stack/docs/remediation/BOARD-LEDGER.md

D-1 / P-ACTIVATION + hygiene — committed .npmrc hard-pins store-dir=/root/.local/share/pnpm/store.

Correct for the CI container (runs as root), fatal for EVERY non-root local checkout: EACCES on /root/.local/share/pnpm/store/v10/server/server.json. A committed config that only works on one runtime is exactly the activation-skew class. Fix candidate: make store-dir env-overridable, not hardcoded.

D-3 / P-FLEET-001 — the seats running this mission are UNMANAGED. mos-remediation, rev-974,

planner-opus, planner-sol appear in NO roster (~/.config/mosaic/fleet/roster.yaml, agents/). Planners run on socket default; the roster declares mosaic-fleet. This is the exact "one roster-owned socket/host + quarantine unmanaged + stale GC" failure P-FLEET-001 indicts — observed on the remediation mission's own fleet. Prerequisite for INBOX identity-addressing.

D-2 / hygiene — husky prepare fails EPERM copying into root-owned .husky/_/. Repo working

tree has root-owned dirs (.husky/, repo root) under a non-root agent. Worked around with the intended HUSKY=0 escape hatch (does NOT disable the existing pre-commit/pre-push hooks).

D-5 / P-QUEUE-001 + P-CONFORMANCE-001 — KEYSTONE: an inert gate that erased its own evidence.

Merged PR #868 (b79336a8) shipped a file that FAILS pnpm format:check ⇒ the CI format gate did not block. An unrelated later PR (#872) then reformatted that file via its own lint-staged, so main went green again and nobody learned the gate had failed to fire. Verified blob-level under the repo's own config. Detection must be per-merge-commit against that commit's own tree — a "is main green today" check reports all-clear on this exact defect. Binding on RM-02/RM-55. Full chain in TASKS.md §1a. NOT quiet-patched, by Mos's ruling: patching the symptom destroys the signal.

D-4 / P-LIFECYCLE + hygiene — a dispatched agent silently IGNORED an in-message context reset.

planner-sol was at 64.3%/372k; the brief asked it to reset first; it began work on dirty context anyway. Only an out-of-band /new driven by the orchestrator guaranteed clean state. Confirms the postmortem thesis: instructions are not enforcement. Reset must be a mechanical pre-dispatch step, not a request.

D-7 / P-FLEET-001 — stale-GC-on-disk: shared 30G /tmp hit 100% ENOSPC, degrading two seats.

~5.2G was session scratch dead 8-9 days (this session's own footprint: 88K). Same missing capability as orphaned-tmux-session GC, applied to disk — not a quota or discipline problem. Resolved manually by Mos (lead coordinator) after independent verification; /tmp now 79%. The gap IS the finding: the authority to reap exists, the deterministic reaper does not. Folded into RM-50 with explicit requirements (mechanical liveness, age threshold, dry-run, audit event per reap — never a heuristic sweep). Refusing to unilaterally delete another session's scratch was correct doctrine; the fix is a reaper, not braver agents.

D-6 / P-QUEUE-001 — the mandated queue guard returned PASS on an UNKNOWN state, live, today.

Running the required ci-queue-wait.sh --purpose push before pushing produced state=unknown ... exit 0 — the exact defect at ci-queue-wait.sh:282-288 that PR #1023 is parked on. It also evaluated branch=main rather than the branch being pushed. The mission's own required pre-push gate passed me on an indeterminate result. Third independent live instance of the class.

D-8 / P-CONFORMANCE-001 — a PRE-REGISTERED acceptance check that was not runnable as written.

PR #1025 AC2's fixture mkdir -p apps/*/venv/lib creates a literal apps/*/venv/lib dir when the glob is unmatched — it did not test what it claimed. rev-974 ran it exactly as written, caught it, re-ran the intended assertion at an explicit path, and disclosed rather than silently substituting a working fixture and reporting PASS. Pre-registration protects a check from being retrofitted to the implementation; it does not make the check correct. An unverified gate appeared inside the mechanism built to catch unverified gates. Hard requirement on RM-02: the registry must self-verify that every registered case runs AND can fail — presence is not evidence.

Decisions log — full record in TASKS.md

All 44 findings (D-1…D-6 in BOARD-LEDGER.md, D-7…D-43 + D-38c in TASKS.md) and every ruling with its rationale live there. Not duplicated here — a second copy is a second thing to go stale, which this board had done three times in one night (gate list, capability registry, DECISION-1 status), and three more times by the next rotation seam (RM-61 "building", "nothing implemented yet", DECISION-1/2/3 "must be ruled"). The rulings a fresh seat needs are items 4–7 above; they are not repeated here, because that repetition is what went stale.

Sequencing — see MISSION.md

Builds 1-5, the cross-cutting retirements, and DECISION-1's corrected wire-in target are stated once in the charter and TASKS.md §5. Not repeated here — the previous copy of DECISION-1's status on this board is one of the six stale restatements below.

• Capability is per-path (D-11b → superseded in part by D-13/D-15): a token file is necessary, not sufficient. Three layers — token file (raw-API), tea login (tea paths), repository permission (writes). Before dispatch, assert permissions.push == true as that seat, not token existence and not a 200 on a read. Mos owns provisioning; escalate missing pairs.
• Seat identity (D-11a): token identity AND git config user.name/user.email must BOTH be set and agree. Exporting MOSAIC_GIT_IDENTITY alone does NOT fix commit authorship.

Why the board must not restate the delivery gates (D-26)

Restating the gate from memory is how the merge-gate step went missing from mission setup twice, once inside the correction for it (D-26).

Fleet seats

• mos-remediation — project orchestrator (Claude, /src/mosaic-stack, socket mosaic-fleet) — ACTIVE
• planner-opus — adversarial planner (robustness), Opus 5, socket default — DELIVERED, idle
• planner-sol — adversarial planner (pragmatic), gpt-5.6-sol, socket default — DELIVERED, idle
• rev-974 — mosaicstack reviewer identity (id 16, write:repository) — idle, on call
• Mos (mos-claude) — lead coordinator, socket default — relay path to Jason