# #1050 C1 fix round — Round 7 canonical Alpine/BusyBox portability

BASE HEAD
- d66e91b1f22489b911eef982aec3faa62c5edeb3
- Review 119 (rev-974) found tools/verify-greenfield-execution-coverage.sh used GNU-only find -printf.
- Pipeline 2246's canonical Alpine ci-base test failed while the Debian greenfield workflow passed; the stale pipeline is diagnostic evidence only and is not inherited as a ruling for the replacement head.

RED
- Before remediation:
  docker run --rm -v "$PWD:/workspace" -w /workspace git.mosaicstack.dev/mosaicstack/stack/ci-base:latest bash tools/verify-greenfield-execution-coverage.test.sh
  => canonical_alpine_red_rc=1
- Independent review 119 captured BusyBox 1.37 rejecting `find: unrecognized: -printf`.
- Debian/GNU execution remained green, proving that one runtime's success did not establish portability.

IMPLEMENTATION
- Removed the GNU find -printf inventory.
- Marker inventory now uses Bash nullglob/dotglob plus parameter expansion, all available in the script's declared Bash runtime.
- The checker verifies the run directory is readable/searchable before inventory and fails closed otherwise.
- Only direct regular, non-symlink `*.ran` files are included, preserving the prior find boundary; identities remain sorted and compared as exact sets.
- No production fixture disposition, expected-RED manifest, e2e installer, #869 wiring, or acquisition behavior changed.

GREEN
- Local focused suite: greenfield execution coverage tests passed.
- Canonical Alpine/BusyBox focused suite:
  docker run --rm -u "$(id -u):$(id -g)" -v "$PWD:/workspace" -w /workspace git.mosaicstack.dev/mosaicstack/stack/ci-base:latest bash tools/verify-greenfield-execution-coverage.test.sh
  => greenfield execution coverage tests passed.
- Existing Round-6 controls retained:
  ignore-arms aggregation helper => rc=1
  ignore-cases aggregation helper => rc=1
  always-RED aggregation helper => rc=1
  delete production .mosaic-test-work archive exclusion => rc=1
- Mutant workspace: /tmp/c1-round7-mutants.LocpBH

FENCED FILES
- tools/e2e-install-test.sh HEAD/worktree SHA-256: a93113565aa69f2c6f3d792b78251021bb3bbe3f7813d5fed547ab0099fa3b98 (byte-identical)
- tools/fixtures/greenfield-expected-red.tsv HEAD/worktree SHA-256: baae06c664d0ab7ffe4c32ec106bfcb6f9dd74b46461d3c4440b73dc582af1a2 (byte-identical)

LOCAL BASELINES
- /home free before and after validation: 11G
- Bash syntax focused scripts: PASS
- ShellCheck focused scripts: PASS
- pnpm test:installer: PASS
- pnpm typecheck: PASS (45/45)
- pnpm lint: PASS (25/25)
- pnpm format:check: PASS
- woodpecker-cli lint --strict .woodpecker/greenfield-install.yml: PASS
- git diff --check: PASS

INDEPENDENT REVIEW
- Codex code review: APPROVE, confidence 0.96, zero findings. It confirmed hidden/empty/direct-regular/non-symlink semantics, exact sorting/comparison, dual-runtime execution, and PRD alignment.
- Codex security review: risk NONE, confidence 0.97, zero findings. It confirmed quoted paths, fail-closed exact-set behavior, and no new injection, traversal, authorization, secret, cryptographic, dependency, or data-integrity risk.
- The security-review sandbox could not execute the focused suite because its filesystem is read-only; the local and canonical-container measured runs above provide dynamic evidence.

PENDING
- commit, queue guard, one lease-pinned push, provider attribution read-back
- replacement-head canonical CI; no manual pipeline trigger or polling
