diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8a7107a..7673d52 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -315,3 +315,96 @@ jobs:
         env:
           RUTSTER_ALLINONE_IMAGE: rutster-allinone:smoke
           RUTSTER_ALLINONE_PORT: "18443"
+
+  # deploy-B §9 compose smoke — T2 four-service compose stack boots + all
+  # services healthy + Caddy TLS /healthz + /readyz. Lighter than the
+  # all-in-one smoke (which already proved the WS path) — its job is the
+  # orchestrator shape + the network_mode: "service:engine" brain->engine tap
+  # posture across the four services.
+  smoke-compose:
+    name: smoke (T2 compose four-service)
+    runs-on: ubuntu-latest
+    needs: [image-build]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      # Rebuild all three first-party images from the warm GHA cache
+      # populated by image-build. Valkey is upstream (no rebuild needed).
+      - name: Rebuild rutster-edge:smoke
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: deploy/Dockerfile
+          target: rutster-edge
+          tags: rutster-edge:smoke
+          push: false
+          load: true
+          cache-from: type=gha,scope=rutster-edge
+
+      - name: Rebuild rutster-engine:smoke
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: deploy/Dockerfile
+          target: rutster-engine
+          tags: rutster-engine:smoke
+          push: false
+          load: true
+          cache-from: type=gha,scope=rutster-engine
+
+      - name: Rebuild rutster-brain:smoke
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: deploy/Dockerfile
+          target: rutster-brain
+          tags: rutster-brain:smoke
+          push: false
+          load: true
+          cache-from: type=gha,scope=rutster-brain
+
+      # jq is pre-installed on ubuntu-latest GHA runners.
+      - name: Run compose smoke (deploy/smoke/compose_smoke.sh)
+        run: bash deploy/smoke/compose_smoke.sh
+        env:
+          RUTSTER_IMAGES_TAG: smoke
+
+  # deploy-B §9 + spec §3.2 + TLS brief §5 risk 1: Caddy config-reload
+  # during a live simulated call, asserting zero frame drops. The
+  # stream_close_delay 24h mitigation in deploy/Caddyfile is the load-
+  # bearing fixture; caddy #6420 / #7222 are open upstream bugs — the
+  # smoke is "don't trust untested" made CI-regressed.
+  smoke-reload:
+    name: smoke (caddy reload during live call, zero drops)
+    runs-on: ubuntu-latest
+    needs: [smoke]   # reuses the rutster-allinone:smoke image, warm cache
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python (stdlib-only; no pip)
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.x"
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Rebuild rutster-allinone:smoke (warm cache)
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: deploy/Dockerfile
+          target: rutster-allinone
+          tags: rutster-allinone:smoke
+          push: false
+          load: true
+          cache-from: type=gha,scope=rutster-allinone
+
+      - name: Run reload-during-call smoke (deploy/smoke/reload_during_call.py)
+        run: python3 deploy/smoke/reload_during_call.py
+        env:
+          RUTSTER_ALLINONE_IMAGE: rutster-allinone:smoke
+          RUTSTER_ALLINONE_PORT: "18444"