test(installer): add approved explicit notifier fixtures (#1816, mos-1537). Untested

BUILD-LOG.md

@@ -5417,3 +5417,5 @@ Row 299 (573, #1806, Gander, Filbert): before, the P10 band test timed a fault r
 2026-10-23 | Gladstone | #1816 / Vikunja 614 scope amendment mos-1534, sage-3741 | F1 narrowed to exact 750/0750 and single spaces; F3 allows @ in absolute unit paths with unsafe-character refusals retained; F4 moves copy_tree to / after path resolution. AS_USER audit found git -C and stack-release's existing checkout cd cover the other steps. Added new unit and unreadable-cwd copy tests only. Untested under Sage's no-Node hold; no live action.
 
 2026-10-23 | Gladstone | #1816 / Vikunja 614 F5 draft (mos-1536) | Before: the run sheet omits the explicit notify decision and precheck misses a bus-start refusal. After: section 9a creates a private null-binding decision as mosaic; precheck directly reuses readNotifyConfig and private_dir, and new tests cover accepted and refused decisions. Existing fixture setup additions await Mos approval through Sage; installer unchanged. Untested under no-Node hold.
+
+2026-10-23 | Gladstone | #1816 / Vikunja 614 fixture ruling mos-1537 | Added only three setup lines each to host(t)/world(t) for the explicit null notifier decision. Existing assertions/fakes/lines intact. New install test checks decision bytes/mode preserved and missing decision remains absent. F5 missing-file fault removes the setup file. Untested under Sage's hold; separate follow-up atop 33950cf9b.

agents/gladstone/work/hostcheck-item5/BUILD.md

@@ -177,3 +177,27 @@ that the old positive precheck tests pass without the pending setup changes.
 | `scripts/case2-precheck.sh` | 19 | 0 |
 | `scripts/case2-unit.sh` | 1 | 1 |
 | `scripts/stack-copy.sh` | 3 | 0 |
+
+## Fixture approval and separate follow-up (mos-1537)
+
+Mos approved exactly setup-only additions to case2-unit.test.mjs host(t) and
+case2-install.test.mjs world(t): each gets three added lines for a 0700
+notify/acme directory and 0600 notify.json with {"notifyVersion":1,"binding":null}.
+No existing line, fake or assertion changes or is deleted. F5's missing-file
+negative case removes the file after setup, so the new default cannot mask it.
+The newly appended install test checks preserved bytes and mode after success,
+and separately removes the decision before install and checks it stays absent.
+case1-accept.test.mjs is unchanged. This follow-up is committed separately on
+33950cf9b as directed, with no amend. No Node/tests run; suite claims remain open.
+Morgana-0211 found F5 source/run sheet CLEAN statically; the setup prerequisite B1
+is addressed by this approved fixture patch, pending execution.
+
+Additional planned mutants from Morgana-0211 (unrun): M5b drops private_dir,
+killed by the directory fault; M5c prints NOTIFY ok unconditionally, killed by
+the document faults. Existing test preservation is checked by git diff showing
+only additions (numstat below).
+
+Fixture follow-up numstat: case2-unit.test.mjs +3/-0,
+case2-install.test.mjs +18/-0. Against the original base: case1-hostcheck.test.mjs
++48/-0, case2-unit.test.mjs +68/-0, stack-copy.test.mjs +16/-0,
+case2-install.test.mjs +18/-0. git diff --check passed.

packages/cli/tests/case2-install.test.mjs

@@ -84,6 +84,9 @@ mkdir -p "$4/$2/scripts" && : >"$4/$2/scripts/mosaic" && echo "copied: $4/$2"`);
   mkdirSync(join(sys, "kernel"), { recursive: true });
   writeFileSync(join(sys, "net", "ipv4", "ip_unprivileged_port_start"), "1024\n");
   writeFileSync(join(sys, "kernel", "apparmor_restrict_unprivileged_userns"), "1\n");
+  const notify = join(home, ".mosaic-dev", "notify", "acme");
+  mkdirSync(notify, { recursive: true, mode: 0o700 });
+  writeFileSync(join(notify, "notify.json"), '{"notifyVersion":1,"binding":null}\n', { mode: 0o600 });
   return {
     root, home, configDir, secrets, input, staging, bin, log, units, sys, doc,
     config: join(configDir, "config.json"),
@@ -399,3 +402,18 @@ test("--library-status takes no --profile", (t) => {
   const r = precheck(x, { args: ["--business", "acme", "--library-status", "--profile", "library"] });
   assert.equal(r.code, 4, r.out);
 });
+
+test("Vikunja 614: install preserves the explicit notifier decision bytes and mode and creates none when absent", (t) => {
+  const x = world(t);
+  const file = join(x.dataRoot, "notify", "acme", "notify.json");
+  const before = readFileSync(file), beforeMode = mode(file);
+  const r = install(x);
+  assert.equal(r.code, 0, r.out);
+  assert.deepEqual(readFileSync(file), before);
+  assert.equal(mode(file), beforeMode);
+  const absent = world(t), missing = join(absent.dataRoot, "notify", "acme", "notify.json");
+  rmSync(missing);
+  const fresh = install(absent);
+  assert.equal(fresh.code, 0, fresh.out);
+  assert.equal(existsSync(missing), false);
+});

packages/cli/tests/case2-unit.test.mjs

@@ -626,6 +626,9 @@ function host(t, { roles = {}, vars = {}, keyFile = `ZAI_API_KEY=${FIXTURE_KEY}\
   script(join(bin, "id"), `if [ "$1" = -G ]; then echo "\${CASE2_TEST_GROUPS:-${GID}}"; else exec /usr/bin/id "$@"; fi`);
   script(join(bin, "node"), `if [ "$1" = --version ]; then echo "\${CASE2_TEST_NODE:-v24.3.0}"; exit 0; fi\nexec '${process.execPath}' "$@"`);
   script(join(bin, "bwrap"), `exit "\${CASE2_TEST_BWRAP:-0}"`);
+  const notify = join(home, ".mosaic-dev", "notify", "acme");
+  mkdirSync(notify, { recursive: true, mode: 0o700 });
+  writeFileSync(join(notify, "notify.json"), '{"notifyVersion":1,"binding":null}\n', { mode: 0o600 });
   return { root, home, configDir, config, secrets, units, sys, bin, dataRoot: join(home, ".mosaic-dev") };
 }