforcement (via
+ * `leaseEnforcementActivatable()`), it does not — and must not — touch the
+ * gate's own runtime denial behavior. This spec runs the two test-locked
+ * cases from `runtime_tools_unittest.py` directly (rather than merely
+ * re-asserting the same logic in TypeScript) so a regression in the actual
+ * Python gate is caught here too, not just documented in prose.
+ */
+
+const MUTATOR_GATE_DIR = new URL('.', import.meta.url).pathname;
+const UNITTEST_FILE = join(MUTATOR_GATE_DIR, 'runtime_tools_unittest.py');
+
+const LOCKED_TEST_CASES = [
+  'ExecutableEntrypointTest.test_gate_entrypoint_denies_when_identity_environment_is_absent',
+  'MutatorGateTest.test_environment_generation_and_request_failures_deny',
+] as const;
+
+describe('mutator-gate fail-closed behavior (C-REGRESS, unchanged by #869 C1)', () => {
+  it.each(LOCKED_TEST_CASES)('%s still passes', (testCase) => {
+    const result = spawnSync('python3', ['-m', 'unittest', `${moduleName()}.${testCase}`, '-v'], {
+      cwd: MUTATOR_GATE_DIR,
+      encoding: 'utf-8',
+    });
+
+    expect(result.status, `stderr:\n${result.stderr}`).toBe(0);
+  });
+});
+
+function moduleName(): string {
+  // runtime_tools_unittest.py, addressed as a bare module name for `python3 -m unittest`.
+  return UNITTEST_FILE.split('/').pop()!.replace(/\.py$/, '');
+}