fix(installer): close detector false-pass gaps

tools/install.sh

@@ -657,15 +657,27 @@ state_path_owner_mode_ok() {
 }
 
 state_tree_owner_mode_ok() {
-  local root="$1" path policy
+  local root="$1" path policy scan valid=true
   [[ -e "$root" ]] || return 0
+  scan="$(mktemp)" \
+    || { STATE_POLICY_REASON="$root enumeration staging failed"; return 1; }
+  if ! find "$root" -xdev -print0 > "$scan"; then
+    STATE_POLICY_REASON="$root enumeration failed; created-path inventory is incomplete"
+    rm -f "$scan"
+    return 1
+  fi
   while IFS= read -r -d '' path; do
     policy=shared-read
     case "$path" in
       "$MOSAIC_HOME/credentials"|"$MOSAIC_HOME/credentials"/*|"$MOSAIC_HOME/SOUL.md"|"$MOSAIC_HOME/USER.md") policy=private ;;
     esac
-    state_path_owner_mode_ok "$path" "$policy" || return
-  done < <(find "$root" -xdev -print0)
+    if ! state_path_owner_mode_ok "$path" "$policy"; then
+      valid=false
+      break
+    fi
+  done < "$scan"
+  rm -f "$scan"
+  [[ "$valid" == true ]]
 }
 
 state_resolved_version() {
@@ -1255,13 +1267,25 @@ PY
   tar xzf "$archive" -C "$WORK_DIR" || return
   state_json_line artifact P2 committed "lane=$GIT_REF source_commit=$RESOLVED_SOURCE_COMMIT sha256=$RESOLVED_SOURCE_DIGEST" || return
 
-  # Gitea archives extract to <repo-name>/ inside the work dir
-  EXTRACTED_DIR="$(find "$WORK_DIR" -maxdepth 1 -mindepth 1 -type d | head -1)" || return
-  if [[ -z "$EXTRACTED_DIR" ]] || [[ ! -d "$EXTRACTED_DIR" ]]; then
-    fail "Could not locate extracted source in archive."
-    ls -la "$WORK_DIR" >&2 || true # Diagnostic only; the named P2 failure is authoritative.
+  # Gitea archives must extract to exactly one <repo-name>/ directory. Capture
+  # and check the complete walk before selecting it: `find | head -1` both hides
+  # a failed enumeration and makes multiple roots depend on filesystem order.
+  local extracted_roots_file
+  local -a extracted_roots=()
+  extracted_roots_file="$(mktemp)" \
+    || { fail "P2 Acquire artifacts failed: could not stage extracted-root inventory."; return 1; }
+  if ! find "$WORK_DIR" -maxdepth 1 -mindepth 1 -type d -print0 > "$extracted_roots_file"; then
+    rm -f "$extracted_roots_file"
+    fail "P2 Acquire artifacts failed: could not enumerate extracted source roots."
     return 1
   fi
+  mapfile -d '' -t extracted_roots < "$extracted_roots_file"
+  rm -f "$extracted_roots_file"
+  if [[ "${#extracted_roots[@]}" -ne 1 ]] || [[ ! -d "${extracted_roots[0]:-}" ]]; then
+    fail "P2 Acquire artifacts failed: expected exactly one extracted source root; found ${#extracted_roots[@]}."
+    return 1
+  fi
+  EXTRACTED_DIR="${extracted_roots[0]}"
 }
 
 # Build @mosaicstack/mosaic + @mosaicstack/gateway from source and install both