diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9187a76..7673d52 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -168,3 +168,243 @@ jobs:
           RUTSTER_TWILIO_TEST_TO: ${{ secrets.TWILIO_TEST_TO }}
           RUTSTER_TWILIO_TEST_FROM: ${{ secrets.TWILIO_TEST_FROM }}
         run: cargo test --all --features=twilio-live -- --include-ignored
+
+  # deploy-B §6.1 image-build — builds all four first-party images via
+  # `docker buildx build --target` against deploy/Dockerfile. Runs AFTER the
+  # fmt/clippy/test/deny/sim-bench matrix gates: the smoke job downstream
+  # depends on these built images.
+  #
+  # Single builder invocation that builds all four --targets would be ideal
+  # (shared cache), but buildx's `--target` is one-per-invocation — so four
+  # build steps share the GHA cache via `cache-from/cache-to: type=gha`.
+  # Warm caches take image-build from ~6 min to ~90s.
+  image-build:
+    name: image-build (4 images)
+    runs-on: ubuntu-latest
+    needs: [fmt, clippy, test, deny, sim-bench]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      # libopus-dev — the headers the `opus` crate's build.rs expects.
+      # (The builder stage of deploy/Dockerfile already installs this
+      # inside the build image; this is a belt-and-braces step so a local
+      # buildx cache root has the headers if the cache misses.)
+      - name: Build-time host deps (belt-and-braces)
+        run: sudo apt-get update && sudo apt-get install -y libopus-dev
+
+      - name: Build rutster-engine image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: deploy/Dockerfile
+          target: rutster-engine
+          tags: rutster-engine:ci-${{ github.sha }}
+          push: false
+          load: true
+          cache-from: type=gha,scope=rutster-engine
+          cache-to: type=gha,mode=max,scope=rutster-engine
+
+      - name: Build rutster-brain image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: deploy/Dockerfile
+          target: rutster-brain
+          tags: rutster-brain:ci-${{ github.sha }}
+          push: false
+          load: true
+          cache-from: type=gha,scope=rutster-brain
+          cache-to: type=gha,mode=max,scope=rutster-brain
+
+      - name: Build rutster-edge image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: deploy/Dockerfile
+          target: rutster-edge
+          tags: rutster-edge:ci-${{ github.sha }}
+          push: false
+          load: true
+          cache-from: type=gha,scope=rutster-edge
+          cache-to: type=gha,mode=max,scope=rutster-edge
+
+      - name: Build rutster-allinone image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: deploy/Dockerfile
+          target: rutster-allinone
+          tags: rutster-allinone:ci-${{ github.sha }}
+          push: false
+          load: true
+          cache-from: type=gha,scope=rutster-allinone
+          cache-to: type=gha,mode=max,scope=rutster-allinone
+
+      - name: Smoke-tag the images for the downstream smoke job
+        # The smoke job references images as `:smoke`
+        # (deploy/smoke/compose_smoke.sh tags images with the
+        # RUTSTER_IMAGES_TAG env). Tag the freshly-built :ci-<sha> images as
+        # :smoke too, so the smoke job picks them up.
+        run: |
+          for img in rutster-engine rutster-brain rutster-edge rutster-allinone; do
+            docker tag "${img}:ci-${{ github.sha }}" "${img}:smoke"
+          done
+          docker images | grep rutster
+
+      - name: caddy validate
+        # Validate the Caddyfile inside the freshly-built rutster-edge image.
+        # Cheap regression against malformed Caddyfile (the local `caddy
+        # validate` in Task 3 is optional; this one is mandatory in CI).
+        run: |
+          docker run --rm \
+            -e RUTSTER_DOMAIN=pbx.example.com \
+            -e RUTSTER_ACME_EMAIL=test@example.com \
+            -v "$PWD/deploy/Caddyfile:/etc/caddy/Caddyfile:ro" \
+            rutster-edge:smoke \
+            caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile
+
+  # deploy-B §9 all-in-one smoke — boots rutster-allinone with
+  # RUTSTER_LOCAL_CERTS=true (Caddy internal CA, no ACME in CI), extracts
+  # the CA root cert from /data, opens wss:// to /twilio/media-stream,
+  # sends Twilio's connected+start handshake frames, streams 200 PCM-zeroed
+  # frames at 20ms cadence, asserts the engine replies with at least one
+  # text frame through the real edge->FOB WS path. Spec §9 acceptance:
+  #   * "boots"
+  #   * "Caddy terminates TLS via its internal CA (no ACME in CI)"
+  #   * "full sim call through the real edge->FOB WS path"
+  # The reload-during-call smoke (Task 9 below) and compose smoke (Task 9)
+  # are separate jobs that depend on this one.
+  smoke:
+    name: smoke (all-in-one TLS sim call)
+    runs-on: ubuntu-latest
+    needs: [image-build]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python (stdlib-only; no pip)
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.x"
+
+      # Pull the freshly-built image from the image-build job. Since
+      # jobs run on separate runners + `push: false` in image-build means
+      # the image isn't in any registry, the smoke job rebuilds from the
+      # GHA cache (warm — image-build populated it). This adds ~30s vs
+      # an image-download artifact, but avoids the registry-auth + image-
+      # save/load plumbing.
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Rebuild rutster-allinone:smoke (warm cache from image-build)
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: deploy/Dockerfile
+          target: rutster-allinone
+          tags: rutster-allinone:smoke
+          push: false
+          load: true
+          cache-from: type=gha,scope=rutster-allinone
+
+      - name: Run all-in-one smoke (deploy/smoke/allinone_smoke.py)
+        run: |
+          python3 deploy/smoke/allinone_smoke.py
+        env:
+          RUTSTER_ALLINONE_IMAGE: rutster-allinone:smoke
+          RUTSTER_ALLINONE_PORT: "18443"
+
+  # deploy-B §9 compose smoke — T2 four-service compose stack boots + all
+  # services healthy + Caddy TLS /healthz + /readyz. Lighter than the
+  # all-in-one smoke (which already proved the WS path) — its job is the
+  # orchestrator shape + the network_mode: "service:engine" brain->engine tap
+  # posture across the four services.
+  smoke-compose:
+    name: smoke (T2 compose four-service)
+    runs-on: ubuntu-latest
+    needs: [image-build]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      # Rebuild all three first-party images from the warm GHA cache
+      # populated by image-build. Valkey is upstream (no rebuild needed).
+      - name: Rebuild rutster-edge:smoke
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: deploy/Dockerfile
+          target: rutster-edge
+          tags: rutster-edge:smoke
+          push: false
+          load: true
+          cache-from: type=gha,scope=rutster-edge
+
+      - name: Rebuild rutster-engine:smoke
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: deploy/Dockerfile
+          target: rutster-engine
+          tags: rutster-engine:smoke
+          push: false
+          load: true
+          cache-from: type=gha,scope=rutster-engine
+
+      - name: Rebuild rutster-brain:smoke
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: deploy/Dockerfile
+          target: rutster-brain
+          tags: rutster-brain:smoke
+          push: false
+          load: true
+          cache-from: type=gha,scope=rutster-brain
+
+      # jq is pre-installed on ubuntu-latest GHA runners.
+      - name: Run compose smoke (deploy/smoke/compose_smoke.sh)
+        run: bash deploy/smoke/compose_smoke.sh
+        env:
+          RUTSTER_IMAGES_TAG: smoke
+
+  # deploy-B §9 + spec §3.2 + TLS brief §5 risk 1: Caddy config-reload
+  # during a live simulated call, asserting zero frame drops. The
+  # stream_close_delay 24h mitigation in deploy/Caddyfile is the load-
+  # bearing fixture; caddy #6420 / #7222 are open upstream bugs — the
+  # smoke is "don't trust untested" made CI-regressed.
+  smoke-reload:
+    name: smoke (caddy reload during live call, zero drops)
+    runs-on: ubuntu-latest
+    needs: [smoke]   # reuses the rutster-allinone:smoke image, warm cache
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python (stdlib-only; no pip)
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.x"
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Rebuild rutster-allinone:smoke (warm cache)
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: deploy/Dockerfile
+          target: rutster-allinone
+          tags: rutster-allinone:smoke
+          push: false
+          load: true
+          cache-from: type=gha,scope=rutster-allinone
+
+      - name: Run reload-during-call smoke (deploy/smoke/reload_during_call.py)
+        run: python3 deploy/smoke/reload_during_call.py
+        env:
+          RUTSTER_ALLINONE_IMAGE: rutster-allinone:smoke
+          RUTSTER_ALLINONE_PORT: "18444"
diff --git a/.github/workflows/publish-images.yml b/.github/workflows/publish-images.yml
new file mode 100644
index 0000000..dc687b3
--- /dev/null
+++ b/.github/workflows/publish-images.yml
@@ -0,0 +1,202 @@
+# .github/workflows/publish-images.yml — slice F (spec §6.3 + §11).
+#
+# Tag-push workflow: builds + pushes all four first-party images to the
+# git.adlee.work/alee/rutster-* registry namespace. linux/amd64 only (spec
+# §1.2 / ADR-0011 — arm64 is a named deferral).
+#
+# Gating: runs AFTER and gated on the existing fmt/clippy/test/deny/sim-bench
+# + image-build pipeline. The publish workflow re-runs the fmt/clippy/test/
+# deny matrix as a `needs:` chain (cheap when nothing changed) + builds all
+# four images from the same Dockerfile CI's image-build job uses. This makes
+# the published image byte-identical to the one CI tested — the "registry tag
+# points at a tested image" invariant operators rely on.
+#
+# Registry namespace: git.adlee.work/alee/rutster-* (matches the `alee` tea
+# login per AGENTS.md Git workflow + the root Cargo.toml's `repository`
+# field). If your Gitea registry uses a different owner segment, replace
+# `alee` throughout this file (REGISTRY_NAMESPACE below).
+
+name: Publish Images
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+env:
+  REGISTRY: git.adlee.work
+  REGISTRY_NAMESPACE: alee
+  PLATFORMS: linux/amd64
+
+jobs:
+  # The publish workflow is its own pipeline; it re-runs fmt/clippy/test/deny
+  # + builds the images + then publishes. The fmt/clippy/test/deny re-runs
+  # are cheap on a green repo (cache hits, fast fmt + clippy + test), and
+  # they make a critical guarantee: the version published under a `v*` tag
+  # has ALL the repo's quality gates green at that exact commit. Without
+  # this `needs:` chain, a tag could be pushed at a commit where the matrix
+  # failed but image-build happened to succeed on a flake.
+  fmt:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt
+      - run: cargo fmt --check
+
+  clippy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+      - name: Install libopus (media crate FFI dep)
+        run: apt-get update && apt-get install -y libopus-dev
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo clippy --all --all-targets -- -D warnings
+
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        toolchain: [stable, "1.85"]
+    steps:
+      - uses: actions/checkout@v4
+
+      # Seam gate (mirror of .github/workflows/ci.yml's test job —
+      # loop_driver.rs + rtc_session.rs stay byte-identical to slice-3/5).
+      - name: Seam gate — loop_driver frozen + rtc_session pinned
+        run: |
+          EXPECTED_LOOP_DRIVER='744bf314edf7f4925c8bb3bd0f5176dbc88f8113'
+          EXPECTED_RTC_SESSION='f47d63b9a2883d37066a93c9daa0e2cf8816bec4'
+          GOT_LOOP_DRIVER=$(git hash-object crates/rutster-media/src/loop_driver.rs)
+          GOT_RTC_SESSION=$(git hash-object crates/rutster-media/src/rtc_session.rs)
+          [ "$GOT_LOOP_DRIVER" = "$EXPECTED_LOOP_DRIVER" ] || exit 1
+          [ "$GOT_RTC_SESSION" = "$EXPECTED_RTC_SESSION" ] || exit 1
+      - uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: ${{ matrix.toolchain }}
+      - name: Install libopus (media crate FFI dep)
+        run: apt-get update && apt-get install -y libopus-dev
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo test --all
+
+  deny:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: EmbarkStudios/cargo-deny-action@v2
+        with:
+          command: check
+
+  sim-bench:
+    name: sim-bench (stable)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+      - name: Install libopus (media crate FFI dep)
+        run: apt-get update && apt-get install -y libopus-dev
+      - uses: Swatinem/rust-cache@v2
+      - name: cargo fmt + clippy on sim-bench feature paths
+        run: |
+          cargo fmt --all --check
+          cargo clippy --all --all-targets --features=sim-bench -- -D warnings
+      - name: Run sim-bench threshold sweep
+        run: cargo test --all --features=sim-bench -- --test-threads=1
+
+  publish:
+    name: Publish 4 images to git.adlee.work/alee/rutster-*
+    runs-on: ubuntu-latest
+    needs: [fmt, clippy, test, deny, sim-bench]
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build-time host deps (belt-and-braces)
+        run: sudo apt-get update && sudo apt-get install -y libopus-dev
+
+      - name: Log in to Gitea registry
+        # GITEA_REGISTRY_USERNAME + GITEA_REGISTRY_PASSWORD are repo secrets
+        # set by the maintainer (per AGENTS.md Git workflow — the `alee`
+        # tea login). The username is `alee` (matches REGISTRY_NAMESPACE).
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ secrets.GITEA_REGISTRY_USERNAME }}
+          password: ${{ secrets.GITEA_REGISTRY_PASSWORD }}
+
+      - name: Determine tags
+        id: tags
+        # Two tags per image: the version tag (github.ref_name, e.g. v0.1.0)
+        # + `latest`. Operators can pin to either; `latest` is the
+        # convenience tag that always points at the most recent release.
+        run: |
+          echo "version_tag=${GITHUB_REF_NAME}" >> $GITHUB_OUTPUT
+          echo "namespace=${REGISTRY}/${REGISTRY_NAMESPACE}" >> $GITHUB_OUTPUT
+
+      - name: Build + push rutster-engine
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: deploy/Dockerfile
+          target: rutster-engine
+          platforms: ${{ env.PLATFORMS }}
+          tags: |
+            ${{ steps.tags.outputs.namespace }}/rutster-engine:${{ steps.tags.outputs.version_tag }}
+            ${{ steps.tags.outputs.namespace }}/rutster-engine:latest
+          push: true
+          cache-from: type=gha,scope=rutster-engine
+          cache-to: type=gha,mode=max,scope=rutster-engine
+
+      - name: Build + push rutster-brain
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: deploy/Dockerfile
+          target: rutster-brain
+          platforms: ${{ env.PLATFORMS }}
+          tags: |
+            ${{ steps.tags.outputs.namespace }}/rutster-brain:${{ steps.tags.outputs.version_tag }}
+            ${{ steps.tags.outputs.namespace }}/rutster-brain:latest
+          push: true
+          cache-from: type=gha,scope=rutster-brain
+          cache-to: type=gha,mode=max,scope=rutster-brain
+
+      - name: Build + push rutster-edge
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: deploy/Dockerfile
+          target: rutster-edge
+          platforms: ${{ env.PLATFORMS }}
+          tags: |
+            ${{ steps.tags.outputs.namespace }}/rutster-edge:${{ steps.tags.outputs.version_tag }}
+            ${{ steps.tags.outputs.namespace }}/rutster-edge:latest
+          push: true
+          cache-from: type=gha,scope=rutster-edge
+          cache-to: type=gha,mode=max,scope=rutster-edge
+
+      - name: Build + push rutster-allinone
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: deploy/Dockerfile
+          target: rutster-allinone
+          platforms: ${{ env.PLATFORMS }}
+          tags: |
+            ${{ steps.tags.outputs.namespace }}/rutster-allinone:${{ steps.tags.outputs.version_tag }}
+            ${{ steps.tags.outputs.namespace }}/rutster-allinone:latest
+          push: true
+          cache-from: type=gha,scope=rutster-allinone
+          cache-to: type=gha,mode=max,scope=rutster-allinone
diff --git a/deploy/.dockerignore b/deploy/.dockerignore
new file mode 100644
index 0000000..16ad94a
--- /dev/null
+++ b/deploy/.dockerignore
@@ -0,0 +1,48 @@
+# deploy/.dockerignore — prune the build context for `docker buildx build`
+# invocations against deploy/Dockerfile. Without this, the context would
+# ship target/ (~5 GB on warm dev), .git/, docs/, .github/, etc. — minutes
+# of pointless context-transfer before the first RUN step.
+#
+# IMPORTANT: patterns are relative to the build context root (the path
+# passed to `docker buildx build`, which is the repo root for this Dockerfile
+# since we use `-f deploy/Dockerfile .`). So `target/` matches
+# /target/ at the repo root AND `**/target/` catches /crates/*/target/.
+
+# Rust build artifacts.
+target/
+**/target/
+
+# Git history + CI configuration.
+.git/
+.github/
+
+# Editor + agent working state.
+.vscode/
+.idea/
+.opencode/
+*.swp
+*.swo
+.DS_Store
+
+# Environment files (never ship secrets — .env.example is the ONLY .env*
+# file that should reach the build context, and it has no secrets by design).
+.env
+.env.local
+.env.*.local
+
+# Documentation (the Dockerfile doesn't read any .md file but README).
+docs/
+*.md
+!README.md
+
+# Plans + specs (not needed at image build time — operator reads from the
+# repo, not the container).
+docs/superpowers/
+
+# Logs + OS junk.
+*.log
+tmp/
+*.tmp
+
+# Tmp artifacts from cargo-deny / cargo-cache.
+deny.toml.lock
diff --git a/deploy/.env.example b/deploy/.env.example
new file mode 100644
index 0000000..a0c6b31
--- /dev/null
+++ b/deploy/.env.example
@@ -0,0 +1,148 @@
+# deploy/.env.example — runtime configuration for the rutster T1 (all-in-one)
+# + T2 (compose) artifacts. Copy to `.env` + edit before `docker compose up -d`.
+#
+# Format: KEY=value (one per line); comments (#) are ignored by `docker
+# compose --env-file`. Fail-fast pattern: every var is parsed by
+# crates/rutster/src/config.rs's pure-`Option<String>` parsers at startup;
+# an invalid value fails the boot loudly with the var name in the error,
+# never silently runs with a wrong default. See AGENTS.md "config.rs"
+# pattern.
+#
+# Bundled-binary licenses (aggregation-clean vs GPL-3 per ADR-0004):
+#   * Caddy      Apache-2.0
+#   * valkey     BSD-3
+#   * s6-overlay ISC
+#   * libopus0   BSD-3 (system package; Debian)
+# Future cargo-deny-adjacent image license scan will assert these in CI
+# (spec §6.1 — out of scope for slice B; this comment seeds it).
+#
+# Registry namespace: git.adlee.work/alee/rutster-* (matches the `alee` tea
+# login per AGENTS.md Git workflow + the root Cargo.toml's `repository`
+# field). If your Gitea registry uses a different owner segment, replace
+# `alee` throughout deploy/compose.yaml + .github/workflows/publish-images.yml.
+
+################################################################################
+# ARTIFACT-LEVEL — Caddy edge (this slice)
+################################################################################
+
+# RUTSTER_DOMAIN — the public hostname the CPaaS dials. Required for T1 (solo
+# all-in-one) and T2 (compose). Used by Caddyfile as the site block name.
+# Example: pbx.example.com
+RUTSTER_DOMAIN=pbx.example.com
+
+# RUTSTER_ACME_EMAIL — the Let's Encrypt account email. Used by Caddy for
+# ACME account creation. Required for production (ACME issuance); ignored
+# in CI (RUTSTER_LOCAL_CERTS=true bypasses ACME).
+RUTSTER_ACME_EMAIL=you@example.com
+
+# RUTSTER_LOCAL_CERTS — set to "true" in CI to use Caddy's internal CA (no
+# ACME round-trips, no rate-limit budget burns). Production leaves this
+# unset (or "false") so Caddy uses Let's Encrypt. The Caddyfile reads this
+# via the {$RUTSTER_LOCAL_CERTS:local_certs_off} interpolation.
+# RUTSTER_LOCAL_CERTS=false
+
+################################################################################
+# FOB engine — bind + drain (slice-5 config.rs + plan-A)
+################################################################################
+
+# RUTSTER_HTTP_BIND — the FOB's HTTP/WS listener. Behind Caddy (T1/T2 prod):
+# 0.0.0.0:8080 (compose network) or 127.0.0.1:8080 (single container T1).
+# Default if unset: 0.0.0.0:8080 (config.rs http_bind).
+RUTSTER_HTTP_BIND=0.0.0.0:8080
+
+# RUTSTER_DRAIN_DEADLINE_SECS — how long shutdown waits for in-flight calls
+# before the hard stop. Default 0 = instant shutdown (dev loop); production
+# sets minutes. Spec §2.2 pins 600 (paired with compose stop_grace_period
+# 660s — grace MUST exceed drain or the orchestrator kills calls the
+# engine was gracefully draining).
+RUTSTER_DRAIN_DEADLINE_SECS=600
+
+# RUTSTER_MAX_SESSIONS — admission cap. Default 64 (placeholder until the
+# ADR-0010 benchmark measures the real per-node ceiling). /readyz flips 503
+# when at the cap so the LB pulls the node.
+RUTSTER_MAX_SESSIONS=64
+
+################################################################################
+# FOB engine — WebRTC media (slice-5 config.rs media_address_config)
+################################################################################
+
+# RUTSTER_MEDIA_BIND_IP — the IP WebRTC DTLS-SRTP binds. Default 127.0.0.1
+# (loopback — dev loop). Production hosts a public IP.
+RUTSTER_MEDIA_BIND_IP=0.0.0.0
+
+# RUTSTER_MEDIA_ADVERTISED_IP — the IP advertised in SDP to WebRTC callers.
+# They send media UDP straight to this IP (NAT 1:1 — no STUN, no TURN).
+# In T1 (host networking): the host's public IP. In T2 (compose): the
+# engine container's published port's host IP.
+RUTSTER_MEDIA_ADVERTISED_IP=203.0.113.7
+
+# RUTSTER_MEDIA_PORT_RANGE — UDP port range for WebRTC media. Format lo-hi
+# inclusive. Must be open inbound on the host's firewall + published in
+# compose (deploy/compose.yaml publishes this range).
+RUTSTER_MEDIA_PORT_RANGE=49152-49407
+
+################################################################################
+# FOB engine — WS hygiene (plan-A §5.2)
+################################################################################
+
+# RUTSTER_WS_PING_SECS — engine-originated app-level WS ping interval on
+# the trunk media-stream WS. Default 20s. 0 rejected (would busy-loop the
+# ping timer); no "off" spelling by design.
+RUTSTER_WS_PING_SECS=20
+
+################################################################################
+# FOB engine — trusted-proxy posture (plan-A §5.3)
+################################################################################
+
+# RUTSTER_TRUSTED_PROXIES — comma-separated CIDR list of edge peers whose
+# X-Forwarded-Proto/Host are believed. Empty or unset = headers IGNORED
+# (fail-closed default). Bare IPs accepted as host-length prefixes. In T1/T2
+# with Caddy as edge, set to the Caddy container's source IP (compose:
+# the compose network's subnet CIDR; T1: 127.0.0.1/32). An internet peer
+# must never choose the public URL that Twilio signature validation
+# reconstructs (spec §3.1 invariant 5).
+RUTSTER_TRUSTED_PROXIES=127.0.0.1/32
+
+################################################################################
+# Trunk — Twilio credentials (slice-5 config.rs twilio_credentials)
+################################################################################
+
+# All four RUTSTER_TWILIO_* vars are ALL-OR-NONE: the parser rejects partial
+# config at startup. Omit all four to run WebRTC-only.
+RUTSTER_TWILIO_ACCOUNT_SID=ACxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+RUTSTER_TWILIO_AUTH_TOKEN=your_auth_token_here
+RUTSTER_TWILIO_MEDIA_BIND=0.0.0.0:8081
+RUTSTER_TWILIO_WEBHOOK_BASE=https://pbx.example.com
+
+################################################################################
+# Brain — tap URL (slice-2/3; loopback-only until step 6)
+################################################################################
+
+# RUTSTER_TAP_URL — the WS URL the FOB opens to the brain. Default
+# ws://127.0.0.1:8081/echo (slice-2 dev-loop echo brain). Production with
+# rutster-brain-realtime: ws://127.0.0.1:8082 (loopback-only —
+# resolve_tap_url rejects non-loopback until step 6's wss:// tap). In T2
+# (compose), the brain shares the engine's netns
+# (network_mode: "service:engine") so this loopback IS the engine's
+# loopback.
+RUTSTER_TAP_URL=ws://127.0.0.1:8082
+
+################################################################################
+# Future vars — land with sibling slices, NOT this slice
+################################################################################
+
+# RUTSTER_TLS_CERT / RUTSTER_TLS_KEY — land with slice C (rustls Phase 1,
+# BYO-cert in-process TLS). The engine binary stays compiled-with-rustls
+# from slice C onward; runtime-gated by these vars. See the slice-C plan
+# at docs/superpowers/plans/2026-07-05-deploy-c-rustls-tls.md (path may
+# vary — check the plans dir).
+# RUTSTER_TLS_CERT=/etc/rutster/tls/fullchain.pem
+# RUTSTER_TLS_KEY=/etc/rutster/tls/privkey.pem
+
+# RUTSTER_METRICS_BIND — lands with slice D (/metrics endpoint). Default
+# 127.0.0.1:9090 (internal — never routed through Caddy).
+# RUTSTER_METRICS_BIND=127.0.0.1:9090
+
+# RUTSTER_VALKEY_URL — lands with slice E (ValkeyEventSink). Unset = today's
+# TracingEventSink (logs to stdout). Set to redis://valkey:6379/0 in T2.
+# RUTSTER_VALKEY_URL=redis://valkey:6379/0
diff --git a/deploy/Caddyfile b/deploy/Caddyfile
new file mode 100644
index 0000000..6bd349f
--- /dev/null
+++ b/deploy/Caddyfile
@@ -0,0 +1,98 @@
+# deploy/Caddyfile — the edge config for rutster-edge (T2) + rutster-allinone (T1).
+# Same file, same build (spec §3.2 + ADR-0011). Read by Caddy v2.8 (the
+# custom xcaddy build from deploy/Dockerfile).
+#
+# Env vars (Caddyfile interpolation syntax {$VAR}):
+#   RUTSTER_DOMAIN      — the public hostname (e.g. pbx.example.com). Required.
+#   RUTSTER_ACME_EMAIL  — the Let's Encrypt account email. Required for ACME.
+#   RUTSTER_LOCAL_CERTS — set to "true" in CI to use Caddy's internal CA
+#                         (no ACME round-trips, no rate-limit budget burns).
+#                         Overrides the ACME block below via the `local_certs`
+#                         global option.
+#
+# Timeouts (TLS brief §3(a); spec §2.1, §2.2, §3.1 invariant 3):
+#   * read_body 30s      — Twilio webhooks fit comfortably in 30s (15s cap
+#                          by invariant 6).
+#   * read_header 30s    — same.
+#   * write 0            — disable; 20ms media frames must flush immediately.
+#   * idle 24h           — the universal 60s-class default kills quiet WS;
+#                          spec §2.1 invariant 3 sets max call duration 24h.
+#   * stream_close_delay 24h — above max call duration; the load-bearing
+#                              mitigation for caddy #6420/#7222 (TLS brief §5
+#                              risk 1; spec §9 reload-during-call smoke).
+#
+# X-Forwarded-* honesty (spec §3.1 invariant 5; plan-A Task 5
+# reconstruct_public_url): Caddy sets these to the real client values via
+# the `header_up` directives below. Engine-side RUTSTER_TRUSTED_PROXIES is
+# the trust gate (fail-closed default).
+
+{
+	# CI override: set RUTSTER_LOCAL_CERTS=true to use Caddy's internal CA
+	# (no ACME in CI; spec §9). Production leaves this unset.
+	{$RUTSTER_LOCAL_CERTS:local_certs_off} local_certs
+
+	# Send logs to stdout (s6-overlay / docker logs collects from there).
+	log {
+		output stdout
+		format console
+	}
+}
+
+# Default ACME email — overridden by RUTSTER_LOCAL_CERTS=true in CI.
+{
+	email {$RUTSTER_ACME_EMAIL:you@example.com}
+}
+
+# Main site block — the public hostname.
+{$RUTSTER_DOMAIN:localhost} {
+	encode zstd gzip
+
+	# The reverse_proxy to the FOB. 127.0.0.1:8080 is correct in T1
+	# (single container, loopback) AND T2 (compose: the engine service's
+	# `rutster-engine` DNS name resolves on the compose network; Caddy
+	# reaches it via that name — replace 127.0.0.1:8080 with
+	# http://engine:8080 in advance; here we use the loopback literal so
+	# the same Caddyfile works in both T1 and T2 spelled identically —
+	# for T2 deployments, the operator overrides the upstream via a env-
+	# substituted site-address block; the shipped default targets loopback
+	# for the bundled all-in-one single-container case which is the harder
+	# constraint).
+	#
+	# `header_up Host {host}` + X-Forwarded-* — sets the honest hop values
+	# (the engine's reconstruct_public_url reads these; spec §3.1 invariant 5).
+	# `header_up X-Forwarded-For {remote_host}` — included for completeness;
+	# the engine does NOT use X-Forwarded-For for signature validation, only
+	# X-Forwarded-Proto/Host. Forwarding the For header is standard proxy
+	# hygiene — engine-side RUTSTER_TRUSTED_PROXIES is the gate.
+	reverse_proxy 127.0.0.1:8080 {
+		header_up Host {host}
+		header_up X-Real-IP {remote_host}
+		header_up X-Forwarded-Proto {scheme}
+		header_up X-Forwarded-Host {host}
+		header_up X-Forwarded-For {remote_host}
+
+		# Tuned timeouts — the load-bearing ones for calls lasting hours.
+		transport http {
+			read_buffer 64KiB
+			write_buffer 64KiB
+			dial_timeout 5s
+			response_header_timeout 30s
+		}
+
+		# stream_close_delay above max call duration (24h) — the caddy
+		# #6420/#7222 mitigation (TLS brief §5 risk 1; spec §9 smoke).
+		# An operator Caddyfile reload mid-call would normally kill
+		# upgraded WS tunnels; the delay keeps them alive until the
+		# streams close naturally (the call ends) — verified by the
+		# reload-during-live-call CI smoke (Task 9).
+		stream_close_delay 24h
+	}
+
+	# Timeouts for the public-facing side.
+	servers {
+		read_body 30s
+		read_header 30s
+		write 0        # never write-timeout; 20ms frames self-flush
+		idle 24h       # above max call duration — the universal 60s-class default kills quiet WS
+	}
+}
diff --git a/deploy/Dockerfile b/deploy/Dockerfile
new file mode 100644
index 0000000..72218a7
--- /dev/null
+++ b/deploy/Dockerfile
@@ -0,0 +1,211 @@
+# syntax=docker/dockerfile:1.7
+# deploy/Dockerfile — multi-stage, four first-party images (spec §6.1).
+#
+# One Dockerfile, four named --target stages:
+#   * rutster-engine     — FOB only (binary `rutster`)
+#   * rutster-brain      — brain only (binary `rutster-brain-realtime`)
+#   * rutster-edge       — custom xcaddy build with curated DNS plugins
+#   * rutster-allinone   — s6-overlay v3 supervising caddy + FOB + brain + valkey-server
+#
+# Build all four locally:
+#   docker buildx build --target rutster-engine    -t rutster-engine:ci    -f deploy/Dockerfile .
+#   docker buildx build --target rutster-brain     -t rutster-brain:ci     -f deploy/Dockerfile .
+#   docker buildx build --target rutster-edge      -t rutster-edge:ci      -f deploy/Dockerfile .
+#   docker buildx build --target rutster-allinone  -t rutster-allinone:ci  -f deploy/Dockerfile .
+#
+# Toolchain pin: rust-toolchain.toml pins `channel = "1.85"`. The builder
+# image is `rust:1.85-slim-bookworm` (NOT `rust:stable` — image builds must
+# reproduce exactly what the MSRV matrix in CI gates; `stable` would float).
+#
+# libopus strategy (spec §6.1 "distro libopus0 over static-bundled"):
+#   * Builder stage: `apt-get install libopus-dev` — the -dev headers needed
+#     to compile the `opus` crate (FFI against libopus; verified:
+#     crates/rutster-media/Cargo.toml line 12: `opus = { workspace = true }`).
+#   * Runtime stages (engine + brain + all-in-one): `apt-get install libopus0`
+#     — the shared library binary. Brain image gets libopus0 too (see spec
+#     ambiguity #2 in this slice's plan): rutster-brain-realtime's
+#     Cargo.toml depends on rutster-media, so the linker records
+#     `NEEDED: libopus.so.0` in the brain ELF even though the brain never
+#     calls an opus symbol. Missing .so.0 would crash the brain at startup.
+#   * Matches the dev loop exactly. Do NOT use the audiopus_sys bundled-cmake
+#     fallback — system libopus is available in Debian.
+
+########################################
+# Stage 1: Rust builder — compiles both binaries once.
+########################################
+FROM rust:1.85-slim-bookworm AS builder
+
+# libopus-dev: the headers the `opus` crate's build.rs expects.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        libopus-dev \
+        ca-certificates \
+        curl \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /usr/src/rutster
+COPY . .
+
+# Build both binaries in one `cargo build --bins` invocation so the
+# dependency graph is compiled once (warm ccache/rustc cache covers both).
+# --release is mandatory: debug builds of str0m + opus run 5-10x slower
+# than the 20ms tick budget; a debug-image container would burn the tick-lag
+# threshold on first call.
+RUN cargo build --release --bins \
+    && cp /usr/src/rutster/target/release/rutster /usr/local/bin/rutster \
+    && cp /usr/src/rutster/target/release/rutster-brain-realtime /usr/local/bin/rutster-brain-realtime
+
+########################################
+# Stage 2: Caddy builder — xcaddy with the curated DNS plugin set.
+########################################
+# caddy:2.8-builder ships Go + xcaddy. The plugin set is exactly spec §3.2
+# / TLS brief §3(a): cloudflare, route53, porkbun, hetzner, desec.
+# duckdns EXCLUDED — no license file (spec §3.2).
+# Plugin licenses: cloudflare=Apache-2.0; route53/porkbun/hetzner/desec=MIT.
+# Aggregation-clean vs GPL-3 (Caddy core itself is Apache-2.0).
+FROM caddy:2.8-builder AS caddy-builder
+
+RUN xcaddy build \
+        --with github.com/caddy-dns/cloudflare \
+        --with github.com/caddy-dns/route53 \
+        --with github.com/caddy-dns/porkbun \
+        --with github.com/caddy-dns/hetzner \
+        --with github.com/caddy-dns/desec \
+    && mv /build/caddy /usr/local/bin/caddy
+
+########################################
+# Stage 3: Valkey binary source (upstream image, no rebuild).
+########################################
+# COPY --from pattern: pull just the valkey-server binary out of the
+# upstream BSD-3 image; avoids rebuilding valkey from source (saves ~5 min
+# per build + ~150 MB of build deps). The binary is statically-linked
+# enough for Debian bookworm (verified by upstream's Debian-based image).
+FROM valkey/valkey:8.0 AS valkey-src
+
+########################################
+# Target: rutster-engine — the FOB only.
+########################################
+FROM debian:bookworm-slim AS rutster-engine
+
+# libopus0: the shared library (see libopus strategy comment at top).
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        libopus0 \
+        ca-certificates \
+        curl \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=builder /usr/local/bin/rutster /usr/local/bin/rutster
+COPY deploy/Caddyfile /etc/rutster/Caddyfile
+
+# RUTSTER_HTTP_BIND defaults to 0.0.0.0:8080 (config.rs). Behind Caddy, the
+# engine binds the compose-network address; behind --network host (T1
+# solo), it binds 127.0.0.1:8080.
+EXPOSE 8080
+# Media UDP range — published via RUTSTER_MEDIA_PORT_RANGE.
+EXPOSE 49152-49407/udp
+
+ENTRYPOINT ["/usr/local/bin/rutster"]
+
+########################################
+# Target: rutster-brain — brain only.
+########################################
+FROM debian:bookworm-slim AS rutster-brain
+
+# libopus0: see spec ambiguity #2 in this slice's plan —
+# rutster-brain-realtime's Cargo.toml depends on rutster-media which
+# depends on the `opus` crate; even though the brain never calls an opus
+# symbol, the ELF records `NEEDED: libopus.so.0` (linker dead-strips
+# unused symbols but the .so is still required at dlopen-time before
+# dead-strip can prove they're unused). A future brain-crate refactor
+# that drops the rutster-media dep can drop this package too.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        libopus0 \
+        ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=builder /usr/local/bin/rutster-brain-realtime /usr/local/bin/rutster-brain-realtime
+
+# Brain binds 127.0.0.1:8082 (loopback-only tap posture until step 6).
+# In compose (T2), the brain shares the engine's netns via
+# `network_mode: "service:engine"` so this loopback IS the engine's
+# loopback — the FOB can reach the brain's tap port without exposing it.
+EXPOSE 8082
+
+ENTRYPOINT ["/usr/local/bin/rutster-brain-realtime"]
+
+########################################
+# Target: rutster-edge — custom Caddy build.
+########################################
+# scratch/alpine choice (spec §6.1): alpine gives a shell for debugging
+# (`docker exec -it rutster-edge sh`); scratch is purer but undebuggable.
+# Alpine's musl is fine for the static Go binary xcaddy produces.
+FROM alpine:3.20 AS rutster-edge
+
+# ca-certificates: ACME TLS validation. curl: smoke-test `caddy reload`
+# invocations + `curl /healthz` from inside the container.
+RUN apk add --no-cache ca-certificates curl
+
+COPY --from=caddy-builder /usr/local/bin/caddy /usr/local/bin/caddy
+COPY deploy/Caddyfile /etc/caddy/Caddyfile
+
+# Caddy needs /data for ACME state — losing it risks the Let's Encrypt
+# duplicate-cert lockout (spec §2.1, TLS brief §5 risk 5). Mount a volume
+# at /data in production. In CI (local_certs) /data just holds the internal
+# CA — recreating is fine, but the volume mount keeps prod + CI on the
+# same code path.
+VOLUME /data
+
+EXPOSE 80 443
+
+ENTRYPOINT ["/usr/local/bin/caddy"]
+CMD ["run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]
+
+########################################
+# Target: rutster-allinone — s6-overlay v3 supervising four processes.
+########################################
+FROM debian:bookworm-slim AS rutster-allinone
+
+# libopus0 (FOB needs it; brain too — see rutster-brain target above).
+# curl: smoke-test invocations + `caddy reload` exec.
+# ca-certificates: ACME.
+# xz: s6-overlay binary tarball extraction (extract-then-rm).
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        libopus0 \
+        ca-certificates \
+        curl \
+        xz-utils \
+    && rm -rf /var/lib/apt/lists/*
+
+# s6-overlay v3.2.0.0 — ISC license (aggregation-clean vs GPL-3).
+# Two tarballs: noarch (the service definitions + s6-rc bundle) + x86_64
+# (the binaries — linux/amd64 only per spec §1.2). arm64 is a named
+# deferral (ADR-0011 §1.2); when it lands, this Dockerfile grows an
+# `ARG TARGETARCH` + `COPY` per-arch.
+COPY deploy/s6-overlay-noarch.tar.xz /tmp/s6-overlay-noarch.tar.xz
+COPY deploy/s6-overlay-x86_64.tar.xz /tmp/s6-overlay-x86_64.tar.xz
+RUN tar -C / -Jxpf /tmp/s6-overlay-noarch.tar.xz \
+    && tar -C / -Jxpf /tmp/s6-overlay-x86_64.tar.xz \
+    && rm /tmp/s6-overlay-noarch.tar.xz /tmp/s6-overlay-x86_64.tar.xz
+
+# Binaries from earlier stages.
+COPY --from=builder /usr/local/bin/rutster /usr/local/bin/rutster
+COPY --from=builder /usr/local/bin/rutster-brain-realtime /usr/local/bin/rutster-brain-realtime
+COPY --from=caddy-builder /usr/local/bin/caddy /usr/local/bin/caddy
+COPY --from=valkey-src /usr/local/bin/valkey-server /usr/local/bin/valkey-server
+
+# Caddyfile + s6 service definitions (long-lined below).
+COPY deploy/Caddyfile /etc/caddy/Caddyfile
+COPY deploy/s6-rc.d/ /etc/s6-overlay/s6-rc.d/
+
+# Volumes: Caddy /data (ACME state — loss risks LE lockout per TLS brief
+# §5 risk 5) + Valkey /var/lib/valkey (stream/state persistence per
+# ADR-0005).
+VOLUME /data /var/lib/valkey
+
+# Caddy :80/:443 public; FOB :8080 behind Caddy; brain :8082 loopback;
+# valkey :6379 loopback; media UDP direct.
+EXPOSE 80 443 8080 8082 6379 49152-49407/udp
+
+# s6-overlay v3 entrypoint — the binary `s6-overlay-init` (symlinked from
+# /s6-init in the noarch tarball) runs the service bundle in
+# /etc/s6-overlay/s6-rc.d/ via s6-rc.
+ENTRYPOINT ["/s6-init"]
diff --git a/deploy/compose.yaml b/deploy/compose.yaml
new file mode 100644
index 0000000..912d5fc
--- /dev/null
+++ b/deploy/compose.yaml
@@ -0,0 +1,109 @@
+# deploy/compose.yaml — T2 modular reference deployment (spec §2.2 / ADR-0011).
+#
+# Four services: caddy (rutster-edge), engine (rutster-engine), brain
+# (rutster-brain, network_mode: "service:engine" so the loopback tap posture
+# survives unchanged — resolve_tap_url rejects non-loopback until step 6),
+# valkey (upstream valkey/valkey).
+#
+# stop_grace_period 660s paired with RUTSTER_DRAIN_DEADLINE_SECS=600 —
+# grace EXCEEDS drain or the orchestrator kills calls the engine was
+# gracefully draining (spec §2.2 / §8). 60s slack accounts for a
+# legitimately-long in-flight call (599s) + shutdown round-trip.
+#
+# Bring your own proxy: comment out the `caddy` service; the engine keeps
+# its plaintext :8080 listener; tuned-timeout configs for nginx/HAProxy/
+# Traefik ship in docs/deploy/reverse-proxies.md (slice G).
+#
+# Bring-up:
+#   cp .env.example .env
+#   $EDITOR .env     # set DOMAIN, ACME_EMAIL, MEDIA_ADVERTISED_IP, TWILIO_*
+#   docker compose up -d
+#   curl -fsS https://$RUTSTER_DOMAIN/healthz && echo OK
+
+services:
+  caddy:
+    # The custom xcaddy build with curated DNS plugins (cloudflare/
+    # route53/porkbun/hetzner/desec — duckdns excluded per spec §3.2).
+    # In production, pulls from the git.adlee.work/alee/rutster-edge
+    # registry (slice F). For local dev / CI without registry auth, build
+    # from the Dockerfile:
+    #   build:
+    #     context: ..
+    #     dockerfile: deploy/Dockerfile
+    #     target: rutster-edge
+    image: rutster-edge:latest
+    restart: unless-stopped
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - caddy-data:/data
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+    env_file:
+      - .env
+    depends_on:
+      - engine
+    networks:
+      - rutster-net
+
+  engine:
+    # The FOB: axum signaling + media thread + trunk WS + /metrics.
+    # Plaintext :8080 behind Caddy (slice C's rustls will terminate
+    # in-process TLS — same listener, operator-choice).
+    image: rutster-engine:latest
+    restart: unless-stopped
+    # 660s grace > 600s drain (RUTSTER_DRAIN_DEADLINE_SECS) — invariant.
+    stop_grace_period: 660s
+    ports:
+      # Signaling + trunk WS behind Caddy (Caddy proxies :443 -> engine:8080).
+      # Comment out for production hardening (Caddy is the only entry).
+      - "8080:8080"
+      # WebRTC media UDP direct — never proxied (spec §2.1).
+      - "49152-49407:49152-49407/udp"
+    volumes:
+      - ./Caddyfile:/etc/rutster/Caddyfile:ro   # copied in image already; mount for edit-without-rebuild
+    env_file:
+      - .env
+    networks:
+      - rutster-net
+
+  brain:
+    # Brain shares engine's network namespace — the FOB reaches the brain's
+    # tap port via 127.0.0.1:8082 (loopback-only posture; resolve_tap_url
+    # rejects non-loopback URLs until step 6 per spec §2.2). The brain
+    # graduates to its own netns + wss:// tap auth with step 6.
+    image: rutster-brain:latest
+    restart: unless-stopped
+    # CRITICAL: quoted — YAML would otherwise parse `service:engine` as a
+    # `service: engine` mapping (key:value). The quotes make it a string.
+    network_mode: "service:engine"
+    env_file:
+      - .env
+    depends_on:
+      - engine
+
+  valkey:
+    # Upstream valkey image (BSD-3; aggregation-clean vs GPL-3 per ADR-0004).
+    # Dark on day one except EventSink (slice E lands ValkeyEventSink
+    # against this service). The operator contract (volumes, ports, upgrade
+    # shape) is stable from v1 per spec §2.1 — the spend ledger (ADR-0009)
+    # + fleet directory land later without changing this service.
+    image: valkey/valkey:8.0
+    restart: unless-stopped
+    command: ["valkey-server", "--dir", "/data", "--save", "60", "1", "--appendonly", "yes"]
+    volumes:
+      - valkey-data:/data
+    networks:
+      - rutster-net
+
+volumes:
+  # /data — Caddy's cert/ACME state. Loss risks the Let's Encrypt
+  # duplicate-cert lockout (5/week — total inbound outage class).
+  # See docs/deploy/certificates.md (slice G) + TLS brief §5 risk 5.
+  caddy-data:
+  # /var/lib/valkey — stream/state persistence (ADR-0005).
+  valkey-data:
+
+networks:
+  rutster-net:
+    driver: bridge
diff --git a/deploy/s6-overlay-noarch.tar.xz b/deploy/s6-overlay-noarch.tar.xz
new file mode 100644
index 0000000..57f85ce
Binary files /dev/null and b/deploy/s6-overlay-noarch.tar.xz differ
diff --git a/deploy/s6-overlay-x86_64.tar.xz b/deploy/s6-overlay-x86_64.tar.xz
new file mode 100644
index 0000000..23cf532
Binary files /dev/null and b/deploy/s6-overlay-x86_64.tar.xz differ
diff --git a/deploy/s6-overlay.sha256sum b/deploy/s6-overlay.sha256sum
new file mode 100644
index 0000000..ba60a40
--- /dev/null
+++ b/deploy/s6-overlay.sha256sum
@@ -0,0 +1,2 @@
+4b0c0907e6762814c31850e0e6c6762c385571d4656eb8725852b0b1586713b6  s6-overlay-noarch.tar.xz
+ad982a801bd72757c7b1b53539a146cf715e640b4d8f0a6a671a3d1b560fe1e2  s6-overlay-x86_64.tar.xz
diff --git a/deploy/s6-rc.d/brain/dependencies.d/engine b/deploy/s6-rc.d/brain/dependencies.d/engine
new file mode 100644
index 0000000..91fd5a6
--- /dev/null
+++ b/deploy/s6-rc.d/brain/dependencies.d/engine
@@ -0,0 +1 @@
+# empty — brain waits for the engine before attempting the tap WS.
diff --git a/deploy/s6-rc.d/brain/run b/deploy/s6-rc.d/brain/run
new file mode 100755
index 0000000..d4596ff
--- /dev/null
+++ b/deploy/s6-rc.d/brain/run
@@ -0,0 +1,6 @@
+#!/command/execlineb -P
+# s6-rc service: rutster-brain-realtime. Shares the engine's network
+# namespace (T1 solo variant — the all-in-one is a single container so
+# loopback IS shared). The brain binds 127.0.0.1:8082 — the FOB reaches it
+# via RUTSTER_TAP_URL=ws://127.0.0.1:8082.
+exec /usr/local/bin/rutster-brain-realtime
diff --git a/deploy/s6-rc.d/caddy/dependencies.d/engine b/deploy/s6-rc.d/caddy/dependencies.d/engine
new file mode 100644
index 0000000..579788c
--- /dev/null
+++ b/deploy/s6-rc.d/caddy/dependencies.d/engine
@@ -0,0 +1 @@
+# empty file — s6-rc reads the basename as the dependency name.
diff --git a/deploy/s6-rc.d/caddy/run b/deploy/s6-rc.d/caddy/run
new file mode 100755
index 0000000..522ed6b
--- /dev/null
+++ b/deploy/s6-rc.d/caddy/run
@@ -0,0 +1,6 @@
+#!/command/execlineb -P
+# s6-rc service: caddy — the edge (ACME + TLS termination + WS proxy).
+# Depends on: engine (s6-rc starts the engine first per caddy/dependencies.d/engine).
+# User: root (caddy needs :80/:443).
+foreground { mkdir -p /data }
+exec /usr/local/bin/caddy run --config /etc/caddy/Caddyfile --adapter caddyfile
diff --git a/deploy/s6-rc.d/engine/dependencies.d/valkey-database b/deploy/s6-rc.d/engine/dependencies.d/valkey-database
new file mode 100644
index 0000000..73c1fb9
--- /dev/null
+++ b/deploy/s6-rc.d/engine/dependencies.d/valkey-database
@@ -0,0 +1,3 @@
+# empty — engine doesn't WAIT on valkey (it must boot even if valkey is down
+# per ADR-0005's fail-safe posture: EventSink counts-and-drops, never blocks).
+# The dependency just orders boot for consistent log sequencing.
diff --git a/deploy/s6-rc.d/engine/run b/deploy/s6-rc.d/engine/run
new file mode 100755
index 0000000..089ac05
--- /dev/null
+++ b/deploy/s6-rc.d/engine/run
@@ -0,0 +1,7 @@
+#!/command/execlineb -P
+# s6-rc service: rutster — the FOB. Runs the rutster binary (axum + media
+# thread + trunk WS + /metrics). Reads its env from the container env
+# directly (s6-overlay v3 inherits container env via s6-overlay-envdir —
+# this slice relies on the container env for simplicity; the per-service
+# env files are a future hardening step).
+exec /usr/local/bin/rutster
diff --git a/deploy/s6-rc.d/user/contents.d/brain b/deploy/s6-rc.d/user/contents.d/brain
new file mode 100644
index 0000000..e69de29
diff --git a/deploy/s6-rc.d/user/contents.d/caddy b/deploy/s6-rc.d/user/contents.d/caddy
new file mode 100644
index 0000000..e69de29
diff --git a/deploy/s6-rc.d/user/contents.d/engine b/deploy/s6-rc.d/user/contents.d/engine
new file mode 100644
index 0000000..e69de29
diff --git a/deploy/s6-rc.d/user/contents.d/valkey-database b/deploy/s6-rc.d/user/contents.d/valkey-database
new file mode 100644
index 0000000..e69de29
diff --git a/deploy/s6-rc.d/valkey-database/dependencies.d/engine b/deploy/s6-rc.d/valkey-database/dependencies.d/engine
new file mode 100644
index 0000000..d2aea58
--- /dev/null
+++ b/deploy/s6-rc.d/valkey-database/dependencies.d/engine
@@ -0,0 +1 @@
+# empty — orders valkey after engine in boot sequence.
diff --git a/deploy/s6-rc.d/valkey-database/run b/deploy/s6-rc.d/valkey-database/run
new file mode 100755
index 0000000..997cc91
--- /dev/null
+++ b/deploy/s6-rc.d/valkey-database/run
@@ -0,0 +1,7 @@
+#!/command/execlineb -P
+# s6-rc service: valkey-server — bus + KV + presence (ADR-0005). Dark on
+# day one except EventSink consumer; the operator contract (volumes, ports,
+# upgrade shape) is stable so the spend ledger + fleet directory land later
+# without changing the deployment shape (spec §2.1).
+foreground { mkdir -p /var/lib/valkey }
+exec /usr/local/bin/valkey-server --dir /var/lib/valkey --save 60 1 --appendonly yes
diff --git a/deploy/smoke/allinone_smoke.py b/deploy/smoke/allinone_smoke.py
new file mode 100755
index 0000000..d7d3d08
--- /dev/null
+++ b/deploy/smoke/allinone_smoke.py
@@ -0,0 +1,329 @@
+#!/usr/bin/env python3
+"""deploy/smoke/allinone_smoke.py — T1 all-in-one TLS smoke (deploy-B §9).
+
+Boots `rutster-allinone` with RUTSTER_LOCAL_CERTS=true (Caddy internal CA —
+no ACME in CI per spec §9), boots, extracts Caddy's internal-CA root cert
+from /data, opens a wss:// WS to /twilio/media-stream, sends Twilio's
+connected + start handshake frames, streams 200 PCM-zeroed frames at 20ms
+cadence, and asserts the engine replies with at least one text frame
+through the real edge->FOB WS path end-to-end through TLS.
+
+Python stdlib ONLY — no pip install required (the CI runner image ships
+Python 3 + ssl + socket + json + time). The WS handshake is hand-rolled
+for the same reason (websocket-client/websockets would require network
+during CI).
+
+Exit code 0 = smoke passed. Non-zero = failed (CI fails the smoke job).
+
+Reusable from: crates/rutster/tests/trunk_sim_e2e.rs (the #[ignore]'d TODO
+body sketch — this script implements the same handshake pattern against a
+real containerized binary rather than an in-process
+MockTwilioMediaStreamsServer) + crates/rutster-trunk/tests/ws_ping.rs (the
+connected/start frame sequence — same JSON shapes verbatim).
+"""
+
+import json
+import os
+import socket
+import ssl
+import struct
+import subprocess
+import sys
+import tempfile
+import time
+from base64 import b64encode
+
+IMAGE = os.environ.get("RUTSTER_ALLINONE_IMAGE", "rutster-allinone:smoke")
+CONTAINER_NAME = "rutster-allinone-smoke"
+HOST_PORT = int(os.environ.get("RUTSTER_ALLINONE_PORT", "18443"))
+DATA_VOLUME = "rutster-smoke-caddy-data"
+
+# 20ms of 8kHz u-law silence = 160 bytes; base64-encoded in a Twilio
+# Media event envelope (matches the slice-A trunk_sim_e2e.rs TODO pattern
+# + crates/rutster-trunk/tests/ws_ping.rs' frame shape).
+PCM_FRAME_BYTES = b"\x00" * 160
+FRAMES_TO_SEND = 200
+CADENCE_MS = 20
+RECV_DEADLINE_S = 10.0
+
+
+def log(msg: str) -> None:
+    print(f"[allinone_smoke] {msg}", flush=True)
+
+
+def fail(msg: str) -> "NoReturn":  # noqa: F821 — Python 3.11+ syntax
+    print(f"[allinone_smoke] FAIL: {msg}", file=sys.stderr, flush=True)
+    subprocess.run(
+        ["docker", "logs", CONTAINER_NAME], capture_output=False, timeout=10
+    )
+    sys.exit(1)
+
+
+def run(cmd, check=True, timeout=30.0) -> str:
+    """Run a command; return stdout. Fail the smoke on non-zero exit (if check)."""
+    log(f"$ {' '.join(cmd)}")
+    r = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
+    if check and r.returncode != 0:
+        print(f"  stdout: {r.stdout[-2000:]}", file=sys.stderr)
+        print(f"  stderr: {r.stderr[-2000:]}", file=sys.stderr)
+        fail(f"command exited {r.returncode}: {' '.join(cmd)}")
+    return r.stdout
+
+
+def bootstrap_container() -> None:
+    """Boot rutster-allinone with RUTSTER_LOCAL_CERTS=true."""
+    subprocess.run(["docker", "rm", "-f", CONTAINER_NAME],
+                   capture_output=True, timeout=10)
+    subprocess.run(["docker", "volume", "rm", "-f", DATA_VOLUME],
+                   capture_output=True, timeout=10)
+    env = [
+        "-e", "RUTSTER_DOMAIN=localhost",
+        "-e", "RUTSTER_ACME_EMAIL=smoke@example.com",
+        # CRITICAL: RUTSTER_LOCAL_CERTS=true makes Caddy use its internal CA
+        # — no ACME in CI (spec §9).
+        "-e", "RUTSTER_LOCAL_CERTS=true",
+        "-e", "RUTSTER_HTTP_BIND=0.0.0.0:8080",
+        "-e", "RUTSTER_MEDIA_BIND_IP=127.0.0.1",
+        "-e", "RUTSTER_MEDIA_PORT_RANGE=49160-49170",
+        "-e", "RUTSTER_DRAIN_DEADLINE_SECS=10",
+        "-e", "RUTSTER_TAP_URL=ws://127.0.0.1:8082",
+        # Twilio creds unset — WebRTC + media-stream WS smoke only.
+        "-p", f"{HOST_PORT}:443",
+    ]
+    run(["docker", "run", "-d", "--name", CONTAINER_NAME,
+         "-v", f"{DATA_VOLUME}:/data",
+         *env, IMAGE], timeout=120.0)
+    root_cert = wait_for_root_cert()
+    log(f"root cert extracted ({len(root_cert)} bytes)")
+    wait_for_healthz(root_cert)
+
+
+def wait_for_root_cert() -> bytes:
+    """Poll until Caddy wrote /data/caddy/pki/authorities/local/root.crt,
+    then docker cp it out. Caddy creates this on first boot with local_certs."""
+    deadline = time.time() + 30.0
+    while time.time() < deadline:
+        r = subprocess.run(
+            ["docker", "exec", CONTAINER_NAME, "test", "-f",
+             "/data/caddy/pki/authorities/local/root.crt"],
+            capture_output=True, timeout=5,
+        )
+        if r.returncode == 0:
+            r = subprocess.run(
+                ["docker", "cp",
+                 f"{CONTAINER_NAME}:/data/caddy/pki/authorities/local/root.crt", "-"],
+                capture_output=True, timeout=10,
+            )
+            if r.returncode == 0 and r.stdout:
+                return r.stdout
+        time.sleep(0.5)
+    fail("Caddy internal CA root cert did not appear within 30s")
+    return b""  # unreachable
+
+
+def wait_for_healthz(root_cert_pem: bytes) -> None:
+    """Curl /healthz through TLS using the extracted root cert."""
+    with tempfile.NamedTemporaryFile(suffix=".pem", delete=False) as f:
+        f.write(root_cert_pem)
+        ca_file = f.name
+    try:
+        deadline = time.time() + 30.0
+        r = subprocess.run(["true"])  # for the warning-less r init
+        while time.time() < deadline:
+            r = subprocess.run(
+                ["curl", "--cacert", ca_file, "-fsS",
+                 f"https://localhost:{HOST_PORT}/healthz"],
+                capture_output=True, text=True, timeout=5,
+            )
+            if r.returncode == 0 and r.stdout.strip() == "ok":
+                log("/healthz ok")
+                return
+            time.sleep(0.5)
+        fail(f"/healthz never returned ok within 30s (last stderr: "
+             f"{getattr(r, 'stderr', '')[-500:]})")
+    finally:
+        os.unlink(ca_file)
+
+
+# --- hand-rolled WS frame encode/decode (RFC 6455 §5) ---
+
+def make_ws_frame(payload: bytes, opcode: int = 0x1) -> bytes:
+    """Encode a client->server WS frame. opcode 0x1=text, 0x2=binary.
+    Client frames MUST be masked (RFC 6455 §5.3)."""
+    mask = os.urandom(4)
+    masked = bytes(b ^ mask[i % 4] for i, b in enumerate(payload))
+    header = bytearray([0x80 | opcode])  # FIN + opcode
+    n = len(payload)
+    if n < 126:
+        header.append(0x80 | n)
+    elif n < 65536:
+        header.append(0x80 | 126)
+        header.extend(struct.pack(">H", n))
+    else:
+        header.append(0x80 | 127)
+        header.extend(struct.pack(">Q", n))
+    header.extend(mask)
+    return bytes(header) + masked
+
+
+def read_ws_frame(sock) -> tuple:
+    """Read one WS frame from the server. Returns (opcode, payload).
+    Server frames are NOT masked (RFC 6455 §5.1).
+    Returns (-1, b"") on EOF."""
+    h1 = sock.recv(1)
+    if not h1:
+        return -1, b""
+    fin_opcode = h1[0]
+    h2 = sock.recv(1)[0]
+    masked = bool(h2 & 0x80)
+    length = h2 & 0x7F
+    if length == 126:
+        length = struct.unpack(">H", sock.recv(2))[0]
+    elif length == 127:
+        length = struct.unpack(">Q", sock.recv(8))[0]
+    if masked:
+        mask = sock.recv(4)
+    payload = b""
+    while len(payload) < length:
+        chunk = sock.recv(length - len(payload))
+        if not chunk:
+            break
+        payload += chunk
+    if masked:
+        payload = bytes(b ^ mask[i % 4] for i, b in enumerate(payload))
+    return fin_opcode & 0x0F, payload
+
+
+def open_wss():
+    """Open the wss:// WS handshake to /twilio/media-stream inside the
+    containerized all-in-one."""
+    sock = socket.create_connection(("localhost", HOST_PORT), timeout=5)
+    ctx = ssl.create_default_context(cafile=None)
+    r = subprocess.run(
+        ["docker", "cp",
+         f"{CONTAINER_NAME}:/data/caddy/pki/authorities/local/root.crt", "-"],
+        capture_output=True, timeout=10,
+    )
+    ctx.load_verify_locations(cadata=r.stdout.decode("ascii"))
+    ctx.check_hostname = False  # the cert is for "localhost" — Caddy's local_certs issues it
+    ssl_sock = ctx.wrap_socket(sock, server_hostname="localhost")
+    log(f"TLS established (cipher={ssl_sock.cipher()})")
+
+    key = os.urandom(16).hex()
+    handshake = (
+        f"GET /twilio/media-stream HTTP/1.1\r\n"
+        f"Host: localhost:{HOST_PORT}\r\n"
+        f"Upgrade: websocket\r\n"
+        f"Connection: Upgrade\r\n"
+        f"Sec-WebSocket-Key: {key}\r\n"
+        f"Sec-WebSocket-Version: 13\r\n"
+        f"\r\n"
+    )
+    ssl_sock.sendall(handshake.encode("ascii"))
+    buf = b""
+    while b"\r\n\r\n" not in buf:
+        chunk = ssl_sock.recv(4096)
+        if not chunk:
+            fail("WS upgrade response closed prematurely")
+        buf += chunk
+    if b"101 Switching Protocols" not in buf:
+        fail(f"WS upgrade did not return 101: {buf[:300]!r}")
+    log("WS upgraded (HTTP/1.1 101 Switching Protocols)")
+    return ssl_sock
+
+
+def send_twilio_handshake(sock) -> None:
+    """Send the Twilio Media Streams connected + start frames (the same
+    JSON sequence crates/rutster-trunk/tests/ws_ping.rs uses against the
+    in-process router — here against the real containerized edge->FOB path)."""
+    connected = json.dumps({
+        "event": "connected",
+        "protocol": "twilio-media-stream",
+        "version": "1.0.0",
+    })
+    start = json.dumps({
+        "event": "start",
+        "start": {"streamSid": "MZsmoke", "callSid": "CAsmoke"},
+    })
+    sock.sendall(make_ws_frame(connected.encode("utf-8")))
+    sock.sendall(make_ws_frame(start.encode("utf-8")))
+    log("sent Twilio connected + start handshake frames")
+
+
+def stream_pcm_frames(sock) -> int:
+    """Stream 200 PCM-zeroed frames at 20ms cadence as Twilio Media events.
+    Returns the count of text frames received back from the engine."""
+    received = 0
+    deadline_global = time.time() + (FRAMES_TO_SEND * CADENCE_MS / 1000.0) + RECV_DEADLINE_S
+    for _ in range(FRAMES_TO_SEND):
+        media_event = json.dumps({
+            "event": "media",
+            "media": {"payload": b64encode(PCM_FRAME_BYTES).decode("ascii")},
+        })
+        sock.sendall(make_ws_frame(media_event.encode("utf-8")))
+        # Drain non-blocking: read anything available without blocking the
+        # 20ms cadence.
+        sock.setblocking(False)
+        try:
+            while True:
+                op, _ = read_ws_frame(sock)
+                if op == -1:
+                    break
+                if op == 0x1:  # text frame — engine-originated event
+                    received += 1
+        except (BlockingIOError, ssl.SSLWantReadError):
+            pass
+        finally:
+            sock.setblocking(True)
+        time.sleep(CADENCE_MS / 1000.0)
+    sock.settimeout(RECV_DEADLINE_S)
+    try:
+        while time.time() < deadline_global:
+            op, _ = read_ws_frame(sock)
+            if op == -1:
+                break
+            if op == 0x1:
+                received += 1
+    except (socket.timeout, ssl.SSLWantReadError):
+        pass
+    return received
+
+
+def main() -> int:
+    log(f"image={IMAGE}, host port={HOST_PORT}")
+    bootstrap_container()
+    sock = open_wss()
+    send_twilio_handshake(sock)
+    received = stream_pcm_frames(sock)
+    log(f"sent {FRAMES_TO_SEND} frames; received {received} text frames back")
+    # TODO slice-A: re-enable engine-reply assertion.
+    # The `received >= 1` assertion depends on Plan A's hygiene wash being
+    # merged first: TCP_NODELAY (serve.rs serve_with_nodelay) so 20ms WS frames
+    # aren't Nagle-coalesced behind the Caddy edge, app-level WS pings so
+    # neither Twilio's nor Telnyx's idle timers can kill a quiet mid-call WS,
+    # config::twilio_credentials startup validation, RUTSTER_TWILIO_WEBHOOK_BASE
+    # derivation into the TwiML Stream URL, and RUTSTER_TRUSTED_PROXIES
+    # trusted X-Forwarded-Proto/Host reconstruction. The 200-frame streaming
+    # cycle is the verification surface pre-A (image built + WS handshake
+    # succeeds + frames flow through Caddy TLS) — that's what we assert until
+    # Plan A merges, then enable the engine-reply fail() assertion.
+    ASSERT_ENGINE_REPLY = True  # Set True once Plan A lands.
+    if received < 1:
+        if ASSERT_ENGINE_REPLY:
+            fail("expected at least one engine-originated text frame (mark/outbound)")
+        log("INFO: received 0 engine-originated frames — assertion deferred to slice A")
+    else:
+        log("PASS: real edge->FOB WS path through Caddy TLS verified — engine replied")
+    log("PASS: warm-cache image build + WS handshake + 200-frame stream cycle")
+    return 0
+
+
+if __name__ == "__main__":
+    try:
+        sys.exit(main())
+    finally:
+        # Always clean up the container + volume — even on FAIL.
+        subprocess.run(["docker", "rm", "-f", CONTAINER_NAME],
+                       capture_output=True, timeout=10)
+        subprocess.run(["docker", "volume", "rm", "-f", DATA_VOLUME],
+                       capture_output=True, timeout=10)
diff --git a/deploy/smoke/compose_smoke.sh b/deploy/smoke/compose_smoke.sh
new file mode 100755
index 0000000..0cc7571
--- /dev/null
+++ b/deploy/smoke/compose_smoke.sh
@@ -0,0 +1,92 @@
+#!/usr/bin/env bash
+# deploy/smoke/compose_smoke.sh — T2 compose smoke (deploy-B §9).
+#
+# Brings up deploy/compose.yaml with `docker compose up -d --wait`, asserts
+# every service reports healthy via `docker compose ps`, then curls
+# /healthz through Caddy's TLS (using the internal CA —
+# RUTSTER_LOCAL_CERTS=true is set in the smoke's env). The compose smoke
+# is intentionally lighter than the all-in-one smoke (which already proves
+# the WS path) — its job is to assert the four-service orchestrator shape
+# boots + the network_mode: "service:engine" brain->engine tap posture.
+#
+# The ValkeyEventSink-lands-in-stream assertion is slice C's concern.
+# Named hook below; do NOT implement it in this slice.
+
+set -euo pipefail
+
+cd "$(dirname "$0")/.."  # deploy/
+
+IMAGES_TAG="${RUTSTER_IMAGES_TAG:-smoke}"
+export RUTSTER_DOMAIN=localhost
+export RUTSTER_ACME_EMAIL=smoke@example.com
+export RUTSTER_LOCAL_CERTS=true
+export RUTSTER_HTTP_BIND=0.0.0.0:8080
+export RUTSTER_MEDIA_BIND_IP=127.0.0.1
+export RUTSTER_MEDIA_PORT_RANGE=49160-49170
+export RUTSTER_DRAIN_DEADLINE_SECS=10
+export RUTSTER_TAP_URL=ws://127.0.0.1:8082
+
+echo "[compose_smoke] overriding compose.yaml image tags -> :${IMAGES_TAG}"
+# Sed the image: tags from :latest to :smoke so CI's locally-built images
+# are picked up. In-place + restored on exit.
+cp compose.yaml compose.yaml.smoke-backup
+trap 'mv compose.yaml.smoke-backup compose.yaml' EXIT
+sed -i "s|image: rutster-edge:latest|image: rutster-edge:${IMAGES_TAG}|" compose.yaml
+sed -i "s|image: rutster-engine:latest|image: rutster-engine:${IMAGES_TAG}|" compose.yaml
+sed -i "s|image: rutster-brain:latest|image: rutster-brain:${IMAGES_TAG}|" compose.yaml
+
+echo "[compose_smoke] docker compose up -d --wait"
+docker compose up -d --wait --timeout 120
+
+echo "[compose_smoke] docker compose ps"
+docker compose ps
+
+# Each service should report "running" state. (Healthy flag is set by the
+# engine's /readyz via the Docker healthcheck — none of the shipped images
+# define a HEALTHCHECK yet; slice-G or a future hardening slice can add one.
+# For now State="running" + /healthz 200 + /readyz 200 is the gate.)
+HEALTHY_COUNT=$(docker compose ps --format json | jq '[.[] | select(.State == "running")] | length')
+EXPECTED=4
+if [ "$HEALTHY_COUNT" -ne "$EXPECTED" ]; then
+  echo "[compose_smoke] FAIL: expected $EXPECTED running services, got $HEALTHY_COUNT" >&2
+  docker compose logs
+  exit 1
+fi
+echo "[compose_smoke] $EXPECTED services running"
+
+# Caddy /healthz via TLS (internal CA). Port 443 is published by the caddy service.
+ROOT_CERT=$(docker compose exec -T caddy cat /data/caddy/pki/authorities/local/root.crt)
+echo "$ROOT_CERT" > /tmp/rutster-smoke-root.pem
+
+# Wait for /healthz to return 200 via Caddy TLS.
+for _ in $(seq 1 60); do
+  if curl --cacert /tmp/rutster-smoke-root.pem -fsS https://localhost/healthz \
+        | grep -q '^ok$'; then
+    echo "[compose_smoke] /healthz ok"
+    break
+  fi
+  sleep 0.5
+done
+curl --cacert /tmp/rutster-smoke-root.pem -fsS https://localhost/healthz \
+  || { echo "[compose_smoke] FAIL: /healthz never returned ok"; docker compose logs; exit 1; }
+
+# Engine /readyz — fresh boot, MUST be 200 (drain happens on shutdown, not
+# boot; cap only after RUTSTER_MAX_SESSIONS sessions exist).
+curl --cacert /tmp/rutster-smoke-root.pem -fsS https://localhost/readyz \
+  || { echo "[compose_smoke] FAIL: /readyz never returned ok"; docker compose logs; exit 1; }
+echo "[compose_smoke] /readyz ok"
+
+# TODO slice-C: assert lifecycle event in Valkey stream.
+# Slice C lands ValkeyEventSink (spec §5.6) + the assert-event-lands-in-
+# Valkey-stream smoke addition. The hook here documents the contract:
+#   Once slice C lands, this smoke runs:
+#     docker compose exec valkey valkey-cli XLEN rutster:events
+#   and asserts > 0 after a sim call completes (an EventSink::on_event
+#   call writes via XADD MAXLEN ~). Until then, the valkey service is dark
+#   (no consumers) — counting the stream length would always be 0.
+# Leaving the named hook so slice C's plan can grep for it.
+echo "[compose_smoke] PASS: T2 compose boots + /healthz + /readyz verified"
+
+# Cleanup (compose down; volumes left for warm cache on re-run).
+docker compose down --volumes --timeout 30 || true
+exit 0
diff --git a/deploy/smoke/reload_during_call.py b/deploy/smoke/reload_during_call.py
new file mode 100755
index 0000000..bf54eb2
--- /dev/null
+++ b/deploy/smoke/reload_during_call.py
@@ -0,0 +1,145 @@
+#!/usr/bin/env python3
+"""deploy/smoke/reload_during_call.py — Caddy config reload during a live
+sim call, asserting zero frame drops (deploy-B §9; spec §3.2; TLS brief
+§5 risk 1).
+
+Spec §3.2 mandates a CI e2e case for Caddy config-reload-during-live-call
+because the upstream mitigation (`stream_close_delay` in Caddyfile) has an
+open bug trail (caddy #6420, #7222) and is NOT trusted untested.
+
+This script reuses the all-in-one smoke's WS helpers (open wss://
+to /twilio/media-stream, send connected+start handshake); starts a streaming
+loop sending PCM frames at 20ms cadence; concurrently triggers a `caddy
+reload` mid-call (the operator's config-edit path); asserts the WS stays
+up across the reload + no frames are dropped (the recv count matches the
+sent count within tolerance).
+
+Exit code 0 = reload-during-call passed. Non-zero = failed.
+"""
+
+import json
+import os
+import subprocess
+import sys
+import threading
+import time
+from base64 import b64encode
+
+# Reuse the all-in-one smoke's WS helpers via import.
+sys.path.insert(0, os.path.dirname(__file__))
+from allinone_smoke import (  # noqa: E402
+    make_ws_frame, read_ws_frame, bootstrap_container,
+    open_wss, send_twilio_handshake, fail, log,
+    CONTAINER_NAME, IMAGE, HOST_PORT, PCM_FRAME_BYTES,
+)
+
+FRAMES_TO_SEND = 400          # 8s of wall clock at 20ms cadence
+CADENCE_MS = 20
+RELOAD_AT_FRAME = 150         # fire `caddy reload` 3s into the 8s call
+
+
+def trigger_caddy_reload() -> None:
+    """Run `docker exec rutster-allinone-smoke caddy reload` inside the
+    container. Caddy reloads its Caddyfile in-memory; stream_close_delay
+    24h should keep upgraded WS tunnels alive."""
+    log(f"triggering `caddy reload` at frame {RELOAD_AT_FRAME}...")
+    r = subprocess.run(
+        ["docker", "exec", CONTAINER_NAME,
+         "caddy", "reload", "--config", "/etc/caddy/Caddyfile",
+         "--adapter", "caddyfile"],
+        capture_output=True, text=True, timeout=30.0,
+    )
+    if r.returncode != 0:
+        log(f"caddy reload stderr: {r.stderr[-500:]}")
+    # We do NOT fail the smoke on a non-zero caddy reload — the smoke's
+    # question is "did the live WS survive?", not "did caddy reload work?"
+    # A failed reload is its own bug; the WS-drop is the caddy #6420/#7222
+    # concern this smoke is testing.
+
+
+def stream_frames_with_midcall_reload(sock):
+    """Returns (frames_sent, frames_received, ws_dropped_during_reload).
+    ws_dropped_during_reload is True if the WS read loop got EOF/exception
+    in the 1-second window after the reload fired."""
+    sent = 0
+    received = 0
+    ws_dropped = False
+    reload_fired = False
+    reload_time = 0.0
+
+    for i in range(FRAMES_TO_SEND):
+        if i == RELOAD_AT_FRAME and not reload_fired:
+            reload_fired = True
+            reload_time = time.time()
+            threading.Thread(target=trigger_caddy_reload, daemon=True).start()
+
+        media_event = json.dumps({
+            "event": "media",
+            "media": {"payload": b64encode(PCM_FRAME_BYTES).decode("ascii")},
+        })
+        try:
+            sock.sendall(make_ws_frame(media_event.encode("utf-8"), opcode=0x1))
+            sent += 1
+        except (BrokenPipeError, ConnectionResetError) as e:
+            log(f"WS send failed at frame {i}: {e}")
+            if not reload_fired or (time.time() - reload_time) < 2.0:
+                ws_dropped = True
+            break
+
+        # Non-blocking drain.
+        import socket as _socket
+        sock.setblocking(False)
+        try:
+            while True:
+                op, _ = read_ws_frame(sock)
+                if op == -1:
+                    break
+                if op == 0x1:
+                    received += 1
+        except (BlockingIOError, ):
+            pass
+        finally:
+            sock.setblocking(True)
+        time.sleep(CADENCE_MS / 1000.0)
+
+    return sent, received, ws_dropped
+
+
+def main() -> int:
+    log(f"image={IMAGE}, host port={HOST_PORT}")
+    bootstrap_container()
+    sock = open_wss()
+    send_twilio_handshake(sock)
+    sent, received, ws_dropped = stream_frames_with_midcall_reload(sock)
+    log(f"sent={sent}, received={received}, ws_dropped={ws_dropped}")
+    # TODO slice-A: re-enable zero-drop assertion.
+    # The `ws_dropped` + `sent == FRAMES_TO_SEND` assertions together verify
+    # that the Caddy `stream_close_delay 24h` mitigation works against the
+    # open bug trail caddy #6420, #7222 (TLS brief §5 risk 1). Until Plan A
+    # merges (TCP_NODELAY + WS pings + trusted-proxy reconstruction), the
+    # WS-path behavior under a caddy reload is not yet trustworthy under
+    # containerized TLS — Plan A lands the hygiene that makes these assertions
+    # meaningful (without NODELAY + pings, WS frames may coalesce / quiet WS
+    # may die mid-reload for non-Plan-A reasons unrelated to stream_close_delay).
+    ASSERT_ZERO_DROPS = True  # Set True once Plan A lands.
+    if ws_dropped:
+        if ASSERT_ZERO_DROPS:
+            fail("WS dropped during caddy reload — stream_close_delay mitigation "
+                 "failed (caddy #6420/#7222) — the configuration MUST be re-evaluated")
+        log("INFO: ws_dropped=True — assertion deferred to slice A")
+    if sent != FRAMES_TO_SEND:
+        if ASSERT_ZERO_DROPS:
+            fail(f"sent only {sent} of {FRAMES_TO_SEND} frames — WS died before reload")
+        log(f"INFO: sent only {sent} of {FRAMES_TO_SEND} — assertion deferred to slice A")
+    log("PASS: caddy reload-during-call cycle executed; assertion deferred to slice A")
+    return 0
+
+
+if __name__ == "__main__":
+    try:
+        sys.exit(main())
+    finally:
+        subprocess.run(
+            ["docker", "rm", "-f", CONTAINER_NAME],
+            capture_output=True, timeout=10,
+        )