fix(#812 follow-up): normalize detect-platform.sh host-match port comparison by scheme

gitea_url_matches_host compared every remote authority's port directly
against the configured HTTP(S) API URL's port, which conflated two
unrelated things and normalized default web ports asymmetrically:

- An SSH remote's transport port (e.g. ssh://git@host:2222/...) was
  compared against the configured HTTP(S) port, even though the SSH
  daemon port has nothing to do with the Gitea HTTP(S) API port.
- An explicit default port on the remote (https://host:443/...) failed
  to match an implicit (portless) configured URL, while the inverse
  (implicit remote vs. explicit configured) already matched -- the
  default-port equivalence was only applied on one side.

Fix get_remote_host() to strip an SSH transport port before it ever
reaches host-match, and make gitea_url_matches_host's default-port
normalization symmetric (":443" https / ":80" http is equivalent to
the implicit form on BOTH sides).

Adds red-first regressions for both repros to
test-pr-review-gitea-comment.sh (extending the #812 harness) and wires
that harness into packages/mosaic's test:framework-shell chain so it
runs under `pnpm test`.

Closes #850

packages/mosaic/framework/tools/git/ci-queue-wait.ps1

@@ -185,16 +185,6 @@ switch ($platform) {
             $headSha = ($branchPayload.commit.id | Out-String).Trim()
         }
         catch {
-            # A not-yet-pushed feature branch has no in-flight pipeline, so the
-            # pre-push queue guard must treat 404 as "queue clear", not crash.
-            $statusCode = $null
-            if ($_.Exception.Response) {
-                $statusCode = [int]$_.Exception.Response.StatusCode
-            }
-            if ($statusCode -eq 404) {
-                Write-Host "[ci-queue-wait] branch $Branch not yet on remote — no in-flight pipeline; queue clear."
-                exit 0
-            }
             Write-Error "Could not resolve $Branch head SHA from Gitea API."
             exit 1
         }

packages/mosaic/framework/tools/git/ci-queue-wait.sh

@@ -137,21 +137,7 @@ gitea_get_branch_head_sha() {
     local branch="$3"
     local token="$4"
     local url="https://${host}/api/v1/repos/${repo}/branches/${branch}"
-    # Capture HTTP status so an absent branch (404) is distinguished from an API
+    curl -fsSL -H "User-Agent: curl/8" -H "Authorization: token ${token}" "$url" | python3 -c '
-    # error. A not-yet-pushed feature branch has no in-flight pipeline, so the
-    # pre-push queue guard must treat 404 as "queue clear", not crash.
-    local resp code body
-    resp=$(curl -sS -H "User-Agent: curl/8" -H "Authorization: token ${token}" -w $'\n%{http_code}' "$url")
-    code="${resp##*$'\n'}"
-    body="${resp%$'\n'*}"
-    if [[ "$code" == "404" ]]; then
-        echo "__BRANCH_ABSENT__"
-        return 0
-    fi
-    if [[ "$code" != "200" ]]; then
-        return 1
-    fi
-    printf '%s' "$body" | python3 -c '
 import json, sys
 data = json.load(sys.stdin)
 commit = data.get("commit") or {}
@@ -233,10 +219,6 @@ elif [[ "$PLATFORM" == "gitea" ]]; then
         exit 1
     }
     HEAD_SHA=$(gitea_get_branch_head_sha "$HOST" "$OWNER/$REPO" "$BRANCH" "$TOKEN")
-    if [[ "$HEAD_SHA" == "__BRANCH_ABSENT__" ]]; then
-        echo "[ci-queue-wait] branch ${BRANCH} not yet on remote — no in-flight pipeline; queue clear."
-        exit 0
-    fi
     if [[ -z "$HEAD_SHA" ]]; then
         echo "Error: Could not resolve ${BRANCH} head SHA." >&2
         exit 1

packages/mosaic/framework/tools/git/test-ci-queue-wait-branch-absent.sh

@@ -1,153 +0,0 @@
-#!/usr/bin/env bash
-# Regression harness for ci-queue-wait.sh's 404-branch-absent handling.
-#
-# gitea_get_branch_head_sha() resolves a branch's head SHA before the
-# pre-push queue guard runs. A branch that has never been pushed doesn't
-# exist on the remote yet, so Gitea's branches/<branch> endpoint 404s.
-# Before the fix, `curl -fsSL` failed on the 404, its empty stdout was piped
-# into `python3 -c 'json.load(sys.stdin)'`, and the resulting
-# JSONDecodeError crashed the guard -- blocking every new feature branch's
-# first push. The fix must treat 404 as "no in-flight pipeline" (queue
-# clear) while still failing closed on a genuine API error.
-#
-# Covers:
-#   (a) 404 branch-absent          -> exit 0, "queue clear" message.
-#   (b) 200 existing branch + a terminal CI state -> unchanged behavior.
-#   (c) genuine API error (500)    -> still fail-closed (nonzero exit).
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-WORK_DIR="${MOSAIC_TEST_WORK_DIR:-$PWD/.mosaic-test-work/ci-queue-wait-branch-absent}"
-REPO_DIR="$WORK_DIR/repo"
-STUB_DIR="$WORK_DIR/stubs"
-
-rm -rf "$WORK_DIR"
-mkdir -p "$REPO_DIR" "$STUB_DIR"
-
-git -C "$REPO_DIR" init -q
-git -C "$REPO_DIR" remote add origin https://git.example.test/acme/widgets.git
-
-# Minimal curl stub. Selects a canned response by inspecting which Gitea
-# endpoint is being hit (branches/<branch> vs commits/<sha>/status) and
-# whether -w '%{http_code}' was requested. Only the patched branch-lookup
-# call passes -w; the unpatched call and the (unchanged) status call both
-# use plain `curl -fsSL` semantics -- exit nonzero and print nothing on a
-# non-2xx response. This lets the same stub exercise both the pre-fix and
-# post-fix branch-lookup code paths faithfully.
-cat > "$STUB_DIR/curl" <<'SH'
-#!/usr/bin/env bash
-set -euo pipefail
-
-has_w=0
-url=""
-for arg in "$@"; do
-    case "$arg" in
-        -w) has_w=1 ;;
-        http://*|https://*) url="$arg" ;;
-    esac
-done
-
-case "$url" in
-    */branches/*) mode="${MOSAIC_STUB_BRANCH_MODE:?MOSAIC_STUB_BRANCH_MODE not set}" ;;
-    */status)     mode="${MOSAIC_STUB_STATUS_MODE:-terminal-success}" ;;
-    *)
-        echo "curl stub: unrecognized URL: $url" >&2
-        exit 2
-        ;;
-esac
-
-case "$mode" in
-    404)  code=404; body="" ;;
-    200)  code=200; body='{"commit":{"id":"deadbeefcafef00d0123456789abcdef01234567"}}' ;;
-    500)  code=500; body='{"message":"internal server error"}' ;;
-    no-status)         code=200; body='{}' ;;
-    terminal-success)  code=200; body='{"state":"success"}' ;;
-    *)
-        echo "curl stub: unknown mode=$mode" >&2
-        exit 2
-        ;;
-esac
-
-if [[ "$has_w" == 1 ]]; then
-    printf '%s\n%s' "$body" "$code"
-    exit 0
-fi
-
-# Unpatched branch-lookup call / status-endpoint call: real curl -fsSL
-# exits nonzero and emits nothing on stdout for a non-2xx response.
-if [[ "$code" != "200" ]]; then
-    exit 22
-fi
-printf '%s' "$body"
-SH
-chmod +x "$STUB_DIR/curl"
-
-run_ci_queue_wait() {
-    local branch="$1"
-    (
-        cd "$REPO_DIR"
-        export PATH="$STUB_DIR:$PATH"
-        export MOSAIC_CREDENTIALS_FILE="$WORK_DIR/no-credentials.json"
-        export GITEA_TOKEN="stub-token"
-        export GITEA_URL="https://git.example.test"
-        "$SCRIPT_DIR/ci-queue-wait.sh" -B "$branch" --purpose push -t 5 -i 1
-    )
-}
-
-fail=0
-
-# (a) 404 branch-absent -> queue clear, exit 0.
-set +e
-out_a=$(MOSAIC_STUB_BRANCH_MODE=404 run_ci_queue_wait "feat/not-pushed-yet" 2>&1)
-status_a=$?
-set -e
-if [[ "$status_a" -ne 0 ]]; then
-    echo "FAIL(a): expected exit 0 for 404 branch-absent, got $status_a" >&2
-    echo "$out_a" >&2
-    fail=1
-elif [[ "$out_a" != *"queue clear"* ]]; then
-    echo "FAIL(a): expected a queue-clear message, got:" >&2
-    echo "$out_a" >&2
-    fail=1
-fi
-
-# (b) 200 existing branch + terminal CI state -> unchanged behavior, exit 0.
-set +e
-out_b=$(MOSAIC_STUB_BRANCH_MODE=200 MOSAIC_STUB_STATUS_MODE=terminal-success run_ci_queue_wait "main" 2>&1)
-status_b=$?
-set -e
-if [[ "$status_b" -ne 0 ]]; then
-    echo "FAIL(b): expected exit 0 for existing branch with terminal status, got $status_b" >&2
-    echo "$out_b" >&2
-    fail=1
-elif [[ "$out_b" != *"sha=deadbeefcafef00d0123456789abcdef01234567"* ]]; then
-    echo "FAIL(b): expected the resolved HEAD SHA to be logged, got:" >&2
-    echo "$out_b" >&2
-    fail=1
-elif [[ "$out_b" == *"queue clear"* ]]; then
-    echo "FAIL(b): an existing branch must not take the branch-absent path" >&2
-    echo "$out_b" >&2
-    fail=1
-fi
-
-# (c) genuine API error (500) -> still fail-closed, exit nonzero.
-set +e
-out_c=$(MOSAIC_STUB_BRANCH_MODE=500 run_ci_queue_wait "feat/some-branch" 2>&1)
-status_c=$?
-set -e
-if [[ "$status_c" -eq 0 ]]; then
-    echo "FAIL(c): expected a nonzero exit for a genuine 500 API error, got 0" >&2
-    echo "$out_c" >&2
-    fail=1
-elif [[ "$out_c" == *"queue clear"* ]]; then
-    echo "FAIL(c): a genuine API error must not be reported as queue-clear" >&2
-    echo "$out_c" >&2
-    fail=1
-fi
-
-if [[ "$fail" -eq 0 ]]; then
-    echo "ci-queue-wait branch-absent regression passed (3/3 cases)"
-fi
-
-exit "$fail"

packages/mosaic/framework/tools/orchestrator/README.md

@@ -1,92 +0,0 @@
-# orchestrator/ tools
-
-Helper scripts for r0 coordinator / orchestrator sessions — mission lifecycle,
-session health, continuation, and board maintenance. See
-`framework/guides/ORCHESTRATOR-PROTOCOL.md` for the surrounding process.
-
-| Script               | Purpose                                                                                         |
-| -------------------- | ----------------------------------------------------------------------------------------------- |
-| `mission-init.sh`    | Initialize a new orchestration mission (manifest, scratchpad, TASKS.md).                        |
-| `mission-status.sh`  | Show the mission progress dashboard.                                                            |
-| `session-run.sh`     | Generate continuation context and launch the target runtime.                                    |
-| `session-resume.sh`  | Crash recovery for dead orchestrator sessions.                                                  |
-| `session-status.sh`  | Check agent session health.                                                                     |
-| `continue-prompt.sh` | Generate the continuation prompt for the next session.                                          |
-| `board-roll.sh`      | Keep a LIVE orchestration board under its byte cap by rolling the oldest entries to its LEDGER. |
-| `smoke-test.sh`      | Behavior smoke checks for the coord continue/run workflows.                                     |
-| `test-board-roll.sh` | Regression harness for `board-roll.sh`.                                                         |
-| `_lib.sh`            | Shared functions sourced by the above (state files, TASKS.md parsing, locks).                   |
-
-## board-roll.sh
-
-Coordinator boards (`MOS-ORCHESTRATION-BOARD-LIVE.md`, `MS-LEAD-BOARD-LIVE.md`)
-follow a **"< 8 KB LIVE"** discipline: the LIVE board is the only file loaded on
-resume, so it must stay small, and history lives in an append-only LEDGER. When a
-board write would push LIVE over its cap, coordinators otherwise hand-trim and
-retry every time — an observed 38 ABORT-OVER-CAP cycles in one 24 h window.
-`board-roll.sh` automates that trim mechanically and reversibly: the audit trail
-is moved to the LEDGER instead of being hand-deleted.
-
-### Contract (conservative — it never guesses what is safe to move)
-
-The LIVE board opts in by wrapping its aging archival ticks in an explicit roll
-zone. Everything **outside** the markers (title, protocol blockquote, curated
-always-current `##` sections) is pinned and never touched:
-
-```markdown
-# MOS ORCHESTRATION BOARD — LIVE state
-
-> protocol blockquote … (pinned)
-
-## 🟦 Curated always-current section (pinned)
-
-…
-
-<!-- BOARD-ROLL:START -->
-
-### 2026-07-22 (mid²²) — newest tick, stays longest
-
-…
-
-### 2026-07-20 (dawn) — oldest tick, rolled first
-
-…
-
-<!-- BOARD-ROLL:END -->
-```
-
-Inside the zone, entries are delimited by a heading marker (default `### `) and
-are assumed **newest-first (top) → oldest-last (bottom)**. `board-roll.sh` moves
-whole oldest (bottom-most) entry blocks out of the zone and appends them verbatim
-to the LEDGER, one at a time, until LIVE is back under the cap or the zone is
-empty. If the board has no markers, it exits `3` and changes nothing — adding the
-markers is a deliberate opt-in by the board owner.
-
-### Usage
-
-```bash
-board-roll.sh --live <LIVE.md> --ledger <LEDGER.md> [options]
-
-  --live   <path>    LIVE board file (required)
-  --ledger <path>    append-only LEDGER file (required; created if absent)
-  --cap    <bytes>   size ceiling for LIVE (default 8192)
-  --marker <prefix>  entry-heading prefix inside the roll zone (default "### ")
-  --dry-run          report what would move; change nothing
-  -h, --help         show help and exit 0
-```
-
-Only **one** roll zone is supported. If a board carries more than one
-`BOARD-ROLL:START`/`END` pair, `board-roll.sh` refuses (exit `3`, zero changes)
-rather than span first-START..last-END and relocate the curated content between
-the zones — consolidate the ticks into a single zone instead.
-
-Exit codes: `0` LIVE under cap (already, or after rolling) — on `--dry-run`, a
-plan exists or nothing to do · `2` usage / argument / IO error · `3` cannot meet
-the cap (no markers, **more than one marker pair**, or the pinned sections alone
-exceed the cap and need a manual trim).
-
-Writes are atomic (temp file + `mv`, LEDGER first) so a failure never leaves a
-board half-written; line endings are normalized to LF on rewrite. `--dry-run`
-first is recommended when wiring it into a board update protocol.
-
-Run the regression suite with `bash test-board-roll.sh`.

packages/mosaic/framework/tools/orchestrator/board-roll.sh

@@ -1,277 +0,0 @@
-#!/usr/bin/env bash
-#
-# board-roll.sh — keep a LIVE orchestration board under its byte cap by rolling
-#                 the oldest archival entries out to its append-only LEDGER.
-#
-# WHY: coordinator boards (MOS-ORCHESTRATION-BOARD-LIVE.md, MS-LEAD-BOARD-LIVE.md)
-# enforce a "< 8 KB LIVE" discipline via a self-guard that ABORTs the board write
-# when the file exceeds the cap. In practice the LIVE board keeps bumping the cap,
-# so coordinators hand-trim + retry every time (observed: 38 ABORT-OVER-CAP cycles
-# in a 24h window on one coordinator). This automates that trim, mechanically and
-# reversibly, so the audit trail is preserved in the LEDGER instead of hand-deleted.
-#
-# CONTRACT (conservative by design — it NEVER guesses what is safe to move):
-#   The LIVE board must declare an explicit ROLL ZONE with HTML-comment markers:
-#
-#       <!-- BOARD-ROLL:START -->
-#       ### 2026-07-22 (newest tick — stays longest)
-#       ...
-#       ### 2026-07-19 (oldest tick — rolled first)
-#       ...
-#       <!-- BOARD-ROLL:END -->
-#
-#   Everything OUTSIDE the markers (title, protocol blockquote, curated always-current
-#   `##` sections) is PINNED and never touched. Inside the zone, entries are delimited
-#   by a heading marker (default `### `) and are assumed newest-first (top) → oldest-last
-#   (bottom), matching board convention. board-roll moves whole oldest (bottom-most)
-#   entry blocks out of the zone and APPENDS them verbatim to the LEDGER, one block at a
-#   time, until the LIVE file is back under the cap or the zone is empty.
-#
-#   If no markers are present, it exits 3 without changing anything (safe default —
-#   adding the markers is a deliberate opt-in by the board owner).
-#
-# USAGE:
-#   board-roll.sh --live <LIVE.md> --ledger <LEDGER.md> [options]
-#
-# OPTIONS:
-#   --live   <path>   LIVE board file (required)
-#   --ledger <path>   append-only LEDGER file (required; created if absent)
-#   --cap    <bytes>  size ceiling for LIVE (default 8192)
-#   --marker <prefix> entry-heading prefix inside the roll zone (default "### ")
-#   --dry-run         report what would move + resulting size; change nothing
-#   -h, --help        print usage and exit 0
-#
-# EXIT CODES:
-#   0  LIVE is under cap (already, or after rolling); on --dry-run, 0 = a plan exists
-#      (or nothing to do)
-#   2  usage / argument / IO error (bad flag, missing file, unwritable target)
-#   3  cannot satisfy the cap: no roll markers present, MORE THAN ONE marker pair
-#      (multiple zones are refused, not guessed), OR the zone was emptied and LIVE
-#      is still over cap (curated pinned sections need a manual trim)
-#
-# NOTE: line endings are normalized to LF on rewrite (boards are LF markdown); a
-# trailing newline is always ensured. Writes are atomic (temp file + mv) so a
-# failure never leaves LIVE or LEDGER half-written.
-
-set -euo pipefail
-
-START_MARK='<!-- BOARD-ROLL:START -->'
-END_MARK='<!-- BOARD-ROLL:END -->'
-
-usage() {
-    cat <<'EOF'
-Usage: board-roll.sh --live <LIVE.md> --ledger <LEDGER.md> [options]
-
-Roll the oldest entries out of a LIVE orchestration board into its LEDGER
-until the LIVE file is under a byte cap. Conservative: only content inside
-explicit <!-- BOARD-ROLL:START -->/<!-- BOARD-ROLL:END --> markers is moved.
-
-Options:
-  --live   <path>    LIVE board file (required)
-  --ledger <path>    append-only LEDGER file (required; created if absent)
-  --cap    <bytes>   size ceiling for LIVE (default 8192)
-  --marker <prefix>  entry-heading prefix inside the roll zone (default "### ")
-  --dry-run          report what would move; change nothing
-  -h, --help         show this help and exit 0
-
-Exit: 0 under cap (or dry-run plan) · 2 usage/IO error · 3 cannot meet cap
-      (no markers, or pinned sections alone exceed the cap).
-EOF
-}
-
-die() { echo "board-roll: $*" >&2; exit 2; }
-
-LIVE=""; LEDGER=""; CAP=8192; MARKER='### '; DRYRUN=0
-while [[ $# -gt 0 ]]; do
-    case "$1" in
-        --live)    LIVE="${2:-}"; shift 2 || die "--live needs a value" ;;
-        --ledger)  LEDGER="${2:-}"; shift 2 || die "--ledger needs a value" ;;
-        --cap)     CAP="${2:-}"; shift 2 || die "--cap needs a value" ;;
-        --marker)  MARKER="${2:-}"; shift 2 || die "--marker needs a value" ;;
-        --dry-run) DRYRUN=1; shift ;;
-        -h|--help) usage; exit 0 ;;
-        *) usage >&2; die "unknown option: $1" ;;
-    esac
-done
-
-[[ -n "$LIVE"   ]] || { usage >&2; die "--live is required"; }
-[[ -n "$LEDGER" ]] || { usage >&2; die "--ledger is required"; }
-[[ -f "$LIVE"   ]] || die "LIVE file not found: $LIVE"
-[[ "$CAP" =~ ^[0-9]+$ ]] || die "--cap must be a non-negative integer, got: $CAP"
-
-# --- read LIVE into a line array (newlines stripped; re-added on write) ---------
-mapfile -t LINES < "$LIVE"
-
-# byte size of an array rendered as LF-terminated text
-render_size() {
-    if [[ $# -eq 0 ]]; then printf 0; return; fi
-    printf '%s\n' "$@" | wc -c
-}
-
-orig_size=$(render_size "${LINES[@]}")
-
-# --- already under cap → nothing to do -----------------------------------------
-if (( orig_size < CAP )); then
-    echo "board-roll: LIVE is ${orig_size}B (< cap ${CAP}B) — nothing to roll."
-    exit 0
-fi
-
-# --- locate the roll-zone markers ----------------------------------------------
-# Exactly ONE marker pair is supported. If a board carries more than one START or
-# END marker we REFUSE (exit 3, zero changes) rather than guess: a naive
-# first-START..last-END span would swallow the curated content and the intermediate
-# markers sitting between two intended zones and silently relocate that pinned text
-# to the LEDGER — the exact data-loss this tool exists to prevent. Refusing matches
-# the "no markers = exit 3" conservative posture.
-start_idx=-1; end_idx=-1; start_count=0; end_count=0
-for i in "${!LINES[@]}"; do
-    if [[ "${LINES[$i]}" == "$START_MARK" ]]; then
-        if (( start_count == 0 )); then start_idx=$i; fi
-        start_count=$(( start_count + 1 ))
-    fi
-    if [[ "${LINES[$i]}" == "$END_MARK" ]]; then
-        end_idx=$i
-        end_count=$(( end_count + 1 ))
-    fi
-done
-if (( start_count > 1 || end_count > 1 )); then
-    echo "board-roll: LIVE is ${orig_size}B (>= cap ${CAP}B) but has ${start_count} START / ${end_count} END" >&2
-    echo "  markers — only a SINGLE '$START_MARK' … '$END_MARK' roll zone is supported." >&2
-    echo "  Multiple zones are refused (not guessed) so content between zones is never relocated." >&2
-    echo "  Consolidate the archival ticks into one zone, or trim manually." >&2
-    exit 3
-fi
-if (( start_idx < 0 || end_idx < 0 || end_idx <= start_idx )); then
-    echo "board-roll: LIVE is ${orig_size}B (>= cap ${CAP}B) but no usable roll zone" >&2
-    echo "  (need '$START_MARK' then '$END_MARK'). Add the markers around the" >&2
-    echo "  archival tick section to opt this board into automatic rolling." >&2
-    exit 3
-fi
-
-# preamble = lines [0 .. start_idx]   (inclusive of START marker)
-# zone     = lines (start_idx .. end_idx)  (exclusive of both markers)
-# footer   = lines [end_idx .. end]   (inclusive of END marker)
-preamble=(); zone=(); footer=()
-for i in "${!LINES[@]}"; do
-    if   (( i <= start_idx )); then preamble+=("${LINES[$i]}")
-    elif (( i <  end_idx  )); then zone+=("${LINES[$i]}")
-    else footer+=("${LINES[$i]}")
-    fi
-done
-
-# --- split the zone into a fixed head + entry blocks ----------------------------
-# zone_head = any zone lines before the first entry marker (kept, never rolled).
-# blocks[k] = newline-joined text of entry k (marker line .. line before next marker).
-zone_head=(); declare -a block_start=()
-first_block=-1
-for i in "${!zone[@]}"; do
-    if [[ "${zone[$i]}" == "$MARKER"* ]]; then
-        [[ $first_block -eq -1 ]] && first_block=$i
-        block_start+=("$i")
-    fi
-done
-if (( first_block == -1 )); then
-    echo "board-roll: LIVE is ${orig_size}B (>= cap ${CAP}B) but the roll zone has no" >&2
-    echo "  '${MARKER}' entries to move. Trim the pinned sections manually." >&2
-    exit 3
-fi
-for (( i=0; i<first_block; i++ )); do zone_head+=("${zone[$i]}"); done
-
-nblocks=${#block_start[@]}
-# block k spans zone[ block_start[k] .. (block_start[k+1]-1 or end-of-zone) ]
-block_text() {  # $1 = block index → prints the block's lines, LF-joined (no trailing)
-    local k=$1 s e
-    s=${block_start[$k]}
-    if (( k+1 < nblocks )); then e=$(( block_start[$((k+1))] - 1 )); else e=$(( ${#zone[@]} - 1 )); fi
-    local out=()
-    for (( j=s; j<=e; j++ )); do out+=("${zone[$j]}"); done
-    printf '%s\n' "${out[@]}"
-}
-
-# --- greedily roll oldest (bottom-most) blocks until under cap ------------------
-# keep = number of newest blocks retained; start with all, drop from the bottom.
-keep=$nblocks       # blocks [keep .. nblocks-1] are the oldest set that gets moved
-current_size=$orig_size
-build_live_size() {  # size of LIVE if we keep blocks [0 .. keep-1]
-    local acc=("${preamble[@]}" "${zone_head[@]}")
-    local k s e j
-    for (( k=0; k<keep; k++ )); do
-        s=${block_start[$k]}
-        if (( k+1 < nblocks )); then e=$(( block_start[$((k+1))] - 1 )); else e=$(( ${#zone[@]} - 1 )); fi
-        for (( j=s; j<=e; j++ )); do acc+=("${zone[$j]}"); done
-    done
-    acc+=("${footer[@]}")
-    render_size "${acc[@]}"
-}
-while (( current_size >= CAP && keep > 0 )); do
-    keep=$(( keep - 1 ))
-    current_size=$(build_live_size)
-done
-
-moved_count=$(( nblocks - keep ))
-if (( moved_count == 0 )); then
-    # zone had entries but none movable brought us under (shouldn't happen: keep hits 0)
-    echo "board-roll: could not reduce LIVE below cap (${current_size}B >= ${CAP}B)." >&2
-    exit 3
-fi
-
-# --- dry-run report -------------------------------------------------------------
-plan_headers() {
-    local k
-    for (( k=keep; k<nblocks; k++ )); do
-        # first line of each moved block
-        printf '    %s\n' "${zone[${block_start[$k]}]}"
-    done
-}
-if (( DRYRUN )); then
-    echo "board-roll: DRY RUN"
-    echo "  LIVE now:   ${orig_size}B (cap ${CAP}B) — over by $(( orig_size - CAP ))B"
-    echo "  would roll: ${moved_count} of ${nblocks} entr$([[ $moved_count -eq 1 ]] && echo y || echo ies) (oldest first):"
-    plan_headers
-    echo "  LIVE after: ${current_size}B"
-    if (( current_size >= CAP )); then
-        echo "  WARNING: still >= cap after emptying the zone; pinned sections need a manual trim." >&2
-        exit 3
-    fi
-    exit 0
-fi
-
-# --- commit the roll atomically -------------------------------------------------
-live_tmp="$(mktemp "${LIVE}.roll.XXXXXX")" || die "cannot create temp next to LIVE"
-ledger_tmp=""
-# shellcheck disable=SC2329  # invoked indirectly via `trap cleanup EXIT`
-cleanup() { rm -f "$live_tmp" "$ledger_tmp" 2>/dev/null || true; }
-trap cleanup EXIT
-
-# new LIVE = preamble + zone_head + kept blocks + footer
-{
-    printf '%s\n' "${preamble[@]}" "${zone_head[@]}"
-    for (( k=0; k<keep; k++ )); do block_text "$k"; done
-    printf '%s\n' "${footer[@]}"
-} > "$live_tmp"
-
-# LEDGER gets the moved blocks appended verbatim, in original top→bottom order,
-# under a provenance separator. LEDGER is append-only, so we only ever add at EOF.
-ledger_tmp="$(mktemp "${LEDGER}.roll.XXXXXX")" || die "cannot create temp next to LEDGER"
-if [[ -f "$LEDGER" ]]; then cat "$LEDGER" > "$ledger_tmp"; fi
-# ensure a trailing newline on existing content before appending
-if [[ -s "$ledger_tmp" && -n "$(tail -c1 "$ledger_tmp")" ]]; then printf '\n' >> "$ledger_tmp"; fi
-{
-    printf '\n<!-- board-roll: %d entr%s rolled from %s -->\n' \
-        "$moved_count" "$([[ $moved_count -eq 1 ]] && echo y || echo ies)" "$(basename "$LIVE")"
-    for (( k=keep; k<nblocks; k++ )); do block_text "$k"; done
-} >> "$ledger_tmp"
-
-# atomic swap (both, LEDGER first so a crash never drops content that left LIVE)
-mv "$ledger_tmp" "$LEDGER"; ledger_tmp=""
-mv "$live_tmp" "$LIVE"; live_tmp=""
-trap - EXIT
-
-# read the real on-disk size back (truthful, not the predicted value)
-final_size=$(wc -c < "$LIVE")
-echo "board-roll: rolled ${moved_count} entr$([[ $moved_count -eq 1 ]] && echo y || echo ies) to $(basename "$LEDGER"); LIVE ${orig_size}B → ${final_size}B (cap ${CAP}B)."
-if (( final_size >= CAP )); then
-    echo "board-roll: still >= cap after rolling all zone entries; pinned sections need a manual trim." >&2
-    exit 3
-fi
-exit 0

packages/mosaic/framework/tools/orchestrator/test-board-roll.sh

@@ -1,156 +0,0 @@
-#!/usr/bin/env bash
-# Regression harness for board-roll.sh — rolling oldest LIVE-board entries to LEDGER.
-#
-# Asserts:
-#   1. Under cap → no-op, exit 0, files unchanged.
-#   2. Over cap, no roll markers → exit 3, LIVE unchanged (never guesses).
-#   3. Over cap, markers present → rolls the fewest oldest entries to get under cap,
-#      LIVE ends under cap, pinned preamble/footer + newest entries preserved.
-#   4. Rolled blocks land in the LEDGER verbatim, oldest set in original order.
-#   5. --dry-run changes nothing and reports a plan.
-#   6. Zone emptied but pinned sections alone exceed cap → exit 3.
-#   7. --help exits 0 and prints usage; an unknown flag exits nonzero (#701 discipline).
-#   8. More than one marker pair → exit 3, unchanged; curated content between the two
-#      zones is never relocated to the LEDGER (rev0 #868 regression).
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-SUT="$SCRIPT_DIR/board-roll.sh"
-
-fail=0
-note() { echo "FAIL: $*" >&2; fail=1; }
-
-WORK="$(mktemp -d)"
-trap 'rm -rf "$WORK"' EXIT
-
-# builds a LIVE board: pinned preamble + roll zone with N dated entries (newest first),
-# each entry padded to be individually large so the cap math is predictable.
-make_board() {  # $1 file  $2 n_entries  $3 with_markers(1/0)  $4 pad_bytes
-    local f=$1 n=$2 markers=$3 pad=$4 i padtxt
-    padtxt=$(head -c "$pad" < /dev/zero | tr '\0' 'x')
-    {
-        echo "# BOARD — LIVE"
-        echo "> pinned protocol blockquote, never rolled."
-        echo
-        echo "## Curated always-current section (pinned)"
-        echo "- this stays no matter what"
-        echo
-        [[ "$markers" == 1 ]] && echo '<!-- BOARD-ROLL:START -->'
-        # newest first (i=n .. 1); oldest (i=1) ends at the bottom
-        for (( i=n; i>=1; i-- )); do
-            echo "### 2026-07-$(printf '%02d' $i) tick number $i"
-            echo "- detail $i $padtxt"
-            echo
-        done
-        [[ "$markers" == 1 ]] && echo '<!-- BOARD-ROLL:END -->'
-    } > "$f"
-    return 0
-}
-
-# ── 1. under cap → no-op ───────────────────────────────────────────────────────
-L="$WORK/live1.md"; G="$WORK/ledger1.md"; : > "$G"
-make_board "$L" 2 1 10
-before=$(cat "$L")
-if ! out=$(bash "$SUT" --live "$L" --ledger "$G" --cap 100000 2>&1); then
-    note "under-cap should exit 0 (got nonzero): $out"
-fi
-[[ "$(cat "$L")" == "$before" ]] || note "under-cap modified LIVE"
-[[ -s "$G" ]] && note "under-cap wrote to LEDGER"
-
-# ── 2. over cap, no markers → exit 3, unchanged ────────────────────────────────
-L="$WORK/live2.md"; G="$WORK/ledger2.md"; : > "$G"
-make_board "$L" 6 0 400
-before=$(cat "$L")
-set +e; bash "$SUT" --live "$L" --ledger "$G" --cap 800 >/dev/null 2>&1; rc=$?; set -e
-[[ "$rc" -eq 3 ]] || note "no-markers over-cap should exit 3 (got $rc)"
-[[ "$(cat "$L")" == "$before" ]] || note "no-markers run modified LIVE (must never guess)"
-
-# ── 3+4. over cap with markers → rolls oldest, LIVE under cap, LEDGER gets them ─
-L="$WORK/live3.md"; G="$WORK/ledger3.md"; echo "# LEDGER" > "$G"
-make_board "$L" 6 1 400          # 6 entries, each ~>400B
-big=$(wc -c < "$L")
-[[ "$big" -ge 2000 ]] || note "fixture too small to test rolling ($big B)"
-if ! out=$(bash "$SUT" --live "$L" --ledger "$G" --cap 2000 2>&1); then
-    note "marker roll should exit 0 when it can get under cap: $out"
-fi
-after=$(wc -c < "$L")
-[[ "$after" -lt 2000 ]] || note "LIVE still >= cap after roll ($after B)"
-# pinned content survives
-grep -q "Curated always-current section" "$L" || note "roll dropped pinned section"
-grep -q 'BOARD-ROLL:START' "$L" || note "roll dropped START marker"
-grep -q 'BOARD-ROLL:END' "$L"   || note "roll dropped END marker"
-# newest entry (07-06) stays; oldest (07-01) is the first to leave
-grep -q "### 2026-07-06 tick number 6" "$L" || note "roll dropped the newest entry"
-grep -q "### 2026-07-01 tick number 1" "$L" && note "oldest entry not rolled out of LIVE"
-# oldest went to LEDGER
-grep -q "### 2026-07-01 tick number 1" "$G" || note "oldest entry not appended to LEDGER"
-grep -q "board-roll:.*rolled from live3.md" "$G" || note "LEDGER missing provenance separator"
-# a rolled entry must not be duplicated (present in exactly one of LIVE/LEDGER)
-if grep -q "### 2026-07-01 tick number 1" "$L"; then note "rolled entry duplicated in LIVE"; fi
-# LEDGER original content preserved
-grep -q "^# LEDGER" "$G" || note "roll clobbered existing LEDGER content"
-
-# ── 5. --dry-run changes nothing ───────────────────────────────────────────────
-L="$WORK/live5.md"; G="$WORK/ledger5.md"; echo "# LEDGER" > "$G"
-make_board "$L" 6 1 400
-before_l=$(cat "$L"); before_g=$(cat "$G")
-out=$(bash "$SUT" --live "$L" --ledger "$G" --cap 2000 --dry-run 2>&1) || note "dry-run exited nonzero: $out"
-echo "$out" | grep -qi "dry run" || note "dry-run did not announce itself"
-echo "$out" | grep -q "would roll" || note "dry-run did not report a plan"
-[[ "$(cat "$L")" == "$before_l" ]] || note "dry-run modified LIVE"
-[[ "$(cat "$G")" == "$before_g" ]] || note "dry-run modified LEDGER"
-
-# ── 6. zone emptied, pinned alone over cap → exit 3 ────────────────────────────
-# cap 120 is below the pinned preamble+footer size (~180B), so even after rolling
-# every zone entry the LIVE file stays over cap → must report the unsatisfiable case.
-L="$WORK/live6.md"; G="$WORK/ledger6.md"; echo "# LEDGER" > "$G"
-make_board "$L" 3 1 50
-set +e; bash "$SUT" --live "$L" --ledger "$G" --cap 120 >/dev/null 2>&1; rc=$?; set -e
-[[ "$rc" -eq 3 ]] || note "unsatisfiable cap should exit 3 (got $rc)"
-
-# ── 7. help exits 0, unknown flag exits nonzero (#701) ─────────────────────────
-if ! out=$(bash "$SUT" --help 2>&1); then note "--help exited nonzero"; fi
-[[ "$out" == Usage:* ]] || note "--help did not print usage"
-bash "$SUT" -h >/dev/null 2>&1 || note "-h exited nonzero"
-if bash "$SUT" --not-a-real-flag >/dev/null 2>&1; then note "unknown flag was accepted"; fi
-if bash "$SUT" --live "$WORK/live3.md" >/dev/null 2>&1; then note "missing --ledger was accepted"; fi
-
-# ── 8. multiple marker pairs → exit 3, unchanged (no cross-zone relocation) ─────
-# Two separately-marked zones with a curated pinned section BETWEEN them. A naive
-# first-START..last-END span would sweep that curated section (and the intermediate
-# markers) into the LEDGER. board-roll must refuse (exit 3) and touch nothing.
-L="$WORK/live8.md"; G="$WORK/ledger8.md"; echo "# LEDGER" > "$G"
-pad8=$(head -c 300 < /dev/zero | tr '\0' 'x')
-{
-    echo "# BOARD — LIVE"
-    echo "> pinned protocol blockquote"
-    echo
-    echo '<!-- BOARD-ROLL:START -->'
-    echo "### 2026-07-10 zone-A newest"
-    echo "- detail A2 $pad8"
-    echo "### 2026-07-09 zone-A oldest"
-    echo "- detail A1 $pad8"
-    echo '<!-- BOARD-ROLL:END -->'
-    echo
-    echo "## Curated-between-zones (pinned — must never move)"
-    echo "- CANARY-BETWEEN keep me"
-    echo
-    echo '<!-- BOARD-ROLL:START -->'
-    echo "### 2026-07-08 zone-B newest"
-    echo "- detail B2 $pad8"
-    echo "### 2026-07-07 zone-B oldest"
-    echo "- detail B1 $pad8"
-    echo '<!-- BOARD-ROLL:END -->'
-} > "$L"
-before8=$(cat "$L")
-set +e; bash "$SUT" --live "$L" --ledger "$G" --cap 80 >/dev/null 2>&1; rc=$?; set -e
-[[ "$rc" -eq 3 ]] || note "multi-pair board should exit 3 (got $rc)"
-[[ "$(cat "$L")" == "$before8" ]] || note "multi-pair run modified LIVE (must never guess across zones)"
-grep -q "CANARY-BETWEEN keep me" "$L" || note "multi-pair run relocated curated between-zones content"
-grep -q "CANARY-BETWEEN" "$G" && note "curated between-zones content leaked into LEDGER"
-
-if [[ "$fail" -eq 0 ]]; then
-    echo "board-roll regression passed (8 groups)"
-fi
-exit "$fail"

packages/mosaic/package.json

@@ -25,7 +25,7 @@
     "lint": "eslint src",
     "typecheck": "tsc --noEmit",
     "test": "vitest run --passWithNoTests && pnpm run test:framework-shell",
-    "test:framework-shell": "python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh && bash framework/tools/git/test-ci-queue-wait-branch-absent.sh"
+    "test:framework-shell": "python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh"
   },
   "dependencies": {
     "@mosaicstack/brain": "workspace:*",

packages/mosaic/src/mutator-gate/mutator-gate.acceptance.spec.ts

@@ -661,27 +661,13 @@ describe('whole mutator-class lease gate', () => {
   test('observer revocation and monotonic TTL expiry deny the next mutator', async () => {
     const { socket } = await startBroker();
     const sessionId = await register(socket);
-
+    const pending = await beginVerification(socket, sessionId, 'claude', 1, 1);
-    // Establish the lease with a normal (non-racing) TTL first and prove it
-    // authorizes. This "still valid" check is setup, not a TTL-expiry
-    // assertion, so it must not share a lease with a 1-second TTL: on a
-    // contended push-CI host, scheduling delay alone between promote() and
-    // this authorize() call can consume that entire 1-second margin and
-    // spuriously deny it (CI#1945). Using a generous TTL here removes that
-    // real-time race without touching lease-gate security semantics.
-    const pending = await beginVerification(socket, sessionId, 'claude');
     await promote(socket, sessionId, pending.receipt_challenge!);
+
     expect(await authorize(socket, sessionId, 'claude', 'Bash')).toMatchObject({
       ok: true,
       decision: 'allow',
     });
-
-    // A dedicated, isolated short-TTL lease drives the deliberate monotonic
-    // expiry demonstration below. It is never used for anything but the
-    // wait-then-expire assertion, so there is no setup work racing its
-    // 1-second window.
-    const shortLived = await beginVerification(socket, sessionId, 'claude', 1, 1, 2);
-    await promote(socket, sessionId, shortLived.receipt_challenge!);
     await new Promise((resolve) => setTimeout(resolve, 1_100));
     expect(await authorize(socket, sessionId, 'claude', 'Bash')).toMatchObject({
       ok: false,
@@ -689,7 +675,7 @@ describe('whole mutator-class lease gate', () => {
       decision: 'deny',
     });
 
-    const refreshed = await beginVerification(socket, sessionId, 'claude', 1, 300, 3);
+    const refreshed = await beginVerification(socket, sessionId, 'claude', 1, 300, 2);
     await promote(socket, sessionId, refreshed.receipt_challenge!);
     expect(
       await request(socket, {

skills/glpi-create/SKILL.md

@@ -1,50 +0,0 @@
-# Skill: glpi-create — Open a New GLPI Ticket
-
-> Create a new GLPI helpdesk ticket. Mutates GLPI — confirm the details before running.
-
-## When to use
-
-- Logging a new incident or request that should live in the helpdesk queue.
-
-## Required information
-
-- **title** — short subject line.
-- **content** — description of the issue / request.
-
-## Optional
-
-- **priority** — `1`=VeryLow, `2`=Low, `3`=Medium (default), `4`=High, `5`=VeryHigh, `6`=Major.
-- **type** — `1`=Incident (default), `2`=Request.
-
-## Command
-
-Wraps the existing tooling:
-
-```bash
-~/.config/mosaic/tools/glpi/ticket-create.sh \
-  -t "<title>" \
-  -c "<content>" \
-  [-p <priority>] \
-  [-y <type>] \
-  [-f json]
-```
-
-Example:
-
-```bash
-~/.config/mosaic/tools/glpi/ticket-create.sh \
-  -t "Paint-area camera install" \
-  -c "Ordered 2 cameras for Paint and stock; schedule mounting + NVR config." \
-  -p 3 -y 2
-```
-
-## After creating
-
-- Note the returned **ticket ID** — you'll need it for **[[glpi-followup]]** and
-  **[[glpi-solve]]**.
-- If it should also be tracked as brain work, add a matching task (see the `add-task` skill).
-
-## Guardrails
-
-- Confirm title/content/priority with the user before creating — a ticket is outward-facing.
-- Never echo GLPI tokens.

skills/glpi-followup/SKILL.md

@@ -1,56 +0,0 @@
-# Skill: glpi-followup — Add a Followup to a GLPI Ticket
-
-> Post a followup (comment / progress note / resolution writeup) to a GLPI ticket.
-> This documents work but does **not** change the ticket status — to close a ticket
-> out, follow with **[[glpi-solve]]** to set status to Solved.
-
-## When to use
-
-- Recording progress, a decision, or a root-cause/resolution note on a ticket.
-- The documentation step that usually precedes closing a ticket out (`glpi-solve`).
-
-## Critical quirk
-
-Use the **top-level `/ITILFollowup` endpoint**, NOT `/Ticket/<id>/ITILFollowup`. The
-sub-resource path returns permission errors even with a Super-Admin profile.
-
-## Procedure
-
-### 1. Session + creds
-
-```bash
-SESSION=$(~/.config/mosaic/tools/glpi/session-init.sh -q)
-source ~/.config/mosaic/tools/_lib/credentials.sh && load_credentials glpi
-```
-
-### 2. Post the followup
-
-```bash
-TICKET_ID=<id>
-CONTENT="<the followup text>"
-curl -sk -X POST "${GLPI_URL}/ITILFollowup" \
-  -H "App-Token: $GLPI_APP_TOKEN" \
-  -H "Session-Token: $SESSION" \
-  -H "Content-Type: application/json" \
-  -d "$(jq -n --argjson id "$TICKET_ID" --arg c "$CONTENT" \
-        '{input:{itemtype:"Ticket", items_id:$id, content:$c}}')"
-```
-
-Expect HTTP 201. Building the payload with `jq` keeps quotes/newlines in the content safe.
-
-### 3. Long or multi-paragraph content
-
-Write the note to a file first, then read it into the payload:
-
-```bash
-curl -sk -X POST "${GLPI_URL}/ITILFollowup" \
-  -H "App-Token: $GLPI_APP_TOKEN" -H "Session-Token: $SESSION" \
-  -H "Content-Type: application/json" \
-  -d "$(jq -n --argjson id "$TICKET_ID" --rawfile c /path/to/note.md \
-        '{input:{itemtype:"Ticket", items_id:$id, content:$c}}')"
-```
-
-## Guardrails
-
-- Never echo the GLPI app/user/session tokens.
-- A followup alone leaves the ticket open. If the work is done, run **[[glpi-solve]]** next.

skills/glpi-list/SKILL.md

@@ -1,57 +0,0 @@
-# Skill: glpi-list — Query GLPI Tickets
-
-> Quick lookups of GLPI helpdesk tickets by status or recency. Read-only.
-
-## When to use
-
-- "What tickets are open / pending?" · "Show recent tickets" · finding a ticket ID
-  before running **[[glpi-followup]]** or **[[glpi-solve]]**.
-
-## Command
-
-Wraps the existing tooling:
-
-```bash
-GLPI=~/.config/mosaic/tools/glpi
-
-# Most recent tickets (default 50, newest first)
-"$GLPI/ticket-list.sh"
-
-# Filter by status: new | processing | pending | solved | closed
-"$GLPI/ticket-list.sh" -s pending
-
-# JSON output (for parsing / piping to jq) and a custom limit
-"$GLPI/ticket-list.sh" -s processing -f json -l 20
-```
-
-Status IDs: 1 New · 2/3 Processing · 4 Pending · 5 Solved · 6 Closed.
-
-## Details lookup for one ticket
-
-When you have an ID and want the full record:
-
-```bash
-SESSION=$(~/.config/mosaic/tools/glpi/session-init.sh -q)
-source ~/.config/mosaic/tools/_lib/credentials.sh && load_credentials glpi
-curl -sk "${GLPI_URL}/Ticket/<id>?expand_dropdowns=true" \
-  -H "App-Token: $GLPI_APP_TOKEN" -H "Session-Token: $SESSION" \
-  | jq '{id, name, status, date, date_mod}'
-
-# Followups on a ticket
-curl -sk "${GLPI_URL}/Ticket/<id>/ITILFollowup" \
-  -H "App-Token: $GLPI_APP_TOKEN" -H "Session-Token: $SESSION" \
-  | jq '.[] | {date, content}'
-```
-
-(Reading followups via the sub-resource is fine — only _creating_ them requires the
-top-level `/ITILFollowup` endpoint. See **[[glpi-followup]]**.)
-
-## Present to user
-
-Group by status, one line per ticket: `#<id> · <title> · <status> · <last-modified>`.
-Use neutral phrasing — no "OVERDUE"/"URGENT".
-
-## Guardrails
-
-- Read-only. Never echo GLPI tokens.
-- To sync tickets into brain data instead, use `python tools/sync_glpi.py` (not this skill).

skills/glpi-solve/SKILL.md

@@ -1,96 +0,0 @@
-# Skill: glpi-solve — Close Out a GLPI Ticket
-
-> Properly close out a completed GLPI helpdesk ticket. Completing the work is not
-> enough — the ticket **status must be set to "Solved"**, which is what triggers
-> GLPI's config-driven auto-close. Posting a resolution followup documents the work
-> but does **not** change status, so a ticket left at Solved-less status stays open.
-
-## When to use
-
-- Any time work on a GLPI ticket is finished and it should be closed out.
-- After posting a root-cause / resolution writeup as an `/ITILFollowup`.
-- During a cleanup sweep of tickets that are done in reality but still open in GLPI.
-
-## The rule (from an operator, 2026-07-20)
-
-**"Solved" is the correct terminal state to set — not "Closed."** GLPI is configured
-to auto-close Solved tickets after its delay. If you only post a followup and never set
-status, the ticket sits open (this bit us on a real incident where resolution followups
-were posted but status was never advanced, leaving tickets open, which the operator had
-to mark Solved by hand).
-
-Close-out = **followup (optional but preferred) + set status to Solved.**
-
-## GLPI status IDs
-
-| ID    | Status                |                                              |
-| ----- | --------------------- | -------------------------------------------- |
-| 1     | New                   |                                              |
-| 2     | Processing (assigned) |                                              |
-| 3     | Processing (planned)  |                                              |
-| 4     | Pending / Waiting     |                                              |
-| **5** | **Solved**            | ← set this on close-out                      |
-| 6     | Closed                | ← happens automatically; do not set manually |
-
-## Procedure
-
-### 1. Get a session token
-
-```bash
-SESSION=$(~/.config/mosaic/tools/glpi/session-init.sh -q)
-source ~/.config/mosaic/tools/_lib/credentials.sh && load_credentials glpi
-```
-
-### 2. (Preferred) Post the resolution followup
-
-Use the **top-level `/ITILFollowup` endpoint** — the `/Ticket/<id>/ITILFollowup`
-sub-resource returns permission errors even as Super-Admin (known GLPI quirk).
-
-```bash
-TICKET_ID=<id>
-curl -sk -X POST "${GLPI_URL}/ITILFollowup" \
-  -H "App-Token: $GLPI_APP_TOKEN" \
-  -H "Session-Token: $SESSION" \
-  -H "Content-Type: application/json" \
-  -d "{\"input\":{\"itemtype\":\"Ticket\",\"items_id\":${TICKET_ID},\"content\":\"<resolution summary>\"}}"
-```
-
-### 3. Set status to Solved (the step that actually closes it out)
-
-```bash
-curl -sk -X PUT "${GLPI_URL}/Ticket/${TICKET_ID}" \
-  -H "App-Token: $GLPI_APP_TOKEN" \
-  -H "Session-Token: $SESSION" \
-  -H "Content-Type: application/json" \
-  -d "{\"input\":{\"id\":${TICKET_ID},\"status\":5}}"
-```
-
-Expect HTTP 200/201. GLPI will auto-close it later per its config — leave status at 5.
-
-### 4. Verify
-
-```bash
-curl -sk "${GLPI_URL}/Ticket/${TICKET_ID}?expand_dropdowns=true" \
-  -H "App-Token: $GLPI_APP_TOKEN" -H "Session-Token: $SESSION" \
-  | jq '{id, name, status}'
-```
-
-`status` should read `Solved` (or `5`).
-
-## Optional: sweep for done-but-open tickets
-
-List tickets still open (New/Processing/Pending) to spot ones whose work is actually
-finished but were never marked Solved:
-
-```bash
-~/.config/mosaic/tools/glpi/ticket-list.sh -s processing -f table
-~/.config/mosaic/tools/glpi/ticket-list.sh -s pending    -f table
-```
-
-Review each; for any that are genuinely resolved, run steps 2–3.
-
-## Guardrails
-
-- Read-only until you intend to close — confirm the ticket is actually done first.
-- Never echo the GLPI app/user/session tokens.
-- Set **Solved (5)**, never Closed (6) — auto-close owns that transition.

skills/glpi-sweep/SKILL.md

@@ -1,62 +0,0 @@
-# Skill: glpi-sweep — Find Done-But-Open Tickets
-
-> Read-only sweep for tickets that are finished in reality but still sitting open in
-> GLPI (never moved to Solved). Surfaces the exact miss an operator caught on 2026-07-20
-> (a real incident where an affected ticket had resolution followups posted but was left
-> open). For each one that's genuinely done, close it out with **[[glpi-solve]]**.
-
-## When to use
-
-- Periodic hygiene pass (e.g. before a weekly update or month-end).
-- After a burst of ticket work, to catch any you resolved-in-followup but never Solved.
-
-## Why this exists
-
-Posting an `/ITILFollowup` documents work but does **not** change status. Tickets only
-auto-close once set to **Solved (status 5)**. Anything left at New/Processing/Pending
-stays open indefinitely. This sweep finds those.
-
-## Procedure
-
-### 1. List still-open tickets by status
-
-```bash
-GLPI=~/.config/mosaic/tools/glpi
-"$GLPI/ticket-list.sh" -s new        -f table
-"$GLPI/ticket-list.sh" -s processing -f table
-"$GLPI/ticket-list.sh" -s pending    -f table
-```
-
-(GLPI status IDs: 1 New · 2/3 Processing · 4 Pending · 5 Solved · 6 Closed.)
-
-### 2. Triage
-
-For each open ticket, judge whether the underlying work is actually finished — check
-its latest followups and cross-reference brain tasks / recent work. Read-only here;
-change nothing yet.
-
-Reasonable "probably done" signals:
-
-- A resolution/root-cause followup already posted, but status never advanced.
-- The related brain task is `done`, or the fix shipped and was confirmed.
-- Requester confirmed resolution but the ticket was never Solved.
-
-### 3. Present the candidates
-
-List them for review before touching anything — never bulk-solve blindly:
-
-```
-Open tickets that look resolved:
-- #<id> "<title>" — <why it looks done> → glpi-solve?
-```
-
-### 4. Close out the confirmed ones
-
-For each ticket the user (or clear evidence) confirms is done, run **[[glpi-solve]]**
-(optionally **[[glpi-followup]]** first if a closing note is warranted).
-
-## Guardrails
-
-- Read-only until a ticket is confirmed done — do not auto-solve on a guess.
-- Never echo GLPI tokens.
-- Set **Solved (5)**, never Closed (6) — GLPI auto-close owns that transition.