docs: #1816 brief (Case 1/2 host fixes F1-F6 for the 433 P1 rerun, mos-1532/1534/1536/1537) and agents/gladstone/README.md registering the Codex builder seat; docs only

agents/gladstone/README.md

@@ -0,0 +1,9 @@
+# Gladstone
+
+Builder seat, Codex gpt-6.1-sol, started by Mos (mos-1531, mos-1532). Owns the Case 1/2 host fixes for the 433 P1 rerun,
+F1 to F6 (#1816, Vikunja 614).
+
+No launcher in this directory. The seat runs as a T3 thread (thread 433058fc) and works in its own worktree. It has no
+credentials of its own; it pushes only its own `gladstone/*` branches through the repository credential helper (mos-0981),
+never `refactor`, `main` or another seat's branch. Claude seats orchestrate and review (Q245). Registered by Sage on
+2026-10-23 so the queue can name the seat as row owner (store.mjs isSeatDir).

docs/plans/2026-10-23_host-fixes-1816-brief.md

@@ -0,0 +1,57 @@
+# Brief: Case 1/2 host fixes for the 433 P1 rerun
+
+Sage, 2026-10-23, filed for Mos (mos-1532). Issue #1816, Vikunja 614. On the 10-27 path.
+
+## Brief: hostcheck item 5, bundle verify, case2-unit @, stack-copy cwd
+
+ops-01 found two defects in the 433 P1 Run A on VM 1013 (ops-0256). Row 240 (c515273db) introduced the first one.
+
+1. `scripts/case1-hostcheck.sh:117` compares `dpkg-statoverride --list /usr/bin/bwrap` to the literal
+   `root mosaic 0750 /usr/bin/bwrap`. dpkg 1.22.6 on Ubuntu 24.04 prints `750`, so item 5 FAILs on every
+   correctly built host. The apt hook and mosaic-hostcheck.service then close bwrap and write DRIFT. The fake
+   at `packages/cli/tests/case1-hostcheck.test.mjs:73` writes `0750`, so the suite missed it.
+2. `docs/guides/host-run-sheet.md:192` and `:209` run `git bundle verify` outside a repository, which fails on
+   a fresh host.
+
+The fix:
+- Item 5 accepts `750` and `0750` as the same mode for the statoverride line. Owner, group and path stay exact,
+  and every other mode still fails. The stat check at :118 is unchanged.
+- The run sheet verifies the bundle inside an empty bare scratch repo, as `scripts/stack-copy.sh:91-93` does.
+  A failure there prints a FAIL line and does not `exit` the interactive root shell (Morgana N1, sage-3743).
+
+Tests are append-only blocks in case1-hostcheck.test.mjs (mos-1272 pre-approved by Mos: 0 lines deleted, the :73
+fake unchanged). They cover: a `750` statoverride passes; `0750` still passes; `755`, `0755`, `7500`, `075`, `00750`, a tab
+or doubled space, and a wrong owner or group fail. Any other change to an existing test goes to Mos first.
+
+Scope add (mos-1534):
+3. F3: `scripts/case2-unit.sh:62` plain() rejects `@`, so the run sheet's required `--claude` path
+   (host-run-sheet.md:85-89, `@anthropic-ai`) refuses on every host (ops-0258, section 10). plain() accepts `@`.
+   The :61 comment doesn't list it as unsafe, so no requirement changes.
+4. F4: `scripts/stack-copy.sh` fails when run as mosaic from a cwd mosaic can't read: the sheet's `sudo -u mosaic`
+   lines and stack-upgrade.sh AS_USER at :154 and :293. It works from any cwd.
+Specs and test terms are in mos-1534. Mos pre-approved append-only test blocks in case2-unit.test.mjs under mos-1272.
+One new N carries F1 to F4 for the #433 rerun.
+
+Owner Gladstone. Reviewer Morgana. Gate: Morgana approves. Mutants are killed: dropping the `750` form, widening the
+match to any mode, rejecting `@` again in plain(), and the F4 cwd fix reverted. The touched test files run whole, and Sage's full landing gate runs every
+package suite and every `scripts/test-*.sh`. After landing, Mos sends ops-01 the new N for a full 433 P1 rerun.
+No hostcheck install on .53 or .54 until it lands.
+
+Scope add (mos-1536, ops-0260):
+5. F5: on a host that follows the run sheet, `mosaic-bus@<business>` exits 3 because nothing writes
+   `<dataRoot>/notify/<business>/notify.json` (bus cli.mjs:104-122 requires it, README :876-892), and case2-precheck
+   has no line for it, so it passed with the bus down. The run sheet gains a step that writes binding `null` as the
+   default, and case2-precheck gains a notify line with tests. Install does not write the file: the README wants an
+   explicit decision. A named binding for .53 is a later per-host choice that needs Mos's go. Spec in mos-1536.
+Gate adds a mutant: the precheck notify line removed or passing on a missing file. #1816 carries F1 to F5.
+
+Scope add (mos-1537, ops-0261):
+- F5 fixture: Mos OK under mos-1272 for the host(t) notify fixture in case2-unit.test.mjs and the world(t) one in
+  case2-install.test.mjs (a 0700 notify/acme dir and a null notify.json, with no assertion changed or deleted).
+  Conditions: the negative F5 tests build their host without the file; one append-only install test shows
+  notify.json bytes and mode are unchanged after install; the fixture lines are their own follow-up commit.
+- Section 9a creates both `notify/` and `notify/<business>` at 0700 (ops-0261 measured a 755 parent).
+6. F6: sheet :235 runs `stack-copy.sh check`, which requires `$HOME/.npm-global/bin/mosaic` (stack-copy.sh:160-173).
+   Nothing creates it: install runs only `copy` (:178), bootstrap has no .npm-global, and the sheet has no wrapper
+   step. The sheet gains a step after install: as mosaic from cwd `/`, create the bin dir, then run
+   `wrapper <sha> --create`, naming the Mos gate (stack-copy.sh:3). No requirement change. #1816 carries F1 to F6.