test(row320): reproduce an unsearchable inherited cwd and restore cleanup (#1816). Untested

BUILD-LOG.md

@@ -5421,3 +5421,5 @@ Row 299 (573, #1806, Gander, Filbert): before, the P10 band test timed a fault r
 2026-10-23 | Gladstone | #1816 / Vikunja 614 fixture ruling mos-1537 | Added only three setup lines each to host(t)/world(t) for the explicit null notifier decision. Existing assertions/fakes/lines intact. New install test checks decision bytes/mode preserved and missing decision remains absent. F5 missing-file fault removes the setup file. Untested under Sage's hold; separate follow-up atop 33950cf9b.
 
 2026-10-23 | Gladstone | #1816 / Vikunja 614 F6 and notify parent (mos-1537) | Before: the run sheet's copy check lacks its required CLI wrapper; mkdir -p -m does not guarantee the notify parent mode. After: a separately Mos-gated wrapper --create step follows install and precedes check, as mosaic from cwd /; section 9a explicitly creates both notify directories at 0700. Docs only, no live action; Node/tests still held.
+
+2026-10-23 | Gladstone | Row320 / #1816 first review CHANGES (morgana-0217) | Reviewer run: hostcheck19/19, unit47/47, install24/24, copy17/18; seven of eight mutants killed, M4 survived because both base/mutant failed only cleanup. Fixed this row's F4 test to enter cwd then chmod000, assert no read/search, pass an absolute outside bundle, and restore0700 in finally. Existing tests/setup and production scripts unchanged. Correction untested locally pending Morgana's focused rerun; no acceptance claim.

agents/gladstone/work/queue-320/BUILD.md

@@ -251,3 +251,54 @@ Numstat for this follow-up: host-run-sheet.md +1/-1; BUILD.md +9/-0.
 Static receipt: git diff --check passed.
 
 Correction: 0f3d874d4 added 10 BUILD.md lines, not 9; the git numstat is authoritative.
+
+## First review run and F4 test correction (morgana-0217)
+
+Morgana ran af201b4a9 (6fa47e07d only relocates this file) under her authorized
+slot with timeout -k 10 and TMPDIR under /mnt/storage/scratch/tmp. Receipts:
+/mnt/storage/scratch/morgana-g320-out/base-summary.txt and mutants-summary.txt.
+
+| Targeted file | Passed | Failed |
+|---|---:|---:|
+| case1-hostcheck.test.mjs | 19 | 0 |
+| case2-unit.test.mjs | 47 | 0 |
+| case2-install.test.mjs | 24 | 0 |
+| stack-copy.test.mjs | 17 | 1 |
+
+Seven of eight mutants were killed: M1 literal0750, M2 anymode, M3a drop@,
+M3b allow$, M5 drop shell block, M5b drop private_dir, M5c always NOTIFY ok.
+M4 drop cd / SURVIVED: base and mutant both failed only setup's cleanup hook.
+This is a test defect, not a green acceptance result. The 0111 cwd retained
+search permission and did not reproduce the inaccessible inherited cwd. It
+also blocked setup's chmod -R cleanup because the directory remained unreadable.
+
+B1 correction touches only this row's appended F4 test: the child shell enters
+an initially searchable directory, chmods it 000, checks both ! -r and ! -x, then
+execs stack-copy. The parent asserts all read/search bits remain cleared. The
+bundle now lives outside cwd and is passed absolutely, matching the real flow;
+existing row232 coverage still tests relative bundles from an accessible cwd.
+Both bundle and checkout paths remain covered.
+B2 correction: each child run/assertion sequence has a finally that restores the
+cwd to0700 before setup's existing cleanup. No old setup/test lines change.
+Production scripts are unchanged; the cd / fix remains correct by static review.
+
+Correction is untested locally: no builder Node/test CLEAR was given. Morgana
+will rerun stack-copy whole, M4 and residue cleanup on the pushed correction;
+other files need no rerun unless changed. git diff --check passed.
+
+## F4 corrected candidate numstat against 93694c518 (added / deleted)
+
+| File | Added | Deleted |
+|---|---:|---:|
+| `BUILD-LOG.md` | 12 | 0 |
+| `agents/gladstone/work/queue-320/BUILD.md` | 304 | 0 |
+| `docs/SESSIONS.md` | 1 | 0 |
+| `docs/guides/host-run-sheet.md` | 51 | 2 |
+| `packages/cli/tests/case1-hostcheck.test.mjs` | 48 | 0 |
+| `packages/cli/tests/case2-install.test.mjs` | 18 | 0 |
+| `packages/cli/tests/case2-unit.test.mjs` | 68 | 0 |
+| `packages/cli/tests/stack-copy.test.mjs` | 22 | 0 |
+| `scripts/case1-hostcheck.sh` | 2 | 2 |
+| `scripts/case2-precheck.sh` | 19 | 0 |
+| `scripts/case2-unit.sh` | 1 | 1 |
+| `scripts/stack-copy.sh` | 3 | 0 |

packages/cli/tests/stack-copy.test.mjs

@@ -350,16 +350,22 @@ test('row 232: check --units external reads the system units, the default reads
 
 test('Vikunja 614: bundle and checkout copy leave an unreadable caller directory before find',t=>{
  const s=setup(t),cwd=join(s.root,'unreadable');mkdirSync(cwd);
- const bundle=join(cwd,'release.bundle');git(s.repo,'bundle','create','-q',bundle,'refactor');
- chmodSync(cwd,0o111);
- // Execute permission permits entry and named-file lookup; directory reads must fail.
- assert.notEqual(spawnSync('/bin/ls',['-a','.'],{cwd,encoding:'utf8'}).status,0);
- for(const [name,args] of [['bundle',['copy','--bundle','release.bundle',s.id]],['checkout',['copy',s.id]]]){
+ const bundle=join(s.root,'release.bundle');git(s.repo,'bundle','create','-q',bundle,'refactor');
+ // Enter while searchable, then reproduce a cwd inherited across a uid drop:
+ // the caller can neither read nor search it. Absolute bundle lookup must work.
+ const enter='cd "$1" && chmod 000 . && [ ! -r . ] && [ ! -x . ] && shift && exec "$@"';
+ for(const [name,args] of [['bundle',['copy','--bundle',bundle,s.id]],['checkout',['copy',s.id]]]){
   const copies=join(s.root,`copies-${name}`);
-  const r=spawnSync(join(s.repo,'scripts','stack-copy.sh'),[...args,'--copies',copies],{cwd,env:s.env,encoding:'utf8',timeout:30000});
-  assert.equal(r.status,0,r.stdout+r.stderr);
-  assert.doesNotMatch(r.stderr,/Failed to restore initial working directory|Permission denied/);
-  assert.ok(existsSync(join(copies,s.id,'scripts','mosaic')));
-  assert.equal(statSync(join(copies,s.id)).mode&0o777,0o555);
+  try{
+   const r=spawnSync('/bin/sh',['-c',enter,'stack-copy-cwd',cwd,join(s.repo,'scripts','stack-copy.sh'),...args,'--copies',copies],{env:s.env,encoding:'utf8',timeout:30000});
+   assert.equal(statSync(cwd).mode&0o555,0,'the inherited cwd is neither readable nor searchable');
+   assert.equal(r.status,0,r.stdout+r.stderr);
+   assert.doesNotMatch(r.stderr,/Failed to (restore initial working|change) directory|Permission denied/);
+   assert.ok(existsSync(join(copies,s.id,'scripts','mosaic')));
+   assert.equal(statSync(join(copies,s.id)).mode&0o777,0o555);
+  }finally{
+   // Restore even after a failed assertion/mutant, before setup's recursive cleanup.
+   chmodSync(cwd,0o700);
+  }
  }
 });