6c6b4f33ac
All checks were successful
ci/woodpecker/pr/ci Pipeline was successful
`mosaic update`'s framework reseed runs install.sh with MOSAIC_SYNC_ONLY=1, which exits after the file-system phase — before the post-install step that runs mosaic-link-runtime-assets, the only place the #869 Point-1 C2 install-ordering guard decided whether the lease-enforcement hooks (mutator-gate.py / receipt-observer-client.py) get wired into ~/.claude/settings.json. `mosaic update` therefore never re-evaluated that wiring decision (Point-2 precondition, Option C per Mos's ruling). Add `runUpdatePathSettingsGuard` (reuses `runInstallOrderingGuard` from install-ordering-guard.ts directly — no forked logic) and extract the `mosaic update` reseed flow into the testable `runUpdateReseedFlow`, which invokes the settings guard immediately after a successful reseed and surfaces its fail-loud/opt-out output to the operator. `--no-reseed` is a pure no-op (nothing reseeded, nothing to re-link). Threads a new `--allow-inactive-enforcement` flag on `mosaic update`, matching install. Part of #882 (resolves the (b) --sync-only Point-2 precondition) Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>