fix(installer): close detector false-pass gaps

tools/install-state-machine.test.sh

@@ -304,6 +304,34 @@ grep -q '^\[P4\] FAIL:.*owner/mode policy' "$TMP/p4-tree-mode.log" \
   || fail_case 'P4 did not attribute unsafe created-path mode'
 chmod 0644 "$good_mosaic/AGENTS.md"
 
+printf '[test] case: P4 fails closed when created-path enumeration is incomplete\n'
+real_find="$(command -v find)"
+cat > "$good_bin/find" <<FIND
+#!/bin/bash
+if [[ "\${1:-}" == '$good_mosaic' && "\${2:-}" == '-xdev' && "\${3:-}" == '-print0' ]]; then
+  printf '%s\\0' '$good_mosaic'
+  exit 73
+fi
+exec '$real_find' "\$@"
+FIND
+chmod 0755 "$good_bin/find"
+printf '# hidden unsafe child\n' > "$good_mosaic/AGENTS.md"
+chmod 0666 "$good_mosaic/AGENTS.md"
+set +e
+HOME="$good_home" MOSAIC_HOME="$good_mosaic" MOSAIC_PREFIX="$good_prefix" MOSAIC_NO_COLOR=1 \
+  PATH="$good_bin:/usr/local/bin:/usr/bin:/bin" bash "$ROOT/tools/install.sh" --check --next \
+  >"$TMP/p4-enumeration-failure.log" 2>&1
+p4_enumeration_status=$?
+set -e
+rm -f "$good_bin/find"
+[[ "$p4_enumeration_status" -ne 0 ]] \
+  && pass_case 'P4 rejects an incomplete created-path inventory' \
+  || fail_case 'P4 accepted a partial created-path inventory after find failed'
+grep -q '^\[P4\] FAIL:.*enumeration failed' "$TMP/p4-enumeration-failure.log" \
+  && pass_case 'P4 attributes the failed created-path enumeration' \
+  || fail_case 'P4 did not report failed created-path enumeration'
+chmod 0644 "$good_mosaic/AGENTS.md"
+
 printf '[test] case: persisted required-action failures remain blocking\n'
 for blocked_phase in P4 P6; do
   node -e '