# #1050 C1 fix-round verification

Frozen reviewed head before remediation: `378bc1afe3bc485adb8614897d66c5edccd4a527`.

Status: **believed-fixed, pending jarvis validation**. PR #1054 is not self-merged and issue #1050 remains open.

## Blocker B — fail-closed test enumeration

The RED-first control used a real filesystem permission failure, not binary shadowing or PATH interception.

1. A planted `{"status":"in-progress"}` file in a readable P2 fault tree made the complete real walk fail the frozen suite at `P2 left an in-progress transaction` (`01-pre-fix-positive-control.log`, exit 1).
2. The same planted defect beneath a target-owned mode-0100 directory made real `find` report a permission failure. The frozen suite erased the producer failure and exited 0 with `installer next lane tests passed` (`02-pre-fix-permission-failure-attack.log`).
3. The committed regression control initially failed because the child full-suite attack still exited 0 (`03-regression-test-red.log`).
4. After remediation, the same child full-suite input exits 1 and names `[test] ERROR: P2 fault-state enumeration failed` (`04-post-fix-permission-failure-attack.log`). The ordinary full suite remains green.

`tools/test-enumeration-assertions.sh` now captures each complete NUL-delimited population and checks the producer status before asserting absence. Content checks inspect the captured population and distinguish “no match” from a read error. The shared fail-closed implementation covers:

- `tools/install-next-lane.test.sh`: redacted staging-file cleanup and fault-state transaction scan;
- `tools/verified-installer-fetch.test.sh`: temporary-download cleanup;
- `tools/install-state-machine.test.sh`: symlink-target non-mutation;
- `docs/reports/verification/1050-b8-redaction-control/positive-control.test.sh`: both copied counterparts.

No assertion was loosened. A1, A2, upgrade-guard, source-root, the species-2 sweep, #869, and expected-RED verdict rows remain outside this remediation.

## Blocker A — installer digest

The stale sidecar value was replaced with the exact `sha256sum` record for `tools/install.sh`:

```text
e59cb441a2f37ae9150f8eae470238e9d858a1816df93343d9784a6796676096  install.sh
```

RED-first documentation control from the repository root: `sha256sum -c tools/install.sh.sha256` exits 1 with `install.sh: FAILED open or read` because the sidecar records a path relative to `tools/`. The command actually executed, `(cd tools && sha256sum -c install.sh.sha256)`, exits 0 with `install.sh: OK`; the workflow's separate exact expected/actual equality also passes. The immutable provider-fetch arm at the new `${CI_COMMIT_SHA}` is recorded in the freeze artifact after push; local equality alone is not treated as sufficient evidence.
