fix(installer): support BusyBox coverage inventory

docs/PRD.md

@@ -1393,7 +1393,7 @@ A from-zero install can report success while leaving the target host unusable be
 12. The expected-RED comparator SHALL validate the complete manifest before selecting a case: exact case population, one exit and P0–P9 disposition per case, pinned require/forbid classes, and no malformed, duplicate, or unknown rows.
 13. The published installer contract SHALL reject failed fetches, HTTP-success empty bodies, and digest mismatch, then execute the exact digest-verified body. The remote CI arm SHALL enumerate every payload-acquisition path and report a bound/found denominator. It SHALL bind both the installer body and the downstream stack framework/source it consumes to the same immutable CI commit, while retaining `--next` as the lane selector. Source resolution/acquisition SHALL fail closed, and the arm SHALL verify the realised source commit and archive digest after installation. Any out-of-scope unpinned sibling SHALL be named and counted rather than silently included in a broader pinning claim. `ASSUMPTION:` the configured repository's authenticated exact-commit endpoint is trusted to map that commit ID to the returned archive bytes; independent signed provenance/authenticity against repository or TLS trust-root compromise remains excluded by canonical greenfield-install PRD v2 §3.
 14. Phase diagnostics SHALL be redacted before terminal or durable-log output. A seeded positive-control canary SHALL remain absent from observed argv, output, command logs, npm configuration, generated files, and shell history.
-15. The CI fixture SHALL publish pipeline-level execution coverage for both the unconditional case set derived from the expected-RED manifest and the explicitly declared required pipeline-arm set, including the immutable remote-installer contract. Per-case and per-arm success markers SHALL be run-scoped, stored beneath an existing checkout-archive exclusion, and written only after that arm's verifier passes. A final step SHALL depend on the complete fixture matrix, run after prior success or failure, emit both `cases_defined=N cases_executed=M` and `arms_defined=N arms_executed=M`, and invoke the same testable aggregation helper whose complete case/arm PASS/FAIL truth table is covered. It SHALL fail unless both expected/executed name sets are exactly equal; missing, unexpected, stale, newly added unexecuted, or checkout-contaminating state SHALL fail closed. The archive-purity control SHALL bind to the production checkout-archive selector so deleting the production exclusion makes the control RED.
+15. The CI fixture SHALL publish pipeline-level execution coverage for both the unconditional case set derived from the expected-RED manifest and the explicitly declared required pipeline-arm set, including the immutable remote-installer contract. Per-case and per-arm success markers SHALL be run-scoped, stored beneath an existing checkout-archive exclusion, and written only after that arm's verifier passes. A final step SHALL depend on the complete fixture matrix, run after prior success or failure, emit both `cases_defined=N cases_executed=M` and `arms_defined=N arms_executed=M`, and invoke the same testable aggregation helper whose complete case/arm PASS/FAIL truth table is covered. It SHALL fail unless both expected/executed name sets are exactly equal; missing, unexpected, stale, newly added unexecuted, or checkout-contaminating state SHALL fail closed. The archive-purity control SHALL bind to the production checkout-archive selector so deleting the production exclusion makes the control RED. Coverage tooling SHALL execute under both the canonical Alpine/BusyBox CI image and the Debian greenfield image; a green result from either runtime alone is insufficient portability evidence.
 
 ### C1 acceptance criteria
 

docs/reports/verification/1050-c1-fix-round/13-round7-busybox-portability.txt

@@ -0,0 +1,56 @@
+# #1050 C1 fix round — Round 7 canonical Alpine/BusyBox portability
+
+BASE HEAD
+- d66e91b1f22489b911eef982aec3faa62c5edeb3
+- Review 119 (rev-974) found tools/verify-greenfield-execution-coverage.sh used GNU-only find -printf.
+- Pipeline 2246's canonical Alpine ci-base test failed while the Debian greenfield workflow passed; the stale pipeline is diagnostic evidence only and is not inherited as a ruling for the replacement head.
+
+RED
+- Before remediation:
+  docker run --rm -v "$PWD:/workspace" -w /workspace git.mosaicstack.dev/mosaicstack/stack/ci-base:latest bash tools/verify-greenfield-execution-coverage.test.sh
+  => canonical_alpine_red_rc=1
+- Independent review 119 captured BusyBox 1.37 rejecting `find: unrecognized: -printf`.
+- Debian/GNU execution remained green, proving that one runtime's success did not establish portability.
+
+IMPLEMENTATION
+- Removed the GNU find -printf inventory.
+- Marker inventory now uses Bash nullglob/dotglob plus parameter expansion, all available in the script's declared Bash runtime.
+- The checker verifies the run directory is readable/searchable before inventory and fails closed otherwise.
+- Only direct regular, non-symlink `*.ran` files are included, preserving the prior find boundary; identities remain sorted and compared as exact sets.
+- No production fixture disposition, expected-RED manifest, e2e installer, #869 wiring, or acquisition behavior changed.
+
+GREEN
+- Local focused suite: greenfield execution coverage tests passed.
+- Canonical Alpine/BusyBox focused suite:
+  docker run --rm -u "$(id -u):$(id -g)" -v "$PWD:/workspace" -w /workspace git.mosaicstack.dev/mosaicstack/stack/ci-base:latest bash tools/verify-greenfield-execution-coverage.test.sh
+  => greenfield execution coverage tests passed.
+- Existing Round-6 controls retained:
+  ignore-arms aggregation helper => rc=1
+  ignore-cases aggregation helper => rc=1
+  always-RED aggregation helper => rc=1
+  delete production .mosaic-test-work archive exclusion => rc=1
+- Mutant workspace: /tmp/c1-round7-mutants.LocpBH
+
+FENCED FILES
+- tools/e2e-install-test.sh HEAD/worktree SHA-256: a93113565aa69f2c6f3d792b78251021bb3bbe3f7813d5fed547ab0099fa3b98 (byte-identical)
+- tools/fixtures/greenfield-expected-red.tsv HEAD/worktree SHA-256: baae06c664d0ab7ffe4c32ec106bfcb6f9dd74b46461d3c4440b73dc582af1a2 (byte-identical)
+
+LOCAL BASELINES
+- /home free before and after validation: 11G
+- Bash syntax focused scripts: PASS
+- ShellCheck focused scripts: PASS
+- pnpm test:installer: PASS
+- pnpm typecheck: PASS (45/45)
+- pnpm lint: PASS (25/25)
+- pnpm format:check: PASS
+- woodpecker-cli lint --strict .woodpecker/greenfield-install.yml: PASS
+- git diff --check: PASS
+
+INDEPENDENT REVIEW
+- Codex code review: APPROVE, confidence 0.96, zero findings. It confirmed hidden/empty/direct-regular/non-symlink semantics, exact sorting/comparison, dual-runtime execution, and PRD alignment.
+- Codex security review: risk NONE, confidence 0.97, zero findings. It confirmed quoted paths, fail-closed exact-set behavior, and no new injection, traversal, authorization, secret, cryptographic, dependency, or data-integrity risk.
+- The security-review sandbox could not execute the focused suite because its filesystem is read-only; the local and canonical-container measured runs above provide dynamic evidence.
+
+PENDING
+- commit, queue guard, one lease-pinned push, provider attribution read-back
+- replacement-head canonical CI; no manual pipeline trigger or polling

docs/reports/verification/1050-c1-fix-round/documentation-checklist.md

@@ -2,7 +2,7 @@
 
 ## Required artifacts
 
-- [x] `docs/PRD.md` exists; #1050 C1 requirement 13 binds the complete in-scope remote stack source chain, and requirement 15 binds pipeline-level exact case+arm execution coverage, executable aggregation, and production-bound archive purity.
+- [x] `docs/PRD.md` exists; #1050 C1 requirement 13 binds the complete in-scope remote stack source chain, and requirement 15 binds pipeline-level exact case+arm execution coverage, executable aggregation, production-bound archive purity, and canonical Alpine/BusyBox plus Debian portability.
 - [x] User guide: not applicable; no user-facing production installer behavior changed.
 - [x] Admin guide: not applicable; no operator procedure or deployment behavior changed.
 - [x] Developer guide: existing `docs/guides/installer-state-machine.md` defines the fail-closed installer model; the C1-specific remote-arm contract and evidence live in the PRD, scratchpad, and scoped verification report.
@@ -23,4 +23,5 @@
 - [x] Round-4 review cycle closed: two blocking Codex findings (missing dependency ordering; production manifest comments misparsed) were accepted and fixed. Final code review APPROVE (confidence 0.94, zero findings) and security risk NONE (confidence 0.96, zero findings).
 - [x] Round-5 exact arm coverage and archive-purity controls reviewed: Codex code APPROVE (confidence 0.93, zero findings) and security risk NONE (confidence 0.96, zero findings).
 - [x] Round-6 executable aggregation and production archive-selector binding reviewed: Codex code APPROVE (confidence 0.94, zero findings) and security risk NONE (confidence 0.97, zero findings).
+- [x] Round-7 BusyBox-safe marker inventory and dual-runtime evidence reviewed: Codex code APPROVE (confidence 0.96, zero findings) and security risk NONE (confidence 0.97, zero findings).
 - [x] Canonical evidence remains in-repo. No external publishing action was requested or performed.

docs/scratchpads/1050-install-state-machine-red-fixture.md

@@ -168,3 +168,11 @@ Denominator corrections were sent to and accepted by the lane lead before implem
 - Review `rev-974` separately proved that deleting only the production `e2e-install-test.sh` `.mosaic-test-work` tar exclusion left the copied-selector control green. The control now structurally binds its semantic archive test to the production checkout-archive command; the delete-production-binding mutant is RED. The fenced production installer remains byte-unchanged.
 - Final review: Codex code APPROVE confidence 0.94 and security risk NONE confidence 0.97, both with zero findings. Full installer tests, typecheck 45/45, lint 25/25, format, Bash syntax, ShellCheck, Woodpecker strict lint, focused truth-table and four mutant controls, and diff check pass with 11G free before validation.
 - Full evidence: `docs/reports/verification/1050-c1-fix-round/12-round6-caller-coupling-and-archive-binding.txt`.
+
+## Round 7 — canonical Alpine/BusyBox portability
+
+- Review 119 found the exact-head focused suite RED in the canonical Alpine `ci-base`: GNU `find -printf` is unsupported by BusyBox 1.37. The same script remained green in the Debian greenfield workflow, so greenfield success alone did not prove canonical runtime compatibility.
+- Local canonical-image RED was reproduced at rc1 before remediation. Marker inventory now uses Bash nullglob/dotglob and parameter expansion, checks state-directory readability, preserves the prior regular-file/non-symlink boundary, and retains sorted exact-set comparison without GNU-only flags.
+- The focused suite is green both locally and inside `git.mosaicstack.dev/mosaicstack/stack/ci-base:latest`. Canonical pipeline evidence remains pending the replacement frozen-head push; no stale pipeline is inherited.
+- Final review: Codex code APPROVE confidence 0.96 and security risk NONE confidence 0.97, both with zero findings. Full installer tests, typecheck 45/45, lint 25/25, format, Bash syntax, ShellCheck, Woodpecker strict lint, dual-runtime focused tests, retained Round-6 mutants, and diff check pass with 11G free.
+- Full evidence: `docs/reports/verification/1050-c1-fix-round/13-round7-busybox-portability.txt`.

tools/verify-greenfield-execution-coverage.sh

@@ -69,8 +69,16 @@ case "$mode" in
     trap cleanup EXIT
 
     expected_names > "$expected_file"
-    find "$run_dir" -mindepth 1 -maxdepth 1 -type f -name '*.ran' -printf '%f\n' \
-      | sed 's/\.ran$//' | LC_ALL=C sort -u > "$actual_file"
+    [[ -r "$run_dir" && -x "$run_dir" ]] \
+      || { echo "[fixture-suite] coverage state is not readable: $run_dir" >&2; exit 1; }
+    (
+      shopt -s nullglob dotglob
+      for marker in "$run_dir"/*.ran; do
+        [[ -f "$marker" && ! -L "$marker" ]] || continue
+        marker_name="${marker##*/}"
+        printf '%s\n' "${marker_name%.ran}"
+      done
+    ) | LC_ALL=C sort -u > "$actual_file"
 
     defined="$(wc -l < "$expected_file" | tr -d ' ')"
     executed="$(wc -l < "$actual_file" | tr -d ' ')"