fix(#1332 ): verdict fixture 2 - herestring, not printf-pipe into grep -qF

pipefail-early-exit.test.mjs (static scan) flagged the fixture-2 check as a pipe into an early-exiting consumer; the sibling at fixture 1 already uses the herestring form. Red reproduced locally (one scan entry, exactly the flagged line), green after matching the sibling; verdict 4/4 and glyph 6/6 re-run green.
fix(#1262 ): adoption follow-ups - enumeration exclusion, SEND-honoring verdict suite, retire rc=2-is-normal guide text
2026-08-20 12:06:56 -05:00 · 2026-08-20 11:31:44 -05:00 · 2026-08-20 11:24:18 -05:00
57 changed files with 332 additions and 1158 deletions
@@ -1,4 +0,0 @@
-{
-  "integration_trunk": "next",
-  "release_branch": "main"
-}
@@ -81,73 +81,6 @@ pnpm format:check  # Prettier check
 pnpm build         # Build all packages and applications
 ```

-## Branch Model and Merge Process — `main` and `next` (CANONICAL)
-
-**Every contribution targets `next` first. No exceptions.** Features, fixes, tests,
-docs, and policy changes all take the same route; urgency changes queue priority,
-never the route. Agents never commit to or merge into `main`.
-
-| Branch | Role                                                             | Who merges into it                                                          |
-| ------ | ---------------------------------------------------------------- | --------------------------------------------------------------------------- |
-| `next` | Integration trunk — the only PR target for contributions         | The designated merge-gate agent, after all gates pass. Never the PR author. |
-| `main` | Stable/release line — receives promotion merges from `next` only | Jason only (or an agent he explicitly delegates for a named promotion).     |
-
-### Contribution sequencing (in order, no skipping)
-
-1. **Issue first.** Work is tracked in a Gitea issue before a branch exists. The
-   issue number appears in the branch name and the PR body.
-2. **Branch from the current `origin/next` head.** Name it
-   `feat/…`, `fix/…`, `docs/…`, or `test/…` with the issue number
-   (e.g. `docs/1214-branch-process`). Record the base SHA in the PR body.
-3. **Develop with evidence.** Applicable tests accompany the change. Hooks are
-   never bypassed (`--no-verify` is prohibited). Stage explicit paths — never
-   `git add -A`.
-4. **Open the PR against `next`.** The body states: scope, base SHA,
-   verification commands with results, and any known pre-existing failures on
-   the base — documented, not retried to green and not absorbed silently.
-5. **CI must be terminal-green on the exact head.** All bounded Woodpecker
-   steps succeed (`verify-terminal-green` contract). Pipelines for fork PRs
-   start `blocked`; a maintainer approves the run — approving CI is not
-   approving the PR.
-6. **Independent review. Self-merge is prohibited** — for every agent, on every
-   PR, including trivial ones. Where the change touches protected or
-   contract-bearing content, the reviewer verifies the exact head
-   (exact-byte/exact-blob comparison), not a description of it. An `AMEND`
-   verdict returns the PR to its author; the reviewer's gate stays held until
-   a fresh exact head passes.
-7. **Merge into `next`** happens only after CI green + review pass, pinned to
-   the reviewed head SHA (a post-review push voids the review).
-8. **Promotion `next` → `main`** is a deliberate, Jason-owned reconciliation
-   merge — not part of any contribution's lifecycle. Contributors are done at
-   step 7.
-
-### Responsibilities
-
- **Contributor** — base pinning, green CI, evidence in the PR body,
-  responding to AMEND verdicts, never merging own work.
- **Reviewer / merge gate** — independent verification on the exact head;
-  holds and lifts gates; executes the merge into `next`.
- **Orchestrator / adjudicator** — cross-PR sequencing, disposition when PRs
-  collide, conflict adjudication.
- **Jason** — `next` → `main` promotions, merge-authority grants, collaborator
-  and token provisioning. Agents cannot grant themselves or each other any of
-  these.
-
-### Hotfixes and divergence
-
- A hotfix follows the same path: branch from `next`, PR to `next`, gates,
-  merge, then an expedited Jason-owned promotion if `main` needs it urgently.
-  Committing the fix to `main` directly is prohibited even under pressure.
- **Never land work on `main` that is not on `next`.** This has happened
-  (issue #1152's goal controller reached `main` without reaching `next`) and
-  every later PR paid for it. If it happens anyway: transplant the work onto
-  a `next`-based branch with provenance-preserving commits
-  (`git cherry-pick -x` or explicit SHA references in the messages), PR it
-  through the normal gates, and let promotion re-align `main`. Do not
-  hand-patch `main` to compensate.
- Force-pushing a branch you do not own is prohibited; rebasing your own PR
-  branch is fine before review, and voids any review already given.
-
 ## Database and Local Runtime Safety

 - Current local data-layer work uses in-process PGlite; leave `DATABASE_URL` unset.
@@ -1,19 +1,5 @@
 # Tasks — MVP (Top-Level Rollup)

-> ---
->
-> **STATUS: SUPERSEDED — 2026-08-20.** kind `tracking` · superseded by `docs/fleet/NORTH_STAR.yaml`
->
-> This file is the pre-backlog tracking mechanism. `NS-2` in the north star declares the
-> replacement: every backlog item is a Mosaic Backlog card projected from the YAML. That
-> model replaced this one and nobody retired the old file, so it kept reading as
-> authoritative while going stale.
->
-> **Do not trust a status in this file.** Verified 2026-08-20: it was already behind the
-> code when it froze five weeks ago.
->
-> Kept as a record of what was believed. Do not update it; update the YAML.
-
 > Single-writer: orchestrator only. Workers read but never modify.
 >
 > **Mission:** mvp-20260312
@@ -122,7 +108,7 @@ Active workstream is **W1 — Federation v1**. Workers should:

 ## north-star doctrine consolidation — doc PR — feat/north-star-doctrine

- Status: applied Mos's consolidated merge-map to docs/fleet/FLEET-DOCTRINE.md (budget governance + control plane/central register + 200k cap + delegation + unified-identity Fleet + role-based naming + tmux security + drift re-captures). Doctrine only; #622/#623/#625/#628 out-of-scope. Conflict checklist green. Detail: scratchpads/north-star-doctrine.md.
+- Status: applied Mos's consolidated merge-map to docs/fleet/north-star.md (budget governance + control plane/central register + 200k cap + delegation + unified-identity Fleet + role-based naming + tmux security + drift re-captures). Doctrine only; #622/#623/#625/#628 out-of-scope. Conflict checklist green. Detail: scratchpads/north-star-doctrine.md.

 ## #631 — re-seed preserves user fleet data (CRITICAL) — fix/631-reseed-preserves-fleet-data

@@ -1,21 +1,5 @@
 # Tasks — Federation v1

-> ---
->
-> **STATUS: SUPERSEDED — 2026-08-20.** kind `tracking` · superseded by `docs/fleet/NORTH_STAR.yaml`
->
-> This file is the pre-backlog tracking mechanism. `NS-2` in the north star declares the
-> replacement: every backlog item is a Mosaic Backlog card projected from the YAML. That
-> model replaced this one and nobody retired the old file, so it kept reading as
-> authoritative while going stale.
->
-> **Do not trust a status in this file.** Verified 2026-08-20: it was already behind the
-> code when it froze five weeks ago. `FED-M3-06` is marked not-started and `get.controller.ts`
-> has existed for eight weeks; `FED-M3-10/11` claim no tests exist while fifteen spec files
-> do. `FED-M2-DEPLOY-IMG-FIX` names `apps/gateway/Dockerfile`, which is not in the repo.
->
-> Kept as a record of what was believed. Do not update it; update the YAML.
-
 > Single-writer: orchestrator only. Workers read but never modify.
 >
 > **Mission:** federation-v1-20260419
@@ -3,7 +3,7 @@
 > **Generated file — do not edit by hand.**
 > Projected deterministically from [`NORTH_STAR.yaml`](./NORTH_STAR.yaml) by the pure
 > generator in `packages/mosaic/src/commands/fleet.ts` (`renderNorthStarMarkdown`).
-> Edit the YAML, then regenerate. Self-contained Mosaic.
+> Edit the YAML, then regenerate. Self-contained Mosaic — no Hermes dependency.

 ## Mission

@@ -11,7 +11,7 @@ A self-driving Mosaic system that 24/7 unattended converts a machine-readable go

 ## Substrate

-The Mosaic Backlog is the backlog of record + dispatch engine, built on Mosaic's native Postgres storage service (@mosaicstack/db drizzle; PGlite-embedded by default, full Postgres by config).
+The Mosaic Backlog is the backlog of record + dispatch engine, built on Mosaic's native Postgres storage service (@mosaicstack/db drizzle; PGlite-embedded by default, full Postgres by config). NOT Hermes.

 ## Standing objectives

@@ -24,18 +24,16 @@ The Mosaic Backlog is the backlog of record + dispatch engine, built on Mosaic's
 - **NS-7** — Meta-loop (session-review + enhancer) continuously proposes small fleet-improvement PRs.
 - **NS-8** — Single operator-flippable PAUSE kill-switch (fleet/run/PAUSED) honored before every dispatch and every merge.
 - **NS-9** — Mosaic is a general-purpose multi-agent system: the user declares the SYSTEM TYPE to run (e.g. software delivery, personal assistant, research, business/operations) and the orchestrator provisions the matching persona roster and org structure from a cross-domain baseline persona library; the delivery/coding fleet is one profile among many.
- **NS-10** — An adoption is not complete until the mechanism it replaces is removed. Two live conventions for one concern is the defect, not a transition state. Measured 2026-08-20: brain-home adopted by 9 modules and not 10; MOSAIC_HOME honored in 4 places, each re-deriving it; backlog cards declared while TASKS.md files stayed authoritative. Every one was decided correctly and left half-applied.

 ## Success criteria

- **AC-NS-0** (tier 0) — The operator launches an agent on any configured harness with one command, observes its state and sends it work without attaching to a terminal multiplexer.
- **AC-NS-1** (tier 1) — The supervisor keeps a two-agent floor (1 orchestrator + >=1 enhancer) healthy across reboot.
- **AC-NS-2** (tier 1) — A goal added to this YAML is decomposed to cards and either merged or escalated, with no human in the loop.
- **AC-NS-3** (tier 1) — No PR merges with failure/error/no-status/timeout CI, and none bypass pr-merge.sh.
- **AC-NS-4** (tier 1) — TTL is enforced on claims; token caps remain advisory until a real meter exists.
- **AC-NS-5** (tier 1) — Flipping fleet/run/PAUSED halts dispatch and merges within one tick.
- **AC-NS-6** (tier 2) — A user can declare a system type and the fleet provisions the matching persona roster + topology from the baseline library, with no code change.
- **AC-NS-7** (tier 2) — A user-customized persona (edited or added via the orchestrator) survives mosaic update: baseline reseed never clobbers user overrides.
+- **AC-NS-1** — The supervisor keeps a two-agent floor (1 orchestrator + >=1 enhancer) healthy across reboot.
+- **AC-NS-2** — A goal added to this YAML is decomposed to cards and either merged or escalated, with no human in the loop.
+- **AC-NS-3** — No PR merges with failure/error/no-status/timeout CI, and none bypass pr-merge.sh.
+- **AC-NS-4** — TTL is enforced on claims; token caps remain advisory until a real meter exists.
+- **AC-NS-5** — Flipping fleet/run/PAUSED halts dispatch and merges within one tick.
+- **AC-NS-6** — A user can declare a system type and the fleet provisions the matching persona roster + topology from the baseline library, with no code change.
+- **AC-NS-7** — A user-customized persona (edited or added via the orchestrator) survives mosaic update: baseline reseed never clobbers user overrides.

 ## Workstreams

@@ -47,44 +45,26 @@ The Mosaic Backlog is the backlog of record + dispatch engine, built on Mosaic's
 | D   | Merge-gate — single approver, pr-merge.sh after CI wait                                                     |
 | E   | Meta-loop — session-review + enhancer improvement PRs                                                       |
 | F   | Safety-rails — TTL claims, advisory spend, PAUSE kill-switch                                                |
-| G   | Kill-switch — operator PAUSE honored before dispatch and merge                                              |
 | H   | Personas & system profiles — cross-domain library, system-type provisioning, update-surviving customization |
-| I   | Operator surface — launcher, fleet visibility, reliable steering (tier 0)                                   |
-| J   | Web control plane — browser surface over the gateway (tier 1)                                               |
-| K   | Clients — desktop and mobile over the same backend (tier 2)                                                 |
-| L   | Auth profiles — per-provider accounts, per-session selection (tier 2)                                       |

 ## Goals (backlog projection)

-| id  | title                                                                                                                                                                                                                                                                                                                                                                              | tier | phase | priority    | depends_on     |
-| --- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---- | ----- | ----------- | -------------- |
-| A1  | Machine-readable NORTH_STAR.yaml + Markdown projection                                                                                                                                                                                                                                                                                                                             | 1    | 1     | must-have   | —              |
-| A2  | Mosaic Backlog schema + storage-service card store (drizzle/PGlite)                                                                                                                                                                                                                                                                                                                | 1    | 1     | must-have   | A1             |
-| A3a | Card lifecycle — create/claim/release with stable ids + depends_on DAG                                                                                                                                                                                                                                                                                                             | 1    | 1     | must-have   | A2             |
-| A3b | TTL-bounded claim enforcement (wall-clock) on cards                                                                                                                                                                                                                                                                                                                                | 1    | 1     | must-have   | A3a            |
-| A4  | Advisory spend projection per card (degrades to TTL, no real meter)                                                                                                                                                                                                                                                                                                                | 1    | 1     | should-have | A3a            |
-| B1  | Supervisor tick — readiness scan, two-agent-floor health check                                                                                                                                                                                                                                                                                                                     | 1    | 2     | must-have   | A3a            |
-| B2  | Native dispatch/claim — assign ready dependency-satisfied work                                                                                                                                                                                                                                                                                                                     | 1    | 2     | must-have   | A3b, B1        |
-| B3a | Planner decompose — goal added to YAML → cards                                                                                                                                                                                                                                                                                                                                     | 1    | 2     | must-have   | A2, B1         |
-| B3b | Replan request on empty backlog; escalate on no-decompose                                                                                                                                                                                                                                                                                                                          | 1    | 2     | should-have | B3a            |
-| G1  | PAUSE kill-switch + merge-gate honored before dispatch and merge                                                                                                                                                                                                                                                                                                                   | 1    | 2     | must-have   | B2             |
-| H1  | Cross-domain baseline persona library (exec, marketing, ops, research, assistant + engineering roles)                                                                                                                                                                                                                                                                              | 2    | 1     | must-have   | A1             |
-| H2  | System-type profiles — declarative mapping of system type to persona roster + topology                                                                                                                                                                                                                                                                                             | 2    | 2     | must-have   | H1             |
-| H3  | System-type provisioning — user declares type; orchestrator instantiates the matching roster + structure                                                                                                                                                                                                                                                                           | 2    | 2     | must-have   | H2             |
-| H4  | Update-surviving persona customization — ad-hoc edits/additions persisted in a PRESERVE-protected override layer (baseline merged with overrides)                                                                                                                                                                                                                                  | 2    | 2     | must-have   | H1             |
-| A5  | NORTH_STAR schema validator — every goal's workstream declared, every workstream has a goal, every depends_on id exists, every tier has a success criterion; runs in CI beside the Markdown regeneration check                                                                                                                                                                     | 0    | 1     | must-have   | A1             |
-| I1  | One home resolver — a single function resolving MOSAIC_HOME with a sane default, adopted by every module. Today brain-home.ts is imported by 9 modules while 10 still use DEFAULT_MOSAIC_HOME, and MOSAIC_HOME is re-derived ad hoc in 4 places. NS-10 applies - finish the adoption and delete the second path                                                                    | 0    | 1     | must-have   | —              |
-| I2  | mosaic fleet ps sees the fleet that is actually running. Three measured blockers: the roster declares socket `mosaic-fleet` which does not exist, the 18 live sessions are on the default socket, and nothing writes a roster because seats are launched outside the CLI. Make the socket configurable and the roster written at launch, or make ps read tmux + seat dirs directly | 0    | 1     | must-have   | I1             |
-| I3  | Migrate fleet steering onto mosaic agent send --verify (exists, FLEET-OBS-005, spec FR-5) and retire tools/tmux/agent-send.sh, which forges the sender (D33) and returns an uninformative rc (D16, D34). FR-5 predates those defects by a month                                                                                                                                    | 0    | 1     | must-have   | I1             |
-| I4  | mosaic fleet absorbs what launch-seat.sh does and launch-seat.sh is deprecated: compose the prompt file set, force the skill set, wire the style hook, fail closed on any unreadable input, export per-seat git identity, and register the seat in the roster. launch-seat.sh was a manual method; it is the reference implementation, not the destination                         | 0    | 1     | must-have   | I1, I5         |
-| I5  | Harness probe matrix — verify a working prompt-injection path for claude, codex, opencode and pi, and refuse any runtime whose path is unverified. AC-NS-0 clause 1 ("any configured harness") rests on this. The probe work in docs/plans/2026-08-19_launch-seat-multi-runtime.md (brain, untracked) transfers; its launch-seat.sh target does not                                | 0    | 1     | must-have   | —              |
-| I6  | Finish the heartbeat responder (FLEET-OBS-002, the only Phase-2 task still in-progress; spec FR-2). Health must mean "answered a heartbeat", not "pane alive" — pane state measured two seats wrong on 2026-08-20                                                                                                                                                                  | 0    | 1     | must-have   | —              |
-| I7  | Independent review and live-fleet dogfood of the Phase-2 verbs (FLEET-OBS-008), then land them (FLEET-OBS-009). Implementation is done and verification is not; "done" in a task file frozen five weeks is not evidence                                                                                                                                                            | 0    | 1     | must-have   | I2, I3, I4, I6 |
-| I8  | Neutralize misleading documentation — supersede headers on docs that state a stale status, a false blocker or a retired mechanism. Cheap, and it is tier 0 because a stale doc does not merely fail to help an agent, it actively misroutes one. Rebuilding the documentation is a separate and later job                                                                          | 0    | 1     | must-have   | —              |
-| I9  | Study t3code's agent-attach and multi-provider auth methods and record what transfers. Reference only — Mosaic implements its own within the stack, never adopts the code and never takes the dependency. Informs HOW I/J/K/L are built, not whether                                                                                                                               | 0    | 1     | should-have | —              |
-| J1  | Web control plane over the gateway — fleet visibility and steering in a browser, same data source as I2                                                                                                                                                                                                                                                                            | 1    | 3     | must-have   | I2             |
-| K1  | Desktop and mobile clients against the gateway, authenticated                                                                                                                                                                                                                                                                                                                      | 2    | 4     | must-have   | J1             |
-| L1  | Per-provider auth profiles with per-session selection                                                                                                                                                                                                                                                                                                                              | 2    | 4     | must-have   | I4             |
+| id  | title                                                                                                                                             | phase | priority    | depends_on |
+| --- | ------------------------------------------------------------------------------------------------------------------------------------------------- | ----- | ----------- | ---------- |
+| A1  | Machine-readable NORTH_STAR.yaml + Markdown projection                                                                                            | 1     | must-have   | —          |
+| A2  | Mosaic Backlog schema + storage-service card store (drizzle/PGlite)                                                                               | 1     | must-have   | A1         |
+| A3a | Card lifecycle — create/claim/release with stable ids + depends_on DAG                                                                            | 1     | must-have   | A2         |
+| A3b | TTL-bounded claim enforcement (wall-clock) on cards                                                                                               | 1     | must-have   | A3a        |
+| A4  | Advisory spend projection per card (degrades to TTL, no real meter)                                                                               | 1     | should-have | A3a        |
+| B1  | Supervisor tick — readiness scan, two-agent-floor health check                                                                                    | 2     | must-have   | A3a        |
+| B2  | Native dispatch/claim — assign ready dependency-satisfied work                                                                                    | 2     | must-have   | A3b, B1    |
+| B3a | Planner decompose — goal added to YAML → cards                                                                                                    | 2     | must-have   | A2, B1     |
+| B3b | Replan request on empty backlog; escalate on no-decompose                                                                                         | 2     | should-have | B3a        |
+| G1  | PAUSE kill-switch + merge-gate honored before dispatch and merge                                                                                  | 2     | must-have   | B2         |
+| H1  | Cross-domain baseline persona library (exec, marketing, ops, research, assistant + engineering roles)                                             | 1     | must-have   | A1         |
+| H2  | System-type profiles — declarative mapping of system type to persona roster + topology                                                            | 2     | must-have   | H1         |
+| H3  | System-type provisioning — user declares type; orchestrator instantiates the matching roster + structure                                          | 2     | must-have   | H2         |
+| H4  | Update-surviving persona customization — ad-hoc edits/additions persisted in a PRESERVE-protected override layer (baseline merged with overrides) | 2     | must-have   | H1         |

 ## Assumptions (vetoable)

@@ -6,7 +6,7 @@
 # packages/mosaic/src/commands/fleet.ts (renderNorthStarMarkdown). Edit the YAML,
 # never the .md.
 #
-# Self-contained Mosaic. The backlog of record is
+# Self-contained Mosaic. NO Hermes runtime dependency. The backlog of record is
 # the Mosaic Backlog on Mosaic's OWN native Postgres storage service.

 version: 1
@@ -24,7 +24,7 @@ substrate:
  note: >-
    The Mosaic Backlog is the backlog of record + dispatch engine, built on
    Mosaic's native Postgres storage service (@mosaicstack/db drizzle;
-    PGlite-embedded by default, full Postgres by config).
+    PGlite-embedded by default, full Postgres by config). NOT Hermes.

 standing_objectives:
  - id: NS-1
@@ -69,53 +69,32 @@ standing_objectives:
      business/operations) and the orchestrator provisions the matching persona
      roster and org structure from a cross-domain baseline persona library; the
      delivery/coding fleet is one profile among many.
-  - id: NS-10
-    text: >-
-      An adoption is not complete until the mechanism it replaces is removed.
-      Two live conventions for one concern is the defect, not a transition
-      state. Measured 2026-08-20: brain-home adopted by 9 modules and not 10;
-      MOSAIC_HOME honored in 4 places, each re-deriving it; backlog cards
-      declared while TASKS.md files stayed authoritative. Every one was decided
-      correctly and left half-applied.

 success_criteria:
-  - id: AC-NS-0
-    tier: 0
-    text: >-
-      The operator launches an agent on any configured harness with one
-      command, observes its state and sends it work without attaching to a
-      terminal multiplexer.
  - id: AC-NS-1
-    tier: 1
    text: >-
      The supervisor keeps a two-agent floor (1 orchestrator + >=1 enhancer)
      healthy across reboot.
  - id: AC-NS-2
-    tier: 1
    text: >-
      A goal added to this YAML is decomposed to cards and either merged or
      escalated, with no human in the loop.
  - id: AC-NS-3
-    tier: 1
    text: >-
      No PR merges with failure/error/no-status/timeout CI, and none bypass
      pr-merge.sh.
  - id: AC-NS-4
-    tier: 1
    text: >-
      TTL is enforced on claims; token caps remain advisory until a real meter
      exists.
  - id: AC-NS-5
-    tier: 1
    text: >-
      Flipping fleet/run/PAUSED halts dispatch and merges within one tick.
  - id: AC-NS-6
-    tier: 2
    text: >-
      A user can declare a system type and the fleet provisions the matching
      persona roster + topology from the baseline library, with no code change.
  - id: AC-NS-7
-    tier: 2
    text: >-
      A user-customized persona (edited or added via the orchestrator) survives
      mosaic update: baseline reseed never clobbers user overrides.
@@ -133,186 +112,80 @@ workstreams:
    title: Meta-loop — session-review + enhancer improvement PRs
  - id: F
    title: Safety-rails — TTL claims, advisory spend, PAUSE kill-switch
-  - id: G
-    title: Kill-switch — operator PAUSE honored before dispatch and merge
  - id: H
    title: Personas & system profiles — cross-domain library, system-type provisioning, update-surviving customization
-  - id: I
-    title: Operator surface — launcher, fleet visibility, reliable steering (tier 0)
-  - id: J
-    title: Web control plane — browser surface over the gateway (tier 1)
-  - id: K
-    title: Clients — desktop and mobile over the same backend (tier 2)
-  - id: L
-    title: Auth profiles — per-provider accounts, per-session selection (tier 2)
-
-# NOTE: workstreams C, D, E and F are declared but currently project no goals.
-# That is planning debt, not an editing error: their goals have not been written
-# yet. The A5 validator below reports it rather than letting it stay invisible.

 goals:
  - id: A1
    title: Machine-readable NORTH_STAR.yaml + Markdown projection
    phase: 1
-    tier: 1
    priority: must-have
    depends_on: []
  - id: A2
    title: Mosaic Backlog schema + storage-service card store (drizzle/PGlite)
    phase: 1
-    tier: 1
    priority: must-have
    depends_on: [A1]
  - id: A3a
    title: Card lifecycle — create/claim/release with stable ids + depends_on DAG
    phase: 1
-    tier: 1
    priority: must-have
    depends_on: [A2]
  - id: A3b
    title: TTL-bounded claim enforcement (wall-clock) on cards
    phase: 1
-    tier: 1
    priority: must-have
    depends_on: [A3a]
  - id: A4
    title: Advisory spend projection per card (degrades to TTL, no real meter)
    phase: 1
-    tier: 1
    priority: should-have
    depends_on: [A3a]
  - id: B1
    title: Supervisor tick — readiness scan, two-agent-floor health check
    phase: 2
-    tier: 1
    priority: must-have
    depends_on: [A3a]
  - id: B2
    title: Native dispatch/claim — assign ready dependency-satisfied work
    phase: 2
-    tier: 1
    priority: must-have
    depends_on: [A3b, B1]
  - id: B3a
    title: Planner decompose — goal added to YAML → cards
    phase: 2
-    tier: 1
    priority: must-have
    depends_on: [A2, B1]
  - id: B3b
    title: Replan request on empty backlog; escalate on no-decompose
    phase: 2
-    tier: 1
    priority: should-have
    depends_on: [B3a]
  - id: G1
    title: PAUSE kill-switch + merge-gate honored before dispatch and merge
    phase: 2
-    tier: 1
    priority: must-have
    depends_on: [B2]
  - id: H1
    title: Cross-domain baseline persona library (exec, marketing, ops, research, assistant + engineering roles)
    phase: 1
-    tier: 2
    priority: must-have
    depends_on: [A1]
  - id: H2
    title: System-type profiles — declarative mapping of system type to persona roster + topology
    phase: 2
-    tier: 2
    priority: must-have
    depends_on: [H1]
  - id: H3
    title: System-type provisioning — user declares type; orchestrator instantiates the matching roster + structure
    phase: 2
-    tier: 2
    priority: must-have
    depends_on: [H2]
  - id: H4
    title: Update-surviving persona customization — ad-hoc edits/additions persisted in a PRESERVE-protected override layer (baseline merged with overrides)
    phase: 2
-    tier: 2
    priority: must-have
    depends_on: [H1]
-  - id: A5
-    title: NORTH_STAR schema validator — every goal's workstream declared, every workstream has a goal, every depends_on id exists, every tier has a success criterion; runs in CI beside the Markdown regeneration check
-    phase: 1
-    tier: 0
-    priority: must-have
-    depends_on: [A1]
-  - id: I1
-    title: One home resolver — a single function resolving MOSAIC_HOME with a sane default, adopted by every module. Today brain-home.ts is imported by 9 modules while 10 still use DEFAULT_MOSAIC_HOME, and MOSAIC_HOME is re-derived ad hoc in 4 places. NS-10 applies - finish the adoption and delete the second path
-    phase: 1
-    tier: 0
-    priority: must-have
-    depends_on: []
-  - id: I2
-    title: 'mosaic fleet ps sees the fleet that is actually running. Three measured blockers: the roster declares socket `mosaic-fleet` which does not exist, the 18 live sessions are on the default socket, and nothing writes a roster because seats are launched outside the CLI. Make the socket configurable and the roster written at launch, or make ps read tmux + seat dirs directly'
-    phase: 1
-    tier: 0
-    priority: must-have
-    depends_on: [I1]
-  - id: I3
-    title: Migrate fleet steering onto mosaic agent send --verify (exists, FLEET-OBS-005, spec FR-5) and retire tools/tmux/agent-send.sh, which forges the sender (D33) and returns an uninformative rc (D16, D34). FR-5 predates those defects by a month
-    phase: 1
-    tier: 0
-    priority: must-have
-    depends_on: [I1]
-  - id: I4
-    title: 'mosaic fleet absorbs what launch-seat.sh does and launch-seat.sh is deprecated: compose the prompt file set, force the skill set, wire the style hook, fail closed on any unreadable input, export per-seat git identity, and register the seat in the roster. launch-seat.sh was a manual method; it is the reference implementation, not the destination'
-    phase: 1
-    tier: 0
-    priority: must-have
-    depends_on: [I1, I5]
-  - id: I5
-    title: Harness probe matrix — verify a working prompt-injection path for claude, codex, opencode and pi, and refuse any runtime whose path is unverified. AC-NS-0 clause 1 ("any configured harness") rests on this. The probe work in docs/plans/2026-08-19_launch-seat-multi-runtime.md (brain, untracked) transfers; its launch-seat.sh target does not
-    phase: 1
-    tier: 0
-    priority: must-have
-    depends_on: []
-  - id: I6
-    title: Finish the heartbeat responder (FLEET-OBS-002, the only Phase-2 task still in-progress; spec FR-2). Health must mean "answered a heartbeat", not "pane alive" — pane state measured two seats wrong on 2026-08-20
-    phase: 1
-    tier: 0
-    priority: must-have
-    depends_on: []
-  - id: I7
-    title: Independent review and live-fleet dogfood of the Phase-2 verbs (FLEET-OBS-008), then land them (FLEET-OBS-009). Implementation is done and verification is not; "done" in a task file frozen five weeks is not evidence
-    phase: 1
-    tier: 0
-    priority: must-have
-    depends_on: [I2, I3, I4, I6]
-  - id: I8
-    title: Neutralize misleading documentation — supersede headers on docs that state a stale status, a false blocker or a retired mechanism. Cheap, and it is tier 0 because a stale doc does not merely fail to help an agent, it actively misroutes one. Rebuilding the documentation is a separate and later job
-    phase: 1
-    tier: 0
-    priority: must-have
-    depends_on: []
-  - id: I9
-    title: Study t3code's agent-attach and multi-provider auth methods and record what transfers. Reference only — Mosaic implements its own within the stack, never adopts the code and never takes the dependency. Informs HOW I/J/K/L are built, not whether
-    phase: 1
-    tier: 0
-    priority: should-have
-    depends_on: []
-  - id: J1
-    title: Web control plane over the gateway — fleet visibility and steering in a browser, same data source as I2
-    phase: 3
-    tier: 1
-    priority: must-have
-    depends_on: [I2]
-  - id: K1
-    title: Desktop and mobile clients against the gateway, authenticated
-    phase: 4
-    tier: 2
-    priority: must-have
-    depends_on: [J1]
-  - id: L1
-    title: Per-provider auth profiles with per-session selection
-    phase: 4
-    tier: 2
-    priority: must-have
-    depends_on: [I4]

 assumptions:
  - id: ASM-1
@@ -1,7 +1,7 @@
 # PRD — Mosaic Fleet Suite (init, configure, operate)

 > **Workstream:** W-FLEET (Fleet) under mission `mvp-20260312` · **Phase:** 3→4 productization
-> **North star:** [docs/fleet/FLEET-DOCTRINE.md](./FLEET-DOCTRINE.md) · prior: Phase-2 observability (#579), durable launch (#581), real-agent enablement (#583/#584/#586), releases 0.0.35–0.0.37
+> **North star:** [docs/fleet/north-star.md](./north-star.md) · prior: Phase-2 observability (#579), durable launch (#581), real-agent enablement (#583/#584/#586), releases 0.0.35–0.0.37
 > **Lead:** Jarvis @ `w-jarvis`. **Collaborator:** coder agent @ `dragon-lin` ([email protected]:coder0-0).
 > Owner of this file: Fleet workstream lead. Does not modify MVP single-writer control-plane files.

@@ -1,7 +1,7 @@
 # PRD — Fleet Phase 2: Operator Observability

 > **Workstream:** W-FLEET under `mvp-20260312` · **Phase:** 2
-> **North star:** [docs/fleet/FLEET-DOCTRINE.md](./FLEET-DOCTRINE.md)
+> **North star:** [docs/fleet/north-star.md](./north-star.md)
 > **Source umbrella PRD:** [docs/PRD.md](../PRD.md) (Mosaic Stack v0.1.0)
 > **Tracks task:** `fleet-observability-1` — restore operator observability into fleet agent sessions.

@@ -1,25 +1,10 @@
 # Tasks — W-FLEET (Fleet) Phase 2: Observability

-> ---
->
-> **STATUS: SUPERSEDED — 2026-08-20.** kind `tracking` · superseded by `docs/fleet/NORTH_STAR.yaml`
->
-> This file is the pre-backlog tracking mechanism. `NS-2` in the north star declares the
-> replacement: every backlog item is a Mosaic Backlog card projected from the YAML. That
-> model replaced this one and nobody retired the old file, so it kept reading as
-> authoritative while going stale.
->
-> **Do not trust a status in this file.** Verified 2026-08-20: it was already behind the
-> code when it froze five weeks ago. The `FLEET-OBS` series was the one thing worth salvaging and
-> is now carried as goals `I2`, `I3`, `I6` and `I7` at tier 0.
->
-> Kept as a record of what was believed. Do not update it; update the YAML.
-
 > Workstream task file for the Fleet. Single-writer: Fleet workstream lead (orchestrator).
 > Workers read but never modify. This is **not** the MVP rollup (`docs/TASKS.md`) — a
 > rollup row is proposed to the MVP orchestrator, not written here.
 >
-> Mission: `mvp-20260312` · PRD: [docs/fleet/PRD.md](./PRD.md) · North star: [docs/fleet/FLEET-DOCTRINE.md](./FLEET-DOCTRINE.md)
+> Mission: `mvp-20260312` · PRD: [docs/fleet/PRD.md](./PRD.md) · North star: [docs/fleet/north-star.md](./north-star.md)
 > Status: `not-started` | `in-progress` | `done` | `blocked` | `failed`

 | id            | status      | description                                                                                                      | depends_on            | agent       | pr  | notes                                                                                                                       |
@@ -1,6 +1,6 @@
 # F4 — Orchestrator chat connector + Matrix (local homeserver)

-> **Issue:** #616 · **Doctrine:** `docs/fleet/FLEET-DOCTRINE.md` (#613) — orchestrator-chat-connector decision.
+> **Issue:** #616 · **Doctrine:** `docs/fleet/north-star.md` (#613) — orchestrator-chat-connector decision.
 > **Status:** Phase 1 (abstraction + scaffold) in this PR; Phase 2+ are follow-ups (below).

 ## Goal
@@ -1,26 +1,9 @@
---
-kind: spec
-parent: docs/fleet/NORTH_STAR.yaml
-status: active
---
+# Mosaic Fleet — North Star

-# Mosaic Fleet — Doctrine
-
-> **This is the WHY. `NORTH_STAR.yaml` is the WHAT and WHEN.**
-> Renamed from `north-star.md` on 2026-08-20. It sat one character away from the
-> generated `NORTH_STAR.md` in the same directory, and the two are read by different
-> populations — the PRDs and TASKS files cite this one, while the agent role contracts
-> and the generator spec cite the YAML pair. Same-name-different-thing was the confusion;
-> the content was never in conflict.
->
-> **Nothing here overrides `NORTH_STAR.yaml`.** Where this document states a plan item,
-> the YAML is authoritative. Where it states a decision, a rationale, or a role
-> definition, this document is the record and the YAML carries none of it.
->
 > **Workstream:** W-FLEET (Fleet) under mission `mvp-20260312`
-> **Umbrella:** [docs/MISSION-MANIFEST.md](../MISSION-MANIFEST.md)
-> **Authored:** 2026-06-20. Owner: Fleet workstream lead.
-> This document does **not** modify the MVP rollup.
+> **Umbrella:** [docs/MISSION-MANIFEST.md](../MISSION-MANIFEST.md) · [docs/PRD.md](../PRD.md) (Mosaic Stack v0.1.0)
+> **Status:** doctrine — authored 2026-06-20. Owner of this file: Fleet workstream lead.
+> This document does **not** modify the MVP rollup; a rollup row is proposed, not written here.

 ## Vision

@@ -281,17 +264,15 @@ Dedicated Postgres **instance** vs. dedicated **schema** in the existing instanc
 Recommendation: dedicated schema, existing instance (a migration file, not new infra);
 re-evaluate if isolation or write-volume demands it.

-## Phased roadmap — SUPERSEDED
+## Phased roadmap

-Superseded 2026-08-20 by [`NORTH_STAR.yaml`](./NORTH_STAR.yaml), whose `goals` carry both
-a `phase` (build order) and a `tier` (which promise the goal delivers). The five-phase
-table that stood here could not express those as separate axes, and its "Phase 2 —
-Observability ▶ now" row stayed unfalsified for two months because a phase has no exit
-test. Tiers do: see `AC-NS-0` through `AC-NS-7`.
-
-The phase-2 content itself is not lost — it is specified in
-[`PRD.md`](./PRD.md) (Fleet Phase 2: Operator Observability) and is now tracked as
-goals `I1`–`I5` at tier 0.
+| Phase                  | Outcome                                                                                                                                                                                                | Status  |
+| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------- |
+| 0–1                    | tmux PoC, hardening, published CLI v0.0.34 (#565–#568)                                                                                                                                                 | ✅ done |
+| **2 — Observability**  | fleet ps (host+tenant aware join), heartbeat protocol + dogfood stub answers it, agent watch (read-only), agent send --verify receipts                                                                 | ▶ now   |
+| 3 — Real runtimes      | claude/codex/pi/opencode answer heartbeat; **hybrid lifecycle** (core always-on: **orchestrator + enhancer**; ephemeral workers per lane)                                                              | planned |
+| 4 — Unified definition | one agent schema in gateway; mosaic agent --new → materialized per-tenant session; uid-tenant provisioning; **`fleet` schema migration + `forge-exec` TaskExecutor adapter (forge → `agent-send.sh`)** | planned |
+| 5 — Control plane      | federation-backed cross-host × cross-tenant fleet view; **webUI** (surface chosen then) for MVP-X1 parity; **central register live (spend ledger, docs-as-projections, multi-host Kanban)**            | planned |

 ## Decisions of record (2026-06-20, with Jason)

@@ -4,16 +4,7 @@
 **Tracking:** [Mosaic Stack issue #751](https://git.mosaicstack.dev/mosaicstack/stack/issues/751)
 **Execution:** USC web1 only; collision-free GPT coder2/3/4/5 lanes
 **Contract:** `SHARED-CONTRACT.md` + four `contracts/*.v1.ts` files
-
-> **HOLD LIFTED — 2026-08-20.** The stated condition ("no feature slice starts until the
-> canon PR is merged to `main` with terminal-green CI") was **met on 2026-07-14** by
-> `49e8a541` — _docs(#751): Publish native Kanban/SOT canon (#752)_ — which is on both
-> `main` and `next`, and `docs/requirements/native-kanban-sot.md` is present on `main`.
-> The line below was never updated, so for five weeks this file advertised a blocker that
-> did not exist. The status line above ("PUBLICATION IN PROGRESS") is stale for the same
-> reason. This file is a build plan, not a task tracker, and is NOT superseded.
-
-**Implementation hold (SATISFIED — see note above):** no feature slice starts until the canon PR is merged to `main` with terminal-green CI; after merge, each slice remains held until every declared KBN prerequisite is complete.
+**Implementation hold:** no feature slice starts until the canon PR is merged to `main` with terminal-green CI; after merge, each slice remains held until every declared KBN prerequisite is complete.

 > This publication file is not a runtime task authority. After cutover, repository `TASKS.md` is generated read-only and never imported.

@@ -84,7 +84,6 @@ is re-seeded a genuinely missing core file is a stop-and-report condition — no

 Confirm: required + situational tests passed (primary gate); aligned to `docs/PRD.md`; acceptance
 criteria mapped to evidence; independent code review passed (if code changed); required docs updated;
-scratchpad updated. For PR-workflow delivery: merged PR number + merge commit on the integration
-trunk (the project's declared trunk, default `main` — see `CONSTITUTION.md` Hard Gates), terminal-green
+scratchpad updated. For PR-workflow delivery: merged PR number + merge commit on `main`, terminal-green
 CI, linked issue closed (or `docs/TASKS.md` equivalent). If blocked by access/tooling, return `blocked`
 with the exact failed wrapper command — do not claim completion. Full checklist: `guides/E2E-DELIVERY.md`.
@@ -21,25 +21,11 @@ guard"), the runtime adapter binds it to a concrete tool and states whether abse

 ## Hard Gates

-The **integration trunk** is the branch a project declares in its `.mosaic/repo.json` under the
-key `integration_trunk`; `release_branch` names the release target when one exists (`null` for
-single-branch projects). Absent a declaration, the trunk is `main`. The declaration is policy
-data, never shell text: values must be valid local branch names under `git check-ref-format
--branch` semantics — no remote refs, no revision expressions, no option-like values (leading `-`),
-no path traversal or control characters. A declaration file that fails to parse, an unknown or
-misspelled key, or an invalid value is a hard stop (`blocked`) — never a silent fallback to `main`.
-Prose that mentions branch names designates nothing; only the declaration file does. A project
-declares exactly ONE trunk. **Changing an existing declaration is operator-owned:** a trunk
-redeclaration redirects merge target and branch-protection target at once, so it requires an
-explicit operator action above ordinary PR review. The designation relaxes nothing:
-reviewed-PR-only delivery, squash merge, independent review, queue guards, and terminal-green CI
-bind to the declared trunk exactly as they bind to `main`.
-
 1. Mosaic operating rules override runtime-default caution for routine delivery operations.
 2. Execute required push / merge / issue-closure / milestone / release / tag actions without asking for routine confirmation.
 3. Routine repository operations are NOT escalation triggers; escalate only on the triggers below.
 4. For source-code delivery, completion is forbidden at the PR-open stage.
-5. Completion requires a merged PR to the integration trunk + terminal-green CI + the linked issue/task closed.
+5. Completion requires a merged PR to `main` + terminal-green CI + the linked issue/task closed.
 6. Before any push or merge, run the CI queue guard.
 7. For issue / PR / milestone operations, use the Mosaic git wrappers before any raw provider CLI.
 8. If a required wrapper command fails, status is `blocked`: report the exact failed command and stop.
@@ -49,7 +35,7 @@ bind to the declared trunk exactly as they bind to `main`.
 12. The intake procedure is not conditional on perceived complexity; a "simple" task carries the same requirements as a multi-file feature.
 13. **Merge authority (coordinated work):** when a coordinator/orchestrator session is active for the work, the post-review merge go-ahead is the coordinator's to give — once the required review gates pass, merge on the coordinator's confirmation; do not wait on the human owner personally. Solo (uncoordinated) delivery keeps the default: merge per gates 2 and 9. A "No self-merge" note on a PR means no UNREVIEWED self-merge — it does not suspend coordinator-authorized merges.
 14. Never hardcode secrets; never emit credential values in any output (not even partially, not "to confirm").
-15. Trunk-based git only: branch from the integration trunk, merge via a reviewed PR (squash), never push directly to the trunk.
+15. Trunk-based git only: branch from `main`, merge via a reviewed PR (squash), never push directly to `main`.
 16. If you modify source code, an independent review (author ≠ reviewer) must pass before completion.

 ## Integrity (quality gates are never bypassed)
@@ -35,4 +35,4 @@ A standing panel of senior voices, each arguing from a fixed vantage. The board
 deliberately slow and adversarial — its value is catching the expensive mistake
 before a single agent-hour is spent on it.

-> Doctrine: `docs/fleet/FLEET-DOCTRINE.md` ('board' role = forge BOD; role library).
+> Doctrine: `docs/fleet/north-star.md` ('board' role = forge BOD; role library).
@@ -33,4 +33,4 @@ The code role writes the change and opens the PR; it never touches the merge pat
 The focused builder. It takes one well-scoped card, drives it to green, opens a
 clean PR, and hands off — never reaching past the card it was given.

-> Doctrine: `docs/fleet/FLEET-DOCTRINE.md` (role library).
+> Doctrine: `docs/fleet/north-star.md` (role library).
@@ -35,4 +35,4 @@ The work-breakdown specialist. It takes a phased plan and a DAG and emits a clea
 linked set of single-PR cards on the Mosaic backlog — then steps back and lets the
 executors run.

-> Doctrine: `docs/fleet/FLEET-DOCTRINE.md` (role library); spend accounting is a process mandate.
+> Doctrine: `docs/fleet/north-star.md` (role library); spend accounting is a process mandate.
@@ -36,4 +36,4 @@ The scribe of record. It makes sure the docs and the north star's projections
 describe the system as it actually is, and it never lets two writers fight over one
 TASKS file.

-> Doctrine: `docs/fleet/FLEET-DOCTRINE.md` (role library).
+> Doctrine: `docs/fleet/north-star.md` (role library).
@@ -38,4 +38,4 @@ The orchestrator alone optimizes for _this_ delivery; the enhancer optimizes for
 delivery — self-healing the fleet's tools, skills, and harnesses, and routing real defects
 upstream. Together they are the irreducible core; every other role is added on demand.

-> Doctrine: `docs/fleet/FLEET-DOCTRINE.md` (two-agent floor + role library).
+> Doctrine: `docs/fleet/north-star.md` (two-agent floor + role library).
@@ -46,4 +46,4 @@ The single, accountable gatekeeper. It waits for green CI (`pr-ci-wait.sh`),
 respects the pause switch, merges only through `pr-merge.sh`, and records every
 decision — so the fleet has exactly one trustworthy door to production.

-> Doctrine: `docs/fleet/FLEET-DOCTRINE.md` (role library); merge path: `pr-merge.sh` + `pr-ci-wait.sh`; forbidden paths: `pr-merge.sh` guard.
+> Doctrine: `docs/fleet/north-star.md` (role library); merge path: `pr-merge.sh` + `pr-ci-wait.sh`; forbidden paths: `pr-merge.sh` guard.
@@ -35,4 +35,4 @@ The on-call dispatcher. It makes sure every escalation is seen and re-seen until
 handled, and it holds the one switch that can stop the fleet when something is
 wrong.

-> Doctrine: `docs/fleet/FLEET-DOCTRINE.md` (role library); pause switch: `fleet/run/PAUSED`.
+> Doctrine: `docs/fleet/north-star.md` (role library); pause switch: `fleet/run/PAUSED`.
@@ -43,4 +43,4 @@ A lean, decisive coordinator. It thinks in readiness and throughput, dispatches
 next ready card the instant a dependency clears, and never lets an idle agent sit
 while ready work exists — keeping its own context minimal so the loop never slows.

-> Doctrine: `docs/fleet/FLEET-DOCTRINE.md` (two-agent floor + role library).
+> Doctrine: `docs/fleet/north-star.md` (two-agent floor + role library).
@@ -38,4 +38,4 @@ The architect of the mission's shape. It thinks in phases and dependencies, hand
 a clean DAG to decomposition, and reports its plan back to the orchestrator that
 dispatched it.

-> Doctrine: `docs/fleet/FLEET-DOCTRINE.md` (two-agent floor + role library).
+> Doctrine: `docs/fleet/north-star.md` (two-agent floor + role library).
@@ -34,4 +34,4 @@ The rebase role keeps PR branches fresh; it never approves or merges.
 The janitor of the merge queue. It quietly keeps branches current and re-runnable,
 and knows when a conflict is beyond a mechanical rebase and must be escalated.

-> Doctrine: `docs/fleet/FLEET-DOCTRINE.md` (role library).
+> Doctrine: `docs/fleet/north-star.md` (role library).
@@ -35,4 +35,4 @@ The careful reader. It assumes nothing, checks the change against its card and i
 tests, and is willing to say "not yet" — its value is catching the wrong change
 before it reaches the merge-gate.

-> Doctrine: `docs/fleet/FLEET-DOCTRINE.md` (role library).
+> Doctrine: `docs/fleet/north-star.md` (role library).
@@ -36,4 +36,4 @@ tree or the merge path.
 The adversary on your side. It reads every diff asking "how does this get exploited
 or leak?" — the second, security-focused pair of eyes before the merge-gate.

-> Doctrine: `docs/fleet/FLEET-DOCTRINE.md` (role library); forbidden paths: `pr-merge.sh` guard.
+> Doctrine: `docs/fleet/north-star.md` (role library); forbidden paths: `pr-merge.sh` guard.
@@ -34,4 +34,4 @@ The retrospective analyst. It reads completed sessions and distills them into cl
 actionable signals — the raw material the enhancer uses to make the fleet better
 next time.

-> Doctrine: `docs/fleet/FLEET-DOCTRINE.md` (role library); consumed by the enhancer role.
+> Doctrine: `docs/fleet/north-star.md` (role library); consumed by the enhancer role.
@@ -34,4 +34,4 @@ merge path.
 The skeptic who insists on running it. It trusts observed behavior over claimed
 behavior, and turns "should work" into "verified works" — or a concrete bug report.

-> Doctrine: `docs/fleet/FLEET-DOCTRINE.md` (role library).
+> Doctrine: `docs/fleet/north-star.md` (role library).
@@ -12,7 +12,7 @@ This guide covers how to bootstrap a project so AI agents (Claude, Codex, etc.)
 4. Issue tracking is consistent across projects
 5. Documentation standards and API contracts are enforced from day one
 6. PRD requirements are established before coding begins
-7. Branching/merging is consistent: branch -> integration trunk (default `main`) via PR with squash-only merges
+7. Branching/merging is consistent: `branch -> main` via PR with squash-only merges
 8. Steered-autonomy execution is enabled so agents can run end-to-end with escalation-only human intervention

 ## Agent Host Prerequisites
@@ -206,7 +206,7 @@ Every runtime context file should contain:
 6. **Issue tracking** — Issue and commit conventions
 7. **Code review** — Required review process
 8. **Runtime notes** — Runtime-specific behavior references
-9. **Branch and merge policy** — Trunk workflow (branch -> integration trunk via PR, squash-only)
+9. **Branch and merge policy** — Trunk workflow (`branch -> main` via PR, squash-only)
 10. **Autonomy and escalation policy** — Agent owns coding/review/PR/release/deploy lifecycle

 ---
@@ -288,17 +288,15 @@ Reserve `0.1.0` for the MVP release milestone.

 ---

-## Step 5b: Configure Trunk Branch Protection (Hard Rule)
+## Step 5b: Configure Main Branch Protection (Hard Rule)

-Apply equivalent settings in Gitea, GitHub, or GitLab, targeting the project's integration trunk
-(the branch its `.mosaic/repo.json` declares under `integration_trunk`; default `main` — see
-`CONSTITUTION.md` Hard Gates):
+Apply equivalent settings in Gitea, GitHub, or GitLab:

-1. Protect the integration trunk from direct pushes.
-2. Require pull requests to merge into the integration trunk.
+1. Protect `main` from direct pushes.
+2. Require pull requests to merge into `main`.
 3. Require required CI/status checks to pass before merge.
 4. Require code review approval before merge.
-5. Allow **squash merge only** for PRs into the integration trunk (disable merge commits and rebase merges for it).
+5. Allow **squash merge only** for PRs into `main` (disable merge commits and rebase merges for `main`).

 This enforces one merge strategy across human and agent workflows.

@@ -515,9 +513,9 @@ After bootstrapping, verify:
 - [ ] Git labels created (epic, feature, bug, task, etc.)
 - [ ] Initial pre-MVP milestone created (0.0.1)
 - [ ] MVP milestone reserved for release (0.1.0)
- [ ] The integration trunk is protected from direct pushes
- [ ] PRs into the integration trunk are required
- [ ] Merge method for the integration trunk is squash-only
+- [ ] `main` is protected from direct pushes
+- [ ] PRs into `main` are required
+- [ ] Merge method for `main` is squash-only
 - [ ] Quality gates run successfully
 - [ ] `.env.example` exists (if project uses env vars)
 - [ ] CI/CD pipeline configured (if using Woodpecker/GitHub Actions)
@@ -4,11 +4,6 @@

 ## Overview

-> **Integration trunk:** the YAML examples in this guide use the default integration trunk `main`
-> in branch conditions and version rules. A project that declares a different trunk in its
-> `.mosaic/repo.json` under `integration_trunk` (see `CONSTITUTION.md` Hard Gates) substitutes its
-> declared trunk wherever `main` appears as the trunk branch.
-
 This guide covers the canonical CI/CD pattern used across projects. The pipeline runs in Woodpecker CI and follows this flow:

 ```
@@ -870,7 +865,7 @@ steps:
   ```yaml
   image: git.example.com/org/service@${IMAGE_DIGEST}
   ```
-7. **Test on a short-lived non-trunk branch first** — open a PR and verify quality gates before merging to the integration trunk
+7. **Test on a short-lived non-main branch first** — open a PR and verify quality gates before merging to `main`
 8. **Verify images appear** in Gitea Packages tab after successful pipeline

 ## Terminal-Green Full-Step Contract
@@ -911,7 +906,7 @@ For source-code delivery, completion is not allowed at "PR opened" stage.

 Required sequence:

-1. Merge PR to the integration trunk (squash) via Mosaic wrapper.
+1. Merge PR to `main` (squash) via Mosaic wrapper.
 2. Monitor CI to terminal status:
   ```bash
   ~/.config/mosaic/tools/git/pr-ci-wait.sh -n <PR_NUMBER>
@@ -1117,5 +1112,5 @@ If a project currently uses Verdaccio (e.g., U-Connect at `npm.uscllc.net`), fol

 ### Pipeline runs Docker builds on pull requests

- Verify `when` clause on Docker build steps restricts to the integration trunk (`branch: [main]` by default)
+- Verify `when` clause on Docker build steps restricts to `branch: [main]`
 - Pull requests should only run quality gates, not build/push images
@@ -10,10 +10,9 @@ If implementation diverges from `docs/PRD.md` or `docs/PRD.json` without PRD upd

 Merge strategy enforcement (HARD RULE):

- The integration trunk is the branch the project's `.mosaic/repo.json` declares under `integration_trunk` (default: `main`) — see `CONSTITUTION.md` Hard Gates.
- PR target for delivery is the integration trunk.
- Direct pushes to the integration trunk are prohibited.
- Merge to the integration trunk MUST be squash-only.
+- PR target for delivery is `main`.
+- Direct pushes to `main` are prohibited.
+- Merge to `main` MUST be squash-only.
 - Use `~/.config/mosaic/tools/git/pr-merge.sh -n {PR_NUMBER} -m squash --expect-head {approved_full_sha}` (or PowerShell equivalent).

 An estate MAY carry a documented exception for a repository whose gates are commit hooks rather
@@ -66,19 +65,6 @@ Each of these produced a wrong conclusion before it was written down.
    conclusion drawn from it describes the wrong tree. Confirm `git rev-parse --show-toplevel`
    is the tree you think it is before trusting any git output.

-13. **Run the repository's PINNED tool version.** `npx <tool>` resolves a local `node_modules`
-    install when one is present and fetches the latest release when one is not, so the same
-    command answers differently depending on where it ran. A reviewer measuring in a fresh clone
-    or a detached worktree — which is exactly where reviewers measure — has no `node_modules` and
-    silently gets the latest release instead of the pinned one. Measured on mosaicstack#1313: the
-    lockfile pins prettier 3.8.1, under which three guides pass; a version-less `npx` in a
-    worktree resolved 3.9.6, under which the same three fail; and 3.0.0, the floor of the declared
-    `^3.0.0` range, fails a different one. Three versions, three verdicts, identical bytes. Use
-    `node_modules/.bin/<tool>`, or name the version the lockfile pins.
-14. **A formatter or linter declared as a range is a dated verdict, not a fact.** If a lockfile
-    pins it, the gate is reproducible today and will disagree with itself the day the pin moves.
-    Report a formatting failure with the version that produced it, always.
-
 ### Feedback Categories

 - **Blocker**: must fix before merge (security, bugs, test failures)
@@ -198,8 +184,8 @@ Use `~/.config/mosaic/templates/docs/DOCUMENTATION-CHECKLIST.md` whenever code/A
 # List the issue being addressed
 ~/.config/mosaic/tools/git/issue-list.sh -i {issue-number}

-# View the changes (diff against the integration trunk; default: main)
-git diff {integration_trunk}...HEAD
+# View the changes
+git diff main...HEAD
 ```

 ### Providing Feedback
@@ -228,4 +214,4 @@ This pattern appears in 3 places. A shared helper would reduce duplication.
 2. If changes requested, assign back to author
 3. If approved, note approval in issue comments
 4. For merges, ensure CI passes first
-5. Merge PR to the integration trunk with squash strategy only
+5. Merge PR to `main` with squash strategy only
@@ -78,7 +78,7 @@ For implementation work, you MUST run this cycle in order:
 7. `commit` - commit only when the logical unit passes tests and review.
 8. `pre-push queue guard` - before pushing, wait for running/queued project pipelines to clear: `~/.config/mosaic/tools/git/ci-queue-wait.sh --purpose push`.
 9. `push` - push immediately after queue guard passes.
-10. `PR integration` - if external git provider is available, create/update PR to the integration trunk (the project's declared trunk, default `main`) and merge with required strategy via Mosaic wrappers.
+10. `PR integration` - if external git provider is available, create/update PR to `main` and merge with required strategy via Mosaic wrappers.
 11. `pre-merge queue guard` - before merging PR, wait for running/queued project pipelines on the exact PR head to clear: `~/.config/mosaic/tools/git/ci-queue-wait.sh --purpose merge -B <PR_HEAD_BRANCH> -R <PR_HEAD_OWNER/REPO> --sha <PR_HEAD_FULL_SHA>`.
 12. `CI/pipeline verification` - wait for terminal CI status and require green before completion (`~/.config/mosaic/tools/git/pr-ci-wait.sh` for PR-based workflow).
 13. `issue closure` - close linked external issue (or close internal `docs/TASKS.md` task ref when provider is unavailable).
@@ -199,7 +199,7 @@ Before running this checklist, pause and self-interrogate: did I fulfill the use
 10. No unresolved blocker hidden.
 11. If deployment is in scope, deployment target, release version, and post-deploy verification evidence are documented.
 12. `docs/TASKS.md` status and issue/internal references are updated to match delivered work.
-13. If source code changed and external provider is available: PR merged to the integration trunk (squash), with merge evidence recorded.
+13. If source code changed and external provider is available: PR merged to `main` (squash), with merge evidence recorded.
 14. CI/pipeline status is terminal green for the merged PR/head commit.
 15. Linked external issue is closed (or internal task ref is closed when no provider exists).
 16. If any of items 13-15 fail due access/tooling, report `blocked` with exact failed wrapper command and do not claim completion.
@@ -53,21 +53,23 @@ sends, it does not auto-reply.

 ### Exit codes

-| rc  | Meaning                                        |
-| --- | ---------------------------------------------- |
-| 0   | delivered or queued                            |
-| 1   | target session not found                       |
-| 2   | text reached the pane but is **still a draft** |
-| 3   | usage error (bad class, missing `-s`)          |
+| rc  | Meaning                                                                                      |
+| --- | -------------------------------------------------------------------------------------------- |
+| 0   | delivered or queued                                                                          |
+| 1   | target session not found                                                                     |
+| 2   | submission unconfirmed: draft still on the input line, or no positive evidence of submission |
+| 3   | usage error (bad class, missing `-s`)                                                        |

-**Never retry on rc=2.** The message is in the target pane; retrying double-sends it. Confirm
-instead:
+**Never retry on rc=2.** The message may be in the target pane, and a retry can double-send it.
+Confirm instead:

 ```bash
 tmux capture-pane -p -t <session>:0.0 | tail -20
 ```

-rc=2 is the normal result when the target is an idle pi seat.
+rc=0 is the normal result for both idle and busy pi seats (submission confirmed by draft
+transition, not by prompt glyph). rc=2 on a healthy seat is exceptional — treat it as a real
+report and investigate the pane.

 ## Durable comms

@@ -253,7 +253,7 @@ status → mission → run → repeat

 - [ ] All milestone tasks in TASKS.md are `done`
 - [ ] CI/pipeline green
- [ ] PR merged to the integration trunk
+- [ ] PR merged to `main`
 - [ ] Issues closed
 - [ ] Update manifest: milestone status → completed
 - [ ] Update scratchpad: session log entry
@@ -15,7 +15,7 @@ mosaic claude -p "Read ~/.config/mosaic/skills/nestjs-best-practices/SKILL.md th
 - You MUST keep the TASKS.md file updated with agent and tasks statuses.
 - You MUST keep `docs/` root clean. Reports and working artifacts MUST be stored in scoped folders (`docs/reports/`, `docs/tasks/`, `docs/releases/`, `docs/scratchpads/`).
 - You MUST enforce plan/token usage budgets when provided, and adapt orchestration strategy to remain within limits.
- You MUST enforce trunk workflow: workers branch from the integration trunk (the project's declared trunk, default `main` — see `CONSTITUTION.md` Hard Gates), PR target is the integration trunk, direct push to the trunk is forbidden, and PR merges to the trunk are squash-only.
+- You MUST enforce trunk workflow: workers branch from `main`, PR target is `main`, direct push to `main` is forbidden, and PR merges to `main` are squash-only.
 - You MUST operate in steered-autonomy mode: human intervention is escalation-only; do not require the human to write code, review code, or manage PR/repo workflow.
 - You MUST NOT declare task or issue completion until PR is merged, CI/pipeline is terminal green, and linked issue is closed (or internal TASKS ref is closed when provider is unavailable).
 - Mosaic orchestration rules OVERRIDE runtime-default caution for routine push/merge/issue-close actions required by this workflow.
@@ -133,10 +133,10 @@ Milestone versioning (HARD RULE):

 Branch and merge strategy (HARD RULE):

- Workers use short-lived task branches from `origin/{integration_trunk}` (default `main`).
- Worker task branches merge back via PR to the integration trunk only.
- Direct pushes to the integration trunk are prohibited.
- PR merges to the integration trunk MUST use squash merge.
+- Workers use short-lived task branches from `origin/main`.
+- Worker task branches merge back via PR to `main` only.
+- Direct pushes to `main` are prohibited.
+- PR merges to `main` MUST use squash merge.

 **Available templates:**

@@ -427,7 +427,7 @@ git push
    - Before merging, run queue guard:
      `~/.config/mosaic/tools/git/ci-queue-wait.sh --purpose merge -B <PR_HEAD_BRANCH> -R <PR_HEAD_OWNER/REPO> --sha <PR_HEAD_FULL_SHA>`
    - Ensure PR exists for the task branch (create/update via wrappers if needed):
-      `~/.config/mosaic/tools/git/pr-create.sh ... -B {integration_trunk}` (default `main`)
+      `~/.config/mosaic/tools/git/pr-create.sh ... -B main`
    - Merge via wrapper:
      `~/.config/mosaic/tools/git/pr-merge.sh -n {PR_NUMBER} -m squash --expect-head {approved_full_sha}`
    - Wait for terminal CI status:
@@ -619,7 +619,7 @@ Construct this from the task row and pass to worker via Task tool:

 ## Workflow

-1. Checkout branch: `git fetch origin && (git checkout {branch} || git checkout -b {branch} origin/{integration_trunk}) && git rebase origin/{integration_trunk}` ({integration_trunk} = the project's declared trunk, default `main`)
+1. Checkout branch: `git fetch origin && (git checkout {branch} || git checkout -b {branch} origin/main) && git rebase origin/main`
 2. Read `docs/PRD.md` or `docs/PRD.json` and align implementation with PRD requirements
 3. Read the finding details from the report
 4. Implement the fix following existing code patterns
@@ -637,7 +637,7 @@ Do NOT leave lint warnings or errors for someone else to clean up. 6. Run REQUIR
 For issue/PR/milestone operations, use scripts (NOT raw tea/gh):

 - `~/.config/mosaic/tools/git/issue-view.sh -i {N}`
- `~/.config/mosaic/tools/git/pr-create.sh -t "Title" -b "Desc" -B {integration_trunk}`
+- `~/.config/mosaic/tools/git/pr-create.sh -t "Title" -b "Desc" -B main`
 - Push: `~/.config/mosaic/tools/git/ci-queue-wait.sh --purpose push -B {task_branch}`
 - Merge: `~/.config/mosaic/tools/git/ci-queue-wait.sh --purpose merge -B {pr_head_branch} -R {pr_head_owner/repo} --sha {pr_head_full_sha}`
 - `~/.config/mosaic/tools/git/pr-merge.sh -n {PR_NUMBER} -m squash --expect-head {approved_full_sha}`
@@ -994,13 +994,13 @@ mv docs/reports/qa-automation/pending/*failing-file* docs/reports/qa-automation/

 ---

-## Merge-to-Trunk Candidate Protocol (Container Deployments)
+## Merge-to-Main Candidate Protocol (Container Deployments)

-If deployment is in scope and container images are used, every merge to the integration trunk MUST execute this protocol:
+If deployment is in scope and container images are used, every merge to `main` MUST execute this protocol:

 1. Build and push immutable candidate image tags:
   - `sha-<shortsha>` (always)
-   - `v{base-version}-rc.{build}` (for integration-trunk merges)
+   - `v{base-version}-rc.{build}` (for `main` merges)
   - `testing` mutable pointer to the same digest
 2. Resolve and record the image digest for each service.
 3. Deploy by digest to testing environment (never deploy by mutable tag alone).
@@ -292,16 +292,6 @@ esac
 _build_runtime_bin_prefix() {
  local candidates=()
  if [ -n "$MOSAIC_RUNTIME_BIN" ]; then candidates+=("$MOSAIC_RUNTIME_BIN"); fi
-  # A host with no system Node gets one bootstrapped here by tools/install.sh, which
-  # records it in ~/.profile. The fleet unit runs `env -i ... bash --noprofile --norc`
-  # by design, so ~/.profile is never read and the directory has to be named here.
-  # The npm probe below cannot cover this: it reports a package prefix
-  # (~/.npm-global), never a Node runtime directory. It sits ahead of the npm probe so
-  # the bootstrapped runtime wins on a host that has both — that is the one the installer
-  # verified — while an explicit MOSAIC_RUNTIME_BIN still outranks it.
-  # Runtime binaries are `#!/usr/bin/env node`, so without this the pane resolves the
-  # binary and then dies on `env: 'node': No such file or directory`.
-  candidates+=("$PANE_HOME/.mosaic/node/current/bin")
  if command -v npm >/dev/null 2>&1; then
    local npm_prefix
    npm_prefix=$(npm config get prefix 2>/dev/null) || true
@@ -520,93 +520,6 @@ for blocked in LD_PRELOAD= BASH_ENV= MOSAIC_UNTRUSTED_SENTINEL=; do
  contains_literal "$pane_environment" "$blocked" && fail "runtime pane received $blocked"
 done

-# #1256. On a host with no system Node, tools/install.sh bootstraps one into
-# ~/.mosaic/node/ and writes that directory to ~/.profile. The fleet unit runs
-# `env -i ... bash --noprofile --norc`, so ~/.profile is never read — correctly, by
-# design — and _build_runtime_bin_prefix does not list the bootstrap directory. Its
-# `npm config get prefix` branch cannot cover the gap either: the installer points
-# npm's prefix at ~/.npm-global, so that branch contributes the npm-global directory
-# and never the Node one, however it resolves.
-#
-# The property under test is not "the string is in PATH". It is that the pane can
-# EXECUTE a Node-shebang runtime binary — which is what `mosaic` is
-# (`#!/usr/bin/env node`) and what actually failed: measured on a greenfield VM as
-# `env: 'node': No such file or directory` after a clean install that reported success.
-#
-# So this case runs the pane for real and requires it to have run. A PATH-substring
-# assertion would pass on a fix that put the directory in the wrong position, and it
-# would keep passing if the pane later stopped running for some unrelated reason.
-: > "$TMUX_CALLS"
-HOME_NODE="$ROOT/bootstrap-node/.config/mosaic"
-write_generated "$HOME_NODE" "coder-node"
-NODE_PANE_HOME="${HOME_NODE%/.config/mosaic}"
-NODE_BOOTSTRAP_BIN="$NODE_PANE_HOME/.mosaic/node/current/bin"
-mkdir -p "$NODE_BOOTSTRAP_BIN"
-
-# The bootstrapped runtime. It records that it ran, which is the evidence this case
-# turns on: no node reachable from the pane means no marker.
-cat > "$NODE_BOOTSTRAP_BIN/node" <<'SHIM'
-#!/usr/bin/env bash
-set -euo pipefail
-env -0 > "${MOSAIC_HOME:?}/fleet/pane-environment"
-SHIM
-chmod +x "$NODE_BOOTSTRAP_BIN/node"
-
-# write_generated plants its symlinks under the MOSAIC_HOME it is given; here the
-# pane's HOME is the trusted parent, so the pane's view of "installed" is this
-# directory instead. `pi` is what #1241 resolves against PANE_PATH; `mosaic` is what
-# the pane then executes, and it is a Node script — not a bash script that would run
-# anywhere and quietly hide the defect.
-mkdir -p "$NODE_PANE_HOME/.npm-global/bin"
-ln -sf "$FAKE_BIN/pi" "$NODE_PANE_HOME/.npm-global/bin/pi"
-printf '#!/usr/bin/env node\n' > "$NODE_PANE_HOME/.npm-global/bin/mosaic"
-chmod +x "$NODE_PANE_HOME/.npm-global/bin/mosaic"
-
-# The npm branch is modelled ALIVE and still cannot close the gap, which is the
-# stronger statement. An earlier draft of this case tried to model npm as absent —
-# true on a real bootstrap host, where npm lives only in the Node directory — and it
-# refused to run anywhere npm is in the system path, i.e. most machines. It was also
-# the weaker claim: it would have proven only that a dead branch supplies nothing.
-#
-# On a bootstrap host the installer sets npm's prefix to ~/.npm-global. So even with
-# `command -v npm` true and the branch executing, `npm config get prefix` yields the
-# npm-global directory and never the Node one. The gap does not depend on whether
-# that branch runs.
-NODE_LAUNCHER_BIN="$ROOT/bootstrap-node-launcher-bin"
-mkdir -p "$NODE_LAUNCHER_BIN"
-ln -sf "$FAKE_BIN/tmux" "$NODE_LAUNCHER_BIN/tmux"
-ln -sf "$FAKE_BIN/npm" "$NODE_LAUNCHER_BIN/npm"
-
-/usr/bin/env -i \
-  "HOME=$NODE_PANE_HOME" \
-  "PATH=$NODE_LAUNCHER_BIN:/usr/bin:/bin" \
-  "MOSAIC_HOME=$HOME_NODE" \
-  "MOSAIC_TEST_TMUX_CALLS=$TMUX_CALLS" \
-  "MOSAIC_TEST_HOME=$NODE_PANE_HOME" \
-  "MOSAIC_TEST_NPM_PREFIX=$NODE_PANE_HOME/.npm-global" \
-  MOSAIC_TEST_FLEET_OWNER=123e4567-e89b-12d3-a456-426614174000 \
-  MOSAIC_TEST_EXECUTE_PANE=1 \
-  "MOSAIC_TEST_PANE_PID=$$" \
-  "$START" coder-node
-
-[ -f "$HOME_NODE/fleet/pane-environment" ] || \
-  fail "pane could not execute a Node-shebang runtime: $NODE_BOOTSTRAP_BIN is absent from PANE_PATH (#1256)"
-node_pane_environment=$(tr '\0' '\n' < "$HOME_NODE/fleet/pane-environment")
-# Colon-pad and match a whole element. A regex with `(^|:)` after `.*` looks like it
-# does this and does not: an anchor cannot match mid-pattern, so it silently requires
-# a leading colon and rejects the directory in FIRST position — which is where THIS
-# FIXTURE puts it: it runs under `env -i` with no MOSAIC_RUNTIME_BIN, so the bootstrap
-# directory leads. That is a property of the fixture, not of the fix — in general the
-# directory sits second, after MOSAIC_RUNTIME_BIN. The colon padding makes the
-# assertion position-independent either way, which is why it is written this way and
-# not with an anchor. That produced a failure reading "pane ran but PANE_PATH does not
-# carry <dir>" against a PATH whose first element was that dir.
-node_pane_path=":$(printf '%s\n' "$node_pane_environment" | sed -n 's/^PATH=//p' | head -1):"
-case "$node_pane_path" in
-  *":$NODE_BOOTSTRAP_BIN:"*) ;;
-  *) fail "pane ran but PANE_PATH does not carry $NODE_BOOTSTRAP_BIN (PATH=$node_pane_path)" ;;
-esac
-
 write_interaction_generated() {
  local home="$1"
  local agent="$2"
@@ -128,7 +128,6 @@ BASE_BRANCH="$(printf '%s' "$PR_METADATA" | python3 -c 'import json, sys; print(
 HEAD_BRANCH="$(printf '%s' "$PR_METADATA" | python3 -c 'import json, sys; print((json.load(sys.stdin).get("headRefName") or "").strip())')"
 HEAD_SHA="$(printf '%s' "$PR_METADATA" | python3 -c 'import json, sys; print((json.load(sys.stdin).get("headRefOid") or "").strip())')"
 HEAD_REPO="$(printf '%s' "$PR_METADATA" | python3 -c 'import json, sys; value=json.load(sys.stdin).get("headRepository") or ""; print((value.get("nameWithOwner") or value.get("full_name") or "") if isinstance(value, dict) else str(value).strip())')"
-BASE_REPO="$(printf '%s' "$PR_METADATA" | python3 -c 'import json, sys; value=json.load(sys.stdin).get("baseRepository") or ""; print((value.get("nameWithOwner") or value.get("full_name") or "") if isinstance(value, dict) else str(value).strip())')"
 PR_TITLE="$(printf '%s' "$PR_METADATA" | python3 -c 'import json, sys; print((json.load(sys.stdin).get("title") or "").strip())')"
 PR_AUTHOR="$(printf '%s' "$PR_METADATA" | python3 -c 'import json, sys; value=json.load(sys.stdin).get("author") or ""; print((value.get("login") or "").strip() if isinstance(value, dict) else str(value).strip())')"
 if [[ "$BASE_BRANCH" != "main" && "$BASE_BRANCH" != "next" ]]; then
@@ -145,19 +144,10 @@ if [[ -n "$EXPECT_HEAD" && "$HEAD_SHA" != "$EXPECT_HEAD" ]]; then
 fi

 if [[ "$DRY_RUN" != true ]]; then
-    # CI statuses for a PR live on the BASE repo (Woodpecker posts there),
-    # even when the head branch lives in a fork. Reading status against the
-    # fork repo yields statuses:null -> malformed for every fork PR (#1215,
-    # gate-merge-01 B1). The head repo is used only for head-sha identity;
-    # when metadata carries no base repository, the origin repo is where CI
-    # posts and remains correct for same-repo PRs.
-    if [[ -z "$BASE_REPO" ]]; then
-        BASE_REPO="$(get_repo_owner)/$(get_repo_name)"
-    fi
    "$SCRIPT_DIR/ci-queue-wait.sh" \
        --purpose merge \
        -B "$HEAD_BRANCH" \
-        -R "$BASE_REPO" \
+        -R "$HEAD_REPO" \
        --sha "$HEAD_SHA" \
        -t "${MOSAIC_CI_QUEUE_TIMEOUT_SEC:-900}" \
        -i "${MOSAIC_CI_QUEUE_POLL_SEC:-15}"
@@ -209,10 +209,6 @@ base_ref = first_non_empty(
    data.get('base_ref'),
    data.get('base_label'),
 )
-base_repo = first_non_empty(
-    nested(data, 'base', 'repo', 'full_name'),
-    nested(data, 'base', 'repo', 'name_with_owner'),
-)

 if not head_ref or not base_ref:
    available = ', '.join(sorted(data.keys()))
@@ -233,7 +229,6 @@ normalized = {
    'headRefOid': head_sha,
    'headRepository': head_repo,
    'baseRefName': base_ref,
-    'baseRepository': base_repo,
    'labels': [l.get('name', '') for l in data.get('labels', []) if isinstance(l, dict)],
    'assignees': [a.get('login', '') for a in data.get('assignees', []) if isinstance(a, dict)],
    'milestone': nested(data, 'milestone', 'title') or '',
@@ -1,76 +0,0 @@
-#!/usr/bin/env bash
-# B1 (stack #1215, gate-merge-01): for a fork PR the merge queue guard must
-# read CI status against the BASE repository. Woodpecker posts statuses on the
-# base repo; pr-metadata's headRepository names the fork, and passing it to
-# ci-queue-wait yields statuses:null -> state=malformed rc=3 on every fork PR.
-#
-# This fixture omits baseRepository entirely (the pre-B1 normalizer's shape),
-# so the guard must fall back to the origin repo — and must NEVER see the fork.
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-WORK_DIR="${MOSAIC_TEST_WORK_DIR:-$PWD/.mosaic-test-work/pr-merge-fork-ci-status}"
-FIXTURE_DIR="$WORK_DIR/tools/git"
-CALL_LOG="$WORK_DIR/queue-call.log"
-
-rm -rf "$WORK_DIR"
-mkdir -p "$FIXTURE_DIR"
-cp "$SCRIPT_DIR/pr-merge.sh" "$FIXTURE_DIR/pr-merge.sh"
-cp "$SCRIPT_DIR/detect-platform.sh" "$FIXTURE_DIR/detect-platform.sh"
-
-cat > "$FIXTURE_DIR/pr-metadata.sh" <<'SH'
-#!/usr/bin/env bash
-printf '%s\n' '{"baseRefName":"next","headRefName":"fix/b1-fork-branch","headRefOid":"fedcba9876543210fedcba9876543210fedcba98","headRepository":"stack-mos-dt-0/stack"}'
-SH
-
-cat > "$FIXTURE_DIR/ci-queue-wait.sh" <<'SH'
-#!/usr/bin/env bash
-printf '%s\n' "$*" > "${MOSAIC_QUEUE_CALL_LOG:?}"
-exit 42
-SH
-chmod +x "$FIXTURE_DIR"/*.sh
-
-# A git repo with an origin remote, so the origin fallback resolves.
-git init -q "$WORK_DIR/upstream"
-git -C "$WORK_DIR/upstream" remote add origin https://git.mosaicstack.dev/mosaicstack/stack.git
-
-set +e
-(
-    cd "$WORK_DIR/upstream"
-    export MOSAIC_QUEUE_CALL_LOG="$CALL_LOG"
-    "$FIXTURE_DIR/pr-merge.sh" -n 1215
-) >/dev/null 2>&1
-rc=$?
-set -e
-
-if [[ "$rc" -ne 42 ]]; then
-    echo "FAIL: expected queue stub rc=42 to propagate, got $rc" >&2
-    exit 1
-fi
-if [[ ! -s "$CALL_LOG" ]]; then
-    echo "FAIL: merge wrapper did not invoke the queue guard" >&2
-    exit 1
-fi
-if grep -q -- '-R stack-mos-dt-0/stack' "$CALL_LOG"; then
-    echo "FAIL: queue guard received the FORK repository for CI status (B1 regression)" >&2
-    cat "$CALL_LOG" >&2
-    exit 1
-fi
-if ! grep -q -- '-R mosaicstack/stack' "$CALL_LOG"; then
-    echo "FAIL: queue guard did not receive the base (origin) repository" >&2
-    cat "$CALL_LOG" >&2
-    exit 1
-fi
-if ! grep -q -- '-B fix/b1-fork-branch' "$CALL_LOG"; then
-    echo "FAIL: queue guard did not receive the PR head branch" >&2
-    cat "$CALL_LOG" >&2
-    exit 1
-fi
-if ! grep -q -- '--sha fedcba9876543210fedcba9876543210fedcba98' "$CALL_LOG"; then
-    echo "FAIL: queue guard did not receive the exact PR head SHA" >&2
-    cat "$CALL_LOG" >&2
-    exit 1
-fi
-
-echo "pr-merge fork-PR CI-status repository regression passed"
@@ -15,7 +15,7 @@ cp "$SCRIPT_DIR/detect-platform.sh" "$FIXTURE_DIR/detect-platform.sh"

 cat > "$FIXTURE_DIR/pr-metadata.sh" <<'SH'
 #!/usr/bin/env bash
-printf '%s\n' '{"baseRefName":"main","baseRepository":"mosaicstack/stack","headRefName":"fix/rm-03-fixture","headRefOid":"0123456789abcdef0123456789abcdef01234567","headRepository":"contributor/widgets-fork"}'
+printf '%s\n' '{"baseRefName":"main","headRefName":"fix/rm-03-fixture","headRefOid":"0123456789abcdef0123456789abcdef01234567","headRepository":"contributor/widgets-fork"}'
 SH

 cat > "$FIXTURE_DIR/ci-queue-wait.sh" <<'SH'
@@ -52,13 +52,8 @@ if grep -q -- '-B main' "$CALL_LOG"; then
    cat "$CALL_LOG" >&2
    exit 1
 fi
-if ! grep -q -- '-R mosaicstack/stack' "$CALL_LOG"; then
-    echo "FAIL: merge queue guard did not receive the BASE repository for CI status" >&2
-    cat "$CALL_LOG" >&2
-    exit 1
-fi
-if grep -q -- '-R contributor/widgets-fork' "$CALL_LOG"; then
-    echo "FAIL: merge queue guard received the fork head repository (B1: statuses are posted on the base repo)" >&2
+if ! grep -q -- '-R contributor/widgets-fork' "$CALL_LOG"; then
+    echo "FAIL: merge queue guard did not receive the fork head repository" >&2
    cat "$CALL_LOG" >&2
    exit 1
 fi
@@ -54,22 +54,6 @@ def main(
    arguments = parser.parse_args(argv)
    source_environment = os.environ if environ is None else environ

-    # D29: a session that never held a lease has nothing to revoke, and that is a
-    # SUCCESS, not a failed revocation. The block below is deliberately fail-closed
-    # for a broker that is unreachable, which is right — but it cannot distinguish
-    # "the broker is down" from "there was never a lease", so a bare-launched
-    # session was denied every lifecycle transition, including compaction. Denying
-    # compaction protects nothing there; it converts a recoverable context limit
-    # into a lost session.
-    #
-    # Absence must be TOTAL to qualify. If exactly one variable is present the
-    # session is half-provisioned, which is real misconfiguration, and it still
-    # takes the fail-closed path below.
-    lease_variables = ("MOSAIC_LEASE_BROKER_SOCKET", "MOSAIC_LEASE_SESSION_ID")
-    present = [name for name in lease_variables if source_environment.get(name)]
-    if not present:
-        return 0
-
    try:
        if not arguments.reason or len(arguments.reason) > 128:
            raise ValueError("invalid revoke reason")
@@ -30,6 +30,7 @@ packages/mosaic/framework/tools/git/test-lane-brief-pr-linkage.sh | unmeasured i
 # --- tools/tmux: require a live tmux server ---
 packages/mosaic/framework/tools/tmux/test-send-message-socket.sh | requires a real tmux server on a throwaway socket; CI image ships no tmux; #1017 burndown (needs tmux in image or a signed permanent exclusion)
 packages/mosaic/framework/tools/tmux/test-send-message-verdict.sh | requires real tmux-pane fixtures on a throwaway socket; CI image ships no tmux; #1017 burndown (same condition as its sibling)
+packages/mosaic/framework/tools/tmux/test-send-message-glyph-agnostic.sh | requires real tmux-pane fixtures on a throwaway socket; CI image ships no tmux; #1017 burndown (same condition as its siblings) — signed at adoption of #1262 (rev-code-02 F5), red-first verified on sb-it-1-dt

 # --- single-suite directories: unmeasured in CI ---

@@ -126,16 +126,7 @@ if [ -z "$SRC_LABEL" ]; then
  src_host=$(hostname -s 2>/dev/null || echo "?")
  src_sess=${MOSAIC_AGENT_NAME:-}
  if [ -z "$src_sess" ]; then
-    if [ -n "${TMUX:-}" ]; then
-      # Inside tmux: display-message resolves against this client's own session.
-      src_sess=$(tmux display-message -p '#S' 2>/dev/null || echo "?")
-    else
-      # Outside tmux with no name: display-message reports the LAST-ACTIVE
-      # session — someone else's identity (measured 2026-08-20: a nameless
-      # non-tmux sender was stamped "peggy", a live seat, forged silently).
-      # Stamp an explicit unverified label instead; deliberate senders use -S.
-      src_sess="unverified"
-    fi
+    src_sess=$(tmux display-message -p '#S' 2>/dev/null || echo "?")
  fi
  SRC_LABEL="${src_host}:${src_sess}"
 fi
@@ -61,15 +61,8 @@ no()   { FAIL=$((FAIL+1)); printf 'FAIL %s\n   %s\n' "$1" "$2"; }

 # Run the tool with the stub injected; echoes captured payload on stdout.
 run() { AGENT_SEND_SENDER="$STUB" bash "$TOOL" -S a:src -n dsthost "$@"; }
-# Hermetic auto-label runs: TMUX is controlled explicitly so results never
-# depend on whether the caller running this suite sits inside tmux.
-run_auto() {          # models a sender OUTSIDE tmux (no client context)
-  env -u MOSAIC_AGENT_NAME -u TMUX \
-    AGENT_SEND_SENDER="$STUB" PATH="$FAKE_BIN:$PATH" \
-    bash "$TOOL" -n dsthost "$@"
-}
-run_auto_in_tmux() {  # models a sender INSIDE tmux (client context exists)
-  env -u MOSAIC_AGENT_NAME TMUX=/fake/socket \
+run_auto() {
+  env -u MOSAIC_AGENT_NAME \
    AGENT_SEND_SENDER="$STUB" PATH="$FAKE_BIN:$PATH" \
    bash "$TOOL" -n dsthost "$@"
 }
@@ -152,9 +145,7 @@ want="[$src_host:authoritative-agent -> dsthost:mos] env identity"
  || no "MOSAIC_AGENT_NAME is authoritative across sockets" "got=[$got] want=[$want]"

 # 9. Without the env identity, self-lookup uses local tmux, not destination -L.
-#    Sender is INSIDE tmux: the only context where display-message self-lookup
-#    is safe (it resolves against this client's own session).
-got=$(FAKE_TMUX_MODE=sessions run_auto_in_tmux -L destination-socket -s mos -m "local fallback")
+got=$(FAKE_TMUX_MODE=sessions run_auto -L destination-socket -s mos -m "local fallback")
 want="[$src_host:local-agent -> dsthost:mos] local fallback"
 [ "$got" = "$want" ] && ok "cross-socket fallback uses local sender session" \
  || no "cross-socket fallback uses local sender session" "got=[$got] want=[$want]"
@@ -162,17 +153,8 @@ want="[$src_host:local-agent -> dsthost:mos] local fallback"
  && ok "cross-socket fallback rejects destination holder identity" \
  || no "cross-socket fallback rejects destination holder identity" "got=[$got]"

-# 9b. NO tmux context: display-message answers with the LAST-ACTIVE session —
-#     someone else's identity (forgery vector). The label must be `unverified`,
-#     never a borrowed name, even though a tmux server exists here and the fake
-#     would confidently answer `local-agent`.
-got=$(FAKE_TMUX_MODE=sessions run_auto -s mos -m "no tmux context")
-want="[$src_host:unverified -> dsthost:mos] no tmux context"
-[ "$got" = "$want" ] && ok "no-tmux sender labeled unverified, never borrowed" \
-  || no "no-tmux sender labeled unverified, never borrowed" "got=[$got] want=[$want]"
-
 # 10. If neither env nor local tmux identifies the sender, preserve '?'.
-got=$(FAKE_TMUX_MODE=unavailable run_auto_in_tmux -L destination-socket -s mos -m "unknown fallback")
+got=$(FAKE_TMUX_MODE=unavailable run_auto -L destination-socket -s mos -m "unknown fallback")
 want="[$src_host:? -> dsthost:mos] unknown fallback"
 [ "$got" = "$want" ] && ok "unknown sender falls back to ?" \
  || no "unknown sender falls back to ?" "got=[$got] want=[$want]"
@@ -97,13 +97,34 @@ printf '%s' "$MSG" | "${tmux_cmd[@]}" load-buffer -b "$BUF" -
 #   would otherwise accumulate forever.
 sleep 0.5

-# 2) Submit, then POSITIVELY confirm submission; flush with another Enter if it is
-#    still a draft. Success requires positive evidence — the queued banner, OR the
-#    REPL input box located AND clear of our message tail. The historical bug was
-#    treating ABSENCE of a draft as delivery: if the prompt glyph was never matched
-#    (wrong pane / prompt-glyph drift), an unsubmitted message read as "delivered"
-#    and worker->lead relays stalled silently. We now default to UNCONFIRMED and only
-#    upgrade to delivered on positive evidence; anything we cannot confirm fails loud.
+# 2) Submit, then POSITIVELY confirm submission by DRAFT TRANSITION, not by prompt
+#    glyph. The historical bug was treating ABSENCE of a draft as delivery; the
+#    2026-08 fix over-corrected to glyph inference (grep '❯|^>|│ >'), which locates
+#    only Claude Code's box and false-NEGATIVES every glyphless REPL (pi renders a
+#    U+2500 rule, no glyph) — a delivered message reported "UNDELIVERED", driving a
+#    retry that duplicates it. Runtime-agnostic evidence: our message tail sits on
+#    the INPUT line (located by the cursor row, not a glyph) BEFORE Enter, and has
+#    LEFT it AFTER — that transition is positive proof of submission and needs no
+#    glyph. Absence alone still never means delivered: if we never saw our draft on
+#    the input line we stay UNCONFIRMED (wrong/dead pane), and a draft that never
+#    leaves the input line stays a DRAFT (exit 2), preserving both historical guards.
+_cursor_line() { # echo the pane's current input (cursor) line, glyph-free
+  local cy line
+  cy=$("${tmux_cmd[@]}" display-message -p -t "$EFFECTIVE_TARGET" -F '#{cursor_y}' 2>/dev/null) || return 1
+  [ -n "$cy" ] || return 1
+  "${tmux_cmd[@]}" capture-pane -t "$EFFECTIVE_TARGET" -p 2>/dev/null | sed -n "$((cy + 1))p"
+}
+_draft_on_input() { # true iff our message tail is sitting on the input line now
+  [ -n "$snippet" ] || return 1
+  grep -qF "$snippet" <<<"$(_cursor_line)"
+}
+
+# Baseline: after the paste, our draft must be on the input line. This is positive
+# proof we are on the right pane and the paste landed — the anchor the transition
+# check measures against.
+saw_draft=0
+_draft_on_input && saw_draft=1
+
 status="unconfirmed"
 for attempt in $(seq 1 $((RETRIES + 1))); do
  "${tmux_cmd[@]}" send-keys -t "$EFFECTIVE_TARGET" Enter
@@ -113,20 +134,26 @@ for attempt in $(seq 1 $((RETRIES + 1))); do
  if grep -qF "$QUEUED_RE" <<<"$pane"; then
    status="queued"; break
  fi
-  # Locate the REPL input box (prompt glyph). If we cannot see it, we have NO
-  # evidence of submission state — stay UNCONFIRMED and retry; never infer delivery.
+  # POSITIVE draft evidence from a located prompt box, when one exists. This is the
+  # cursor-row check's blind spot: a pane in COOKED mode (a plain shell whose
+  # foreground process never reads stdin) echoes our paste via the kernel line
+  # discipline and moves the cursor off it on Enter, which is indistinguishable from
+  # a real submit by cursor row alone. If a prompt box IS locatable and still carries
+  # our tail, that is affirmative proof the message was not consumed. Absence of a
+  # glyph is still never used for anything — that inference is the original E7 bug.
  promptline=$(printf '%s' "$pane" | grep -E '❯|^>|│ >' | tail -1)
-  if [ -z "$promptline" ]; then
-    status="unconfirmed"; continue
-  fi
-  # Input box located AND still carrying our tail => unsubmitted draft. Flush + retry.
-  # (Submitted messages scroll up into history; a draft stays on the ❯ line.)
-  if [ -n "$snippet" ] && grep -qF "$snippet" <<<"$promptline"; then
+  if [ -n "$promptline" ] && [ -n "$snippet" ] && grep -qF "$snippet" <<<"$promptline"; then
    status="draft"; continue
  fi
-  # Input box located AND clear of our tail => positively submitted. This is the
-  # only path to success besides the queued banner.
-  status="delivered"; break
+  if [ "$saw_draft" = 1 ]; then
+    if _draft_on_input; then
+      status="draft"; continue      # still on the input line => not submitted; flush + retry
+    fi
+    status="delivered"; break        # left the input line => positively submitted
+  fi
+  # No confirmed baseline yet: try to (re)acquire it; never infer delivery from absence.
+  if _draft_on_input; then saw_draft=1; status="draft"; continue; fi
+  status="unconfirmed"; continue
 done

 [ "$VERBOSE" = 1 ] && { echo "--- pane tail ($TARGET) ---"; printf '%s\n' "$pane" | tail -4; echo "---"; }
@@ -0,0 +1,97 @@
+#!/usr/bin/env bash
+# Red-first regression test for E7 (#1017 task 2): the confirm-check must bind
+# "delivered" to WHETHER THE MESSAGE WAS SUBMITTED, not to which runtime's prompt
+# glyph is present. A pi seat renders a U+2500 rule input box with no ❯/^>/│ >
+# glyph; send-message.sh:118 locates the box only by glyph, so a genuinely
+# delivered message on a glyphless REPL falsely reports exit 2 "may be UNDELIVERED",
+# and the operator's rc=2-driven retry duplicates it.
+#
+# Parameterized on $SEND: RED against the shipping blob (B and D fail), GREEN
+# against a candidate patch. No pi; no fake HOME; hermetic throwaway socket.
+#
+# Submission counting is EXACT and terminal-echo-independent: the fixture message
+# is `echo <tok> >>SINK`; each real submission appends one line. wc -l SINK ==
+# number of times the REPL actually executed the send. This does not depend on how
+# many times the marker string is painted on screen.
+set -u
+SEND="${SEND:?set SEND=/path/to/send-message.sh}"
+SOCKET="glyphagnostic-$$"
+TMP="$(mktemp -d)"
+tmux() { command tmux -L "$SOCKET" "$@"; }
+cleanup() { command tmux -L "$SOCKET" kill-server 2>/dev/null; rm -rf "$TMP"; }
+trap cleanup EXIT
+pass=0; fail=0
+ok() { printf 'ok   %s\n' "$1"; pass=$((pass+1)); }
+no() { printf 'FAIL %s -- %s\n' "$1" "$2"; fail=$((fail+1)); }
+
+mk() { tmux new-session -d -s "$1" -x 120 -y 40 -c "$TMP" "PS1='$2' exec bash --noprofile --norc -i"; sleep 0.5; }
+subs() { [ -f "$1" ] && wc -l <"$1" | tr -d ' ' || echo 0; }  # exact submission count
+
+echo "SEND=$SEND    tmux $(command tmux -V | awk '{print $2}')"
+
+# --- A (control): glyph box (❯) that submits => exit 0, exactly one submission.
+mk ctl '❯ '
+SINK="$TMP/sink.ctl"
+out=$("$SEND" -L "$SOCKET" -t ctl -m "echo x >>'$SINK'" 2>"$TMP/e.ctl"); rc=$?; sleep 0.4
+if [ "$rc" = 0 ] && [ "$(subs "$SINK")" = 1 ]; then
+  ok "control: ❯-box submits => exit 0, exactly one submission"
+else no "control: ❯-box submits => exit 0, one submission" "rc=$rc subs=$(subs "$SINK") err=[$(cat "$TMP/e.ctl")]"; fi
+
+# --- B (THE false-rc regression): glyphless U+2500 box that SUBMITS. Message lands
+#     (subs==1) yet shipping reports exit 2. Must be exit 0.
+mk sub $'──────── \n'
+SINK="$TMP/sink.sub"
+out=$("$SEND" -L "$SOCKET" -t sub -m "echo x >>'$SINK'" 2>"$TMP/e.sub"); rc=$?; sleep 0.4
+if [ "$rc" = 0 ] && [ "$(subs "$SINK")" = 1 ]; then
+  ok "glyphless: U+2500 box that submits => exit 0 (delivered, not 'UNDELIVERED')"
+else no "glyphless: U+2500 box that submits => exit 0" \
+        "rc=$rc subs=$(subs "$SINK")(delivered=$([ "$(subs "$SINK")" -ge 1 ] && echo yes||echo no)) err=[$(cat "$TMP/e.sub")]"; fi
+
+# --- D (duplicate arm): operator follows the rc=2 stderr and retries once. On the
+#     glyphless box, shipping => two submissions (the reported duplicate). The
+#     property: one logical send => exactly one submission. Same fix closes it.
+mk dup $'──────── \n'
+SINK="$TMP/sink.dup"
+tries=0
+for attempt in 1 2; do
+  tries=$((tries+1))
+  out=$("$SEND" -L "$SOCKET" -t dup -m "echo x >>'$SINK'" 2>/dev/null); rc=$?
+  sleep 0.4
+  [ "$rc" = 0 ] && break   # operator stops retrying only when told delivered
+done
+if [ "$(subs "$SINK")" = 1 ]; then
+  ok "duplicate: one logical send (rc-driven retry) => exactly one submission (tries=$tries)"
+else no "duplicate: one logical send => exactly one submission" "submissions=$(subs "$SINK") tries=$tries"; fi
+
+# --- E (faithful hung managed TUI, NOT a cooked shell): raw/no-echo, paints nothing.
+#     A cooked `sleep infinity` echoes the paste via the kernel line discipline and
+#     false-passes a cursor-row fix that is correct on real seats (measured). So: raw.
+mk_rawstuck() { tmux new-session -d -s "$1" -x 120 -y 40 -c "$TMP" \
+  "bash --noprofile --norc -c 'stty -echo -icanon min 1 time 0 2>/dev/null; exec sleep infinity'"; sleep 0.5; }
+mk_rawstuck estuck
+SINK="$TMP/sink.estuck"
+out=$("$SEND" -L "$SOCKET" -t estuck -r 1 -m "this stuck draft was never submitted" 2>/dev/null); rc=$?
+sleep 0.3
+if [ "$rc" != 0 ] && [ "$(subs "$SINK")" = 0 ]; then
+  ok "raw/no-echo stuck TUI (not submitted) => non-zero (no false delivered)"
+else no "raw stuck TUI must NOT report delivered" "rc=$rc subs=$(subs "$SINK")"; fi
+
+# --- F (busy/queued branch, your BUSY-not-runtime finding): glyphless pane rendering the
+#     queued banner, never consuming. QUEUED_RE :113 fires before the glyph grep => rc=0.
+mk_busy() { tmux new-session -d -s "$1" -x 120 -y 40 -c "$TMP" \
+  "bash --noprofile --norc -c 'printf \"Press up to edit queued messages\n\"; exec sleep infinity'"; sleep 0.5; }
+mk_busy ebusy
+SINK="$TMP/sink.ebusy"
+out=$("$SEND" -L "$SOCKET" -t ebusy -m "echo x >>'$SINK'" 2>/dev/null); rc=$?; sleep 0.3
+if [ "$rc" = 0 ]; then
+  ok "busy/queued-banner glyphless => exit 0 (queued is delivery; runtime owns custody)"
+else no "busy/queued-banner must report delivered" "rc=$rc"; fi
+
+# --- C (historical-bug guard): unresolvable target. No pane ever carried our draft
+#     => must fail, never infer delivered from absence of a glyph/snippet.
+if out=$("$SEND" -L "$SOCKET" -t "nonexistent-$$" -m "echo x >>'$TMP/sink.wrong'" 2>/dev/null); then
+  no "wrong-pane: unresolvable target must NOT report success" "expected non-zero, got 0"
+else ok "wrong-pane: unresolvable target => non-zero (no false delivered)"; fi
+
+echo "---"; echo "pass=$pass fail=$fail"
+[ "$fail" = 0 ]
@@ -4,16 +4,19 @@
 #
 #   1. DELIVERED   — a REPL that renders a `❯ ` input box and submits on Enter
 #                    (text scrolls to history, box clears) => exit 0 "✓ delivered".
-#   2. UNCONFIRMED — a pane with NO locatable prompt glyph. This is the exact
-#                    historical FALSE POSITIVE: pre-patch it printed "✓ delivered"
-#                    exit 0; post-patch it MUST fail loud (exit 2, stderr
-#                    "could not confirm submission").
+#   2. DELIVERED   — a pane with NO prompt glyph that DOES submit => exit 0. A pi
+#                    seat is this fixture (U+2500 rule, no glyph). Reshaped for
+#                    #1257; see the note at the fixture for why the old exit-2
+#                    assertion was wrong.
+#   2b. UNCONFIRMED— a glyphless pane that never submits (raw/no-echo hung TUI)
+#                    => must fail loud. This carries the historical
+#                    false-positive guard that fixture 2 used to be credited with.
 #   3. DRAFT       — a `❯ `-prompt pane that never submits (message stays on the
 #                    input line) => exit 2, stderr "unsubmitted draft".
 set -uo pipefail

 HERE=$(cd -- "$(dirname -- "$0")" && pwd)
-SEND="$HERE/send-message.sh"
+SEND="${SEND:-$HERE/send-message.sh}"
 SOCKET="verdict-test-$RANDOM-$$"
 TMP=$(mktemp -d)
 trap 'tmux -L "$SOCKET" kill-server >/dev/null 2>&1 || true; rm -rf "$TMP"' EXIT
@@ -37,19 +40,44 @@ else
  no "delivered: ❯-prompt REPL that submits => exit 0 ✓ delivered" "rc=$rc out=[$out] err=[$(cat "$TMP/e1")]"
 fi

-# --- Fixture 2: NO prompt glyph (default bash PS1). THE regression: pre-patch this
-#     was a silent false-positive "delivered"; post-patch it must be unconfirmed→exit 2.
+# --- Fixture 2: NO prompt glyph, and the pane DOES submit (interactive bash).
+#     RESHAPED 2026-08-16 (#1257), deliberately. This fixture previously asserted
+#     exit 2 here and was labelled "false-positive FIXED". That assertion was wrong,
+#     and locking it in is what kept E7 alive: the pane submits, so "delivered" is
+#     the truth, and a pi seat — whose input box is a bare U+2500 rule with no glyph
+#     — IS this fixture. Reporting exit 2 for it told operators a delivered message
+#     may be undelivered, and the retry that advice invites is the duplicate.
+#
+#     The guard this fixture was reaching for is real and is NOT dropped: "never
+#     infer delivered from absence" is now enforced positively by fixture 2b below
+#     (glyphless AND not submitting => must fail) and by fixture 3 (locatable box
+#     still carrying our tail => draft). Absence alone decides nothing either way.
 tmux -L "$SOCKET" new-session -d -s noglyph -c "$TMP" \
  'PS1="sh-noglyph$ " exec bash --noprofile --norc -i'
 sleep 0.3
-if out=$("$SEND" -L "$SOCKET" -t "=noglyph" -m "verdict fixture two must fail loud" 2>"$TMP/e2"); then
-  no "unconfirmed: glyphless pane must NOT report success" "expected exit 2, got 0 (out=[$out])"
+out=$("$SEND" -L "$SOCKET" -t "=noglyph" -m "verdict fixture two must fail loud" 2>"$TMP/e2"); rc=$?
+if [ "$rc" -eq 0 ] && grep -qF "✓ delivered" <<<"$out"; then
+  ok "delivered: glyphless pane that submits => exit 0 (runtime-agnostic, E7 FIXED)"
+else
+  no "delivered: glyphless pane that submits => exit 0" "rc=$rc out=[$out] err=[$(cat "$TMP/e2")]"
+fi
+
+# --- Fixture 2b: NO prompt glyph AND never submits — a hung managed TUI holding the
+#     terminal in raw/no-echo, which is what a stuck agent seat actually is (measured
+#     on live pi: stty -echo -icanon). Nothing is echoed, nothing is consumed, so
+#     there is no positive evidence of submission and the tool MUST fail loud. This
+#     is the historical false-positive guard, kept as a positive test.
+tmux -L "$SOCKET" new-session -d -s rawstuck -c "$TMP" \
+  'bash --noprofile --norc -c "stty -echo -icanon min 1 time 0 2>/dev/null; exec sleep infinity"'
+sleep 0.3
+if out=$("$SEND" -L "$SOCKET" -t "=rawstuck" -r 1 -m "verdict fixture two-b never submitted" 2>"$TMP/e2b"); then
+  no "unconfirmed: glyphless hung TUI must NOT report success" "expected non-zero, got 0 (out=[$out])"
 else
  rc=$?
-  if [ "$rc" -eq 2 ] && grep -qF "could not confirm submission" "$TMP/e2"; then
-    ok "unconfirmed: glyphless pane => exit 2 + 'could not confirm submission' (false-positive FIXED)"
+  if [ "$rc" -ne 0 ] && grep -qF "could not confirm submission" "$TMP/e2b"; then
+    ok "unconfirmed: glyphless hung TUI (raw/no-echo) => non-zero + 'could not confirm submission'"
  else
-    no "unconfirmed: glyphless pane => exit 2 + stderr" "rc=$rc err=[$(cat "$TMP/e2")]"
+    no "unconfirmed: glyphless hung TUI => non-zero + stderr" "rc=$rc err=[$(cat "$TMP/e2b")]"
  fi
 fi

@@ -25,7 +25,7 @@
    "lint": "eslint src",
    "typecheck": "tsc --noEmit",
    "test": "vitest run --passWithNoTests && pnpm run test:framework-shell",
-    "test:framework-shell": "bash framework/tools/quality/scripts/check-test-enumeration.sh && bash framework/tools/quality/scripts/test-check-test-enumeration.sh && python3 framework/tools/quality/scripts/test-framework-drift-check.py && bash framework/tools/quality/scripts/test-framework-drift-doctor.sh && bash framework/systemd/user/test-fleet-units.sh && python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/promotion_binding_unittest.py && python3 src/lease-broker/promotion_trigger_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/receipt_observer_client_unittest.py && python3 src/lease-broker/invariant_r_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/lease-broker/revoke_noop_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 src/mutator-gate/version_coupling_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-edit.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh && bash framework/tools/git/test-pr-review-repo-host-override.sh && bash framework/tools/git/test-ci-queue-wait-no-status.sh && bash framework/tools/git/test-ci-queue-wait-branch-absent.sh && bash framework/tools/git/test-ci-queue-wait-tristate.sh && bash framework/tools/git/test-ci-queue-wait-github-checks.sh && bash framework/tools/git/test-pr-merge-queue-branch.sh && bash framework/tools/git/test-pr-merge-fork-ci-status.sh && bash framework/tools/git/test-pr-merge-head-pin.sh && bash framework/tools/git/test-pr-merge-message-field.sh && bash framework/tools/git/test-git-credential-mosaic.sh && bash framework/tools/git/test-gitea-token-identity.sh && bash framework/tools/git/test-explain-diagnostic-status-neutral.sh && bash framework/tools/git/test-detect-platform-outside-repo.sh && bash framework/tools/woodpecker/test-terminal-green-contract.sh && bash framework/tools/_scripts/test-install-ordering-guard.sh && bash framework/tools/_scripts/test-mosaic-init-rce.sh && bash framework/tools/tmux/agent-send.test.sh && bash framework/tools/wake/test-wake-store-ack.sh && bash framework/tools/wake/test-wake-store-enqueue-race.sh && bash framework/tools/wake/test-wake-digest-hmac.sh && bash framework/tools/wake/test-wake-digest-quarantine.sh && bash framework/tools/wake/test-wake-detector.sh && bash framework/tools/wake/test-wake-fn-oracle.sh && bash framework/tools/wake/test-wake-reconcile.sh && bash framework/tools/wake/test-wake-beacon.sh && bash framework/tools/wake/test-wake-preimage.sh && bash framework/tools/wake/test-wake-install.sh && bash framework/tools/glpi/test-list-http-status.sh && bash framework/tools/orchestrator/test-board-roll.sh && bash framework/tools/woodpecker/test-ci-wait-exit-matrix.sh && bash framework/tools/_scripts/test-fleet-transport-check.sh && bash framework/tools/_scripts/test-brain-home-check.sh"
+    "test:framework-shell": "bash framework/tools/quality/scripts/check-test-enumeration.sh && bash framework/tools/quality/scripts/test-check-test-enumeration.sh && python3 framework/tools/quality/scripts/test-framework-drift-check.py && bash framework/tools/quality/scripts/test-framework-drift-doctor.sh && bash framework/systemd/user/test-fleet-units.sh && python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/promotion_binding_unittest.py && python3 src/lease-broker/promotion_trigger_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/receipt_observer_client_unittest.py && python3 src/lease-broker/invariant_r_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 src/mutator-gate/version_coupling_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-edit.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh && bash framework/tools/git/test-pr-review-repo-host-override.sh && bash framework/tools/git/test-ci-queue-wait-no-status.sh && bash framework/tools/git/test-ci-queue-wait-branch-absent.sh && bash framework/tools/git/test-ci-queue-wait-tristate.sh && bash framework/tools/git/test-ci-queue-wait-github-checks.sh && bash framework/tools/git/test-pr-merge-queue-branch.sh && bash framework/tools/git/test-pr-merge-head-pin.sh && bash framework/tools/git/test-pr-merge-message-field.sh && bash framework/tools/git/test-git-credential-mosaic.sh && bash framework/tools/git/test-gitea-token-identity.sh && bash framework/tools/git/test-explain-diagnostic-status-neutral.sh && bash framework/tools/git/test-detect-platform-outside-repo.sh && bash framework/tools/woodpecker/test-terminal-green-contract.sh && bash framework/tools/_scripts/test-install-ordering-guard.sh && bash framework/tools/_scripts/test-mosaic-init-rce.sh && bash framework/tools/tmux/agent-send.test.sh && bash framework/tools/wake/test-wake-store-ack.sh && bash framework/tools/wake/test-wake-store-enqueue-race.sh && bash framework/tools/wake/test-wake-digest-hmac.sh && bash framework/tools/wake/test-wake-digest-quarantine.sh && bash framework/tools/wake/test-wake-detector.sh && bash framework/tools/wake/test-wake-fn-oracle.sh && bash framework/tools/wake/test-wake-reconcile.sh && bash framework/tools/wake/test-wake-beacon.sh && bash framework/tools/wake/test-wake-preimage.sh && bash framework/tools/wake/test-wake-install.sh && bash framework/tools/glpi/test-list-http-status.sh && bash framework/tools/orchestrator/test-board-roll.sh && bash framework/tools/woodpecker/test-ci-wait-exit-matrix.sh && bash framework/tools/_scripts/test-fleet-transport-check.sh && bash framework/tools/_scripts/test-brain-home-check.sh"
  },
  "dependencies": {
    "@mosaicstack/brain": "workspace:*",
@@ -147,11 +147,11 @@ describe('renderNorthStarMarkdown', () => {
        'standing_objectives:',
        '  - { id: NS-1, text: t }',
        'success_criteria:',
-        '  - { id: AC-NS-1, text: t, tier: 0 }',
+        '  - { id: AC-NS-1, text: t }',
        'workstreams:',
        '  - { id: A, title: t }',
        'goals:',
-        '  - { id: A1, title: t, phase: 1, tier: 0, priority: must-have, depends_on: [] }',
+        '  - { id: A1, title: t, phase: 1, priority: must-have, depends_on: [] }',
        'assumptions:',
        '  - { id: ASM-1, vetoable: true, text: t }',
        'spend:',
@@ -191,10 +191,6 @@ export interface NorthStarIdText {
  text: string;
 }

-export interface NorthStarCriterion extends NorthStarIdText {
-  tier: number;
-}
-
 export interface NorthStarWorkstream {
  id: string;
  title: string;
@@ -204,8 +200,6 @@ export interface NorthStarGoal {
  id: string;
  title: string;
  phase: number;
-  /** Capability tier this goal serves: 0 dogfood, 1 MVP, 2 full vision. Orthogonal to phase, which is build order. */
-  tier: number;
  priority: string;
  depends_on: string[];
 }
@@ -226,7 +220,7 @@ export interface NorthStar {
  mission: string;
  substrate: { note: string };
  standing_objectives: NorthStarIdText[];
-  success_criteria: NorthStarCriterion[];
+  success_criteria: NorthStarIdText[];
  workstreams: NorthStarWorkstream[];
  goals: NorthStarGoal[];
  assumptions: NorthStarAssumption[];
@@ -286,13 +280,9 @@ export function parseNorthStar(rawText: string): NorthStar {
    standing_objectives: requireArray(parsed.standing_objectives, 'standing_objectives').map(
      (row, i) => idText(row, 'standing_objectives', i),
    ),
-    success_criteria: requireArray(parsed.success_criteria, 'success_criteria').map((row, i) => {
-      const tier = (row as Record<string, unknown>)?.tier;
-      if (typeof tier !== 'number') {
-        throw new Error(`NORTH_STAR.yaml: success_criteria[${i}].tier must be a number.`);
-      }
-      return { ...idText(row, 'success_criteria', i), tier };
-    }),
+    success_criteria: requireArray(parsed.success_criteria, 'success_criteria').map((row, i) =>
+      idText(row, 'success_criteria', i),
+    ),
    workstreams: requireArray(parsed.workstreams, 'workstreams').map((row, i) => {
      const ws = row as Record<string, unknown>;
      return {
@@ -310,15 +300,10 @@ export function parseNorthStar(rawText: string): NorthStar {
      if (typeof phase !== 'number') {
        throw new Error(`NORTH_STAR.yaml: goals[${i}].phase must be a number.`);
      }
-      const tier = goal?.tier;
-      if (typeof tier !== 'number') {
-        throw new Error(`NORTH_STAR.yaml: goals[${i}].tier must be a number.`);
-      }
      return {
        id: requireString(goal?.id, `goals[${i}].id`),
        title: requireString(goal?.title, `goals[${i}].title`),
        phase,
-        tier,
        priority: requireString(goal?.priority, `goals[${i}].priority`),
        depends_on: dependsRaw.map((dep, j) => requireString(dep, `goals[${i}].depends_on[${j}]`)),
      };
@@ -364,7 +349,7 @@ function renderMarkdownTable(headers: string[], rows: string[][]): string[] {
 * Pure function of its input — same input always yields byte-identical output,
 * so the round-trip (YAML → render → write) is stable across runs. No clock, no
 * network, no CLI. Layout follows the repo's existing doctrine-doc convention
- * (heading, blockquote banner, then sections + tables, e.g. FLEET-DOCTRINE.md /
+ * (heading, blockquote banner, then sections + tables, e.g. north-star.md /
 * mission-control/BOARD.md).
 */
 export function renderNorthStarMarkdown(ns: NorthStar): string {
@@ -377,7 +362,7 @@ export function renderNorthStarMarkdown(ns: NorthStar): string {
    '> Projected deterministically from [`NORTH_STAR.yaml`](./NORTH_STAR.yaml) by the pure',
  );
  lines.push('> generator in `packages/mosaic/src/commands/fleet.ts` (`renderNorthStarMarkdown`).');
-  lines.push('> Edit the YAML, then regenerate. Self-contained Mosaic.');
+  lines.push('> Edit the YAML, then regenerate. Self-contained Mosaic — no Hermes dependency.');
  lines.push('');

  lines.push('## Mission');
@@ -400,7 +385,7 @@ export function renderNorthStarMarkdown(ns: NorthStar): string {
  lines.push('## Success criteria');
  lines.push('');
  for (const ac of ns.success_criteria) {
-    lines.push(`- **${ac.id}** (tier ${ac.tier}) — ${ac.text}`);
+    lines.push(`- **${ac.id}** — ${ac.text}`);
  }
  lines.push('');

@@ -418,11 +403,10 @@ export function renderNorthStarMarkdown(ns: NorthStar): string {
  lines.push('');
  lines.push(
    ...renderMarkdownTable(
-      ['id', 'title', 'tier', 'phase', 'priority', 'depends_on'],
+      ['id', 'title', 'phase', 'priority', 'depends_on'],
      ns.goals.map((goal) => [
        goal.id,
        goal.title,
-        String(goal.tier),
        String(goal.phase),
        goal.priority,
        goal.depends_on.length > 0 ? goal.depends_on.join(', ') : '—',
@@ -922,8 +922,8 @@ describe('fleet operator documentation', (): void => {
    );
    expect(
      surfaces.filter((surface): boolean => surface.category === 'InlineLiteral'),
-    ).toHaveLength(882);
-    expect(surfaces).toHaveLength(906);
+    ).toHaveLength(863);
+    expect(surfaces).toHaveLength(887);

    const rosterSource = await readFile(join(fleetDocs, 'examples', 'roster-v2.yaml'), 'utf8');
    const auxiliary: CodeSurface = {
@@ -1,79 +0,0 @@
-#!/usr/bin/env python3
-"""D29 contracts: no lease is a no-op success; half-provisioned still fails closed."""
-
-from __future__ import annotations
-
-import importlib.util
-import unittest
-from pathlib import Path
-
-TOOLS = Path(__file__).parents[2] / "framework/tools/lease-broker"
-REVOKE_PATH = TOOLS / "revoke-lease.py"
-
-_spec = importlib.util.spec_from_file_location("revoke_lease", REVOKE_PATH)
-assert _spec and _spec.loader
-revoke_lease = importlib.util.module_from_spec(_spec)
-import sys as _sys
-
-_sys.path.insert(0, str(TOOLS))
-_spec.loader.exec_module(revoke_lease)
-
-ARGV = ["--runtime", "claude", "--reason", "pre-compact"]
-VALID_SESSION = "a" * 64
-
-
-def _explode(*_args, **_kwargs):
-    raise AssertionError("broker must not be contacted when no lease is held")
-
-
-class RevokeWithoutLease(unittest.TestCase):
-    def test_no_lease_variables_is_a_noop_success(self) -> None:
-        """The D29 case: bare-launched session, nothing to revoke, must not deny."""
-        self.assertEqual(
-            revoke_lease.main(ARGV, environ={}, request=_explode),
-            0,
-        )
-
-    def test_no_lease_does_not_contact_the_broker(self) -> None:
-        """A no-op must be vacuous: no socket, no generation bump, no transport."""
-        revoke_lease.main(ARGV, environ={"HOME": "/nonexistent"}, request=_explode)
-
-    def test_socket_without_session_still_fails_closed(self) -> None:
-        """Half-provisioned is misconfiguration, not absence. Fail-closed stands."""
-        self.assertEqual(
-            revoke_lease.main(
-                ARGV,
-                environ={"MOSAIC_LEASE_BROKER_SOCKET": "/tmp/nonexistent.sock"},
-                request=_explode,
-            ),
-            2,
-        )
-
-    def test_session_without_socket_still_fails_closed(self) -> None:
-        """The mirror case, so the guard cannot be satisfied by either half alone."""
-        self.assertEqual(
-            revoke_lease.main(
-                ARGV,
-                environ={"MOSAIC_LEASE_SESSION_ID": VALID_SESSION},
-                request=_explode,
-            ),
-            2,
-        )
-
-    def test_empty_string_counts_as_absent(self) -> None:
-        """An exported-but-empty variable is not a lease."""
-        self.assertEqual(
-            revoke_lease.main(
-                ARGV,
-                environ={
-                    "MOSAIC_LEASE_BROKER_SOCKET": "",
-                    "MOSAIC_LEASE_SESSION_ID": "",
-                },
-                request=_explode,
-            ),
-            0,
-        )
-
-
-if __name__ == "__main__":
-    unittest.main()
@@ -337,13 +337,7 @@ class ExecutableEntrypointTest(unittest.TestCase):
            runpy.run_path(str(TOOLS_DIR / "launch-runtime.py"), run_name="__main__")
        self.assertEqual(raised.exception.code, 64)

-    def test_revoker_entrypoint_noops_when_identity_environment_is_absent(self) -> None:
-        # D29 supersession. This assertion previously pinned rc=2. Absent identity
-        # means no lease was ever held, so there is nothing to revoke and the correct
-        # result is no-op success. The old pin was written in e4d7d45 (WI-3), the same
-        # commit that shipped launch-runtime.py's lease-var provisioning, on the
-        # assumption that an envless revoker was unreachable. D29 falsified that in
-        # production. Behavioural pins live in src/lease-broker/revoke_noop_unittest.py.
+    def test_revoker_entrypoint_denies_when_identity_environment_is_absent(self) -> None:
        with patch.object(
            sys,
            "argv",
@@ -358,42 +352,9 @@ class ExecutableEntrypointTest(unittest.TestCase):
            io.StringIO()
        ), self.assertRaises(SystemExit) as raised:
            runpy.run_path(str(TOOLS_DIR / "revoke-lease.py"), run_name="__main__")
-        self.assertEqual(raised.exception.code, 0)
-
-    def test_revoker_entrypoint_denies_when_identity_environment_is_half_provisioned(
-        self,
-    ) -> None:
-        # The no-op above is reachable ONLY when identity is TOTALLY absent. A
-        # half-provisioned environment is a machinery-present failure and must still
-        # fail closed. main() already pins this; the entrypoint did not, and the
-        # entrypoint is what the runtime extension actually spawns.
-        half_provisioned = (
-            {"MOSAIC_LEASE_BROKER_SOCKET": "/run/test/broker.sock"},
-            {"MOSAIC_LEASE_SESSION_ID": "d" * 64},
-        )
-        for environment in half_provisioned:
-            with self.subTest(environment=environment), patch.object(
-                sys,
-                "argv",
-                [
-                    str(TOOLS_DIR / "revoke-lease.py"),
-                    "--runtime",
-                    "claude",
-                    "--reason",
-                    "pre-compact",
-                ],
-            ), patch.dict(os.environ, environment, clear=True), redirect_stderr(
-                io.StringIO()
-            ), self.assertRaises(SystemExit) as raised:
-                runpy.run_path(str(TOOLS_DIR / "revoke-lease.py"), run_name="__main__")
-            self.assertEqual(raised.exception.code, 2)
+        self.assertEqual(raised.exception.code, 2)

    def test_gate_entrypoint_denies_when_identity_environment_is_absent(self) -> None:
-        # Deliberately NOT changed alongside its revoker twin above. The asymmetry is
-        # intentional: the gate's deny-on-absent is the authorization path and is
-        # load-bearing, so absent identity must fail closed here. The revoker's rc=2
-        # was inert in the same case (no session id means no broker call is possible),
-        # which is why only the revoker moved under D29. Do not "restore symmetry".
        class Stdin:
            buffer = io.BytesIO(b'{"tool_name":"Bash"}')

@@ -742,11 +703,8 @@ class LeaseRevocationTest(unittest.TestCase):
            "MOSAIC_RUNTIME_GENERATION": "1",
        }
        malformed_session = {**good, "MOSAIC_LEASE_SESSION_ID": "not-a-session"}
-        # D29 exemption: the `({}, ...)` case was removed from this list. An empty
-        # environment is absence-of-lease, not an identity/reply/transport failure, and
-        # its correct result is no-op success (pinned in revoke_noop_unittest.py). The
-        # five cases below are all machinery-present failures and stay fail-closed.
        cases = [
+            ({}, lambda *_args: {"ok": True, "state": "UNVERIFIED"}),
            (malformed_session, lambda *_args: {"ok": True, "state": "UNVERIFIED"}),
            (good, lambda *_args: {"ok": False, "state": "UNVERIFIED"}),
            (good, lambda *_args: {"ok": True, "state": "VERIFIED"}),
@@ -1,152 +0,0 @@
-/**
- * setupPath profile management (issue #1327, MOSAIC-IMPROVEMENTS 4c / D25).
- *
- * The profile append used to be guarded on the binDir value it was about to
- * write, which is blind to accumulation across different Mosaic homes: every
- * wizard run against a fresh temp home appended a permanent block to the
- * operator's real shell profile (1,061 measured appends on sb-it-1-dt).
- *
- * Arms below map to the requirements:
- *   S1 sentinel-managed block, rewritten in place
- *   S2 a non-default target home never touches the operator profile
- *   S3 byte-identical profile across repeated runs
- *   S4 legacy unmarked `# Mosaic` blocks collapse into the managed block
- *   S5 the Windows ($env:Path) arm shares the same block logic
- */
-
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
-import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, rmSync } from 'node:fs';
-import { join } from 'node:path';
-import { tmpdir, homedir } from 'node:os';
-
-let profilePathMock: string | null = null;
-
-vi.mock('../platform/detect.js', () => ({
-  getShellProfilePath: (): string | null => profilePathMock,
-}));
-
-import { setupPath, managedBlockFor, stripLegacyPathBlocks } from './finalize.js';
-
-// The real resolved default on this host. Tests use it as the comparator a
-// non-default home must fail against, exactly as the wizard would.
-const REAL_DEFAULT_HOME = join(homedir(), '.config', 'mosaic');
-
-function tempHome(prefix: string): string {
-  const dir = join(tmpdir(), prefix);
-  mkdirSync(join(dir, 'bin'), { recursive: true });
-  return dir;
-}
-
-describe('setupPath profile management (#1327)', () => {
-  let workDir: string;
-  let profileFile: string;
-  let defaultLikeHome: string;
-  let otherHome: string;
-  const baseline = '# existing operator content\nexport EDITOR=vim\n';
-
-  beforeEach(() => {
-    workDir = mkdtempSync(join(tmpdir(), 'setuppath-spec-'));
-    profileFile = join(workDir, '.bashrc');
-    writeFileSync(profileFile, baseline, 'utf-8');
-    profilePathMock = profileFile;
-    defaultLikeHome = tempHome(join(workDir, 'home-a', '.config', 'mosaic'));
-    otherHome = tempHome(join(workDir, 'home-b', '.config', 'mosaic'));
-  });
-
-  afterEach(() => {
-    profilePathMock = null;
-    rmSync(workDir, { recursive: true, force: true });
-  });
-
-  // S2 — the arm that MUST fail against the pre-fix code: a home that is not
-  // the resolved default may not modify the operator profile at all.
-  it('does not touch the operator profile when the target home is not the resolved default', () => {
-    const action = setupPath(otherHome, REAL_DEFAULT_HOME);
-    expect(action).toBe('skipped');
-    expect(readFileSync(profileFile, 'utf-8')).toBe(baseline);
-  });
-
-  it('returns skipped when no shell profile can be resolved', () => {
-    profilePathMock = null;
-    const action = setupPath(defaultLikeHome, defaultLikeHome);
-    expect(action).toBe('skipped');
-  });
-
-  // S1 + S3 — two distinct homes (each run as the resolved default in turn,
-  // the shape of two legitimate installs against one operator profile) and
-  // repeated runs against the same home both leave exactly one block.
-  it('leaves exactly one managed block after runs against two distinct homes', () => {
-    const first = setupPath(defaultLikeHome, defaultLikeHome);
-    expect(first).toBe('added');
-
-    const second = setupPath(otherHome, otherHome);
-    expect(second).toBe('added');
-
-    const content = readFileSync(profileFile, 'utf-8');
-    const beginCount = content.split('# >>> mosaic begin >>>').length - 1;
-    const endCount = content.split('# <<< mosaic end <<<').length - 1;
-    expect(beginCount).toBe(1);
-    expect(endCount).toBe(1);
-    expect(content).toContain(join(otherHome, 'bin'));
-    expect(content).toContain(baseline);
-  });
-
-  it('is byte-identical across repeated runs against the same home', () => {
-    setupPath(defaultLikeHome, defaultLikeHome);
-    const afterFirst = readFileSync(profileFile, 'utf-8');
-
-    const again = setupPath(defaultLikeHome, defaultLikeHome);
-    expect(again).toBe('already');
-    expect(readFileSync(profileFile, 'utf-8')).toBe(afterFirst);
-  });
-
-  // S4 — pre-existing unmarked blocks from the old append logic collapse
-  // into the single managed block instead of accumulating beside it.
-  it('collapses legacy unmarked # Mosaic blocks into the managed block', () => {
-    const legacy =
-      '# existing operator content\n' +
-      '# Mosaic\n' +
-      'export PATH="/tmp/mosaic-dead-wizard-1/bin:$PATH"\n' +
-      'export EDITOR=vim\n' +
-      '# Mosaic\n' +
-      'export PATH="/tmp/mosaic-dead-wizard-2/bin:$PATH"\n';
-    writeFileSync(profileFile, legacy, 'utf-8');
-
-    const action = setupPath(defaultLikeHome, defaultLikeHome);
-    expect(action).toBe('added');
-
-    const content = readFileSync(profileFile, 'utf-8');
-    expect(content).not.toContain('/tmp/mosaic-dead-wizard-1/bin');
-    expect(content).not.toContain('/tmp/mosaic-dead-wizard-2/bin');
-    expect(content).toContain('export EDITOR=vim');
-    expect(content.split('# >>> mosaic begin >>>').length - 1).toBe(1);
-    expect(content).toContain(join(defaultLikeHome, 'bin'));
-  });
-});
-
-describe('managed block helpers (#1327)', () => {
-  // S5 — the Windows arm shares markers and shape with the POSIX arm.
-  it('builds the $env:Path variant inside the same markers', () => {
-    const block = managedBlockFor('C:\\Users\\op\\.config\\mosaic\\bin', true);
-    expect(block).toContain('# >>> mosaic begin >>>');
-    expect(block).toContain('# <<< mosaic end <<<');
-    expect(block).toContain('$env:Path = "C:\\Users\\op\\.config\\mosaic\\bin;$env:Path"');
-  });
-
-  it('builds the POSIX export variant inside the same markers', () => {
-    const block = managedBlockFor('/home/op/.config/mosaic/bin', false);
-    expect(block).toContain('# >>> mosaic begin >>>');
-    expect(block).toContain('export PATH="/home/op/.config/mosaic/bin:$PATH"');
-    expect(block).toContain('# <<< mosaic end <<<');
-  });
-
-  it('strips legacy $env:Path pairs on the Windows arm', () => {
-    const legacy =
-      '# Mosaic\n$env:Path = "C:\\tmp\\dead\\bin;$env:Path"\n' +
-      '# Mosaic\n$env:Path = "C:\\tmp\\dead2\\bin;$env:Path"\n' +
-      'Write-Host hi\n';
-    const stripped = stripLegacyPathBlocks(legacy, true);
-    expect(stripped).not.toContain('C:\\tmp\\dead');
-    expect(stripped).toContain('Write-Host hi');
-  });
-});
@@ -1,12 +1,11 @@
 import { spawnSync } from 'node:child_process';
-import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, readFileSync, appendFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { platform } from 'node:os';
 import type { WizardPrompter } from '../prompter/interface.js';
 import type { ConfigService } from '../config/config-service.js';
 import type { WizardState } from '../types.js';
 import { getShellProfilePath } from '../platform/detect.js';
-import { DEFAULT_MOSAIC_HOME } from '../constants.js';
 import { ManifestError } from '../framework/manifest.js';
 import {
  getDefaultSkillPaths,
@@ -145,87 +144,32 @@ function runDoctor(mosaicHome: string): DoctorResult {

 type PathAction = 'already' | 'added' | 'skipped';

-const PATH_BLOCK_BEGIN = '# >>> mosaic begin >>>';
-const PATH_BLOCK_END = '# <<< mosaic end <<<';
-const PATH_BLOCK_NOTE = '# Managed by the Mosaic installer; this block is rewritten on install.';
-
-/**
- * The managed PATH block written into the operator's shell profile.
- *
- * The block is delimited by begin/end sentinels so any number of installs,
- * against any homes, collapse to exactly one block: the writer replaces the
- * region between the sentinels instead of appending a second copy (#1327).
- */
-export function managedBlockFor(binDir: string, isWindows: boolean): string {
-  const exportLine = isWindows
-    ? `$env:Path = "${binDir};$env:Path"`
-    : `export PATH="${binDir}:$PATH"`;
-  return `${PATH_BLOCK_BEGIN}\n${PATH_BLOCK_NOTE}\n${exportLine}\n${PATH_BLOCK_END}\n`;
-}
-
-/**
- * Remove legacy unmarked `# Mosaic` PATH pairs appended by pre-#1327
- * installs. Only the exact two-line shape this installer used to write is
- * removed; any other `# Mosaic` comment line is left alone.
- */
-export function stripLegacyPathBlocks(content: string, isWindows: boolean): string {
-  const legacyExport = isWindows ? /^\$env:Path = ".*;\$env:Path"$/ : /^export PATH=".*:\$PATH"$/;
-  const lines = content.split('\n');
-  const kept: string[] = [];
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i] ?? '';
-    const next = i + 1 < lines.length ? lines[i + 1] : undefined;
-    if (line === '# Mosaic' && next !== undefined && legacyExport.test(next)) {
-      i += 1;
-      continue;
-    }
-    kept.push(line);
-  }
-  return kept.join('\n');
-}
-
-/** Drop the region between the managed-block sentinels, first occurrence. */
-function withoutManagedBlock(content: string): string {
-  const beginIdx = content.indexOf(PATH_BLOCK_BEGIN);
-  if (beginIdx < 0) return content;
-  const endIdx = content.indexOf(PATH_BLOCK_END, beginIdx);
-  if (endIdx < 0) return content;
-  return content.slice(0, beginIdx) + content.slice(endIdx + PATH_BLOCK_END.length);
-}
-
-export function setupPath(mosaicHome: string, resolvedDefaultHome: string): PathAction {
-  // Never write outside the home under test (#1327 S2): a wizard run against
-  // a non-default home (test harnesses, throwaway installs) must not mutate
-  // the operator's real shell profile.
-  if (mosaicHome !== resolvedDefaultHome) {
-    return 'skipped';
-  }
-
+function setupPath(mosaicHome: string, _p: WizardPrompter): PathAction {
  const binDir = join(mosaicHome, 'bin');
+  const currentPath = process.env['PATH'] ?? '';
+
+  if (currentPath.includes(binDir)) {
+    return 'already';
+  }
+
  const profilePath = getShellProfilePath();
  if (!profilePath) return 'skipped';

  const isWindows = platform() === 'win32';
-  const block = managedBlockFor(binDir, isWindows);
+  const exportLine = isWindows
+    ? `\n# Mosaic\n$env:Path = "${binDir};$env:Path"\n`
+    : `\n# Mosaic\nexport PATH="${binDir}:$PATH"\n`;

-  let content = '';
+  // Check if already in profile
  if (existsSync(profilePath)) {
-    content = readFileSync(profilePath, 'utf-8');
-  }
-
-  // Migration (#1327 S4): legacy unmarked blocks collapse into the managed
-  // block, and an existing managed block is rewritten in place rather than
-  // appended beside itself (S1/S3).
-  const base = stripLegacyPathBlocks(withoutManagedBlock(content), isWindows);
-  const trimmed = base.replace(/\n+$/, '');
-  const next = trimmed.length === 0 ? block : `${trimmed}\n${block}`;
-
-  if (next === content) {
-    return 'already';
+    const content = readFileSync(profilePath, 'utf-8');
+    if (content.includes(binDir)) {
+      return 'already';
+    }
  }

  try {
-    writeFileSync(profilePath, next, 'utf-8');
+    appendFileSync(profilePath, exportLine, 'utf-8');
    return 'added';
  } catch {
    return 'skipped';
@@ -342,7 +286,7 @@ export async function finalizeStage(
  }

  // 7. PATH setup
-  const pathAction = setupPath(state.mosaicHome, DEFAULT_MOSAIC_HOME);
+  const pathAction = setupPath(state.mosaicHome, p);

  let summaryShown = false;
  const showSummary = () => {
@@ -1,73 +0,0 @@
-# 2026-08-17 — Fleet identity, comms delivery, and the ~/.mosaic tree (continuation record)
-
-> **Status:** active continuation record | **Owner:** Jason (rulings) / fleet (delivery) | **Created:** 2026-08-17, sb-it-1-dt session with Jarvis (jarvis-brain)
-> **Audience:** the homelab agents continuing this effort tonight. Read this whole file before acting; it supersedes nothing but preserves structure and decisions that must not be lost.
-
---
-
-## Why this exists
-
-A session on sb-it-1-dt (2026-08-17) produced three architecture decisions (two awaiting Jason's ruling), one incident postmortem (#1295), interim guardrail edits in the user-owned `~/.mosaic/` contract tree, and one new tool (`ensure-watcher.sh`). The work spans jarvis-brain (P0, not retained) and this repo (the product). **This file is the stack-side anchor so continuation does not depend on jarvis-brain surviving.**
-
-## 1. The `~/.mosaic` tree model — as-built, preserve this structure
-
-Three-tree split (this is design intent, not accident; keep it through all framework work):
-
-| Tree                | Owner     | Rule                                                                                                          |
-| ------------------- | --------- | ------------------------------------------------------------------------------------------------------------- |
-| `~/.config/mosaic/` | framework | upgrade-managed templates; NEVER user-edited; `mosaic upgrade` may overwrite                                  |
-| `~/.mosaic/`        | user      | working contracts, guides, fleet agents; upgrades reconcile with **deny-wins** (user edits never overwritten) |
-| repo satellites     | repos     | bootstrapped per-repo `.mosaic/` state                                                                        |
-
-As-built inventory of `~/.mosaic` on sb-it-1-dt (2026-08-17):
-
- **Contract core:** `CONSTITUTION.md` (L0 law), `AGENTS.md` (dispatcher + guide router + Fleet Comms Watcher requirement), `SOUL.md` (generic base for ALL fleet agents, zero persona — includes the new **Fleet Boundaries** section), `STANDARDS.md` (universal standards — includes new **session identity** + **comms watcher hygiene** sections), `SYSTEM.md` (pure communication contract, byte-identical to jarvis-brain's prompt-testing `sr_opus_5_system_prompt.md`), `USER.md`, `TOOLS.md`.
- **`guides/`** — user-owned working copies (E2E-DELIVERY, ORCHESTRATOR(+PROTOCOL,+LEARNINGS), WAKE-DOCTRINE, VAULT-SECRETS, etc.).
- **`fleet/agents/`** — the per-agent store (this is MOSAIC-D-002's substrate, already in use):
-  - real agent dirs: `fargo/`, `orchestrator/`, `probe/`, `vision/`, `weekly-update/` — shape: `profile.json` (harness/account/overlay pointer) + `overlay.json` + `SOUL.md` (persona) + `scratch/` `work/` `notes/` subdirs (hygiene rules in root SOUL.md)
-  - `*.env.generated` launch overlays: `luna` `sol` `terra` (carry `MOSAIC_AGENT_NAME`, `_CLASS`, `_RUNTIME`, `_MODEL`, `_REASONING`, `_TOOL_POLICY`) — these are the mosaic-fleet seat launch envs; `inbox.env`, `itops.env` also present
-  - `probe/` is the validated layout proof: auth-bundle symlink chain, per-agent sessions, plugin-store symlink (from 2026-08-07)
- **`auth/`, `config/`, `memory/`, `plugins/`, `skills/`, `skills-local/`** — per-tree copies/links for runtime isolation.
- Related but outside the tree: watcher units at `~/.config/systemd/user/<agent>-comms-watcher.service`; watcher seen-state at `~/.local/state/comms-watcher-<agent>/`.
-
-## 2. Decisions register (2026-08-17 session)
-
-Full strict records live in jarvis-brain `docs/decisions/mosaic-stack/` (render on its dashboard); both are **Pending Jason's ruling**. Summaries so the content survives P0:
-
- **MOSAIC-D-001 — SYSTEM.md as canonical harness system prompt.** Static core (Constitution+AGENTS+USER+overlays) in one tracked file; launcher renders dynamic tail (mission/PRD/fleet/persona). Delivery: `--append-system-prompt` (repeatable) for pi/claude; symlinked core file for codex (`$CODEX_HOME/instructions.md`) and opencode (`AGENTS.md`); their dynamic tail via initial prompt (needs live verification). Static-first order is the cache win. `SYSTEM.md` in `~/.mosaic` today is the communication-contract file — D-001's SYSTEM.md is the broader composition; naming to reconcile at implementation.
- **MOSAIC-D-002 — per-agent harness homes + mechanical profiles.** Launch with targeted config-dir env vars (e.g. `PI_CODING_AGENT_DIR=~/.mosaic/fleet/agents/<name>/pi`), NOT literal HOME. SOUL.md identity mechanically generated from roster (single writer; kills the hand-copy drift measured in `agents/vision/SOUL.md` on jarvis-brain: declared Jarvis, answered Vision). Composes: SYSTEM core → per-agent SOUL → dynamic tail. `MOSAIC_AGENT_NAME` stays load-bearing for comms.
- **Comms delivery tooling belongs in the STACK framework, not jarvis-brain** (decided in discussion; supersedes the interim placement). jarvis-brain keeps only the transport _data_ (`comms/` tree) while it lives. Agents launch from their own repos (terra from `~/src/stack` etc.) — delivery is transport-repo-relative, so this works; but every installed watcher unit's ExecStart currently points into `~/src/jarvis-brain/scripts/` — that dependency is the P0 trap to remove. Migration = move tools + regenerate units, in one step.
- **Watcher provisioning is instantiation duty, never running-agent duty.** Interim landed as jarvis-brain `scripts/comms/ensure-watcher.sh` (idempotent ensure + `--status` boot check + interim identity warnings: missing target session, pane `MOSAIC_AGENT_NAME` mismatch via `/proc/<child>/environ`, bare-runtime NOTE). Framework move: fold into `mosaic agent --new` + fleet launch + `mosaic doctor` drift check.
- **Prose guardrails landed (interim fences until mechanical fixes):** `~/.mosaic/SOUL.md` Fleet Boundaries (wrong-session tripwire; comms ownership; cross-agent investigation requires tasking) · `STANDARDS.md` session identity + watcher hygiene · `AGENTS.md` Fleet Comms Watcher requirement (P0-interim script path marked transitional).
-
-## 3. Incident → #1295 (already tracked here)
-
-`https://git.mosaicstack.dev/mosaicstack/stack/issues/1295` — docs-seat incident: cwd-keyed session files served three lives (dev chat → goals seat → 22 watcher injections into a wedged process); name-based watcher delivery with no identity verification; wedge after pi 0.84.1→0.84.2 update passes every liveness instrument. Proposed fixes enumerated there; provisioning follow-up in comment ID 23027.
-
-## 4. Open work queue (suggested sequence)
-
-1. **Comms tooling migration PR** (lane `next`): move `comms-watcher.sh`, `install-watcher.sh`, `ensure-watcher.sh` into the framework tree → deploy `~/.config/mosaic/tools/comms/`; regenerate existing units' ExecStart to framework paths (one-command sweep); keep `COMMS_WATCH_REPO` per-host config (points at a brain checkout until the queue transport lands). Reference: jarvis-brain commit `701c353b1`.
-2. **Ensure-on-instantiation**: `mosaic agent --new` / fleet launch call ensure semantics; `mosaic doctor` gains the drift check (`--status --all` semantics + `fred`'s hand-written unit as the known drift case; also note daphne/docs/happy/pepper/sanity/tiny/fargo currently have no watcher — cover or consciously exempt).
-3. **MOSAIC-D-002 implementation** (after ruling): per-agent homes via targeted env vars; roster-generated SOUL.md single-writer; extend the existing `*.env.generated` pattern; launch ledger keeps `config_home` audit.
-4. **MOSAIC-D-001 implementation** (after ruling): SYSTEM.md sourcing + per-harness delivery + `compose-contract` becomes render-core+tail with drift check; bench cache-ordering before/after (jarvis-brain `domains/software-dev/mosaic-stack/prompt-testing` has the bench).
-5. **Queue transport + forced separation** (longer term): supersedes watcher path; identity-verification and wedge-detection remain valid regardless of transport.
-6. **Docs inheritance**: jarvis-brain AGENTS.md's durable comms guidance (E7 pi-glyph delivery gotchas, capture-pane rules, comms protocol) must be inherited into stack docs before P0 retirement.
-
-## 5. Rules for tonight's agents
-
- Lane: **`next`** only; nothing to `main` without Jason (standing ruling).
- Attribution caveat #1280: Gitea/git identity from this host may misattribute (issue #1295 showed as created by `@mos-dt-0`); prefer per-invocation `git -c user.name=<seat>` and verify what the remote recorded.
- Do not delete `sb-it-1-dt:docs]` (untracked file at repo root) — it is cited fleet-wide as incident evidence.
- Edit user contracts in `~/.mosaic/`, never the templates in `~/.config/mosaic/`.
- Do not restart other fleet seats unilaterally (goals/scrappy/sanity restart decisions are fred's/Jason's per the docs-seat report).
-
-## 6. Artifact map
-
-| Artifact                                                           | Where                                                                                                                    |
-| ------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------ |
-| Decision records D-001/D-002 (strict, pending ruling)              | jarvis-brain `docs/decisions/mosaic-stack/2026-08-17_mosaic-d-00{1,2}_*.md`                                              |
-| Incident issue + provisioning comment                              | stack #1295 + comment 23027                                                                                              |
-| ensure-watcher.sh (reference implementation)                       | jarvis-brain `scripts/comms/ensure-watcher.sh` (commit `701c353b1`)                                                      |
-| Bench for prompt A/B (pi, thinking levels, footer-token semantics) | jarvis-brain `domains/software-dev/mosaic-stack/prompt-testing/` + `docs/reports/2026-08-17-prompt-testing-glm-bench.md` |
-| Launcher inspection basis                                          | `@mosaicstack/mosaic` 0.0.49 `dist/commands/launch.js` (composeContract / ensureRuntimeConfig / harness-home isolation)  |
-| Guardrail edits                                                    | `~/.mosaic/{SOUL,AGENTS,STANDARDS}.md` on sb-it-1-dt (2026-08-17 16:53–17:04)                                            |