fix(installer): close detector false-pass gaps

tools/verify-greenfield-expected-red.sh

@@ -23,7 +23,7 @@ declare -A allowed_case=(
 declare -A expected_requires=(
   [next-git-present]=6 [main-git-present]=6 [next-git-absent]=4
 )
-declare -A row_count=() exit_count=() require_count=() forbid_count=() phase_count=() unique_rows=()
+declare -A row_count=() exit_count=() require_count=() forbid_count=() phase_count=() phase_reason_count=() unique_rows=()
 while IFS= read -r raw; do
   [[ -n "$raw" && "${raw:0:1}" != "#" ]] || continue
   field_count="$(awk -F '\t' '{print NF}' <<<"$raw")"
@@ -46,6 +46,11 @@ while IFS= read -r raw; do
       phase_key="$case_name|$phase"
       phase_count[$phase_key]=$((${phase_count[$phase_key]:-0} + 1))
       ;;
+    phase-reason)
+      [[ "$expectation" =~ ^P0=(.+)$ ]] \
+        || { echo "invalid expected-RED phase reason: case=$case_name value=$expectation" >&2; exit 2; }
+      phase_reason_count[$case_name|P0]=$((${phase_reason_count[$case_name|P0]:-0} + 1))
+      ;;
     require)
       [[ -n "$expectation" ]] || { echo "empty expected-RED require row: case=$case_name" >&2; exit 2; }
       require_count[$case_name]=$((${require_count[$case_name]:-0} + 1))
@@ -65,11 +70,13 @@ for case_name in "${expected_cases[@]}"; do
     [[ "${phase_count[$case_name|$phase]:-0}" -eq 1 ]] \
       || { echo "expected-RED manifest requires exactly one $phase disposition for case=$case_name" >&2; exit 2; }
   done
+  [[ "${phase_reason_count[$case_name|P0]:-0}" -eq 1 ]] \
+    || { echo "expected-RED manifest requires exactly one P0 reason binding for case=$case_name" >&2; exit 2; }
   [[ "${require_count[$case_name]:-0}" -eq "${expected_requires[$case_name]}" ]] \
     || { echo "expected-RED manifest require-row population changed for case=$case_name" >&2; exit 2; }
   [[ "${forbid_count[$case_name]:-0}" -eq 1 ]] \
     || { echo "expected-RED manifest requires exactly one forbid row for case=$case_name" >&2; exit 2; }
-  expected_total=$((1 + 10 + expected_requires[$case_name] + 1))
+  expected_total=$((1 + 10 + 1 + expected_requires[$case_name] + 1))
   [[ "${row_count[$case_name]:-0}" -eq "$expected_total" ]] \
     || { echo "expected-RED manifest row population changed for case=$case_name" >&2; exit 2; }
 done
@@ -98,6 +105,16 @@ while IFS=$'\t' read -r case_name kind expectation; do
         failures=$((failures + 1))
       fi
       ;;
+    phase-reason)
+      phase="${expectation%%=*}"
+      expected_reason="${expectation#*=}"
+      last_row="$(grep -E "^\[$phase\] (PASS|FAIL):" "$LOG" | tail -n 1 || true)"
+      actual_reason="${last_row#*: }"
+      if [[ -z "$last_row" ]] || ! grep -Eq -- "^${expected_reason}$" <<<"$actual_reason"; then
+        echo "expected-RED phase reason mismatch: case=$CASE phase=$phase reason=${actual_reason:-missing}" >&2
+        failures=$((failures + 1))
+      fi
+      ;;
     require)
       if ! grep -Eq -- "$expectation" "$LOG"; then
         echo "expected-RED missing required evidence: case=$CASE regex=$expectation" >&2