Lock in the four open questions resolved during session 1: - Gateway recovery uses BetterAuth cookie (not nonce file or rescue flag) - Sub-package command surface scope is acceptable as-is for this mission - Telemetry upload ships in dry-run mode until mosaicstack.dev server exists - Top-level mosaic config command is required (added as CU-04-04) Also: - Mark CU-02-01/02/03 done; milestone cu-m02 complete - Mission progress 2/8, phase -> Execution - CU-03-01 compressed from spike to plan-only (design locked) - Added CU-04-04 mosaic config and CU-04-05 tests - Full handoff block in scratchpad: state, decisions, gotchas, suggested starting tasks for session 2 No code changes. Docs-only. Session 1 closes clean for handoff. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>