fix(installer): avoid pipefail marker race

fix(installer): support BusyBox coverage inventory
test(installer): bind execution coverage callers
2026-08-06 12:13:42 -05:00 · 2026-08-06 11:53:56 -05:00 · 2026-08-06 03:48:03 -05:00 · 2026-08-06 03:14:19 -05:00 · 2026-08-06 02:52:14 -05:00 · 2026-08-06 01:38:23 -05:00
44 changed files with 3384 additions and 247 deletions
@@ -6,8 +6,23 @@ when:
    branch: [next, main]

 steps:
+  greenfield-case-denominator-init:
+    image: node:22-bookworm-slim
+    commands:
+      - |
+        coverage_run="${CI_PIPELINE_NUMBER}-${CI_WORKFLOW_NUMBER}"
+        coverage_root=.mosaic-test-work/greenfield-execution-coverage
+        bash tools/verify-greenfield-execution-coverage.sh init cases \
+          tools/fixtures/greenfield-expected-red.tsv "$coverage_root" \
+          "$coverage_run"
+        bash tools/verify-greenfield-execution-coverage.sh init arms \
+          tools/fixtures/greenfield-expected-arms.txt "$coverage_root" \
+          "$coverage_run"
+
  greenfield-git-present:
    image: node:22-bookworm-slim
+    depends_on:
+      - greenfield-case-denominator-init
    commands:
      - |
        set +e
@@ -19,9 +34,19 @@ steps:
        cat /tmp/greenfield-git-present.log
        bash tools/verify-greenfield-expected-red.sh \
          next-git-present /tmp/greenfield-git-present.log "$fixture_status"
+        coverage_run="${CI_PIPELINE_NUMBER}-${CI_WORKFLOW_NUMBER}"
+        coverage_root=.mosaic-test-work/greenfield-execution-coverage
+        bash tools/verify-greenfield-execution-coverage.sh mark cases \
+          tools/fixtures/greenfield-expected-red.tsv "$coverage_root" \
+          "$coverage_run" next-git-present
+        bash tools/verify-greenfield-execution-coverage.sh mark arms \
+          tools/fixtures/greenfield-expected-arms.txt "$coverage_root" \
+          "$coverage_run" greenfield-git-present

  greenfield-main-git-present:
    image: node:22-bookworm-slim
+    depends_on:
+      - greenfield-case-denominator-init
    commands:
      - |
        set +e
@@ -33,9 +58,46 @@ steps:
        cat /tmp/greenfield-main-git-present.log
        bash tools/verify-greenfield-expected-red.sh \
          main-git-present /tmp/greenfield-main-git-present.log "$fixture_status"
+        coverage_run="${CI_PIPELINE_NUMBER}-${CI_WORKFLOW_NUMBER}"
+        coverage_root=.mosaic-test-work/greenfield-execution-coverage
+        bash tools/verify-greenfield-execution-coverage.sh mark cases \
+          tools/fixtures/greenfield-expected-red.tsv "$coverage_root" \
+          "$coverage_run" main-git-present
+        bash tools/verify-greenfield-execution-coverage.sh mark arms \
+          tools/fixtures/greenfield-expected-arms.txt "$coverage_root" \
+          "$coverage_run" greenfield-main-git-present
+
+  greenfield-remote-installer-contract:
+    image: node:22-bookworm-slim
+    depends_on:
+      - greenfield-case-denominator-init
+    commands:
+      - |
+        expected="$(awk 'NF {print $1; exit}' tools/install.sh.sha256)"
+        actual="$(sha256sum tools/install.sh | awk '{print $1}')"
+        test "$actual" = "$expected"
+        set +e
+        MOSAIC_GREENFIELD_CONTAINER=1 \
+          MOSAIC_FIXTURE_INSTALLER_URL="https://git.mosaicstack.dev/mosaicstack/stack/raw/commit/${CI_COMMIT_SHA}/tools/install.sh" \
+          MOSAIC_FIXTURE_INSTALLER_SHA256="$expected" \
+          MOSAIC_FIXTURE_SOURCE_COMMIT="${CI_COMMIT_SHA}" \
+          bash tools/e2e-install-test.sh --lane next --source remote --git present \
+          > /tmp/greenfield-remote.log 2>&1
+        fixture_status=$?
+        set -e
+        cat /tmp/greenfield-remote.log
+        bash tools/verify-greenfield-expected-red.sh \
+          next-git-present /tmp/greenfield-remote.log "$fixture_status"
+        coverage_run="${CI_PIPELINE_NUMBER}-${CI_WORKFLOW_NUMBER}"
+        coverage_root=.mosaic-test-work/greenfield-execution-coverage
+        bash tools/verify-greenfield-execution-coverage.sh mark arms \
+          tools/fixtures/greenfield-expected-arms.txt "$coverage_root" \
+          "$coverage_run" greenfield-remote-installer-contract

  greenfield-git-absent:
    image: node:22-bookworm-slim
+    depends_on:
+      - greenfield-case-denominator-init
    commands:
      - |
        set +e
@@ -47,3 +109,31 @@ steps:
        cat /tmp/greenfield-git-absent.log
        bash tools/verify-greenfield-expected-red.sh \
          next-git-absent /tmp/greenfield-git-absent.log "$fixture_status"
+        coverage_run="${CI_PIPELINE_NUMBER}-${CI_WORKFLOW_NUMBER}"
+        coverage_root=.mosaic-test-work/greenfield-execution-coverage
+        bash tools/verify-greenfield-execution-coverage.sh mark cases \
+          tools/fixtures/greenfield-expected-red.tsv "$coverage_root" \
+          "$coverage_run" next-git-absent
+        bash tools/verify-greenfield-execution-coverage.sh mark arms \
+          tools/fixtures/greenfield-expected-arms.txt "$coverage_root" \
+          "$coverage_run" greenfield-git-absent
+
+  greenfield-case-denominator:
+    image: node:22-bookworm-slim
+    # Publish exact execution coverage after the full matrix, even if a case failed.
+    depends_on:
+      - greenfield-git-present
+      - greenfield-main-git-present
+      - greenfield-remote-installer-contract
+      - greenfield-git-absent
+    when:
+      - status: [success, failure]
+    commands:
+      - |
+        coverage_run="${CI_PIPELINE_NUMBER}-${CI_WORKFLOW_NUMBER}"
+        coverage_root=.mosaic-test-work/greenfield-execution-coverage
+        bash tools/verify-greenfield-execution-coverage-gate.sh \
+          tools/verify-greenfield-execution-coverage.sh \
+          tools/fixtures/greenfield-expected-red.tsv \
+          tools/fixtures/greenfield-expected-arms.txt \
+          "$coverage_root" "$coverage_run"
@@ -7,20 +7,21 @@ Mosaic gives you a unified launcher for Claude Code, Codex, OpenCode, and Pi —
 ## Quick Install

 ```bash
-bash -o pipefail -c 'curl -fsSL https://mosaicstack.dev/install.sh | bash'
+d="$(mktemp -d)" && trap 'rm -rf "$d"' EXIT && curl -fsSL -o "$d/install.sh" https://git.mosaicstack.dev/mosaicstack/stack/raw/branch/main/tools/install.sh -o "$d/install.sh.sha256" https://git.mosaicstack.dev/mosaicstack/stack/raw/branch/main/tools/install.sh.sha256 && (cd "$d" && test -s install.sh && sha256sum -c install.sh.sha256 && bash install.sh)
 ```

-Or use the direct URL:
-
-```bash
-bash <(curl -fsSL https://git.mosaicstack.dev/mosaicstack/stack/raw/branch/main/tools/install.sh)
-```
+The published installer body must be non-empty and match its versioned SHA-256
+sidecar before it executes. A failed fetch, HTTP-200 empty body, or digest
+mismatch is fatal. Because both files come from the same repository and trust
+domain, this detects corruption or inconsistent publication—not repository or
+server compromise. Independently signed release provenance is explicitly
+deferred by the greenfield-install PRD.

 The installer auto-launches the setup wizard, which walks you through gateway install and verification. Flags for non-interactive use:

 ```bash
-bash <(curl -fsSL …) --yes               # Accept all defaults
-bash <(curl -fsSL …) --yes --no-auto-launch  # Install only, skip wizard
+(cd "$d" && bash install.sh --yes)                   # Accept all defaults
+(cd "$d" && bash install.sh --yes --no-auto-launch)  # Install only, skip wizard
 ```

 This installs both components:
@@ -348,16 +349,10 @@ Each stage has a dispatch mode (`exec` for research/review, `yolo` for coding),

 ## Upgrading

-Run the installer again — it handles upgrades automatically:
+Run the same verified installer flow again — it handles upgrades automatically:

 ```bash
-bash -o pipefail -c 'curl -fsSL https://mosaicstack.dev/install.sh | bash'
-```
-
-Or use the direct URL:
-
-```bash
-bash <(curl -fsSL https://git.mosaicstack.dev/mosaicstack/stack/raw/branch/main/tools/install.sh)
+d="$(mktemp -d)" && trap 'rm -rf "$d"' EXIT && curl -fsSL -o "$d/install.sh" https://git.mosaicstack.dev/mosaicstack/stack/raw/branch/main/tools/install.sh -o "$d/install.sh.sha256" https://git.mosaicstack.dev/mosaicstack/stack/raw/branch/main/tools/install.sh.sha256 && (cd "$d" && test -s install.sh && sha256sum -c install.sh.sha256 && bash install.sh)
 ```

 Or use the CLI:
@@ -1387,14 +1387,21 @@ A from-zero install can report success while leaving the target host unusable be
 6. The from-zero fixture SHALL be lane-parametric, use Debian/glibc, run the documented install command as a non-root target user with an isolated HOME, and inherit no host credentials, npm cache, home directory, or runtime configuration.
 7. The fixture SHALL select `next` with `--next` or `MOSAIC_NEXT=1` and assert the resolved lane version. Internal predicates use P3's absolute CLI path; shell discoverability is tested only at P8.
 8. Fault injection after each P2–P8 phase SHALL prove either clean rollback or a durable, honestly reported resumable partial state, with no journal incorrectly left in progress.
-9. Unsupported musl/Alpine and unavailable Docker SHALL fail loudly rather than skip as pass.
+9. Unsupported musl/Alpine and unavailable Docker SHALL fail loudly rather than skip as pass. The repository's installer tests SHALL nevertheless run in the canonical Alpine CI image by explicitly modeling a supported non-root/glibc target and using portable filesystem enumeration.
+10. P0 SHALL bind the effective uid and username to the authoritative passwd HOME and shell and state/reject unsafe root or sudo-with-inherited-HOME privilege contexts.
+11. Created paths SHALL satisfy phase-specific target owner/group and mode policy: P3 executables are not group/world writable, framework/runtime trees are not group/world writable, and identity/credential material is private.
+12. The expected-RED comparator SHALL validate the complete manifest before selecting a case: exact case population, one exit and P0–P9 disposition per case, pinned require/forbid classes, and no malformed, duplicate, or unknown rows.
+13. The published installer contract SHALL reject failed fetches, HTTP-success empty bodies, and digest mismatch, then execute the exact digest-verified body. The remote CI arm SHALL enumerate every payload-acquisition path and report a bound/found denominator. It SHALL bind both the installer body and the downstream stack framework/source it consumes to the same immutable CI commit, while retaining `--next` as the lane selector. Source resolution/acquisition SHALL fail closed, and the arm SHALL verify the realised source commit and archive digest after installation. Any out-of-scope unpinned sibling SHALL be named and counted rather than silently included in a broader pinning claim. `ASSUMPTION:` the configured repository's authenticated exact-commit endpoint is trusted to map that commit ID to the returned archive bytes; independent signed provenance/authenticity against repository or TLS trust-root compromise remains excluded by canonical greenfield-install PRD v2 §3.
+14. Phase diagnostics SHALL be redacted before terminal or durable-log output. A seeded positive-control canary SHALL remain absent from observed argv, output, command logs, npm configuration, generated files, and shell history.
+15. The CI fixture SHALL publish pipeline-level execution coverage for both the unconditional case set derived from the expected-RED manifest and the explicitly declared required pipeline-arm set, including the immutable remote-installer contract. Per-case and per-arm success markers SHALL be run-scoped, stored beneath an existing checkout-archive exclusion, and written only after that arm's verifier passes. A final step SHALL depend on the complete fixture matrix, run after prior success or failure, emit both `cases_defined=N cases_executed=M` and `arms_defined=N arms_executed=M`, and invoke the same testable aggregation helper whose complete case/arm PASS/FAIL truth table is covered. It SHALL fail unless both expected/executed name sets are exactly equal; missing, unexpected, stale, newly added unexecuted, or checkout-contaminating state SHALL fail closed. The archive-purity control SHALL bind to the production checkout-archive selector so deleting the production exclusion makes the control RED. Coverage tooling SHALL execute under both the canonical Alpine/BusyBox CI image and the Debian greenfield image; a green result from either runtime alone is insufficient portability evidence. Expected-set membership SHALL consume a fully materialized producer result so an early-closing consumer cannot turn a valid marker into a `pipefail` rejection.

 ### C1 acceptance criteria

 1. The pre-C1 from-zero matrix records both discriminating controls: with `git` absent, the legacy installer still exits zero while P1 fails and skill sync degrades; with `git` present, P1 passes and the observed sync store/runtime links are 101/101. The C1 installer must fail at P1 before mutation when `git` is absent.
 2. The discriminating P3 row passes: the binary exists at the expected absolute path and reports exactly the resolved `next` lane version, while P4, P5, and P8 fail.
 3. The `--check` mutation negative control proves host fingerprints are byte-identical before and after observation.
-4. Woodpecker executes and validates the expected RED fixture; C1 does not repair P4/P5/P8 or activate #869.
+4. Woodpecker executes and validates the expected RED fixture plus the immutable remote-installer contract; its pipeline-level coverage gate reports exact equality for the manifest-derived case set and the declared arm set, while skipped-case and skipped-remote-arm controls prove non-execution is red. C1 does not repair P4/P5/P8 or activate #869.
+5. Negative controls prove manifest shrink/duplicates/unknown rows fail, unsafe P0/P3/P4/P5 contexts fail, the P2–P8 fault seam enters real actions rather than synthetic writes, empty/mismatched fetched bodies fail, and a deliberately emitted secret canary is redacted from every persisted/output population.

 ### Explicit exclusions and dependencies

@@ -6,12 +6,12 @@ The unified installer uses a transactional P0–P9 model. It may report success

 | Phase                           | Responsibility                                                                                                                    | Failure disposition                                                              |
 | ------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
-| P0 Resolve context              | State target user, HOME, shell, privilege mode, architecture, libc, Node, and npm                                                 | Fail before mutation                                                             |
+| P0 Resolve context              | Bind uid/username to the authoritative passwd HOME/shell, state privilege mode, architecture, libc, Node, and npm                 | Fail before mutation                                                             |
 | P1 Preflight                    | Validate downstream tool closure (including `git` and `python3`), writable prefix, registry lane, disk/inodes, and exclusive lock | Fail before target mutation                                                      |
 | P2 Acquire artifacts            | Resolve exact registry versions and an immutable framework commit; record lane and SHA-256                                        | Discard temporary work                                                           |
-| P3 Install CLI                  | Install at the configured absolute prefix and require exact resolved version                                                      | Restore the prior prefix/npmrc snapshot                                          |
+| P3 Install CLI                  | Install at the configured absolute prefix; require exact version plus target owner/group and non-writable executable mode         | Restore the prior prefix/npmrc snapshot                                          |
 | P4 Install framework + skills   | Sync framework and consume a checkout-free, lane/versioned shipped-skill declaration                                              | Restore prior framework/runtime trees                                            |
-| P5 Identity                     | Validate SOUL/USER content, owner, and mode; establish any credential capability requested downstream                             | Restore generated identity/credential binding                                    |
+| P5 Identity                     | Validate SOUL/USER content and private modes; require private credential storage and target owner/group                           | Restore generated identity/credential binding                                    |
 | P6 Runtime linking / activation | Evaluate activation honestly; never treat dead enforcement hooks as active readiness                                              | Restore runtime activation files                                                 |
 | P7 Services                     | Provision only requested services/resources after any required P5 credential commits                                              | Stop and restore requested services/resources                                    |
 | P8 Shell discoverability        | Require fresh login and non-login shells of the actual target shell to resolve P3's path                                          | Restore shell profiles                                                           |
@@ -56,7 +56,7 @@ Before each mutation scope is touched, `journal.ndjson` records:
 - the reversal action;
 - the captured command-output location and command status.

-Journal, action-status, manifest, or command-log write/sync failure is fatal. An unrecorded mutation is not allowed. Successful P9 runs append a seal event, write the SHA-256 sidecar, and make the journal and sidecar read-only. Required P4/P6 action failures are persisted in the manifest so a later `--check` cannot turn a failed action into a false pass.
+Journal, action-status, manifest, or command-log write/sync failure is fatal. An unrecorded mutation is not allowed. Command diagnostics are redacted before terminal output or durable logging; credential-shaped environment values, bearer values, auth tokens, and credentialed URLs are never deliberately persisted. Successful P9 runs append a seal event, write the SHA-256 sidecar, and make the journal and sidecar read-only. Required P4/P6 action failures are persisted in the manifest so a later `--check` cannot turn a failed action into a false pass.

 Rollback roots must be non-overlapping, non-symlinked, target-user-owned strict descendants of canonical `HOME`; unsafe custom `MOSAIC_HOME`/`MOSAIC_PREFIX` values fail at P0. The same validation runs again immediately before recursive rollback. The OS lock is concurrency authority: if a process dies while `active.json` still says `in-progress`, a retry that acquires the free lock preserves the stale projection as `prior-active.json` and proceeds from the honestly retained partial state.

@@ -80,7 +80,7 @@ Rollback roots must be non-overlapping, non-symlinked, target-user-owned strict

 `.woodpecker/greenfield-install.yml` runs `tools/e2e-install-test.sh` from zero in Debian/glibc as a non-root uid with `env -i`. No host HOME, npm cache, credentials, or bind mount enters the target process. Checkout mode packages the complete current checkout into an archive, pins its SHA-256 through an internal fixture seam, and copies the self-contained fixture into the container; framework-installer changes in the PR are therefore exercised rather than fetched from an older remote branch.

-The C1 fixture intentionally returns an attributable RED while C2–C5 remain open. CI itself remains green only when the fixture's final P0–P9 verdicts, required discriminator rows, and non-zero exit match the versioned contract in `tools/fixtures/greenfield-expected-red.tsv`. Any later remediation that changes an observed verdict makes CI red until the owning lane deliberately updates that manifest:
+The C1 fixture intentionally returns an attributable RED while C2–C5 remain open. CI itself remains green only when the fixture's final P0–P9 verdicts, required discriminator rows, seeded secret-canary scan, and non-zero exit match the versioned contract in `tools/fixtures/greenfield-expected-red.tsv`. The comparator validates the complete three-case schema before selecting a case: exactly one exit and P0–P9 disposition per case, pinned require/forbid populations, and no duplicate or unknown rows. Any later remediation that changes an observed verdict makes CI red until the owning lane deliberately updates that manifest:

 - `git` present: P1 and strict P3 pass; P4/P5/P6/P8 fail for their own reasons; P9 refuses success.
 - `git` absent: P1 fails before target mutation and the installer emits no `Done.`.
@@ -92,8 +92,8 @@ bash tools/e2e-install-test.sh --lane next --git present
 bash tools/e2e-install-test.sh --lane main --git present
 ```

-CI exercises both lane parameters as expected-RED structural checks. Delivery targets `main` under the trunk-only merge rule; `next` remains a non-merging integration lane. The linked installer issue stays open after merge and closes only after Jarvis independently validates the greenfield behavior.
+CI exercises both lane parameters as expected-RED structural checks. A separate remote-contract arm fetches the installer at the immutable CI commit, rejects failed or empty HTTP-success bodies, compares it to the reviewed `tools/install.sh.sha256`, and executes that exact fetched artifact. The P2–P8 fault matrix runs the real phase actions (including the P3 npm path, P4 framework path, and wizard path) rather than synthetic representative writes, then compares the complete target tree to its pre-install fingerprint. Delivery targets `main` under the trunk-only merge rule; `next` remains a non-merging integration lane. The linked installer issue stays open after merge and closes only after Jarvis independently validates the greenfield behavior.

 ## Source trust boundary

-Remote source mode pins the resolved commit, records the archive SHA-256, limits compressed/expanded size and entry count, and rejects traversal, links, devices, and special files before extraction. This provides immutable run provenance and archive safety, not an independent authenticity root. Signed artifact metadata/provenance is explicitly deferred by the canonical greenfield PRD; C1 does not invent a signing system. The checkout CI seam does verify an expected digest supplied independently by the fixture.
+Remote installer mode requires a non-empty body and an expected SHA-256 before execution. Remote source-archive mode separately pins the resolved commit, records the archive SHA-256, limits compressed/expanded size and entry count, and rejects traversal, links, devices, and special files before extraction. These controls provide immutable run provenance and archive safety, not an independent signing root. Signed artifact metadata/provenance is explicitly deferred by the canonical greenfield PRD; C1 does not invent a signing system. The checkout and remote CI seams verify reviewed digests before executing their artifacts.
@@ -0,0 +1,14 @@
+subject_head=3edde464b3891ad439019fcc19aad7728e4c2fb8
+source=git show HEAD:tools/install-next-lane.test.sh
+
+   477	  echo 'credentialed URL userinfo leaked to terminal output' >&2; exit 1
+   478	fi
+   479	[[ "$(grep -oF '[REDACTED]@' <<<"$OUTPUT" | wc -l | tr -d ' ')" -ge 5 ]] \
+   480	  || { echo 'credentialed URL redaction controls were not all exercised' >&2; exit 1; }
+   481	secret_active="$TMP/secret-state/active.json"
+--
+   525	  echo 'framework nested capture leaked credential diagnostics' >&2; exit 1
+   526	fi
+   527	[[ "$(grep -oF '[REDACTED]@' "$framework_log" | wc -l | tr -d ' ')" -ge 5 ]] \
+   528	  || { echo 'framework URL redaction controls were not exercised' >&2; exit 1; }
+   529
@@ -0,0 +1,16 @@
+source=/tmp/c1-ci-next-x.log (exact failing canonical-image xtrace)
+credential material is already replaced by the redactor token [REDACTED]; no live secret is reproduced
+
+  urls=https://[REDACTED]@example.com/a https://[REDACTED]@example.net/b https://[REDACTED]@example.org/c https://[REDACTED]@example.dev/d https://[REDACTED]@example.io/e
+  urls=https://[REDACTED]@example.com/a https://[REDACTED]@example.net/b https://[REDACTED]@example.org/c https://[REDACTED]@example.dev/d https://[REDACTED]@example.io/e
+
+line_count=2
+occurrence_count=10
+observed_assertion_value=2 (from xtrace: [[ 2 -ge 5 ]])
+
+canonical-image discriminator (same locally cached digest as failing run):
+image_id=sha256:d40fb1a218b72d3dcbf8a427a5076facf2a6d958b6854e6bbd057f7264540841 repo_digests=["git.mosaicstack.dev/mosaicstack/stack/ci-base@sha256:0f1d996a6cfcc09e6dcf979ee66c872a1b0be4f1bfde852b4790f520ddd0d776"]
+busybox=BusyBox v1.37.0 (2026-01-10 15:38:28 UTC)
+regex_-o_single_line=5
+fixed_-oF_single_line=1
+fixed_-oF_two_lines=2
@@ -0,0 +1,14 @@
+positive_control_exit=1
+seeded_line=https://[MASKED-USERINFO]@example.io/e (actual synthetic userinfo intentionally omitted here)
+expected_failure=credentialed URL redaction control missing for example.io
+transcript_tail:
+[test] --next fast path pins resolved package versions
+[test] fast path failure falls back to source build
+[test] source-build failure is fatal and restores the pre-install prefix
+[test] corrupt source archive is fatal and restores the pre-install prefix
+[test] --dev source install does not require registry version resolution
+[test] explicit --ref keeps source lane and avoids @next lookup
+[test] --check --next rejects mismatched prerelease pipeline suffixes
+[test] full framework path receives P3 absolute CLI without relying on PATH
+[test] captured diagnostics redact seeded credential canary everywhere
+credentialed URL redaction control missing for example.io
@@ -0,0 +1,10 @@
+[test] --next fast path pins resolved package versions
+[test] fast path failure falls back to source build
+[test] source-build failure is fatal and restores the pre-install prefix
+[test] corrupt source archive is fatal and restores the pre-install prefix
+[test] --dev source install does not require registry version resolution
+[test] explicit --ref keeps source lane and avoids @next lookup
+[test] --check --next rejects mismatched prerelease pipeline suffixes
+[test] full framework path receives P3 absolute CLI without relying on PATH
+[test] captured diagnostics redact seeded credential canary everywhere
+credentialed URL redaction control missing for example.io
@@ -0,0 +1,579 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="/work"
+# shellcheck source=tools/test-enumeration-assertions.sh
+source "$ROOT/tools/test-enumeration-assertions.sh"
+TMP="$(mktemp -d "${TMPDIR:-/tmp}/mosaic-next-install-test-XXXXXX")"
+trap 'rm -rf "$TMP"' EXIT
+export TMPDIR="$TMP/runtime-tmp"
+mkdir -p "$TMPDIR"
+
+FAKE_BIN="$TMP/bin"
+HOME_DIR="$TMP/home"
+PREFIX="$HOME_DIR/prefix"
+MOSAIC_HOME="$HOME_DIR/mosaic"
+STATE="$TMP/state"
+LOG="$TMP/npm.log"
+mkdir -p "$FAKE_BIN" "$HOME_DIR" "$STATE"
+
+# Model the supported non-root/glibc target explicitly even when this harness
+# itself runs as root in Alpine/BusyBox CI.
+cat > "$FAKE_BIN/id" <<'FAKE_ID'
+#!/usr/bin/env bash
+case "${1:-}" in
+  -u) echo 1001 ;;
+  -g) echo 1001 ;;
+  -un) echo fixture-user ;;
+  *) exec /bin/id "$@" ;;
+esac
+FAKE_ID
+cat > "$FAKE_BIN/getent" <<FAKE_GETENT
+#!/usr/bin/env bash
+printf 'fixture-user:x:1001:1001::%s:/bin/bash\n' '$HOME_DIR'
+FAKE_GETENT
+cat > "$FAKE_BIN/ldd" <<'FAKE_LDD'
+#!/usr/bin/env bash
+printf 'ldd (GNU libc) 2.36\n'
+FAKE_LDD
+cat > "$FAKE_BIN/stat" <<'FAKE_STAT'
+#!/usr/bin/env bash
+if [[ "${1:-} ${2:-}" == '-c %u' ]]; then
+  [[ "${3:-}" == "${MOSAIC_TEST_WRONG_OWNER_PATH:-__none__}" ]] && echo 9999 || echo 1001
+  exit 0
+fi
+if [[ "${1:-} ${2:-}" == '-c %g' ]]; then
+  [[ "${3:-}" == "${MOSAIC_TEST_WRONG_GROUP_PATH:-__none__}" ]] && echo 9999 || echo 1001
+  exit 0
+fi
+exec /bin/stat "$@"
+FAKE_STAT
+cat > "$FAKE_BIN/realpath" <<'FAKE_REALPATH'
+#!/usr/bin/env python3
+import os, sys
+args=sys.argv[1:]
+mode=args.pop(0) if args and args[0] in ('-e','-m') else '-m'
+if args and args[0]=='--': args.pop(0)
+if len(args)!=1 or (mode=='-e' and not os.path.exists(args[0])): raise SystemExit(1)
+print(os.path.realpath(args[0]))
+FAKE_REALPATH
+chmod 0755 "$FAKE_BIN/id" "$FAKE_BIN/getent" "$FAKE_BIN/ldd" "$FAKE_BIN/stat" "$FAKE_BIN/realpath"
+
+cat > "$FAKE_BIN/npm" <<'FAKE_NPM'
+#!/usr/bin/env bash
+set -euo pipefail
+LOG="${MOSAIC_TEST_NPM_LOG:?}"
+STATE="${MOSAIC_TEST_STATE:?}"
+echo "$*" >> "$LOG"
+
+if [[ "${1:-}" == "--version" ]]; then
+  echo "10.6.2"
+  exit 0
+fi
+
+install_cli() {
+  local version="$1"
+  echo "$version" > "$STATE/mosaic"
+  mkdir -p "${MOSAIC_PREFIX:?}/bin"
+  cat > "$MOSAIC_PREFIX/bin/mosaic" <<CLI
+#!/usr/bin/env bash
+set -euo pipefail
+if [[ "\${1:-}" == "wizard" ]]; then
+  printf 'wizard\n' >> "\${MOSAIC_TEST_NPM_LOG:?}"
+  mkdir -p "\${MOSAIC_HOME:?}" "\${HOME:?}/.config/mosaic-gateway"
+  printf '# Soul\\n\\nConfigured.\\n' > "\$MOSAIC_HOME/SOUL.md"
+  printf '# User\\n\\nConfigured.\\n' > "\$MOSAIC_HOME/USER.md"
+  chmod 0600 "\$MOSAIC_HOME/SOUL.md" "\$MOSAIC_HOME/USER.md"
+  exit 0
+fi
+printf '%s\\n' '$version'
+CLI
+  chmod +x "$MOSAIC_PREFIX/bin/mosaic"
+}
+
+if [[ "$1" == "view" ]]; then
+  if [[ "${MOSAIC_TEST_FAIL_NPM_VIEW:-0}" == "1" ]]; then
+    echo "forced registry metadata failure" >&2
+    exit 1
+  fi
+  case "$2 $3" in
+    "@mosaicstack/mosaic@next version") echo "0.0.49-next.999" ;;
+    "@mosaicstack/gateway@next version") echo "${MOSAIC_TEST_GATEWAY_NEXT_VERSION:-0.0.7-next.999}" ;;
+    "@mosaicstack/mosaic version") echo "0.0.48" ;;
+    *) echo "unexpected npm view: $*" >&2; exit 1 ;;
+  esac
+  exit 0
+fi
+
+if [[ "$1" == "install" ]]; then
+  if [[ -n "${MOSAIC_INSTALL_SECRET_CANARY:-}" ]]; then
+    printf 'registry diagnostic authToken=%s\n' "$MOSAIC_INSTALL_SECRET_CANARY"
+    printf 'urls=https://alice:p@[email protected]/a https://bob:pa:[email protected]/b https://carol:p%%[email protected]/c https://[email protected]/d https://public.example/e\n'
+    printf 'Authorization: Basic QWxhZGRpbjpvcGVu\n//registry/:_auth=Ym9iOnNlY3JldA==\nCookie: session=abc123\nSet-Cookie: sid=xyz789\n'
+    printf '%s\n' "$MOSAIC_INSTALL_SECRET_CANARY" > "${MOSAIC_TEST_CANARY_OBSERVATION:?}"
+  fi
+  case "$*" in
+    *"@mosaicstack/[email protected]"*)
+      install_cli "0.0.49-next.999"
+      ;;
+    *"@mosaicstack/[email protected]"*)
+      if [[ "${MOSAIC_TEST_FAIL_NEXT_GATEWAY_INSTALL:-0}" == "1" ]]; then
+        echo "forced gateway install failure" >&2
+        exit 1
+      fi
+      echo "0.0.7-next.999" > "$STATE/gateway"
+      ;;
+    *"mosaicstack-mosaic-0.0.0-source.tgz"*)
+      install_cli "0.0.0-source"
+      ;;
+    *"mosaicstack-gateway-0.0.0-source.tgz"*)
+      echo "0.0.0-source" > "$STATE/gateway"
+      ;;
+    *) echo "unexpected npm install: $*" >&2; exit 1 ;;
+  esac
+  exit 0
+fi
+
+if [[ "$1" == "ls" ]]; then
+  cli="$(cat "$STATE/mosaic" 2>/dev/null || true)"
+  gateway="$(cat "$STATE/gateway" 2>/dev/null || true)"
+  node -e '
+    const cli = process.argv[1];
+    const gateway = process.argv[2];
+    const dependencies = {};
+    if (cli) dependencies["@mosaicstack/mosaic"] = { version: cli };
+    if (gateway) dependencies["@mosaicstack/gateway"] = { version: gateway };
+    process.stdout.write(JSON.stringify({ dependencies }));
+  ' "$cli" "$gateway"
+  exit 0
+fi
+
+echo "unexpected npm command: $*" >&2
+exit 1
+FAKE_NPM
+chmod +x "$FAKE_BIN/npm"
+
+cat > "$FAKE_BIN/curl" <<'FAKE_CURL'
+#!/usr/bin/env bash
+set -euo pipefail
+headers=""; output=""; url=""
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    -D) headers="$2"; shift 2 ;;
+    -o) output="$2"; shift 2 ;;
+    --max-filesize) shift 2 ;;
+    -*) shift ;;
+    *) url="$1"; shift ;;
+  esac
+done
+case "$url" in
+  */api/v1/repos/mosaicstack/stack/commits?sha=*)
+    printf 'HTTP/1.1 200 OK\r\ncontent-type: application/json; charset=utf-8\r\n\r\n' > "$headers"
+    printf '[{"sha":"1111111111111111111111111111111111111111"}]\n' > "$output"
+    ;;
+  */archive/*.tar.gz)
+    if [[ "${MOSAIC_TEST_CORRUPT_ARCHIVE:-0}" == "1" ]]; then
+      printf 'not-a-tarball\n' > "$output"
+    else
+      archive_root="$(mktemp -d)"
+      mkdir -p "$archive_root/stack"
+      printf 'fixture\n' > "$archive_root/stack/.fixture"
+      /bin/tar czf "$output" -C "$archive_root" stack
+      rm -rf "$archive_root"
+    fi
+    ;;
+esac
+FAKE_CURL
+chmod +x "$FAKE_BIN/curl"
+
+cat > "$FAKE_BIN/tar" <<'FAKE_TAR'
+#!/usr/bin/env bash
+set -euo pipefail
+dest=""; list=false
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    -C) dest="$2"; shift 2 ;;
+    -*t*|t*) list=true; shift ;;
+    *) shift ;;
+  esac
+done
+[[ "$list" == true ]] && exit 0
+if [[ -z "$dest" ]]; then
+  echo "fake tar missing -C destination" >&2
+  exit 1
+fi
+mkdir -p "$dest/stack/packages/mosaic/framework" "$dest/stack/apps/gateway"
+cat > "$dest/stack/packages/mosaic/framework/install.sh" <<'FRAMEWORK'
+#!/usr/bin/env bash
+set -euo pipefail
+expected="${MOSAIC_PREFIX:?}/bin/mosaic"
+[[ "${MOSAIC_CLI_PATH:-}" == "$expected" && -x "$MOSAIC_CLI_PATH" ]] || {
+  echo "framework did not receive P3 absolute CLI (got=${MOSAIC_CLI_PATH:-unset} expected=$expected)" >&2
+  exit 61
+}
+printf 'framework-cli=%s version=%s\n' "$MOSAIC_CLI_PATH" "$($MOSAIC_CLI_PATH --version)" >> "${MOSAIC_TEST_NPM_LOG:?}"
+mkdir -p "${MOSAIC_HOME:?}/credentials"
+chmod 0700 "$MOSAIC_HOME/credentials"
+printf '# framework fixture\n' > "$MOSAIC_HOME/AGENTS.md"
+FRAMEWORK
+chmod 0755 "$dest/stack/packages/mosaic/framework/install.sh"
+FAKE_TAR
+chmod +x "$FAKE_BIN/tar"
+
+cat > "$FAKE_BIN/pnpm" <<'FAKE_PNPM'
+#!/usr/bin/env bash
+set -euo pipefail
+LOG="${MOSAIC_TEST_NPM_LOG:?}"
+echo "pnpm $*" >> "$LOG"
+
+if [[ "$1" == "pack" ]]; then
+  out=""
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      --pack-destination) out="$2"; shift 2 ;;
+      *) shift ;;
+    esac
+  done
+  if [[ -z "$out" ]]; then
+    echo "fake pnpm pack missing destination" >&2
+    exit 1
+  fi
+  mkdir -p "$out"
+  case "$PWD" in
+    */apps/gateway) touch "$out/mosaicstack-gateway-0.0.0-source.tgz" ;;
+    */packages/mosaic) touch "$out/mosaicstack-mosaic-0.0.0-source.tgz" ;;
+    *) echo "unexpected pnpm pack cwd: $PWD" >&2; exit 1 ;;
+  esac
+  exit 0
+fi
+
+if [[ "${MOSAIC_TEST_FAIL_PNPM_INSTALL:-0}" == "1" && "$1" == "install" ]]; then
+  echo "forced pnpm install failure" >&2
+  exit 42
+fi
+
+# Other install/build commands are no-ops in this harness.
+exit 0
+FAKE_PNPM
+chmod +x "$FAKE_BIN/pnpm"
+
+reset_state() {
+  : > "$LOG"
+  rm -f "$STATE"/*
+}
+
+tree_fingerprint() {
+  local root="$1"
+  if [[ ! -d "$root" ]]; then printf 'ABSENT\n'; return; fi
+  python3 - "$root" <<'PY'
+import hashlib, os, stat, sys
+root=os.path.abspath(sys.argv[1]); rows=[]
+for current, dirs, files in os.walk(root, topdown=True, followlinks=False):
+    for name in dirs + files:
+        path=os.path.join(current,name); meta=os.lstat(path)
+        rel=os.path.relpath(path,root)
+        target=os.readlink(path) if stat.S_ISLNK(meta.st_mode) else ''
+        digest=''
+        if stat.S_ISREG(meta.st_mode):
+            with open(path,'rb') as handle: digest=hashlib.sha256(handle.read()).hexdigest()
+        rows.append((rel,stat.S_IFMT(meta.st_mode),stat.S_IMODE(meta.st_mode),target,digest))
+payload='\n'.join('|'.join(map(str,row)) for row in sorted(rows)).encode()
+print(hashlib.sha256(payload).hexdigest())
+PY
+}
+
+prefix_fingerprint() { tree_fingerprint "$PREFIX"; }
+
+reset_state
+echo "[test] --next fast path pins resolved package versions"
+OUTPUT="$(
+  HOME="$HOME_DIR" \
+  MOSAIC_HOME="$MOSAIC_HOME" \
+  MOSAIC_PREFIX="$PREFIX" \
+  MOSAIC_NO_COLOR=1 \
+  MOSAIC_TEST_NPM_LOG="$LOG" \
+  MOSAIC_TEST_STATE="$STATE" \
+  PATH="$FAKE_BIN:$PATH" \
+  bash "$ROOT/tools/install.sh" --cli --next --yes --no-auto-launch
+)"
+
+grep -qF 'Installed @next packages: CLI 0.0.49-next.999, gateway 0.0.7-next.999' <<<"$OUTPUT"
+grep -qF 'install -g @mosaicstack/[email protected]' "$LOG"
+grep -qF 'install -g @mosaicstack/[email protected]' "$LOG"
+if grep -qE '^install -g .+@next( |$)' "$LOG"; then
+  echo "expected exact-version installs, found mutable @next install" >&2
+  exit 1
+fi
+if grep -qF 'Downloading source ref next at pinned commit' <<<"$OUTPUT"; then
+  echo "fast path unexpectedly fell back to source" >&2
+  exit 1
+fi
+
+ACTIVE="$HOME_DIR/.local/state/mosaic/install/active.json"
+[[ "$(node -p "require('$ACTIVE').status")" == "committed" ]]
+JOURNAL="$(node -p "require('$ACTIVE').journal")"
+[[ "$(stat -c '%a' "$JOURNAL")" == "444" ]]
+( cd "$(dirname "$JOURNAL")" && sha256sum -c "$(basename "$JOURNAL").sha256" >/dev/null )
+grep -q '"event":"mutation".*"phase":"P3".*path=.*prior=.*reverse=' "$JOURNAL"
+
+reset_state
+echo "[test] fast path failure falls back to source build"
+OUTPUT="$(
+  HOME="$HOME_DIR" \
+  MOSAIC_HOME="$MOSAIC_HOME" \
+  MOSAIC_PREFIX="$PREFIX" \
+  MOSAIC_NO_COLOR=1 \
+  MOSAIC_TEST_NPM_LOG="$LOG" \
+  MOSAIC_TEST_STATE="$STATE" \
+  MOSAIC_TEST_FAIL_NEXT_GATEWAY_INSTALL=1 \
+  PATH="$FAKE_BIN:$PATH" \
+  bash "$ROOT/tools/install.sh" --cli --next --yes --no-auto-launch
+)"
+
+grep -qF 'Fast gateway @next install failed.' <<<"$OUTPUT"
+grep -qF 'Falling back to source build at ref next; --next will not hard-fail on registry issues.' <<<"$OUTPUT"
+grep -qF 'Downloading source ref next at pinned commit 1111111111111111111111111111111111111111' <<<"$OUTPUT"
+grep -qF 'Installed from source: CLI 0.0.0-source' <<<"$OUTPUT"
+grep -qF 'install -g @mosaicstack/[email protected]' "$LOG"
+grep -qE 'install -g .*/mosaicstack-gateway-0\.0\.0-source\.tgz' "$LOG"
+grep -qE 'install -g .*/mosaicstack-mosaic-0\.0\.0-source\.tgz' "$LOG"
+[[ "$(cat "$STATE/mosaic")" == "0.0.0-source" ]]
+[[ "$(cat "$STATE/gateway")" == "0.0.0-source" ]]
+
+reset_state
+echo "[test] source-build failure is fatal and restores the pre-install prefix"
+before_prefix="$(prefix_fingerprint)"
+set +e
+OUTPUT="$(
+  HOME="$HOME_DIR" \
+  MOSAIC_HOME="$MOSAIC_HOME" \
+  MOSAIC_PREFIX="$PREFIX" \
+  MOSAIC_NO_COLOR=1 \
+  MOSAIC_TEST_NPM_LOG="$LOG" \
+  MOSAIC_TEST_STATE="$STATE" \
+  MOSAIC_TEST_FAIL_NEXT_GATEWAY_INSTALL=1 \
+  MOSAIC_TEST_FAIL_PNPM_INSTALL=1 \
+  PATH="$FAKE_BIN:$PATH" \
+  bash "$ROOT/tools/install.sh" --cli --next --yes --no-auto-launch 2>&1
+)"
+FAIL_STATUS=$?
+set -e
+[[ "$FAIL_STATUS" -ne 0 ]]
+[[ "$(prefix_fingerprint)" == "$before_prefix" ]]
+grep -qF 'forced pnpm install failure' <<<"$OUTPUT"
+[[ "$(node -p "require('$ACTIVE').status")" == "rolled-back" ]]
+
+reset_state
+echo "[test] corrupt source archive is fatal and restores the pre-install prefix"
+before_prefix="$(prefix_fingerprint)"
+set +e
+OUTPUT="$(
+  HOME="$HOME_DIR" \
+  MOSAIC_HOME="$MOSAIC_HOME" \
+  MOSAIC_PREFIX="$PREFIX" \
+  MOSAIC_NO_COLOR=1 \
+  MOSAIC_TEST_NPM_LOG="$LOG" \
+  MOSAIC_TEST_STATE="$STATE" \
+  MOSAIC_TEST_FAIL_NEXT_GATEWAY_INSTALL=1 \
+  MOSAIC_TEST_CORRUPT_ARCHIVE=1 \
+  PATH="$FAKE_BIN:$PATH" \
+  bash "$ROOT/tools/install.sh" --cli --next --yes --no-auto-launch 2>&1
+)"
+FAIL_STATUS=$?
+set -e
+[[ "$FAIL_STATUS" -ne 0 ]]
+[[ "$(prefix_fingerprint)" == "$before_prefix" ]]
+grep -qF 'archive safety/integrity check failed' <<<"$OUTPUT"
+[[ "$(node -p "require('$ACTIVE').status")" == "rolled-back" ]]
+
+reset_state
+echo "[test] --dev source install does not require registry version resolution"
+OUTPUT="$(
+  HOME="$HOME_DIR" \
+  MOSAIC_HOME="$MOSAIC_HOME" \
+  MOSAIC_PREFIX="$PREFIX" \
+  MOSAIC_NO_COLOR=1 \
+  MOSAIC_TEST_NPM_LOG="$LOG" \
+  MOSAIC_TEST_STATE="$STATE" \
+  MOSAIC_TEST_FAIL_NPM_VIEW=1 \
+  PATH="$FAKE_BIN:$PATH" \
+  bash "$ROOT/tools/install.sh" --cli --dev --ref feature-x --yes --no-auto-launch
+)"
+grep -qF 'Downloading source ref feature-x at pinned commit 1111111111111111111111111111111111111111' <<<"$OUTPUT"
+grep -qF 'Installed from source: CLI 0.0.0-source' <<<"$OUTPUT"
+grep -q '^\[P2\] PASS: source_ref=feature-x pinned_commit=1111111111111111111111111111111111111111 sha256=' <<<"$OUTPUT"
+
+reset_state
+echo "[test] explicit --ref keeps source lane and avoids @next lookup"
+set +e
+OUTPUT="$(
+  HOME="$HOME_DIR" \
+  MOSAIC_HOME="$MOSAIC_HOME" \
+  MOSAIC_PREFIX="$PREFIX" \
+  MOSAIC_NO_COLOR=1 \
+  MOSAIC_TEST_NPM_LOG="$LOG" \
+  MOSAIC_TEST_STATE="$STATE" \
+  PATH="$FAKE_BIN:$PATH" \
+  bash "$ROOT/tools/install.sh" --check --cli --next --ref feature-x
+)"
+CHECK_STATUS=$?
+set -e
+[[ "$CHECK_STATUS" -ne 0 ]]
+grep -q '^\[P2\] PASS: source_ref=feature-x pinned_commit=1111111111111111111111111111111111111111 sha256=' <<<"$OUTPUT"
+if grep -qF '@next version' "$LOG"; then
+  echo "explicit ref should not query @next dist-tags" >&2
+  exit 1
+fi
+
+reset_state
+echo "[test] --check --next rejects mismatched prerelease pipeline suffixes"
+set +e
+OUTPUT="$(
+  HOME="$HOME_DIR" \
+  MOSAIC_HOME="$MOSAIC_HOME" \
+  MOSAIC_PREFIX="$PREFIX" \
+  MOSAIC_NO_COLOR=1 \
+  MOSAIC_TEST_NPM_LOG="$LOG" \
+  MOSAIC_TEST_STATE="$STATE" \
+  MOSAIC_TEST_GATEWAY_NEXT_VERSION="0.0.7-next.1000" \
+  PATH="$FAKE_BIN:$PATH" \
+  bash "$ROOT/tools/install.sh" --check --cli --next
+)"
+CHECK_STATUS=$?
+set -e
+[[ "$CHECK_STATUS" -ne 0 ]]
+grep -q '^\[P2\] FAIL: resolved_version=unavailable' <<<"$OUTPUT"
+
+printf '[test] full framework path receives P3 absolute CLI without relying on PATH\n'
+rm -rf "$HOME_DIR" "$STATE"; mkdir -p "$HOME_DIR" "$STATE"; reset_state
+set +e
+OUTPUT="$(
+  HOME="$HOME_DIR" MOSAIC_HOME="$MOSAIC_HOME" MOSAIC_PREFIX="$PREFIX" \
+  MOSAIC_INSTALL_STATE_DIR="$TMP/full-state" MOSAIC_NO_COLOR=1 \
+  MOSAIC_TEST_NPM_LOG="$LOG" MOSAIC_TEST_STATE="$STATE" \
+  PATH="$FAKE_BIN:/usr/local/bin:/usr/bin:/bin" \
+  bash "$ROOT/tools/install.sh" --next --yes --no-auto-launch 2>&1
+)"
+FULL_STATUS=$?
+set -e
+[[ "$FULL_STATUS" -ne 0 ]] # P4 remains intentionally undeclared until C5.
+grep -qF "framework-cli=$PREFIX/bin/mosaic version=0.0.49-next.999" "$LOG"
+if grep -q "CLI not found on PATH\|did not receive P3 absolute CLI" <<<"$OUTPUT"; then
+  echo "internal framework phase depended on PATH instead of P3 absolute CLI" >&2
+  exit 1
+fi
+
+printf '[test] captured diagnostics redact seeded credential canary everywhere\n'
+rm -rf "$HOME_DIR" "$STATE"; mkdir -p "$HOME_DIR" "$STATE"; reset_state
+canary='C1_SECRET_CANARY_7df4c2'
+OUTPUT="$(
+  HOME="$HOME_DIR" MOSAIC_HOME="$MOSAIC_HOME" MOSAIC_PREFIX="$PREFIX" \
+  MOSAIC_INSTALL_STATE_DIR="$TMP/secret-state" MOSAIC_NO_COLOR=1 \
+  MOSAIC_INSTALL_SECRET_CANARY="$canary" MOSAIC_TEST_CANARY_OBSERVATION="$TMP/canary-observed" \
+  MOSAIC_TEST_NPM_LOG="$LOG" MOSAIC_TEST_STATE="$STATE" \
+  PATH="$FAKE_BIN:/usr/local/bin:/usr/bin:/bin" \
+  bash "$ROOT/tools/install.sh" --cli --next --yes --no-auto-launch 2>&1
+)"
+# Positive control: replace the removed redacted example.io source with one deliberately unredacted userinfo URL.
+OUTPUT+=$'\nhttps://[email protected]/e'
+if grep -qF "$canary" <<<"$OUTPUT"; then echo 'credential canary leaked to terminal output' >&2; exit 1; fi
+if grep -Eq 'alice:p@ss|bob:pa:ss|carol:p%40ss|token@example|user%3Apass|QWxhZGRpbjpvcGVu|Ym9iOnNlY3JldA|session=abc123|sid=xyz789' <<<"$OUTPUT"; then
+  echo 'credentialed URL userinfo leaked to terminal output' >&2; exit 1
+fi
+for host in example.com example.net example.org example.dev example.io; do
+  grep -qF "https://[REDACTED]@$host" <<<"$OUTPUT" \
+    || { echo "credentialed URL redaction control missing for $host" >&2; exit 1; }
+done
+secret_active="$TMP/secret-state/active.json"
+secret_journal="$(node -p "require('$secret_active').journal")"
+secret_command_log="$(dirname "$secret_journal")/commands.log"
+if grep -R -F "$canary" "$secret_command_log" "$HOME_DIR" 2>/dev/null; then
+  echo 'credential canary leaked to persistent installer output' >&2; exit 1
+fi
+if grep -E 'alice:p@ss|bob:pa:ss|carol:p%40ss|token@example|user%3Apass|QWxhZGRpbjpvcGVu|Ym9iOnNlY3JldA|session=abc123|sid=xyz789' "$secret_command_log" >/dev/null; then
+  echo 'credentialed URL userinfo leaked to persistent installer output' >&2; exit 1
+fi
+if [[ "$(cat "$TMP/canary-observed" 2>/dev/null || true)" != "$canary" ]]; then
+  echo 'credential canary positive control was not exercised' >&2; exit 1
+fi
+test_assert_find_empty 'redacted diagnostic staging files' \
+  "$TMPDIR" -maxdepth 1 -type f \
+  \( -name 'mosaic-phase-redacted.*' -o -name 'mosaic-post-redacted.*' \) || exit 1
+
+printf '[test] framework nested capture redacts the same canary and URL variants\n'
+framework_test_home="$TMP/framework-redact-home"
+framework_target="$framework_test_home/.config/mosaic"
+framework_cli="$TMP/framework-redact-cli"
+framework_log="$TMP/framework-redact-commands.log"
+framework_status="$TMP/framework-redact-status.tsv"
+mkdir -p "$framework_test_home"; : > "$framework_log"; : > "$framework_status"
+cat > "$framework_cli" <<'FRAMEWORK_CLI'
+#!/usr/bin/env bash
+printf 'nested authToken=%s\n' "${MOSAIC_INSTALL_SECRET_CANARY:?}"
+printf 'nested=https://alice:p@[email protected]/a https://bob:pa:[email protected]/b https://carol:p%%[email protected]/c https://[email protected]/d https://user%%[email protected]/e\n'
+printf 'Authorization: Basic QWxhZGRpbjpvcGVu\n//registry/:_auth=Ym9iOnNlY3JldA==\nCookie: session=abc123\nSet-Cookie: sid=xyz789\n'
+exit 1
+FRAMEWORK_CLI
+chmod 0755 "$framework_cli"
+set +e
+FRAMEWORK_OUTPUT="$(
+  HOME="$framework_test_home" MOSAIC_HOME="$framework_target" MOSAIC_INSTALL_MODE=overwrite \
+  MOSAIC_CLI_PATH="$framework_cli" MOSAIC_INSTALL_SECRET_CANARY="$canary" \
+  MOSAIC_INSTALL_COMMAND_LOG="$framework_log" MOSAIC_INSTALL_PHASE_STATUS_FILE="$framework_status" \
+  MOSAIC_ALLOW_MISSING_SEQUENTIAL_THINKING=1 MOSAIC_SKIP_SKILLS_SYNC=1 \
+  bash "$ROOT/packages/mosaic/framework/install.sh" 2>&1
+)"
+framework_install_status=$?
+set -e
+[[ "$framework_install_status" -eq 0 ]]
+if grep -Eq "$canary|alice:p@ss|bob:pa:ss|carol:p%40ss|token@example|user%3Apass|QWxhZGRpbjpvcGVu|Ym9iOnNlY3JldA|session=abc123|sid=xyz789" <<<"$FRAMEWORK_OUTPUT" \
+  || grep -Eq "$canary|alice:p@ss|bob:pa:ss|carol:p%40ss|token@example|user%3Apass|QWxhZGRpbjpvcGVu|Ym9iOnNlY3JldA|session=abc123|sid=xyz789" "$framework_log"; then
+  echo 'framework nested capture leaked credential diagnostics' >&2; exit 1
+fi
+for host in example.com example.net example.org example.dev example.io; do
+  grep -qF "https://[REDACTED]@$host" "$framework_log" \
+    || { echo "framework URL redaction control missing for $host" >&2; exit 1; }
+done
+
+printf '[test] real P2-P8 actions run under fault injection and restore actual surfaces\n'
+for phase in P2 P3 P4 P5 P6 P7 P8; do
+  rm -rf "$HOME_DIR" "$STATE" "$TMP/fault-$phase"; mkdir -p "$HOME_DIR" "$STATE" "$TMP/fault-$phase"
+  printf 'operator-sentinel\n' > "$HOME_DIR/operator.txt"
+  reset_state
+  before="$(tree_fingerprint "$HOME_DIR")"
+  set +e
+  HOME="$HOME_DIR" MOSAIC_HOME="$MOSAIC_HOME" MOSAIC_PREFIX="$PREFIX" \
+    MOSAIC_INSTALL_STATE_DIR="$TMP/fault-$phase" MOSAIC_INSTALL_FAULT_AFTER="$phase" \
+    MOSAIC_INSTALL_SELF_TEST_ALLOW=1 MOSAIC_NO_COLOR=1 \
+    MOSAIC_TEST_NPM_LOG="$LOG" MOSAIC_TEST_STATE="$STATE" \
+    PATH="$FAKE_BIN:/usr/local/bin:/usr/bin:/bin" \
+    bash "$ROOT/tools/install.sh" --state-machine-self-test --next --yes \
+    >"$TMP/fault-$phase.log" 2>&1
+  status=$?
+  set -e
+  [[ "$status" -eq 97 ]] || { echo "$phase real fault expected 97, got $status" >&2; exit 1; }
+  [[ -s "$LOG" ]] || { echo "$phase fault never entered the real action path" >&2; exit 1; }
+  [[ "$(tree_fingerprint "$HOME_DIR")" == "$before" ]] || { echo "$phase real rollback mismatch" >&2; exit 1; }
+  grep -q "phase=$phase" "$TMP/fault-$phase.log"
+  test_assert_no_file_content_match "$phase fault-state" \
+    '"status"[[:space:]]*:[[:space:]]*"in-progress"' "$TMP/fault-$phase" || exit 1
+done
+
+printf '[test] stale projection is preserved while the real fault path acquires a free OS lock\n'
+rm -rf "$HOME_DIR" "$STATE" "$TMP/stale-state"; mkdir -p "$HOME_DIR" "$STATE" "$TMP/stale-state"
+printf '{"status":"in-progress","journal":"%s"}\n' "$TMP/stale-state/dead-run/journal.ndjson" > "$TMP/stale-state/active.json"
+reset_state
+set +e
+HOME="$HOME_DIR" MOSAIC_HOME="$MOSAIC_HOME" MOSAIC_PREFIX="$PREFIX" \
+  MOSAIC_INSTALL_STATE_DIR="$TMP/stale-state" MOSAIC_INSTALL_FAULT_AFTER=P2 \
+  MOSAIC_INSTALL_SELF_TEST_ALLOW=1 MOSAIC_NO_COLOR=1 \
+  MOSAIC_TEST_NPM_LOG="$LOG" MOSAIC_TEST_STATE="$STATE" \
+  PATH="$FAKE_BIN:/usr/local/bin:/usr/bin:/bin" \
+  bash "$ROOT/tools/install.sh" --state-machine-self-test --next --yes >"$TMP/stale.log" 2>&1
+stale_status=$?
+set -e
+[[ "$stale_status" -eq 97 ]]
+find "$TMP/stale-state" -name prior-active.json -type f -print -quit | grep -q .
+[[ "$(node -p "require('$TMP/stale-state/active.json').status")" == rolled-back ]]
+
+echo "[test] installer next lane tests passed"
@@ -0,0 +1,13 @@
+[test] --next fast path pins resolved package versions
+[test] fast path failure falls back to source build
+[test] source-build failure is fatal and restores the pre-install prefix
+[test] corrupt source archive is fatal and restores the pre-install prefix
+[test] source archive with multiple extracted roots fails instead of selecting by find order
+[test] --dev source install does not require registry version resolution
+[test] explicit --ref keeps source lane and avoids @next lookup
+[test] --check --next rejects mismatched prerelease pipeline suffixes
+[test] full framework path receives P3 absolute CLI without relying on PATH
+[test] captured diagnostics redact seeded credential canary everywhere
+[test] framework nested capture redacts the same canary and URL variants
+[test] real P2-P8 actions run under fault injection and restore actual surfaces
+P2 left an in-progress transaction
@@ -0,0 +1,14 @@
+[test] --next fast path pins resolved package versions
+[test] fast path failure falls back to source build
+[test] source-build failure is fatal and restores the pre-install prefix
+[test] corrupt source archive is fatal and restores the pre-install prefix
+[test] source archive with multiple extracted roots fails instead of selecting by find order
+[test] --dev source install does not require registry version resolution
+[test] explicit --ref keeps source lane and avoids @next lookup
+[test] --check --next rejects mismatched prerelease pipeline suffixes
+[test] full framework path receives P3 absolute CLI without relying on PATH
+[test] captured diagnostics redact seeded credential canary everywhere
+[test] framework nested capture redacts the same canary and URL variants
+[test] real P2-P8 actions run under fault injection and restore actual surfaces
+[test] stale projection is preserved while the real fault path acquires a free OS lock
+[test] installer next lane tests passed
@@ -0,0 +1,2 @@
+[test] enumeration failure cannot mask a planted in-progress transaction
+[test] FAIL: planted in-progress transaction plus failed enumeration passed the full suite
@@ -0,0 +1,14 @@
+[test] --next fast path pins resolved package versions
+[test] fast path failure falls back to source build
+[test] source-build failure is fatal and restores the pre-install prefix
+[test] corrupt source archive is fatal and restores the pre-install prefix
+[test] source archive with multiple extracted roots fails instead of selecting by find order
+[test] --dev source install does not require registry version resolution
+[test] explicit --ref keeps source lane and avoids @next lookup
+[test] --check --next rejects mismatched prerelease pipeline suffixes
+[test] full framework path receives P3 absolute CLI without relying on PATH
+[test] captured diagnostics redact seeded credential canary everywhere
+[test] framework nested capture redacts the same canary and URL variants
+[test] real P2-P8 actions run under fault injection and restore actual surfaces
+find: ‘/tmp/mosaic-next-install-test-hqL7U0/fault-P2/blocked’: Permission denied
+[test] ERROR: P2 fault-state enumeration failed
@@ -0,0 +1,121 @@
+#1050 C1 ROUND 3 — REMOTE-ARM DOWNSTREAM SOURCE BINDING
+
+IDENTITY / SCOPE
+- branch: feat/1050-install-state-machine-red-fixture
+- predecessor/provider lease pin: ff3f0d29f1763bed44a60610d073036112e66b77
+- status language: believed-fixed, pending jarvis validation
+- in scope: remote arm's mosaicstack/stack framework/source archive (#7)
+- unchanged/fenced: expected-RED manifest including P6=FAIL; #869; #1068 sequencing
+- corrected reference citation: the container-image acquisition path in fa-install.sh only
+
+ACQUISITION-PATH CENSUS (10/10 CODE-READ; COMPLETE RUNTIME PATH CENSUS NOT MEASURED)
+1. Woodpecker checkout at CI commit — fully constrained by intended CI identity.
+2. node:22-bookworm-slim image — unpinned sibling, out of scope.
+3. apt package set — unpinned sibling, out of scope.
+4. tools/install.sh at CI_COMMIT_SHA + verified SHA-256 — fully constrained.
+5. @mosaicstack/mosaic@next — P2 CLI value is authoritative; realised disagreement is detected at P3 — fully constrained at the top-level package version.
+6. @mosaicstack/gateway@next — later re-resolution wins and is verified against itself; drift from the first value can be silently accepted — partially constrained TOCTOU sibling, out of scope.
+7. stack framework/source archive — pre-fix internally pinned to WRONG identity 4df478cdd150fdf8d52ea109f02ade5d85017acd; post-fix bound to intended CI commit.
+8. unversioned sequential-thinking npx package — unpinned sibling, out of scope.
+9. Excalidraw dependency graph — shipped lockfile exact versions + registry integrity hashes — fully constrained by lock/integrity.
+10. agent-skills default-branch clone — unpinned sibling, out of scope.
+
+Post-fix mechanism breakdown: fully constrained 5/10 (#1,#4,#5,#7,#9); partially constrained 1/10 (#6); unpinned 4/10 (#2,#3,#8,#10). Same-CI stack payload hops moved from 1/2 to 2/2. The fix does not increase the number of constrained paths; it corrects #7 from wrong identity to intended identity. This census is a LOWER BOUND on defects and an UPPER BOUND on assurance: questioning revised the claimed assurance downward each time (blended 6/10 -> mechanism split -> 5 full + 1 partial + 4 unpinned), never upward.
+
+#5/#6 RESOLUTION-FAILURE / TOCTOU DISPOSITION (CODE-READ; DISAGREEMENT INJECTION NOT MEASURED)
+- P1 metadata failure blocks before mutation.
+- Failed package install falls back to the one immutable stack archive resolved in P2; source resolution/fetch failure is fatal.
+- #5 CLI: P2 RESOLVED_CLI_VERSION is authoritative; a later installed CLI mismatch is detected by P3 and rolls back.
+- #6 gateway: no authoritative P2 gateway value is persisted. The last resolution in install_next_cli_from_registry wins and is compared with itself, so successful same-suffix gateway drift can be silently accepted. Reported, not fixed.
+
+RED-FIRST — STALE NEXT REJECTED BEFORE ACQUISITION FIX
+Command shape: exact ff3f0d2 installer URL/digest + expected source commit/digest, remote next lane.
+- expected source commit: ff3f0d29f1763bed44a60610d073036112e66b77
+- expected source SHA-256: 944c6db1b01b23c83169e6dc83e0d31262b1d24a2825270441745eb65c269c25
+- fixture rc: 1
+- realised source commit: 4df478cdd150fdf8d52ea109f02ade5d85017acd
+- realised source SHA-256: 3e6d831efe13c3b2c0501507099d4a566af5abf877dacf85e5d7e4284d35e5c7
+- source control: FAIL (realised != expected)
+- P6 final fixture value: PASS (false pass from stale framework)
+- forbidden evidence: CLI not found on PATH present
+- comparator rc: 1; failures=8/checks=19
+
+IMPLEMENTED PATH #7
+- .woodpecker/greenfield-install.yml supplies MOSAIC_FIXTURE_SOURCE_COMMIT=${CI_COMMIT_SHA} while still invoking --lane next and --source remote.
+- tools/e2e-install-test.sh validates 40-hex commit input, derives the exact commit archive URL, rejects failed/empty fetch, computes SHA-256 over that exact body, and passes the body/commit/digest through MOSAIC_INSTALL_LOCAL_SOURCE_{ARCHIVE,COMMIT,SHA256}.
+- The existing installer local-source seam re-hashes the body and rejects mismatch.
+- The fixture verifies realised .install-manifest.json sourceCommit and sourceSha256 against the exact fetched body after installation. Mismatch exits before the phase comparator; there is no fallback to next.
+
+EXACT-SOURCE REPRODUCIBILITY RESULT — N=5 IDENTICAL FINAL-TREE EXECUTIONS
+Invariant inputs on every run:
+- fixture mode: --lane next --source remote --git present
+- installer/source commit: ff3f0d29f1763bed44a60610d073036112e66b77
+- installer SHA-256: e59cb441a2f37ae9150f8eae470238e9d858a1816df93343d9784a6796676096
+- realised source SHA-256: 944c6db1b01b23c83169e6dc83e0d31262b1d24a2825270441745eb65c269c25
+- resolved/realised CLI: @mosaicstack/mosaic@next = 0.0.50-next.2207
+- fixture rc=1, P3 PASS, SOURCE-CONTROL PASS, installer_exit=1, done_claims=0, P6 FAIL, P9 FAIL
+
+Per-run outcomes:
+run 1: comparator rc=0; checks=19/19; dead_hooks=0; P6 reason=runtime linking/activation action reported a required failure; elapsed/load NOT MEASURED
+run 2: comparator rc=0; checks=19/19; dead_hooks=0; P6 reason=runtime linking/activation action reported a required failure; elapsed/load NOT MEASURED
+run 3: comparator rc=1; checks=18/19; dead_hooks=2; P6 reason=broker absent but dead enforcement hooks are active (count=2); elapsed=912s; load before=7.79 7.51 8.93; load after=12.28 14.82 11.79
+run 4: comparator rc=0; checks=19/19; dead_hooks=0; P6 reason=runtime linking/activation action reported a required failure; elapsed=938s; load before=12.28 14.82 11.79; load after=9.84 15.18 13.83
+run 5: comparator rc=0; checks=19/19; dead_hooks=0; P6 reason=runtime linking/activation action reported a required failure; elapsed=954s; load before=9.84 15.18 13.83; load after=3.94 4.76 8.18
+
+Rate, not verdict:
+- comparator rc=0: 4/5
+- comparator rc=1: 1/5
+- action-failure P6 reason: 4/5
+- dead-hooks-active count=2 P6 reason: 1/5
+- source commit/digest property: PASS 5/5
+- P6 outcome property: FAIL 5/5
+No comparator verdict is claimed. Identical source, digest, and package version produced different comparator values; this gate is nondeterministic on the #869 probe path. Load does not explain the small sample monotonically: run 4 had the highest observed 5/15-minute load but produced rc=0. The 2000ms capability-probe timeout remains a code-read hypothesis, NOT MEASURED as causal.
+
+CHECKOUT CONTROL (EXECUTED, NOT PART OF REMOTE N=5)
+The checkout-source arm independently produced: fixture rc=1; @next CLI 0.0.50-next.2207; P3 PASS; P6 FAIL with dead hooks active count=2; comparator rc=1 with the same 1/19 required-reason miss. This showed that outcome can occur independently of the remote #7 binding; its reproducibility was not separately measured.
+
+PROPERTY / SIGNAL FINDING (MANIFEST UNCHANGED)
+P6=FAIL remains the correct property and is unchanged. The comparator additionally pins one reason signal: "runtime linking/activation action reported a required failure". Exact-source P6 failed on all 5/5 runs, while the reason signal varied. The reason assertion was not widened to fit either observation.
+
+#869 FINDING (BEHAVIOR EXECUTED; ROOT-CAUSE ATTRIBUTION CODE-READ)
+Current @next now carries the lease capability. defaultSupervisorProbe treats bundled launcher+daemon file presence plus a nonempty resolved socket PATH as supervisor presence; it does not require the socket itself to exist. One of five identical clean broker-absent runs wired two dead hooks and let the linker exit zero; four reported the action failure. The 2000ms defaultCapabilityProbe subprocess timeout is a code-read candidate for the variance, NOT MEASURED as causal. Fixing this is #869 scope and was not performed.
+
+TRUST BOUNDARY / INDEPENDENT PROVENANCE
+The exact-commit archive URL binds source identity under the configured repository provider's authenticated mapping of commit ID to response bytes. The computed SHA-256 proves that the bytes executed are the bytes that exact URL served and that they did not change between fetch, installer consumption, and manifest verify-after. That is the measured control against stale-next substitution: SOURCE-CONTROL passed 5/5 exact-source runs and failed when R7 deleted the binding. The digest does NOT prove that those bytes are what the repository's authors published if the repository service or TLS trust root is compromised. Provider + TLS are the trust root by design. Independent signed provenance/authenticity remains an inherited deferral explicitly sourced to canonical greenfield-install PRD v2 §3, matching the already documented install.sh sidecar boundary. No stronger supply-chain claim is made. Codex security review's initial HIGH/CWE-494 finding is retained as the named trust-root deferral rather than bypassed or silently reclassified.
+
+R7 DELETE-THE-SUBJECT MUTANT (EXECUTED)
+Deleted the three MOSAIC_INSTALL_LOCAL_SOURCE_{ARCHIVE,COMMIT,SHA256} binding exports from tools/e2e-install-test.sh temporarily while retaining the realised source assertion.
+- fixture rc: 1
+- realised source commit reverted to 4df478cdd150fdf8d52ea109f02ade5d85017acd
+- expected source commit remained ff3f0d29f1763bed44a60610d073036112e66b77
+- realised source SHA-256: 3e6d831efe13c3b2c0501507099d4a566af5abf877dacf85e5d7e4284d35e5c7
+- expected source SHA-256: 944c6db1b01b23c83169e6dc83e0d31262b1d24a2825270441745eb65c269c25
+- SOURCE-CONTROL: FAIL
+- comparator rc: 1; failures=8/checks=19
+- elapsed: 171s; load before=4.13 4.71 8.05; load after=4.94 4.58 7.42
+- subject file SHA-256 before mutant: a93113565aa69f2c6f3d792b78251021bb3bbe3f7813d5fed547ab0099fa3b98
+- subject file SHA-256 after restoration: a93113565aa69f2c6f3d792b78251021bb3bbe3f7813d5fed547ab0099fa3b98
+
+EVIDENCE LOGS (LOCAL, NOT COMMITTED RAW TRANSCRIPTS)
+- /tmp/c1-round3-red.log and /tmp/c1-round3-red-summary.txt
+- /tmp/c1-round3-green.log and /tmp/c1-round3-green-summary.txt
+- /tmp/c1-round3-green-comparator.log
+- /tmp/c1-round3-checkout-control.log and /tmp/c1-round3-checkout-summary.txt
+- /tmp/c1-round3-repro-n5.tsv and /tmp/c1-round3-repro-{3,4,5}.log
+- /tmp/c1-round3-final-r7.log and /tmp/c1-round3-final-r7-summary.txt
+
+BASELINES / INDEPENDENT REVIEW
+- bash -n tools/e2e-install-test.sh: PASS
+- shellcheck tools/e2e-install-test.sh: PASS
+- invalid remote source commit control: rc=2, named 40-hex requirement
+- pnpm test:installer: PASS
+- pnpm typecheck: PASS, 45/45 tasks
+- pnpm lint: PASS, 25/25 tasks
+- pnpm format:check: PASS
+- git diff --check: PASS
+- Codex code review: APPROVE, confidence 0.92, 6 files, zero findings
+- Initial Codex security review: HIGH/CWE-494 on independent provider-compromise provenance; retained and bounded explicitly in PRD/report as the canonical v2 §3 deferral
+- Codex security re-review after trust-boundary documentation: risk NONE, confidence 0.96, 6 files, zero findings
+
+PUSH / CI
+Not yet recorded in this artifact. No CI polling is authorised after the single push.
@@ -0,0 +1,83 @@
+#1050 C1 ROUND 4 — PIPELINE CASE-COVERAGE DENOMINATOR
+
+IDENTITY / SCOPE
+- predecessor head: 0e2eef1c1261444b83c089df6047a2a06592d5c6
+- branch: feat/1050-install-state-machine-red-fixture
+- only open requirement: pipeline-level expected-case/executed-case set equality
+- unchanged/fenced: tools/fixtures/greenfield-expected-red.tsv, tools/verify-greenfield-expected-red.sh, #869, P6 detector/producer, absolute-P3 CLI linking, and per-case fixture dispositions
+- status language: believed-fixed, pending jarvis validation
+
+STALE-RULING WITHDRAWAL HONOURED
+Requirements 1-3 were withdrawn after pipeline 2242 at 0e2eef1c reached terminal green and showed P6 failure propagation, absolute-P3 CLI use, and an executed git-absent arm. A temporary local P6-consumer edit made while the stale ruling was in flight was restored before this change set; tools/e2e-install-test.sh has no final-tree delta. Requirement 5 alone remains in this round.
+
+RED-FIRST
+Before the change, .woodpecker/greenfield-install.yml had no pipeline-level initialized marker store, no per-case success marker, and no final exact-set gate. A static assertion for a final run-on-failure case-coverage step failed. Pipeline 2242's green result proved that all three cases ran once, but no gate required that population on a later run.
+
+IMPLEMENTATION
+- tools/verify-greenfield-case-coverage.sh is a new pipeline-level instrument; the existing per-case verifier is unchanged.
+- Expected case names are derived from the first TSV field of tools/fixtures/greenfield-expected-red.tsv and sorted uniquely. There is no literal expected count.
+- Marker storage is scoped by ${CI_PIPELINE_NUMBER}-${CI_WORKFLOW_NUMBER}. The init action validates the manifest and empties only that run directory, so stale markers cannot satisfy a retry or later run.
+- Every case/contract step explicitly depends on initialization. Each unconditional case step calls mark only after its exact tools/verify-greenfield-expected-red.sh invocation succeeds.
+- The final greenfield-case-denominator step explicitly depends on all four case/contract steps, has status eligibility [success, failure], emits cases_defined=N cases_executed=M, and compares sorted expected and actual case-name sets. Missing or unexpected names fail even when the two counts are equal.
+- A newly defined manifest case changes the expected set automatically and fails until a corresponding successful case step marks it.
+
+MEASURED CONTROLS
+1. Skipped expected arm:
+   rc=1
+   [fixture-suite] cases_defined=3 cases_executed=2
+   [fixture-suite] missing_case=next-git-absent
+2. Count-inflation control (one expected missing, one unexpected added):
+   rc=1
+   [fixture-suite] cases_defined=3 cases_executed=3
+   [fixture-suite] missing_case=next-git-absent
+   [fixture-suite] unexpected_case=unexpected-case
+3. Stale-marker initialization control (same run re-initialized after markers existed):
+   rc=1
+   [fixture-suite] cases_defined=3 cases_executed=0
+   missing_case rows emitted for all three expected names
+4. Exact-set positive control:
+   rc=0
+   [fixture-suite] cases_defined=3 cases_executed=3
+5. Future manifest case control:
+   rc=1
+   [fixture-suite] cases_defined=4 cases_executed=3
+   [fixture-suite] missing_case=future-case
+
+WORKFLOW / FOCUSED VALIDATION
+- bash -n new subject and test: PASS
+- shellcheck new subject and test: PASS
+- bash tools/verify-greenfield-case-coverage.test.sh: PASS
+- test statically proves each mark follows its exact per-case verifier, every producer depends on initialization, the final gate depends on the complete matrix, and final status eligibility includes success+failure
+- woodpecker-cli lint --strict .woodpecker/greenfield-install.yml: PASS
+- Prettier check for workflow/package/PRD: PASS
+- git diff --check: PASS
+
+CURRENT-HEAD FIXTURE MEASUREMENTS TAKEN BEFORE THE STALE RULING WAS WITHDRAWN
+These measurements were run from 0e2eef1c before requirement 5 changed only pipeline instrumentation. They are retained as measured outcomes, not as justification for modifying requirements 1-3.
+- next checkout/git-present: fixture rc=1; resolved @next=0.0.50-next.2207; P0/P1/P2/P3/P7 PASS; P4/P5/P6/P8/P9 FAIL; installer_exit=1; done_claims=0; P6 reason was dead enforcement hooks active count=2.
+- next checkout/git-absent: fixture rc=1; P0/P6/P7 PASS; P1/P2/P3/P4/P5/P8/P9 FAIL; installer_exit=1; done_claims=0.
+- /home free before the first run: 8.5G; after concurrent authorized fleet reclaim completed: 11G; no be-coder-05 generated payload was deleted because active fixture work made that churn.
+
+INDEPENDENT REVIEW CYCLE
+- Initial Codex code review: REQUEST_CHANGES, confidence 0.96; one blocker found that the first draft omitted depends_on ordering and could race initialization/final checking.
+- Disposition: accepted. Added explicit init -> all case/contract steps -> final dependency graph and a regression assertion for every dependency edge.
+- Initial Codex security review: risk NONE, confidence 0.94, zero findings. The sandbox could not create its own temp directory; local focused/full tests provide the dynamic evidence.
+- First post-dependency code re-review: REQUEST_CHANGES, confidence 0.99; the case extractor treated the production manifest's comment lines as case names, while the synthetic test omitted comments.
+- Disposition: accepted. Case derivation now excludes blank/comment lines; the focused test includes representative comments and executes init/mark/check against the repository's real manifest.
+- Post-dependency security re-review: risk NONE, confidence 0.96, zero findings.
+- Final Codex code re-review after the comment fix: APPROVE, confidence 0.94, 8 files, zero findings. It confirmed ordering, run scope, fail-closed set equality, PRD alignment, and negative controls.
+- Final Codex security re-review: risk NONE, confidence 0.96, 8 files, zero findings.
+
+FINAL LOCAL BASELINES
+- pnpm test:installer: PASS, including the new coverage suite
+- pnpm typecheck: PASS, 45/45
+- pnpm lint: PASS, 25/25
+- pnpm format:check: PASS
+- bash -n + ShellCheck for new shell surfaces: PASS
+- Woodpecker strict lint: PASS
+- git diff --check: PASS
+- /home free before/after local baselines: 11G
+
+PENDING BEFORE PUSH
+- commit, queue guard, one push, provider attribution read-back
+- announce the new full SHA to rev-security-02; do not merge or close
@@ -0,0 +1,81 @@
+#1050 C1 ROUND 5 — ARM COVERAGE + CHECKOUT PURITY
+
+IDENTITY / SCOPE
+- predecessor head: f33bd0da96bee3ce518744d6888d018bebb1c841
+- branch: feat/1050-install-state-machine-red-fixture
+- review inputs: be-coder-06 review 110; rev-security-02 review 111
+- in scope: exact required pipeline-arm set including greenfield-remote-installer-contract; success-only arm marks; skipped-remote RED control; coverage-state exclusion from checkout source archives
+- unchanged/fenced: tools/fixtures/greenfield-expected-red.tsv, tools/verify-greenfield-expected-red.sh, tools/e2e-install-test.sh, #869, and all per-case dispositions
+- status: believed-fixed, pending jarvis validation
+
+RED-FIRST — FOUR ARMS WERE REPRESENTED BY THREE CASES
+The f33bd0d gate represented only the three expected-RED case identities. With all three case names marked and no remote-arm identity available, the production checker returned:
+  SKIPPED_REMOTE_ARM_CURRENT_GATE_RC=0
+  [fixture-suite] cases_defined=3 cases_executed=3
+The fourth required arm, greenfield-remote-installer-contract, reused next-git-present and therefore could skip without changing case-set equality.
+
+RED-FIRST — COVERAGE STATE CONTAMINATED CHECKOUT ARCHIVES
+The f33bd0d workflow created .greenfield-case-state in the shared repository before the checkout-mode fixture arms. An independent reproduction using the exact e2e-install-test.sh tar exclusions created .greenfield-case-state/remote-arm.ran and measured:
+  OLD_STATE_ARCHIVE_MATCHES=1
+The state instrument was therefore part of the checkout source payload it was intended only to observe.
+
+IMPLEMENTATION
+- Renamed the checker to tools/verify-greenfield-execution-coverage.sh and generalized it over two validated dimensions: cases and arms.
+- Added tools/fixtures/greenfield-expected-arms.txt as the explicit required arm set:
+  greenfield-git-present
+  greenfield-main-git-present
+  greenfield-remote-installer-contract
+  greenfield-git-absent
+- Expected cases remain derived from the unchanged expected-RED TSV. Expected arms are derived from the new one-name-per-line arm declaration. Both inputs allow comments/blanks and validate every resulting name.
+- Each of the four fixture arms writes its unique arm marker only after its exact per-case verifier succeeds. The three distinct expected-RED cases continue to write case markers after successful verification.
+- The final step checks both dimensions even when the first check fails, emits both denominators, and fails unless both exact name sets match.
+- Coverage state moved to .mosaic-test-work/greenfield-execution-coverage/${CI_PIPELINE_NUMBER}-${CI_WORKFLOW_NUMBER}/{cases,arms}. The checkout archive already excludes every */.mosaic-test-work subtree.
+- The expected-RED manifest, per-case verifier, and detector are untouched.
+
+MEASURED SKIPPED-REMOTE CONTROL
+With all three cases marked and only the three non-remote arms marked:
+  case gate rc=0
+  [fixture-suite] cases_defined=3 cases_executed=3
+  arm gate rc=1
+  [fixture-suite] arms_defined=4 arms_executed=3
+  [fixture-suite] missing_arm=greenfield-remote-installer-contract
+This is the discriminating control: the case denominator remains green while the arm denominator catches the exact previously invisible skip.
+
+OTHER DYNAMIC CONTROLS
+- missing case: cases 3/2 => rc1
+- case count inflation (one missing + one unexpected): cases 3/3 => rc1
+- stale case markers after re-init: cases 3/0 => rc1
+- exact case set: cases 3/3 => rc0
+- future manifest case: cases 4/3 => rc1
+- arm count inflation (remote missing + unexpected): arms 4/4 => rc1
+- exact arm set: arms 4/4 => rc0
+- production expected-RED manifest comments/blanks: accepted; exact set 3/3 => rc0
+- archive selector firing control: a non-excluded root marker is present in the archive
+- archive purity control: no .mosaic-test-work path is present in the archive
+
+STATIC / STRUCTURAL CONTROLS
+- every case mark follows that arm's successful per-case verifier
+- every arm mark, including the remote contract, follows that arm's successful per-case verifier
+- all four arms depend on coverage initialization
+- final denominator depends on all four arms and is eligible after success or failure
+- final denominator runs both checks and aggregates their statuses
+- workflow contains the already-excluded .mosaic-test-work state root and no .greenfield-case-state reference
+
+LOCAL BASELINES
+- bash -n + ShellCheck on generalized checker/test: PASS
+- pnpm test:installer: PASS, including execution-coverage controls
+- pnpm typecheck: PASS, 45/45
+- pnpm lint: PASS, 25/25
+- pnpm format:check: PASS
+- woodpecker-cli lint --strict: PASS
+- git diff --check: PASS
+- /home free before/after: 11G
+
+INDEPENDENT REVIEW
+- Codex code review: APPROVE, confidence 0.93, zero findings. It confirmed exact arm coverage, success-only marking, dual-status aggregation, excluded state, checkout-purity controls, and PRD alignment.
+- Codex security review: risk NONE, confidence 0.96, zero findings. CI/path identifiers are constrained, expansions quoted, expected sets treated as data, and checks fail closed.
+- Review sandboxes could not execute their own dynamic suite/ShellCheck because their filesystem is read-only; the local measured baselines above provide that evidence.
+
+PENDING
+- commit, queue guard, one push, attribution read-back
+- announce the new full SHA; no merge or closure
@@ -0,0 +1,60 @@
+# #1050 C1 fix round — Round 6 caller coupling and production archive binding
+
+BASE HEAD
+- df705828a439c6795cd47c938ed7f838b956ebf3
+- Reviews 114 (rev-security-02) and 115 (be-coder-06) independently reproduced the same caller-level mutant: ignoring arms_status in the workflow left the focused helper suite green.
+- Both reviewers confirmed the production aggregation was correct and requested test reachability, not a logic rewrite.
+- rev-974 separately deleted only the production e2e-install-test.sh .mosaic-test-work tar exclusion; the copied-selector suite remained green.
+
+RED
+- After adding the four-cell caller truth-table expectations but before creating the workflow helper:
+  bash tools/verify-greenfield-execution-coverage.test.sh => rc=1
+  The expected helper did not exist, so the test could not reach a passing aggregation implementation.
+- Prior independent controls:
+  ignore-arms workflow mutant => rc=0 before this round (reviews 114/115)
+  delete-production-archive-exclusion mutant => rc=0 before this round (rev-974 exact-head sandbox)
+
+IMPLEMENTATION
+- Extracted the existing set +e / two checks / status capture / final OR into tools/verify-greenfield-execution-coverage-gate.sh without changing its semantics.
+- .woodpecker/greenfield-install.yml now invokes that helper directly; its inline duplicate was removed.
+- The focused suite invokes the same helper used by the workflow across all four cells:
+  cases PASS / arms FAIL => RED
+  cases FAIL / arms PASS => RED
+  both FAIL => both diagnostic outputs and RED
+  both PASS => GREEN
+- The archive-purity test now first locates the production checkout-archive command in tools/e2e-install-test.sh and requires its .mosaic-test-work exclusion, then proves the exclusion's archive effect.
+- GREENFIELD_COVERAGE_GATE and GREENFIELD_E2E_INSTALLER are test-only subject injection seams used to prove the requested mutants; production paths remain the defaults.
+
+MUTATION CONTROLS
+- ignore-arms aggregation helper => focused suite rc=1
+- ignore-cases aggregation helper => focused suite rc=1
+- always-RED aggregation helper => focused suite rc=1
+- delete only production .mosaic-test-work archive exclusion => focused suite rc=1
+- restored production subjects => greenfield execution coverage tests passed
+- final mutant workspace: /tmp/c1-round6-final-mutants.u0ZaL6
+- logs: /tmp/c1-round6-final-gate-ignore-arms.log, /tmp/c1-round6-final-gate-ignore-cases.log, /tmp/c1-round6-final-gate-always-red.log, /tmp/c1-round6-final-archive-mutant.log
+
+FENCED FILES
+- tools/e2e-install-test.sh HEAD/worktree SHA-256: a93113565aa69f2c6f3d792b78251021bb3bbe3f7813d5fed547ab0099fa3b98 (byte-identical)
+- tools/fixtures/greenfield-expected-red.tsv HEAD/worktree SHA-256: baae06c664d0ab7ffe4c32ec106bfcb6f9dd74b46461d3c4440b73dc582af1a2 (byte-identical)
+- No per-case disposition or #869 wiring changed.
+
+LOCAL BASELINES
+- /home free before build: 11G
+- bash -n focused scripts: PASS
+- ShellCheck focused scripts: PASS
+- bash tools/verify-greenfield-execution-coverage.test.sh: PASS
+- pnpm test:installer: PASS
+- pnpm typecheck: PASS (45/45)
+- pnpm lint: PASS (25/25)
+- pnpm format:check: PASS
+- woodpecker-cli lint --strict .woodpecker/greenfield-install.yml: PASS
+- git diff --check: PASS
+
+INDEPENDENT REVIEW
+- Codex code review: APPROVE, confidence 0.94, seven files reviewed, zero findings. It confirmed the workflow invokes the exact four-cell-tested helper, both diagnostics remain observable, and archive purity binds to the production selector.
+- Codex security review: risk NONE, confidence 0.97, seven files reviewed, zero findings. It confirmed fail-closed behavior, quoted inputs, repository-controlled production arguments, and no new secret/injection/access-control exposure.
+- The code-review sandbox could not execute the dynamic suite because its filesystem is read-only; the local measured baselines and mutation controls above provide dynamic evidence.
+
+PENDING
+- commit, queue guard, one lease-pinned push, provider attribution read-back
@@ -0,0 +1,56 @@
+# #1050 C1 fix round — Round 7 canonical Alpine/BusyBox portability
+
+BASE HEAD
+- d66e91b1f22489b911eef982aec3faa62c5edeb3
+- Review 119 (rev-974) found tools/verify-greenfield-execution-coverage.sh used GNU-only find -printf.
+- Pipeline 2246's canonical Alpine ci-base test failed while the Debian greenfield workflow passed; the stale pipeline is diagnostic evidence only and is not inherited as a ruling for the replacement head.
+
+RED
+- Before remediation:
+  docker run --rm -v "$PWD:/workspace" -w /workspace git.mosaicstack.dev/mosaicstack/stack/ci-base:latest bash tools/verify-greenfield-execution-coverage.test.sh
+  => canonical_alpine_red_rc=1
+- Independent review 119 captured BusyBox 1.37 rejecting `find: unrecognized: -printf`.
+- Debian/GNU execution remained green, proving that one runtime's success did not establish portability.
+
+IMPLEMENTATION
+- Removed the GNU find -printf inventory.
+- Marker inventory now uses Bash nullglob/dotglob plus parameter expansion, all available in the script's declared Bash runtime.
+- The checker verifies the run directory is readable/searchable before inventory and fails closed otherwise.
+- Only direct regular, non-symlink `*.ran` files are included, preserving the prior find boundary; identities remain sorted and compared as exact sets.
+- No production fixture disposition, expected-RED manifest, e2e installer, #869 wiring, or acquisition behavior changed.
+
+GREEN
+- Local focused suite: greenfield execution coverage tests passed.
+- Canonical Alpine/BusyBox focused suite:
+  docker run --rm -u "$(id -u):$(id -g)" -v "$PWD:/workspace" -w /workspace git.mosaicstack.dev/mosaicstack/stack/ci-base:latest bash tools/verify-greenfield-execution-coverage.test.sh
+  => greenfield execution coverage tests passed.
+- Existing Round-6 controls retained:
+  ignore-arms aggregation helper => rc=1
+  ignore-cases aggregation helper => rc=1
+  always-RED aggregation helper => rc=1
+  delete production .mosaic-test-work archive exclusion => rc=1
+- Mutant workspace: /tmp/c1-round7-mutants.LocpBH
+
+FENCED FILES
+- tools/e2e-install-test.sh HEAD/worktree SHA-256: a93113565aa69f2c6f3d792b78251021bb3bbe3f7813d5fed547ab0099fa3b98 (byte-identical)
+- tools/fixtures/greenfield-expected-red.tsv HEAD/worktree SHA-256: baae06c664d0ab7ffe4c32ec106bfcb6f9dd74b46461d3c4440b73dc582af1a2 (byte-identical)
+
+LOCAL BASELINES
+- /home free before and after validation: 11G
+- Bash syntax focused scripts: PASS
+- ShellCheck focused scripts: PASS
+- pnpm test:installer: PASS
+- pnpm typecheck: PASS (45/45)
+- pnpm lint: PASS (25/25)
+- pnpm format:check: PASS
+- woodpecker-cli lint --strict .woodpecker/greenfield-install.yml: PASS
+- git diff --check: PASS
+
+INDEPENDENT REVIEW
+- Codex code review: APPROVE, confidence 0.96, zero findings. It confirmed hidden/empty/direct-regular/non-symlink semantics, exact sorting/comparison, dual-runtime execution, and PRD alignment.
+- Codex security review: risk NONE, confidence 0.97, zero findings. It confirmed quoted paths, fail-closed exact-set behavior, and no new injection, traversal, authorization, secret, cryptographic, dependency, or data-integrity risk.
+- The security-review sandbox could not execute the focused suite because its filesystem is read-only; the local and canonical-container measured runs above provide dynamic evidence.
+
+PENDING
+- commit, queue guard, one lease-pinned push, provider attribution read-back
+- replacement-head canonical CI; no manual pipeline trigger or polling
@@ -0,0 +1,56 @@
+# #1050 C1 fix round — Round 8 pipefail-safe expected-set membership
+
+BASE HEAD
+- 58ada98d2b430da28c46cf92eebdb6d45b8b1846
+- Review 122 (rev-security-02) found expected_names | grep -Fxq could falsely reject valid markers under pipefail when grep closed the pipe after an early match and the producer exited 141.
+- Independent canonical-Alpine live-manifest stress reproduced intermittent false failures at the current four-arm set size. No small-manifest safe threshold is claimed.
+
+DETERMINISTIC RED
+- The focused suite now generates a 20,001-name manifest with a valid target sorted first and invokes the real mark path.
+- Before remediation, in canonical Alpine ci-base:
+  docker run --rm -u "$(id -u):$(id -g)" -v "$PWD:/workspace" -w /workspace git.mosaicstack.dev/mosaicstack/stack/ci-base:latest bash tools/verify-greenfield-execution-coverage.test.sh
+  => canonical_sigpipe_tdd_red_rc=1
+  => [fixture-suite] case is not in the expected set: a-target
+- This control exercises the production checker invocation rather than an approximated producer and makes the early-close race deterministic by exceeding pipe capacity.
+
+IMPLEMENTATION
+- The mark path now fully materializes expected_names into expected_snapshot and fails closed if production fails.
+- grep -Fxq reads the completed snapshot through a here-string; there is no producer/consumer pipeline to close early.
+- Missing names still fail with the same attributable message. No `|| true` or other failure suppression was introduced.
+- Exact-set checks, marker inventory, aggregation, archive binding, fixture dispositions, expected-RED manifest, e2e installer, #869 wiring, and acquisition behavior are unchanged.
+
+GREEN
+- Local focused suite: greenfield execution coverage tests passed.
+- Canonical Alpine focused suite: greenfield execution coverage tests passed.
+- Canonical Alpine live production-manifest stress: 1,000 valid greenfield-git-absent arm marks, failures=0.
+- Canonical grep-q pipeline mutant through the real checker path => rc=1 with the attributable false rejection; restored subject => GREEN.
+- Existing Round-6 controls retained:
+  ignore-arms aggregation helper => rc=1
+  ignore-cases aggregation helper => rc=1
+  always-RED aggregation helper => rc=1
+  delete production .mosaic-test-work archive exclusion => rc=1
+- Round-8 mutant workspace: /tmp/c1-round8-mutants.aS1xTI
+
+FENCED FILES
+- tools/e2e-install-test.sh HEAD/worktree SHA-256: a93113565aa69f2c6f3d792b78251021bb3bbe3f7813d5fed547ab0099fa3b98 (byte-identical)
+- tools/fixtures/greenfield-expected-red.tsv HEAD/worktree SHA-256: baae06c664d0ab7ffe4c32ec106bfcb6f9dd74b46461d3c4440b73dc582af1a2 (byte-identical)
+
+LOCAL BASELINES
+- /home free before and after validation: 11G
+- Bash syntax focused scripts: PASS
+- ShellCheck focused scripts: PASS
+- pnpm test:installer: PASS
+- pnpm typecheck: PASS (45/45)
+- pnpm lint: PASS (25/25)
+- pnpm format:check: PASS
+- woodpecker-cli lint --strict .woodpecker/greenfield-install.yml: PASS
+- git diff --check: PASS
+
+INDEPENDENT REVIEW
+- Codex code review: APPROVE, confidence 0.96, six files reviewed, zero findings. It confirmed full materialization removes the SIGPIPE race and the deterministic regression control exercises the real early-match mark path.
+- Codex security review: risk NONE, confidence 0.98, six files reviewed, zero findings. It confirmed fail-closed producer handling, constrained/quoted names, and no new injection, traversal, secret, access-control, cryptographic, dependency, or logging risk.
+- The code-review sandbox could not execute the suite or install ShellCheck because its filesystem is read-only; local and canonical-container dynamic evidence above supplies those gates.
+
+PENDING
+- commit, queue guard, one lease-pinned push, provider attribution read-back
+- replacement-head canonical CI; no manual trigger or polling
@@ -0,0 +1,33 @@
+# #1050 C1 fix-round verification
+
+Frozen reviewed head before remediation: `378bc1afe3bc485adb8614897d66c5edccd4a527`.
+
+Status: **believed-fixed, pending jarvis validation**. PR #1054 is not self-merged and issue #1050 remains open.
+
+## Blocker B — fail-closed test enumeration
+
+The RED-first control used a real filesystem permission failure, not binary shadowing or PATH interception.
+
+1. A planted `{"status":"in-progress"}` file in a readable P2 fault tree made the complete real walk fail the frozen suite at `P2 left an in-progress transaction` (`01-pre-fix-positive-control.log`, exit 1).
+2. The same planted defect beneath a target-owned mode-0100 directory made real `find` report a permission failure. The frozen suite erased the producer failure and exited 0 with `installer next lane tests passed` (`02-pre-fix-permission-failure-attack.log`).
+3. The committed regression control initially failed because the child full-suite attack still exited 0 (`03-regression-test-red.log`).
+4. After remediation, the same child full-suite input exits 1 and names `[test] ERROR: P2 fault-state enumeration failed` (`04-post-fix-permission-failure-attack.log`). The ordinary full suite remains green.
+
+`tools/test-enumeration-assertions.sh` now captures each complete NUL-delimited population and checks the producer status before asserting absence. Content checks inspect the captured population and distinguish “no match” from a read error. The shared fail-closed implementation covers:
+
+- `tools/install-next-lane.test.sh`: redacted staging-file cleanup and fault-state transaction scan;
+- `tools/verified-installer-fetch.test.sh`: temporary-download cleanup;
+- `tools/install-state-machine.test.sh`: symlink-target non-mutation;
+- `docs/reports/verification/1050-b8-redaction-control/positive-control.test.sh`: both copied counterparts.
+
+No assertion was loosened. A1, A2, upgrade-guard, source-root, the species-2 sweep, #869, and expected-RED verdict rows remain outside this remediation.
+
+## Blocker A — installer digest
+
+The stale sidecar value was replaced with the exact `sha256sum` record for `tools/install.sh`:
+
+```text
+e59cb441a2f37ae9150f8eae470238e9d858a1816df93343d9784a6796676096  install.sh
+```
+
+RED-first documentation control from the repository root: `sha256sum -c tools/install.sh.sha256` exits 1 with `install.sh: FAILED open or read` because the sidecar records a path relative to `tools/`. The command actually executed, `(cd tools && sha256sum -c install.sh.sha256)`, exits 0 with `install.sh: OK`; the workflow's separate exact expected/actual equality also passes. The immutable provider-fetch arm at the new `${CI_COMMIT_SHA}` is recorded in the freeze artifact after push; local equality alone is not treated as sufficient evidence.
@@ -0,0 +1,28 @@
+# Documentation completion checklist — #1050 C1 fix round
+
+## Required artifacts
+
+- [x] `docs/PRD.md` exists; #1050 C1 requirement 13 binds the complete in-scope remote stack source chain, and requirement 15 binds exact case+arm execution coverage, executable aggregation, production-bound archive purity, dual-runtime portability, and pipefail-safe materialized membership.
+- [x] User guide: not applicable; no user-facing production installer behavior changed.
+- [x] Admin guide: not applicable; no operator procedure or deployment behavior changed.
+- [x] Developer guide: existing `docs/guides/installer-state-machine.md` defines the fail-closed installer model; the C1-specific remote-arm contract and evidence live in the PRD, scratchpad, and scoped verification report.
+- [x] OpenAPI and endpoint index: not applicable; no API changed.
+- [x] Sitemap: not applicable; no navigation changed.
+
+## API and structural coverage
+
+- [x] API schema/auth/error coverage: not applicable; no endpoint changed.
+- [x] Guide book indexes: not applicable; no guide page was added or moved.
+- [x] Root hygiene preserved; all new artifacts are under `docs/reports/verification/1050-c1-fix-round/` and the active scratchpad remains under `docs/scratchpads/`.
+
+## Review and publishing
+
+- [x] Verification documentation is in the same logical change set as the shell-test remediation.
+- [x] Trust boundary states both halves: the digest proves fetched bytes remain identical through execution/verify-after; it does not authenticate authorship against provider/TLS compromise. Independent provenance is the inherited PRD v2 §3 deferral.
+- [x] Round-3 Codex code review APPROVE (confidence 0.92, zero findings) and security re-review risk NONE (confidence 0.96, zero findings). The initial HIGH trust-root finding remains documented as the canonical signed-provenance deferral, not hidden.
+- [x] Round-4 review cycle closed: two blocking Codex findings (missing dependency ordering; production manifest comments misparsed) were accepted and fixed. Final code review APPROVE (confidence 0.94, zero findings) and security risk NONE (confidence 0.96, zero findings).
+- [x] Round-5 exact arm coverage and archive-purity controls reviewed: Codex code APPROVE (confidence 0.93, zero findings) and security risk NONE (confidence 0.96, zero findings).
+- [x] Round-6 executable aggregation and production archive-selector binding reviewed: Codex code APPROVE (confidence 0.94, zero findings) and security risk NONE (confidence 0.97, zero findings).
+- [x] Round-7 BusyBox-safe marker inventory and dual-runtime evidence reviewed: Codex code APPROVE (confidence 0.96, zero findings) and security risk NONE (confidence 0.97, zero findings).
+- [x] Round-8 materialized membership and deterministic canonical-Alpine control reviewed: Codex code APPROVE (confidence 0.96, zero findings) and security risk NONE (confidence 0.98, zero findings).
+- [x] Canonical evidence remains in-repo. No external publishing action was requested or performed.
@@ -0,0 +1,66 @@
+# #1050 successor remediation verification
+
+Head under test before remediation: `e5d5c8495a070af2dcd393cace287fe74a8a819e`.
+
+This change strengthens the expected-RED detector; it does not repair the intentionally failing greenfield rows. The #869 hooks remain unwired.
+
+## A1 — P0 reason binding
+
+RED first:
+
+```text
+$ bash tools/verify-greenfield-expected-red.test.sh
+[test] FAIL: vacuous P0 PASS satisfied the expected-RED contract without identity/context evidence
+exit=1
+```
+
+The pinned manifest now has an explicit `phase-reason` binding against the final P0 row: target `mosaic`, uid `1001`, equal `HOME` and passwd HOME, `/bin/bash`, `privilege=user`, `x86_64`, glibc, and version-shaped Node/npm evidence. All three cases structurally require exactly one P0 reason binding. The greenfield fixture's final P0 row now emits and validates the same complete identity/context evidence, so an unrelated earlier P0 line cannot satisfy the binding for a vacuous final row.
+
+Pipeline 2224 and the successor's pre-change fixture run also exposed a stale next-lane P6 reason left behind by the already-closed B6 remediation: actual behavior is a fail-closed runtime-link action refusal with `#869` hooks left inactive and a persisted required P6 failure, while the manifest still expected dead hooks to be active. The pinned reason now matches the stronger measured refusal (`runtime linking/activation action reported a required failure`); no verdict changed and #869 remains unwired.
+
+GREEN:
+
+```text
+[test] PASS: P0 PASS must bind target identity, HOME, shell, privilege, architecture, and runtime reason
+```
+
+## A2 — fail-closed P4 enumeration
+
+RED first: a `find` control emitted only the safe root, omitted an unsafe mode-`0666` child, and exited `73`. The process-substitution consumer discarded that status:
+
+```text
+[test] FAIL: P4 accepted a partial created-path inventory after find failed
+[test] FAIL: P4 did not report failed created-path enumeration
+exit=1
+```
+
+P4 now captures the NUL-delimited walk into a temporary file, checks `find` to completion, and only then evaluates the complete inventory. A failed walk reports that enumeration failed and returns a P4 finding.
+
+GREEN:
+
+```text
+[test] PASS: P4 rejects an incomplete created-path inventory
+[test] PASS: P4 attributes the failed created-path enumeration
+```
+
+## B — deterministic TERM no-exit control
+
+Woodpecker pipeline 2224 at the original head reported `32 passed, 2 failed`: the no-exit fixture did not exit zero or report sync success. The premise was not stale: the same fixture passed `34/34` on another filesystem.
+
+A controlled reverse-sorted `find -print0` walk reproduced the pipeline result exactly (`32 passed, 2 failed`). Root cause: signal injection was tied to `guides/E2E-DELIVERY.md`; whether required `tools/` content remained after restore depended on filesystem enumeration order. The test was measuring path order as well as trap semantics.
+
+The generated fixtures now damage a real target path after the snapshot is armed, self-signal immediately before the complete normal sync, and differ only in the explicit handler exit. Therefore a no-exit handler always restores, returns, runs the full sync, mutates the restored target again, and reports completion independent of walk order.
+
+GREEN on both native and reverse-sorted enumeration:
+
+```text
+RESULT: 36 passed, 0 failed
+```
+
+Mutation sensitivity: restoring `exit 1` to the nominal no-exit fixture makes the control RED (`32 passed, 4 failed`), including failures of the zero-exit and resumed-success assertions. The control can still fail for its stated reason.
+
+## Enumeration-class sweep
+
+The sweep covered production enumeration in `tools/install.sh` and `packages/mosaic/framework/install.sh`, plus process-substitution consumers in the C1 shell-test surfaces. Framework installer file, operator, durable-snapshot, and pruning walks already capture and check their producer status. P4's created-path walk was the reviewed unchecked instance.
+
+One additional order/completeness dependency was found in source acquisition: `find "$WORK_DIR" ... | head -1` hid `find` failure and selected arbitrarily when an archive produced multiple top-level directories. RED first, the extraction fake produced two roots and the lane test stopped at that new assertion with exit 1 because today's code selected one. Source acquisition now captures and checks the complete NUL-delimited walk and requires exactly one extracted root. The lane suite is green with the multiple-root rejection. No remaining production installer enumeration uses unchecked process substitution or first-row order as authority.
@@ -0,0 +1,71 @@
+# #1019 — Zero-timeout queue-guard harness race
+
+- **Issue:** #1019 (parent status remains `believed-fixed, pending jarvis validation`; do not close)
+- **Branch:** `fix/1019-ci-queue-timeout-harness`
+- **Owner:** `be-coder-08`
+- **Base:** `origin/main` at `5916aeefd6ed12bcac086c6834c7f6c4ae38e1bc`
+- **Charter:** `/home/hermes/agent-work/tl-mosaic/CHARTER-1019-HARNESS-FIX.md`
+
+## Objective
+
+Make `test-ci-queue-wait-tristate.sh` deterministic without changing any asserted outcome. Remove the indiscriminate zero-timeout race, require every status-classification case to prove the provider was observed, and prove the harness-controlled virtual clock is active.
+
+## Scope
+
+- In scope: `packages/mosaic/framework/tools/git/test-ci-queue-wait-tristate.sh` only, plus this evidence scratchpad.
+- Out of scope: guard parsers, D2/D3 behavior, installer/reseed staleness, PR #1060, and issue closure.
+
+## Acceptance criteria
+
+1. RED deterministically reproduces deadline pre-emption before the provider call.
+2. Every case that intends status classification positively proves provider observation.
+3. Pending observes `pending` before deterministic virtual-time expiration.
+4. The virtual clock has a positive interception control; a broken-clock mutant makes the suite red.
+5. The exact CI-base image passes the final harness repeatedly with zero failures.
+6. Baseline gates, independent code/security review, exact-head CI, and coordinator-authorized squash merge pass.
+
+## Plan
+
+1. Add deterministic RED instrumentation for the known merge/provider-unreachable pre-emption.
+2. Replace global `-t 0` with a nonzero timeout interpreted under an event-driven virtual clock; stub sleep without wall waiting.
+3. Add provider-observation and virtual-clock positive controls without changing outcome assertions.
+4. Run focused shell checks, repeat in exact CI-base image, baseline gates, and independent reviews.
+5. Commit with both identity layers, queue-guard plus direct Woodpecker terminal-state verification, push, self-post PR, verify poster/head/CI, obtain coordinator merge authorization, then squash merge without closing #1019.
+
+## Budget
+
+- No explicit token cap supplied. Keep scope to one harness file and one scratchpad; stop/report at the charter's 60% context gate.
+
+## Evidence
+
+- RED, deterministic pre-provider expiry: `evidence/1019-harness-fix/red-pre-provider-expiry.log` — rc 1; merge/provider-unreachable got rc 124 instead of 75, omitted CANNOT_ASSERT, did not observe the status provider, and wrote no additional audit record (four named failures).
+- GREEN host focused harness: `evidence/1019-harness-fix/green-host.log` — rc 0, all outcome classes passed.
+- Load-bearing clock negative control: a temporary same-directory mutant replaced the virtual `date` body with `/bin/date`; `evidence/1019-harness-fix/red-clock-not-intercepted.log` — rc 1 with named `virtual clock interception did not run` failures. The mutant file was removed after the run.
+- Exact CI-base repeat: `git.mosaicstack.dev/mosaicstack/stack/ci-base:latest`, repository mounted read-only, harness work under container `/tmp`; `evidence/1019-harness-fix/ci-image-repeat/summary.log` — **100 pass / 0 fail / 100 total**.
+- Synchronization design: provider-status observation creates the event marker; virtual time is 1000 before the event and 1002 afterward. Pending alone reaches the stubbed no-op sleep and a post-observation deadline check. `-t 1` is uniquely load-bearing because removing it restores the 900-second default deadline at virtual time 1900, which 1002 does not cross. The numeric timeout is subject semantics under virtual time, not a wall-clock synchronization duration.
+
+## Review remediation — semantic timeout vs. liveness bound
+
+Security review found that virtual time remained at 1000 forever before provider observation and stubbed sleep never waited. A regression looping before the status endpoint—or blocking in the first provider call—therefore could prevent `run_guard` from returning, so the post-return provider assertion could never fire.
+
+**General rule:** A timeout usually serves two purposes: semantics and liveness. Removing wall time from semantic synchronization can silently remove the only independent hang bound. Preserve deterministic virtual time for subject semantics, but provide a separately implemented real-clock liveness watchdog and prove that watchdog fires.
+
+Remediation:
+
+- Every guard subject invocation is launched by absolute `/usr/bin/python3` in a new session. Python's internal monotonic `wait(timeout=...)` provides real-clock liveness independently of PATH; expiry kills the entire isolated process group, so neither PATH-front shims nor a blocked provider descendant can retain the capture pipe.
+- Watchdog expiry returns distinct harness rc 90 plus `FAIL HANG watchdog`, separate from subject timeout rc 124.
+- A first attempt using absolute `/usr/bin/timeout -s KILL` passed on GNU coreutils but failed in the exact Alpine CI-base image: BusyBox killed the immediate wrapper while the guard/provider descendants survived and retained the command-substitution pipe. The process-group kill is therefore required behavior, not portability polish.
+- A committed positive control hangs the branch-provider stub before the status endpoint. It must terminate through the watchdog, emit the hang-specific diagnostic, return rc 90, and prove the status provider was never reached.
+- RED before remediation: a temporary ordinary-success mutant hung before provider observation; only an external control could kill the suite (rc 137), and there was no internal hang-specific diagnostic (`red-watchdog-absent.log`).
+- The watchdog mutant/control is load-bearing: removing the internal watchdog leaves the control unable to produce its required rc 90 and diagnostic.
+
+Post-review evidence:
+
+- Host focused harness with process-group watchdog: rc 0 (`green-watchdog-process-group-host.log`).
+- Exact Alpine CI-base focused harness with process-group watchdog: rc 0 (`green-watchdog-ci-image.log`).
+- Hanging ordinary-success mutant: suite rc 1; success returned rc 90, emitted `FAIL HANG watchdog`, and loudly reported that provider/clock observation did not occur (`red-watchdog-fires.log`).
+- Removed-`-t 1` mutant: suite rc 1; pending was terminated by the watchdog instead of producing `ASSERTED_NOT_READY`, proving the explicit timeout is load-bearing (`red-timeout-argument-removed.log`).
+
+## 60% context hold
+
+Stopped before baseline/review/commit as required by the charter. Remaining: inspect final diff, shell/static/baseline gates, independent code/security review, remediation if any, identity-bound commit/trailer verification, mandatory queue guard plus direct terminal Woodpecker `mosaic` enumeration, push, self-posted PR/provider poster read-back, exact-head terminal-green CI, coordinator merge authorization, squash merge, main CI verification, and leave #1019 unclosed as `believed-fixed, pending jarvis validation`.
@@ -50,7 +50,9 @@ Implement C1 from the canonical greenfield-install PRD v2: a transactional P0–
 - [x] Corrected RED transcript captured and reported, including the git-present/absent controls and strict P3 PASS.
 - [x] State-machine implementation complete: private pre-mutation journal/snapshot, P0–P8 `--check`, P2–P8 fault seam, rollback, durable manifest/journal seal, action-status persistence, safe rollback roots, and stale-projection recovery.
 - [x] Debian/glibc checkout fixture now packages the complete current checkout, verifies its digest in-container, and reaches the expected attributable RED without host inheritance. CI compares its exact final phase map/reasons to `tools/fixtures/greenfield-expected-red.tsv`; the fixture remains red while the detector job is green only on an exact match.
- [ ] Reviews complete. Automated review defects around Bash conditional errexit, explicit exits, P4/P6 persisted action status, dev/offline source resolution, stale locks, checkout coverage, and rollback path safety were remediated. Remaining automated objections are the charter-mandated expected RED/C5 boundary and signed provenance, which the canonical PRD explicitly defers; independent informed review is still required.
+- [ ] Reviews complete. Reviews 80 (`rev-security-02`) and 81 (`rev-974`) requested changes at `3934e03f`; their eight non-overlapping detector findings are being remediated red-first. Current remediation adds canonical-image portability, absolute P3 CLI propagation, exact expected-RED schema/cardinality, passwd-HOME binding, created-path owner/mode policy, real-action P2–P8 fault injection, verified non-empty remote installer execution, and seeded secret-canary/redacted diagnostics. Both old verdicts become void when the remediation head moves and require fresh independent review.
+- [x] Successor remediation for review 90 is RED-first and recorded in `docs/reports/verification/1050-successor-remediation/`: the manifest now binds the complete supported final P0 reason; P4 rejects an incomplete created-path walk instead of discarding `find` failure; and the TERM no-exit control is independent of filesystem enumeration order while retaining a proven RED mutation. Pipeline 2224's 32/2 result was a path-order-sensitive control, not evidence that the resume bug's premise became stale. The enumeration-class sweep additionally replaced order-dependent `find | head -1` source-root selection with a checked complete inventory requiring exactly one extracted root.
+- [x] C1 fix round for reviews 92/93: Blocker B was completed first. RED was reproduced before implementation: a planted `{"status":"in-progress"}` record makes the complete real walk fail the suite at P2, while the same planted defect beneath a target-owned mode-0100 directory makes real `find` fail and the frozen suite falsely exit 0 with `installer next lane tests passed`. One shared helper now captures and checks the complete NUL-delimited population before testing absence across the primary and copied harness sites; grep no-match is distinct from read failure. The same attack child drives the full suite RED with a named enumeration error, while ordinary native and root/container runs pass. Blocker A then regenerated the exact installer sidecar; provider-fetch validation remains the required post-push bar. Working estimate: 16K tokens; no external hard cap; 60% context is the stop/report gate.

 ## Risks / blockers

@@ -59,10 +61,126 @@ Implement C1 from the canonical greenfield-install PRD v2: a transactional P0–
 - #869 must remain staged and inactive.
 - Late sequencing input MB-BRAIN-01 is accommodated without implementation or renumbering: P2 covers installer distribution only; P5 owns requested credential capability; P7 leaves an ordered seam for credential-dependent resource provisioning after P5.

+## Remediation review controls
+
+- B1 RED: the next-lane harness failed immediately under `ci-base:latest` as root/musl; it now models uid 1001/glibc explicitly and uses Python tree fingerprints instead of GNU `find -printf`.
+- B2 RED: framework/runtime linking consumed bare `mosaic` from PATH after P3 had committed an absolute path. The unified installer now exports/passes `MOSAIC_CLI_PATH`; the linker invokes that absolute artifact, and wizard auto-launch has no stale-PATH fallback.
+- B3 RED: a one-row manifest (`exit=1`) certified any exit-1 log. Full-manifest validation now requires the exact three cases, one exit and P0–P9 row each, pinned require/forbid populations, and rejects malformed/duplicate/unknown rows; shrink is a negative control.
+- B4 RED: uid 1001 with a passwd HOME different from ambient HOME produced P0 PASS. P0 now binds uid, username, passwd HOME and shell and explicitly rejects root and sudo-with-inherited-HOME controls.
+- B5 RED: mode-0777 CLI, mode-0644 identity, and mode-0755 credential storage passed. P3/P4/P5 now apply target owner/group plus executable/shared/private policies; framework credential storage is created 0700.
+- B6 RED: fault injection only wrote `.selftest-*` files. The synthetic path was removed; the P2–P8 matrix enters the normal action flow, proves an action observation occurred, injects after each real phase, and fingerprints rollback.
+- B7 RED: an HTTP-200 empty body exits zero when piped to Bash. The fetched installer must now be non-empty, digest-equal to `tools/install.sh.sha256`, and that exact file is executed; failed/empty/mismatch controls are blocking and CI has a remote immutable-commit arm.
+- B8 RED: raw combined command output was duplicated to terminal and `commands.log`. Both capture layers now redact before output/persistence; a seeded canary is positively emitted by the fake credential-capable registry and must remain absent from terminal, command log, npmrc, generated files and observed argv. The real greenfield fixture also scans those populations.
+- Advisory code review findings are fixed: URL userinfo redaction now handles raw `@`, token-only and percent-encoded forms, repeated `:`, multiple URLs, Authorization/Basic, npm `_auth`, and Cookie headers in both capture layers; the real greenfield path positively emits its canary through `state_run_captured`; verified-fetch removes its temporary body after successful execution; and plaintext diagnostics exist only in process-substitution pipes rather than interruptible temporary files.
+- Advisory security review's independent trust-root finding is **DEFERRED by canonical PRD v2 §3**, which explicitly excludes signed provenance. README now states precisely that the same-origin sidecar detects empty/corrupt/inconsistent publication but cannot authenticate against repository/server compromise; no stronger claim remains.
+- The web1 no-manifest representativeness observation is recorded but intentionally not acted on: it is explicitly outside these eight blockers. This remediation does not weaken or otherwise change P9's manifest-presence assertion.
+
 ## Verification log

 - `bash -n` and ShellCheck pass for all changed shell surfaces; `git diff --check` passes.
- `bash tools/install-state-machine.test.sh` passes, including exact P0–P8 rows, good/bad discrimination, persisted P4/P6 action failures, P2–P8 rollback, unsafe/overlapping/symlink roots, stale `active.json`, and fatal journal initialization.
- `bash tools/install-next-lane.test.sh` passes, including exact `@next` versions, immutable source fallback, source-build/archive-failure rollback, offline `--dev`, explicit refs, and prerelease suffix mismatch.
+- `bash tools/install-state-machine.test.sh` passes, including exact P0–P8 rows, passwd-HOME/privilege discrimination, owner/group/mode attacks, persisted P4/P6 action failures, no synthetic fault implementation, unsafe/overlapping/symlink roots, and fatal journal initialization.
+- `bash tools/install-next-lane.test.sh` passes inside `ci-base:latest`, including exact `@next` versions, immutable source fallback, source-build/archive-failure rollback, offline `--dev`, explicit refs, prerelease suffix mismatch, absolute P3 CLI propagation, secret redaction, real-action P2–P8 rollback, and stale projection recovery.
+- Comparator controls pass for verdict drift, unexpected exit, manifest shrink, missing phases, duplicate rows, unknown cases, and unknown kinds. Verified-fetch controls pass for successful execution and failed/empty/digest-mismatch rejection.
 - `bash tools/e2e-install-test.sh --lane next --source checkout --git present` returns the required expected RED in clean Debian/glibc as uid 1001: installer P0/P1/P2/P3/P7 PASS; P4/P5/P6/P8 and P9 blocking; no `Done.` claim; checkout archive digest pinned and current framework installer exercised. `tools/verify-greenfield-expected-red.sh` converts that expected detector result into a green CI assertion and fails on any unreviewed verdict drift.
- Earlier repository gates passed: `pnpm typecheck`, `pnpm lint`, `pnpm format:check`, `pnpm test:installer`, upgrade manifest/rollback/durable-snapshot/migration suites, and focused `@mosaicstack/mosaic` tests with an isolated npm prefix. Full rerun is required after final edits.
+- Earlier repository gates passed: `pnpm typecheck`, `pnpm lint`, `pnpm format:check`, upgrade manifest/rollback/durable-snapshot/migration suites, and focused `@mosaicstack/mosaic` tests with an isolated npm prefix. Full exact-remediation rerun is required before push.
+- Review-93 RED evidence at frozen `378bc1a`: isolated positive-control full-suite exit `1` with `P2 left an in-progress transaction`; isolated permission-failure attack full-suite exit `0` with final `installer next lane tests passed`. No binary shadowing or PATH interception was used; the failure came from a real target-owned mode-0100 directory.
+- Fix-round GREEN: `pnpm test:installer`, native next-lane, root/`ci-base:latest` next-lane, state-machine, verified-fetch, Bash syntax, ShellCheck, `pnpm typecheck`, `pnpm lint`, `pnpm format:check`, and `git diff --check` pass. The direct attack child exits 1 and names `P2 fault-state enumeration failed`. All 81 Mosaic Vitest files / 1508 tests pass under an isolated npm prefix; the wider framework-shell chain reaches the pre-existing #973 Bash-line-number gate and exits 97, matching the known host-specific condition rather than this delta. Codex code review approved at 0.93 confidence with zero findings; Codex security review reported no risk at 0.96 confidence with zero findings.
+- Sidecar RED-first documentation control from the repository root: `sha256sum -c tools/install.sh.sha256` exits 1 with `install.sh: FAILED open or read` because the sidecar path is relative to `tools/`. Sidecar GREEN with the command actually executed: `(cd tools && sha256sum -c install.sh.sha256)` exits 0 with `install.sh: OK`; the workflow's separate expected/actual comparison resolves `e59cb441a2f37ae9150f8eae470238e9d858a1816df93343d9784a6796676096`. This is not substituted for the required immutable provider-fetch arm at the pushed head.
+
+## Round 3 — remote-arm downstream source binding
+
+### Objective and constraints
+
+- Tracking remains `mosaicstack/stack#1050`, delivery PR #1054, branch `feat/1050-install-state-machine-red-fixture`; `docs/TASKS.md` remains orchestrator-single-writer.
+- Bind the remote arm's downstream stack framework/source archive to the same immutable `${CI_COMMIT_SHA}` as the digest-verified `install.sh`, while retaining `--next` and its exact resolved CLI/gateway lane-version assertion.
+- RED first: the realised source commit/digest assertion must reject the existing stale `origin/next` substitution; GREEN must restore the exact expected `P6 FAIL` and pass the comparator. R7 then deletes the binding and requires RED again.
+- Fenced out: the expected-RED manifest (including `P6=FAIL`), #869 activation, and #1068 digest-before-comparator sequencing.
+- Push budget: one force-with-lease push pinned to provider head `ff3f0d29f1763bed44a60610d073036112e66b77`; run the queue guard first; do not poll CI after push.
+- Working estimate: 14K reasoning/output tokens; no external hard token cap. Scope reduction order: reuse the existing local-source archive seam, add one realised-state assertion, avoid installer behavior changes.
+
+### Corrected reference citation
+
+The transferable reference is only **the container-image acquisition path in `fa-install.sh`**: resolve mutable input once to `Docker-Content-Digest`, fail closed if unresolved, render `@sha256`, then verify running images against the resolved digest. It is not a claim about USC's installer as a whole; the sibling root bundle extraction in `Install-FieldAgentOnPanel.ps1:82` is unpinned. The applicable structure is `RESOLVE-ONCE -> PIN -> FAIL-CLOSED ON RESOLUTION -> VERIFY-AFTER`, applied per acquisition path.
+
+### Remote-arm acquisition-path census before the fix
+
+Code-path enumeration only; execution of the complete list is **NOT MEASURED** in this round yet. Logical payload paths are counted once even when one command is invoked repeatedly or installs a dependency graph.
+
+| # | Acquisition path taken by the arm | Pre-fix binding state | Scope disposition |
+|---|---|---|---|
+| 1 | Woodpecker checkout containing the workflow, fixture, sidecar, and comparator | CI commit checkout (commit-bound by runner contract) | existing arm substrate |
+| 2 | `node:22-bookworm-slim` step image | mutable image tag | unpinned sibling; outside this fix fence |
+| 3 | Debian package set acquired by `apt-get update/install` | repository-current, no package versions/snapshot | unpinned sibling; outside this fix fence |
+| 4 | remote `tools/install.sh` | exact `${CI_COMMIT_SHA}` URL plus checked SHA-256 | in scope; already bound first hop |
+| 5 | `@mosaicstack/mosaic@next` CLI package graph | mutable lane resolved to an exact top-level version, exact version installed, realised top-level version verified | lane assertion; must remain |
+| 6 | `@mosaicstack/gateway@next` package graph | later re-resolution wins and is verified against itself; drift from the first value can be silently accepted | partially constrained TOCTOU sibling; outside this fix |
+| 7 | `mosaicstack/stack` framework/source archive consumed by `ensure_monorepo` | `next` resolves once to `4df478cdd150fdf8d52ea109f02ade5d85017acd`, not the arm's CI commit | **in-scope defect; bind to CI commit** |
+| 8 | sequential-thinking MCP package warmed via unversioned `npx -y @modelcontextprotocol/server-sequential-thinking` | mutable package resolution | unpinned sibling; outside this fix fence |
+| 9 | Excalidraw npm dependency graph | shipped `package-lock.json` exact versions + registry integrity hashes; `npm install` consumes the lock | already lock/integrity-bound, separate from CI-source identity |
+| 10 | canonical skills repo cloned by `mosaic-sync-skills` | mutable default branch of `mosaic/agent-skills.git` | unpinned sibling; outside this fix fence |
+
+Pre-fix mechanism breakdown (do not blend unlike strengths): **2 / 10 intended-CI-commit-bound** (#1 checkout, #4 installer); **1 / 10 resolve-then-pin with comparison to the authoritative value** (#5 CLI); **1 / 10 partially constrained because verify-after compares #6 gateway to its later re-resolution rather than an authoritative pin**; **1 / 10 lockfile+integrity-bound** (#9 Excalidraw); **1 / 10 internally pinned to an immutable commit+digest but bound to the wrong arm identity** (#7 framework at `4df478cd`); **4 / 10 unpinned siblings** (#2, #3, #8, #10). The in-scope same-CI stack payload ratio is **1 / 2** (`install.sh` yes; framework/source no).
+
+Resolution-failure behavior is separately stated rather than hidden in the counts. For #5/#6, a metadata-resolution failure during P1 blocks before mutation. Later package metadata/install failure enters the documented source fallback, but that fallback consumes the immutable stack archive already resolved in P2; failure to resolve or fetch that source is fatal. For #5, the P2 CLI value is authoritative and a later realised mismatch blocks P3 and rolls back. For #6, no authoritative P2 gateway value persists; a later same-suffix gateway drift can be silently accepted because the later value is compared with itself. Changing that TOCTOU path is outside this fix. The new #7 path accepts the 40-hex CI commit directly, fetches only its exact commit URL, rejects failed/empty acquisition, computes and passes the exact body's digest through the existing local-source seam, and rejects any realised manifest commit/digest mismatch without falling back to `next`.
+
+Denominator corrections were sent to and accepted by the lane lead before implementation. Four expressly unpinned siblings make `7/10` impossible. Post-fix, the primary mechanism breakdown is **fully constrained 5 / 10** (#1, #4, #5, #7, #9), **partially constrained 1 / 10** (#6), and **unpinned 4 / 10** (#2, #3, #8, #10). The meaningful repaired ratio is **2 / 2 same-CI stack payload hops**. The fix does not increase coverage; it moves #7 from wrong identity to intended identity. Every census revision moved assurance downward under additional questioning, never upward, so the census is a lower bound on defects and an upper bound on assurance.
+
+### Implementation plan
+
+1. Add the realised source commit+archive-digest assertion and pass the expected immutable identity through the remote fixture; run the current stale-`next` mechanism and capture RED before changing acquisition.
+2. Fetch the stack archive from the exact commit URL once, fail closed on failed/empty acquisition, compute its digest, pass that exact body through the installer's existing local-source archive seam, and verify the manifest's realised `sourceCommit` and `sourceSha256` against those values.
+3. Run exact-source GREEN: require `P6 FAIL` values and a passing `next-git-present` comparator; run focused installer/baseline gates.
+4. R7: delete the binding in a temporary mutant, run the same assertion to RED, then restore and re-run GREEN.
+5. Independent code/security review, commit with command-scoped identity, queue guard, one force-with-lease push pinned to `ff3f0d29`; stop without CI polling and report `believed-fixed, pending jarvis validation`.
+
+### Executed outcome
+
+- RED-first stale substitution: fixture `rc=1`; realised source `4df478cdd150fdf8d52ea109f02ade5d85017acd` / `3e6d831efe13c3b2c0501507099d4a566af5abf877dacf85e5d7e4284d35e5c7` rejected against expected `ff3f0d29f1763bed44a60610d073036112e66b77` / `944c6db1b01b23c83169e6dc83e0d31262b1d24a2825270441745eb65c269c25`; comparator `rc=1`, 8/19 mismatches.
+- Exact-source reproducibility, N=5 identical final-tree executions: every run had fixture `rc=1`, `@mosaicstack/mosaic@next=0.0.50-next.2207`, P3 PASS, realised source `ff3f0d29…` / `944c6db1…`, SOURCE-CONTROL PASS, `installer_exit=1`, `done_claims=0`, P6 FAIL, and P9 FAIL. Comparator `rc=0` occurred 4/5 (19/19 checks; action-failure reason); comparator `rc=1` occurred 1/5 (18/19; dead hooks active count `2`). The rate is the finding; no comparator verdict is claimed.
+- Timings/load: runs 1–2 NOT MEASURED; run 3 rc1 elapsed 912s, load 7.79/7.51/8.93 -> 12.28/14.82/11.79; run 4 rc0 elapsed 938s, load 12.28/14.82/11.79 -> 9.84/15.18/13.83; run 5 rc0 elapsed 954s, load 9.84/15.18/13.83 -> 3.94/4.76/8.18. Load does not explain this sample monotonically.
+- The `P6=FAIL` row remains untouched; P6 failed 5/5 while its reason signal varied. No comparator widening was performed. Checkout-source control independently exhibited the rc1/dead-hooks outcome, but its reproducibility was not separately measured.
+- #869 out-of-scope finding: current `defaultSupervisorProbe` checks bundled supervisor artifact presence and a resolvable socket path, not socket existence. The 2000ms capability-probe timeout is a code-read hypothesis for variance, NOT MEASURED as causal.
+- Final-tree R7 deleted the three local-source binding exports temporarily. The realised source reverted to `4df478cd…` / `3e6d831…`, SOURCE-CONTROL failed against `ff3f0d29…` / `944c6db…`, and comparator `rc=1` with 8/19 mismatches. The subject file SHA-256 was `a93113565aa69f2c6f3d792b78251021bb3bbe3f7813d5fed547ab0099fa3b98` before mutation and after restoration.
+- Trust boundary: the exact-commit URL trusts the configured repository provider's authenticated commit-to-archive mapping. The computed digest pins transfer/consumption but does not authenticate against repository/TLS compromise; signed provenance remains the canonical PRD v2 §3 deferral. Initial Codex security review retained this as HIGH/CWE-494; no stronger claim or out-of-scope signing change was made.
+- Final baselines: Bash syntax, ShellCheck, `pnpm test:installer`, `pnpm typecheck` (45/45), `pnpm lint` (25/25), `pnpm format:check`, and `git diff --check` pass. Codex code review APPROVE confidence 0.92 with zero findings; after explicit trust-boundary documentation, security re-review risk NONE confidence 0.96 with zero findings. The initial HIGH trust-root finding remains recorded as the signed-provenance deferral.
+- Full evidence and named paths: `docs/reports/verification/1050-c1-fix-round/09-round3-source-binding.txt`.
+
+## Round 4 — pipeline case-coverage denominator
+
+- Pipeline 2242 at `0e2eef1c` superseded the lane lead's earlier pipeline-2229 ruling: requirements 1–3 were already satisfied. The temporary local P6-consumer edit started while that ruling was in flight was restored; `tools/e2e-install-test.sh`, the expected-RED manifest, the per-case verifier, and #869 remain unchanged in the final tree.
+- Requirement 5 adds a pipeline-level instrument above the three per-case invocations. Expected names are derived from the manifest, markers are scoped by pipeline+workflow run, and each marker is written only after that exact per-case verifier succeeds. Every producer depends on initialization; the final step depends on the complete case/contract matrix, runs after success or failure, and requires exact expected/actual set equality rather than count equality.
+- Measured firing controls: skipped arm `3/2` rc1; count inflation `3/3` rc1 with one missing and one unexpected name; stale re-initialized run `3/0` rc1; exact set `3/3` rc0; future manifest case `4/3` rc1. Codex review found and blocked two independent defects: first the missing `depends_on` graph, then comment lines being parsed as case names. Both were accepted; dependency edges are regression-asserted, blank/comments are excluded, and the focused test now consumes the production manifest directly. Final Codex code re-review APPROVE confidence 0.94 and security re-review risk NONE confidence 0.96, both with zero findings. Woodpecker strict lint, Bash syntax, ShellCheck, focused/full installer tests, typecheck, lint, Prettier, and diff check pass.
+- Full evidence: `docs/reports/verification/1050-c1-fix-round/10-round4-case-coverage.txt`.
+
+## Round 5 — arm coverage and checkout purity
+
+- Reviews 110/111 identified two blockers at `f33bd0da`: the three-case set could not represent the fourth `greenfield-remote-installer-contract` arm, and the root `.greenfield-case-state` directory was included in checkout fixture archives. The expected-RED manifest, per-case verifier, detector, and #869 remain fenced.
+- RED controls: with all three cases complete and no remote-arm identity, the old gate returned rc0 at `cases_defined=3 cases_executed=3`; the exact fixture tar selector archived `.greenfield-case-state/remote-arm.ran` once.
+- The checker is generalized across exact `cases` and `arms` dimensions. A new explicit four-arm declaration includes the remote contract; all four arms mark only after successful per-case verification. With the remote omitted, cases remain 3/3 rc0 while arms report 4/3 rc1 and name `greenfield-remote-installer-contract` as missing.
+- State moved beneath `.mosaic-test-work/greenfield-execution-coverage`, which the existing checkout selector excludes. The regression control proves a non-excluded root marker is archived while no `.mosaic-test-work` path is archived.
+- Final review: Codex code APPROVE confidence 0.93 and security risk NONE confidence 0.96, both with zero findings. Full installer tests, typecheck 45/45, lint 25/25, format, Bash syntax, ShellCheck, Woodpecker strict lint, and diff check pass with 11G free before/after.
+- Full evidence: `docs/reports/verification/1050-c1-fix-round/11-round5-arm-coverage-and-purity.txt`.
+
+## Round 6 — executable aggregation and production archive binding
+
+- Reviews 114/115 independently reproduced the same caller-level mutant at `df705828`: ignoring `arms_status` in the workflow still left the helper-bounded focused suite green. The production OR was correct and was not rewritten; its aggregation moved byte-for-byte into `verify-greenfield-execution-coverage-gate.sh`, which the workflow invokes directly.
+- The focused suite now exercises that exact helper across the complete truth table: cases PASS/arms FAIL RED; cases FAIL/arms PASS RED; both FAIL emits both outputs and is RED; both PASS GREEN. Local ignore-arms, ignore-cases, and always-RED mutants each make the suite RED.
+- Review `rev-974` separately proved that deleting only the production `e2e-install-test.sh` `.mosaic-test-work` tar exclusion left the copied-selector control green. The control now structurally binds its semantic archive test to the production checkout-archive command; the delete-production-binding mutant is RED. The fenced production installer remains byte-unchanged.
+- Final review: Codex code APPROVE confidence 0.94 and security risk NONE confidence 0.97, both with zero findings. Full installer tests, typecheck 45/45, lint 25/25, format, Bash syntax, ShellCheck, Woodpecker strict lint, focused truth-table and four mutant controls, and diff check pass with 11G free before validation.
+- Full evidence: `docs/reports/verification/1050-c1-fix-round/12-round6-caller-coupling-and-archive-binding.txt`.
+
+## Round 7 — canonical Alpine/BusyBox portability
+
+- Review 119 found the exact-head focused suite RED in the canonical Alpine `ci-base`: GNU `find -printf` is unsupported by BusyBox 1.37. The same script remained green in the Debian greenfield workflow, so greenfield success alone did not prove canonical runtime compatibility.
+- Local canonical-image RED was reproduced at rc1 before remediation. Marker inventory now uses Bash nullglob/dotglob and parameter expansion, checks state-directory readability, preserves the prior regular-file/non-symlink boundary, and retains sorted exact-set comparison without GNU-only flags.
+- The focused suite is green both locally and inside `git.mosaicstack.dev/mosaicstack/stack/ci-base:latest`. Canonical pipeline evidence remains pending the replacement frozen-head push; no stale pipeline is inherited.
+- Final review: Codex code APPROVE confidence 0.96 and security risk NONE confidence 0.97, both with zero findings. Full installer tests, typecheck 45/45, lint 25/25, format, Bash syntax, ShellCheck, Woodpecker strict lint, dual-runtime focused tests, retained Round-6 mutants, and diff check pass with 11G free.
+- Full evidence: `docs/reports/verification/1050-c1-fix-round/13-round7-busybox-portability.txt`.
+
+## Round 8 — pipefail-safe expected-set membership
+
+- Review 122 found `expected_names | grep -Fxq` could falsely reject a valid early-sorted marker: `grep -q` closes after its match, the upstream sorter can exit 141, and `pipefail` selects that producer failure. Independent canonical-Alpine stress measured failures at the live four-arm manifest size, so no safe small-set threshold is claimed.
+- A deterministic 20,001-entry real-script mark control makes the unfixed canonical-Alpine path RED with `case is not in the expected set: a-target`. The mark path now materializes and validates the complete expected-name snapshot before applying `grep -q` via a here-string, eliminating the producer/consumer pipe while retaining fail-closed producer errors.
+- The focused suite is green locally and in canonical Alpine after remediation. A separate 1,000-mark canonical-Alpine stress against the live four-arm production manifest recorded zero false failures.
+- Final review: Codex code APPROVE confidence 0.96 and security risk NONE confidence 0.98, both with zero findings. Full installer tests, typecheck 45/45, lint 25/25, format, Bash syntax, ShellCheck, Woodpecker strict lint, canonical deterministic/stress controls, retained Round-6 mutants, and diff check pass with 11G free.
+- Full evidence: `docs/reports/verification/1050-c1-fix-round/14-round8-pipefail-membership.txt`.
@@ -11,7 +11,7 @@
    "typecheck": "pnpm preflight && turbo run typecheck",
    "test:checkout": "node --test scripts/*.test.mjs",
    "test": "pnpm test:checkout && turbo run test && pnpm run test:installer",
-    "test:installer": "bash tools/install-state-machine.test.sh && bash tools/install-next-lane.test.sh && bash tools/verify-greenfield-expected-red.test.sh",
+    "test:installer": "bash tools/install-state-machine.test.sh && bash tools/install-next-lane.test.sh && bash tools/verify-greenfield-expected-red.test.sh && bash tools/verify-greenfield-execution-coverage.test.sh && bash tools/verified-installer-fetch.test.sh",
    "format": "prettier --write \"**/*.{ts,tsx,js,jsx,json,md}\"",
    "format:check": "prettier --check \"**/*.{ts,tsx,js,jsx,json,md}\"",
    "prepare": "node scripts/install-hooks.mjs"
@@ -710,9 +710,11 @@ trap 'restore_snapshot; exit 1' ERR INT TERM

 sync_framework

-# Ensure persistent directories exist
+# Ensure persistent directories exist. Credentials are private material and
+# must never inherit a permissive umask/default mode.
 mkdir -p "$TARGET_DIR/memory"
 mkdir -p "$TARGET_DIR/credentials"
+chmod 0700 "$TARGET_DIR/credentials"

 # Reconcile contract files from defaults/ into the framework root: framework-owned
 # files (CONSTITUTION/AGENTS/STANDARDS) are overwritten every upgrade (a divergent
@@ -781,22 +783,74 @@ record_phase_outcome() {
  fi
 }

+redact_install_stream() {
+  # Keep this bootstrap copy behaviorally identical to tools/install.sh's
+  # state_redact_stream; neither installer can assume the other is installed.
+  python3 /dev/fd/3 3<<'PY'
+import os, re, sys
+text = sys.stdin.read()
+secret_name = re.compile(r"(?:TOKEN|PASSWORD|PASSWD|SECRET|API_KEY|AUTH|CREDENTIAL|CANARY)", re.I)
+secrets = {value for name, value in os.environ.items() if secret_name.search(name) and len(value) >= 4}
+for value in sorted(secrets, key=len, reverse=True):
+    text = text.replace(value, "[REDACTED]")
+patterns = (
+    (re.compile(r"(?im)^(\s*(?:proxy-)?authorization\s*:\s*)[^\r\n]+"), r"\1[REDACTED]"),
+    (re.compile(r"(?im)^(\s*(?:set-)?cookie\s*:\s*)[^\r\n]+"), r"\1[REDACTED]"),
+    (re.compile(r"(?i)(Bearer\s+)[^\s'\"]+"), r"\1[REDACTED]"),
+    (re.compile(r"(?i)((?:[_-]?auth(?:Token)?|token|password|passwd|secret|api[_-]?key)\s*[=:]\s*)[^\s'\"]+"), r"\1[REDACTED]"),
+)
+for pattern, replacement in patterns:
+    text = pattern.sub(replacement, text)
+url_pattern = re.compile(r"https?://[^\s'\"<>]+", re.I)
+def redact_url(match):
+    url = match.group(0)
+    scheme_end = url.find("://") + 3
+    authority_end = len(url)
+    for separator in "/?#":
+        position = url.find(separator, scheme_end)
+        if position != -1:
+            authority_end = min(authority_end, position)
+    authority = url[scheme_end:authority_end]
+    at = authority.rfind("@")
+    if at != -1:
+        return url[:scheme_end] + "[REDACTED]@" + authority[at + 1:] + url[authority_end:]
+    return url
+sys.stdout.write(url_pattern.sub(redact_url, text))
+PY
+}
+
 run_captured() {
-  local label="$1" output status=0
+  local label="$1" redacted redactor_pid capture_fd status=0 redact_status=0
  shift
-  output="$(mktemp "${TMPDIR:-/tmp}/mosaic-post-install.XXXXXX.log")"
-  if "$@" >"$output" 2>&1; then status=0; else status=$?; fi
+  redacted="$(mktemp "${TMPDIR:-/tmp}/mosaic-post-redacted.XXXXXX")"
+  chmod 0600 "$redacted" || { rm -f "$redacted"; exit 1; }
+  # Preserve in-shell command behavior without ever staging plaintext output on
+  # disk. Process substitution carries raw bytes only through a pipe.
+  exec {capture_fd}> >(redact_install_stream > "$redacted")
+  redactor_pid=$!
+  set +e
+  "$@" >&"$capture_fd" 2>&1
+  status=$?
+  exec {capture_fd}>&-
+  wait "$redactor_pid"
+  redact_status=$?
+  set -e
+  if [[ "$redact_status" -ne 0 ]]; then
+    rm -f "$redacted"
+    fail "Could not redact '$label' diagnostics; refusing to expose or persist raw output."
+    exit 1
+  fi
  if [[ -n "${MOSAIC_INSTALL_COMMAND_LOG:-}" ]]; then
-    if ! { printf '\n=== %s (exit=%s) ===\n' "$label" "$status"; cat "$output"; } >> "$MOSAIC_INSTALL_COMMAND_LOG" \
+    if ! { printf '\n=== %s (exit=%s) ===\n' "$label" "$status"; cat "$redacted"; } >> "$MOSAIC_INSTALL_COMMAND_LOG" \
      || ! sync "$MOSAIC_INSTALL_COMMAND_LOG"; then
-      cat "$output" >&2
-      rm -f "$output"
+      cat "$redacted" >&2
+      rm -f "$redacted"
      fail "Could not durably append '$label' diagnostics to the install command log."
      exit 1
    fi
  fi
-  if [[ "$status" -ne 0 ]]; then cat "$output" >&2; fi
-  rm -f "$output"
+  if [[ "$status" -ne 0 ]]; then cat "$redacted" >&2; fi
+  rm -f "$redacted"
  return "$status"
 }

@@ -68,8 +68,15 @@ copy_claude_settings_guarded() {
    guard_args+=(--allow-inactive-enforcement)
  fi

-  if command -v mosaic >/dev/null 2>&1; then
-    if mosaic "${guard_args[@]}"; then
+  local mosaic_cli="${MOSAIC_CLI_PATH:-}"
+  # Unified install passes P3's committed absolute artifact. Standalone
+  # framework installs may resolve PATH once, but still invoke the resulting
+  # absolute path rather than a bare command.
+  if [[ -z "$mosaic_cli" ]]; then
+    mosaic_cli="$(command -v mosaic 2>/dev/null || true)"
+  fi
+  if [[ "$mosaic_cli" == /* && -x "$mosaic_cli" ]]; then
+    if "$mosaic_cli" "${guard_args[@]}"; then
      return 0
    fi
    echo "[mosaic-link] Enforcement hooks were NOT wired into $dst (see message above)." >&2
@@ -77,7 +84,7 @@ copy_claude_settings_guarded() {
    return 0
  fi

-  echo "[mosaic-link] ERROR: 'mosaic' CLI not found on PATH — cannot confirm lease-enforcement" >&2
+  echo "[mosaic-link] ERROR: P3 absolute mosaic CLI unavailable — cannot confirm lease-enforcement" >&2
  echo "[mosaic-link] activation capability. enforcement requested but activation half absent —" >&2
  echo "[mosaic-link] needs a published CLI carrying launch-runtime activation + a broker" >&2
  echo "[mosaic-link] supervisor; refusing to wire a dead gate (see #869)." >&2
@@ -9,10 +9,51 @@ WORK_DIR="${MOSAIC_TEST_WORK_DIR:-$PWD/.mosaic-test-work/ci-queue-wait-tristate}
 REPO_DIR="$WORK_DIR/repo"
 STUB_DIR="$WORK_DIR/stubs"
 AUDIT_LOG="$WORK_DIR/audit/ci-queue-wait.jsonl"
+STATUS_OBSERVED="$WORK_DIR/status-observed"
+CLOCK_LOG="$WORK_DIR/clock.log"
+WATCHDOG_PYTHON="/usr/bin/python3"
+WATCHDOG_SCRIPT="$WORK_DIR/real-clock-watchdog.py"
+WATCHDOG_TIMEOUT_SEC=5
+WATCHDOG_EXIT=90
 FEATURE_BRANCH="fix/rm-03-fixture"

+if [[ ! -x "$WATCHDOG_PYTHON" ]]; then
+    echo "FAIL setup: required real-clock watchdog runtime is unavailable at $WATCHDOG_PYTHON" >&2
+    exit 1
+fi
+
 rm -rf "$WORK_DIR"
 mkdir -p "$REPO_DIR" "$STUB_DIR"
+cat > "$WATCHDOG_SCRIPT" <<'PY'
+import os
+import signal
+import subprocess
+import sys
+
+if len(sys.argv) < 3:
+    raise SystemExit(2)
+
+timeout_seconds = float(sys.argv[1])
+process = subprocess.Popen(sys.argv[2:], start_new_session=True)
+try:
+    return_code = process.wait(timeout=timeout_seconds)
+except subprocess.TimeoutExpired:
+    try:
+        os.killpg(process.pid, signal.SIGKILL)
+    except ProcessLookupError:
+        pass
+    process.wait()
+    print(
+        f"FAIL HANG watchdog: subject exceeded {timeout_seconds:g}s "
+        "before completing its intended path",
+        file=sys.stderr,
+    )
+    raise SystemExit(90)
+
+if return_code < 0:
+    raise SystemExit(128 - return_code)
+raise SystemExit(return_code)
+PY
 git -C "$REPO_DIR" init -q
 git -C "$REPO_DIR" checkout -q -b "$FEATURE_BRANCH"
 git -C "$REPO_DIR" remote add origin https://git.example.test/acme/widgets.git
@@ -33,6 +74,9 @@ printf '%s\n' "$url" >> "${MOSAIC_STUB_URL_LOG:?}"

 case "$url" in
    */branches/*)
+        if [[ "${MOSAIC_STUB_BRANCH_MODE:-ok}" == "hang-before-provider" ]]; then
+            while :; do :; done
+        fi
        if [[ "${MOSAIC_STUB_BRANCH_MODE:-ok}" == "unreachable" ]]; then
            exit 7
        fi
@@ -44,6 +88,7 @@ case "$url" in
        fi
        ;;
    */status)
+        : > "${MOSAIC_STUB_STATUS_OBSERVED:?}"
        case "${MOSAIC_STUB_STATUS_MODE:?}" in
            success)   printf '%s' '{"state":"success","statuses":[{"status":"success"}]}' ;;
            pending)   printf '%s' '{"state":"pending","statuses":[{"status":"pending","context":"ci/test"}]}' ;;
@@ -63,7 +108,31 @@ case "$url" in
    *) echo "unexpected curl URL: $url" >&2; exit 2 ;;
 esac
 SH
-chmod +x "$STUB_DIR/curl"
+
+cat > "$STUB_DIR/date" <<'SH'
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ "$#" -ne 1 || "$1" != "+%s" ]]; then
+    echo "unexpected date invocation: $*" >&2
+    exit 2
+fi
+
+if [[ -e "${MOSAIC_STUB_STATUS_OBSERVED:?}" ]]; then
+    printf 'date-phase=after-status\n' >> "${MOSAIC_STUB_CLOCK_LOG:?}"
+    printf '1002\n'
+else
+    printf 'date-phase=before-status\n' >> "${MOSAIC_STUB_CLOCK_LOG:?}"
+    printf '1000\n'
+fi
+SH
+
+cat > "$STUB_DIR/sleep" <<'SH'
+#!/usr/bin/env bash
+set -euo pipefail
+printf 'sleep-after-status=%s\n' "$*" >> "${MOSAIC_STUB_CLOCK_LOG:?}"
+SH
+chmod +x "$STUB_DIR/curl" "$STUB_DIR/date" "$STUB_DIR/sleep"

 run_guard() {
    local status_mode="$1"
@@ -83,13 +152,46 @@ run_guard() {
            export GITEA_URL=https://git.example.test
            export MOSAIC_STUB_STATUS_MODE="$status_mode"
        fi
+        rm -f "$STATUS_OBSERVED" "$CLOCK_LOG"
        export MOSAIC_STUB_URL_LOG="$WORK_DIR/urls.log"
+        export MOSAIC_STUB_STATUS_OBSERVED="$STATUS_OBSERVED"
+        export MOSAIC_STUB_CLOCK_LOG="$CLOCK_LOG"
        export MOSAIC_CI_QUEUE_AUDIT_LOG="$audit_log"
-        "$SCRIPT_DIR/ci-queue-wait.sh" --purpose "${MOSAIC_TEST_PURPOSE:-push}" -t 0 -i 0 "$@"
+        # Provider observation is the synchronization event. The one-second
+        # timeout is subject semantics under virtual time, never a wall wait.
+        # The absolute Python runtime uses an internal monotonic wait and kills
+        # the subject's isolated process group. Neither operation can resolve
+        # to the virtual date/sleep stubs at the front of PATH.
+        local subject_rc
+        if "$WATCHDOG_PYTHON" "$WATCHDOG_SCRIPT" "$WATCHDOG_TIMEOUT_SEC" \
+            "$SCRIPT_DIR/ci-queue-wait.sh" --purpose "${MOSAIC_TEST_PURPOSE:-push}" -t 1 -i 1 "$@"; then
+            subject_rc=0
+        else
+            subject_rc=$?
+        fi
+        return "$subject_rc"
    )
 }

 failures=0
+assert_provider_observed() {
+    local name="$1" require_expiration="${2:-0}"
+    if [[ ! -e "$STATUS_OBSERVED" ]]; then
+        echo "FAIL $name: status provider was not observed" >&2
+        failures=$((failures + 1))
+    fi
+    if [[ ! -s "$CLOCK_LOG" ]] || ! grep -q '^date-phase=before-status$' "$CLOCK_LOG"; then
+        echo "FAIL $name: virtual clock interception did not run before provider observation" >&2
+        failures=$((failures + 1))
+    fi
+    if [[ "$require_expiration" -eq 1 ]]; then
+        if ! grep -q '^sleep-after-status=' "$CLOCK_LOG" || ! grep -q '^date-phase=after-status$' "$CLOCK_LOG"; then
+            echo "FAIL $name: pending path did not expire after provider observation" >&2
+            failures=$((failures + 1))
+        fi
+    fi
+}
+
 run_assertion() {
    local name="$1" expected_rc="$2" status_mode="$3" required_text="$4"
    local output rc
@@ -124,6 +226,13 @@ run_assertion() {
        printf '%s\n' "$output" >&2
        failures=$((failures + 1))
    fi
+    if [[ "$status_mode" != "credential-unresolvable" ]]; then
+        if [[ "$status_mode" == "pending" ]]; then
+            assert_provider_observed "$name" 1
+        else
+            assert_provider_observed "$name"
+        fi
+    fi
 }

 set -e
@@ -140,6 +249,27 @@ run_assertion large-payload not126 large-success 'state=terminal-success'
 run_assertion credential-unresolvable zero credential-unresolvable 'CANNOT_ASSERT'
 run_assertion provider-unreachable zero unreachable 'CANNOT_ASSERT'

+# Positive liveness control: a subject mutant hangs before the branch lookup
+# can reach the status provider. Only the independent real-clock watchdog may
+# terminate it, and its failure must be distinct from subject timeout rc=124.
+set +e
+watchdog_output=$(MOSAIC_STUB_BRANCH_MODE=hang-before-provider run_guard success "$AUDIT_LOG" 2>&1)
+watchdog_rc=$?
+set -e
+if [[ "$watchdog_rc" -ne "$WATCHDOG_EXIT" ]]; then
+    echo "FAIL watchdog-control: expected hang-specific rc=$WATCHDOG_EXIT, got rc=$watchdog_rc" >&2
+    failures=$((failures + 1))
+fi
+if [[ "$watchdog_output" != *"FAIL HANG watchdog:"* ]]; then
+    echo "FAIL watchdog-control: expected distinct hang-specific diagnostic" >&2
+    printf '%s\n' "$watchdog_output" >&2
+    failures=$((failures + 1))
+fi
+if [[ -e "$STATUS_OBSERVED" ]]; then
+    echo "FAIL watchdog-control: hanging mutant unexpectedly reached the status provider" >&2
+    failures=$((failures + 1))
+fi
+
 if [[ ! -s "$AUDIT_LOG" ]] || ! grep -q '"outcome":"CANNOT_ASSERT"' "$AUDIT_LOG"; then
    echo "FAIL provider-unreachable-audit: expected durable CANNOT_ASSERT JSONL record" >&2
    failures=$((failures + 1))
@@ -160,6 +290,7 @@ if [[ "$merge_unreachable_output" != *"CANNOT_ASSERT"* ]]; then
    echo "FAIL merge-provider-unreachable: expected loud CANNOT_ASSERT diagnostic" >&2
    failures=$((failures + 1))
 fi
+assert_provider_observed merge-provider-unreachable
 merge_audit_lines_after=$(wc -l < "$AUDIT_LOG")
 if [[ "$merge_audit_lines_after" -le "$merge_audit_lines_before" ]]; then
    echo "FAIL merge-provider-unreachable: expected an additional audit record" >&2
@@ -223,6 +354,7 @@ if [[ "$audit_failure_output" != *"audit"* ]]; then
    echo "FAIL audit-unavailable: expected loud audit failure diagnostic" >&2
    failures=$((failures + 1))
 fi
+assert_provider_observed audit-unavailable

 if [[ "$failures" -ne 0 ]]; then
    echo "ci-queue-wait tri-state regression failed ($failures assertions)" >&2
@@ -39,11 +39,12 @@ ORIG_PATH="$PATH"
 # loop — which would make the control a false negative. A root dotfile is
 # operator-owned (unknown→operator), so the sync loop skips it. Clean up on exit.
 STRIPPED="$FW/.install-rollback-control.tmp.sh"
+SIGNALED="$FW/.install-signal-control.tmp.sh"
 NOEXIT="$FW/.install-noexit-control.tmp.sh"
 D1CTRL="$FW/.install-d1guard-control.tmp.sh"
 D2CTRL="$FW/.install-d2guard-control.tmp.sh"
-rm -f "$STRIPPED" "$NOEXIT" "$D1CTRL" "$D2CTRL"
-trap 'rm -f "$STRIPPED" "$NOEXIT" "$D1CTRL" "$D2CTRL"' EXIT
+rm -f "$STRIPPED" "$SIGNALED" "$NOEXIT" "$D1CTRL" "$D2CTRL"
+trap 'rm -f "$STRIPPED" "$SIGNALED" "$NOEXIT" "$D1CTRL" "$D2CTRL"' EXIT

 pass=0; fail=0
 chk() { if eval "$2"; then echo "  ✓ $1"; pass=$((pass + 1)); else echo "  ✗ $1"; fail=$((fail + 1)); fi; }
@@ -179,58 +180,107 @@ chk "[control] without -E the mid-sync corruption survives (no rollback)" \

 # ── Part C: an INT/TERM interrupt must terminate, not resume (blocker-A) ──────
 # A bash signal trap that merely returns lets the script continue past the
-# interrupt — restoring the snapshot, then resuming the sync and reporting
-# success. We inject a SIGTERM mid-sync with a cp that SUCCEEDS (so set -e never
-# fires and ONLY the signal path governs), and assert the shipped installer
-# restores AND exits without reporting success. The control strips `exit 1` from
-# the trap and shows the buggy resume-to-success.
-make_term_shim() {
-  local dir="$1"
-  cat > "$dir/cp" <<SHIM
-#!/usr/bin/env bash
-dest="\${@: -1}"
-case "\$dest" in
-  */$POISON_REL)
-    kill -TERM "\$PPID" 2>/dev/null   # signal install.sh; the copy still succeeds
-    exec env PATH="$ORIG_PATH" cp "\$@" ;;
-esac
-exec env PATH="$ORIG_PATH" cp "\$@"
-SHIM
-  chmod +x "$dir/cp"
+# interrupt — restoring the snapshot, then resuming the install and reporting
+# success. Generate two installer fixtures that first damage a real target path
+# after the snapshot is armed, then signal their own Bash process immediately
+# before the normal sync. This fixed injection point is independent of `find`
+# enumeration order: after a no-exit handler restores and returns, the complete
+# sync still remains to run, so the historical resume bug is deterministic on
+# every filesystem. Their TERM handlers emit the same observable before
+# diverging, so missing signal delivery fails BOTH arms rather than manufacturing
+# a pass. The only semantic difference between fixtures is the explicit `exit 1`
+# whose load-bearing behavior this control proves.
+TERM_MARKER='[test-control] TERM handler entered'
+HANDLER_WITH_EXIT="trap 'echo \"$TERM_MARKER\" >&2; restore_snapshot; exit 1' TERM  # TEST-TERM-HANDLER"
+HANDLER_WITHOUT_EXIT="trap 'echo \"$TERM_MARKER\" >&2; restore_snapshot' TERM  # TEST-TERM-HANDLER"
+
+make_signal_installer() {
+  local output="$1" handler="$2"
+  local target_trap="trap 'restore_snapshot; exit 1' ERR INT TERM"
+  local target_sync='sync_framework'
+  local inject_damage="printf '%s' '$GARBAGE' > \"\$TARGET_DIR/$POISON_REL\"  # TEST-TERM-DAMAGE"
+  local inject_kill='kill -TERM "$$"  # TEST-TERM-INJECTION'
+
+  if ! awk \
+    -v target_trap="$target_trap" -v target_sync="$target_sync" \
+    -v handler="$handler" -v inject_damage="$inject_damage" \
+    -v inject_kill="$inject_kill" '
+      $0 == target_sync {
+        print inject_damage
+        print inject_kill
+        injection_sites++
+      }
+      { print }
+      $0 == target_trap {
+        print handler
+        handler_sites++
+      }
+      END {
+        if (handler_sites != 1 || injection_sites != 1) exit 42
+      }
+    ' "$INSTALL" > "$output"; then
+    rm -f "$output"
+    fail "Could not construct the self-TERM control installer at the exact trap/copy sites"
+    exit 1
+  fi
+  chmod +x "$output"
 }

-# Run one keep-mode upgrade with the SIGTERM shim. Echoes "<exit>\t<out>\t<home>".
+make_signal_installer "$SIGNALED" "$HANDLER_WITH_EXIT"
+make_signal_installer "$NOEXIT" "$HANDLER_WITHOUT_EXIT"
+signal_fixture_ready() {
+  local fixture="$1" expected_handler="$2"
+  [[ "$(grep -cF '# TEST-TERM-DAMAGE' "$fixture")" -eq 1 ]] \
+    && [[ "$(grep -cF '# TEST-TERM-INJECTION' "$fixture")" -eq 1 ]] \
+    && [[ "$(grep -cF '# TEST-TERM-HANDLER' "$fixture")" -eq 1 ]] \
+    && grep -Fqx "$expected_handler" "$fixture"
+}
+signaled_fixture_ready() { signal_fixture_ready "$SIGNALED" "$HANDLER_WITH_EXIT"; }
+noexit_fixture_ready() { signal_fixture_ready "$NOEXIT" "$HANDLER_WITHOUT_EXIT"; }
+chk "[signal] shipped fixture has exactly one self-TERM injection and marked handler" \
+  "signaled_fixture_ready"
+chk "[control] no-exit fixture has exactly one self-TERM injection and marked handler" \
+  "noexit_fixture_ready"
+chk "[control] removing the explicit TERM exit changes the fixture" \
+  "! cmp -s '$SIGNALED' '$NOEXIT'"
+
+# Run one keep-mode upgrade whose own shell delivers SIGTERM synchronously at
+# the selected copy. Echoes "<exit>\t<out>\t<home>".
 run_signal_upgrade() {
-  local installer="$1" H OUT SHIM rc
-  H=$(mktemp -d); OUT=$(mktemp); SHIM=$(mktemp -d)
+  local installer="$1" H OUT rc
+  H=$(mktemp -d); OUT=$(mktemp)
  seed_home "$H"
-  make_term_shim "$SHIM"
  set +e
-  PATH="$SHIM:$ORIG_PATH" \
+  PATH="$ORIG_PATH" \
    MOSAIC_HOME="$H" MOSAIC_INSTALL_MODE=keep MOSAIC_SYNC_ONLY=1 bash "$installer" >"$OUT" 2>&1
  rc=$?
  set -e 2>/dev/null || true
-  rm -rf "$SHIM"
  printf '%s\t%s\t%s\n' "$rc" "$OUT" "$H"
 }

-IFS=$'\t' read -r rcC OUTC HC < <(run_signal_upgrade "$INSTALL")
-chk "[signal] SIGTERM mid-sync aborts non-zero (trap exits, does not resume)" \
+IFS=$'\t' read -r rcC OUTC HC < <(run_signal_upgrade "$SIGNALED")
+chk "[signal] TERM handler observable fires exactly once" \
+  "[ \"\$(grep -cF '$TERM_MARKER' '$OUTC')\" -eq 1 ]"
+chk "[signal] SIGTERM after target mutation aborts non-zero (trap exits, does not resume)" \
  "[ '$rcC' -ne 0 ]"
 chk "[signal] restore_snapshot fires on the interrupt" \
  "grep -q 'restoring previous state from snapshot' '$OUTC'"
+chk "[signal] the deliberately damaged target is restored before termination" \
+  "[ \"\$(cat '$HC/$POISON_REL')\" = '$GOOD' ]"
 chk "[signal] does NOT resume to report sync success after the interrupt" \
  "! grep -q 'file phase complete' '$OUTC'"

-# Control: strip `exit 1` from the signal trap → the handler returns, the script
-# resumes past the interrupt and wrongly reports success. In $FW so SOURCE_DIR resolves.
-sed "s/trap 'restore_snapshot; exit 1' ERR INT TERM/trap 'restore_snapshot' ERR INT TERM/" \
-  "$INSTALL" > "$NOEXIT"
-chk "[control] the exit-strip actually changed the installer" \
-  "! cmp -s '$INSTALL' '$NOEXIT'"
-IFS=$'\t' read -r _rcD OUTD HD < <(run_signal_upgrade "$NOEXIT")
+IFS=$'\t' read -r rcD OUTD HD < <(run_signal_upgrade "$NOEXIT")
+chk "[control] TERM handler observable fires exactly once" \
+  "[ \"\$(grep -cF '$TERM_MARKER' '$OUTD')\" -eq 1 ]"
+chk "[control] without 'exit 1' the handler restores before returning" \
+  "grep -q 'restoring previous state from snapshot' '$OUTD'"
+chk "[control] without 'exit 1' the installer exits zero after resuming" \
+  "[ '$rcD' -eq 0 ]"
 chk "[control] without 'exit 1' the trap resumes and reports sync success (the bug)" \
  "grep -q 'file phase complete' '$OUTD'"
+chk "[control] the resumed full sync mutates the restored target again" \
+  "! grep -qxF '$GOOD' '$HD/$POISON_REL' && cmp -s '$FW/$POISON_REL' '$HD/$POISON_REL'"

 # ── Part D: a failed source/prune `find` scan must abort + roll back (D1) ─────
 # A `< <(find …)` process substitution discards find's exit status, so an
@@ -309,10 +359,10 @@ chk "[control] without the D2 recovery line the operator gets no snapshot pointe
 # Reap any snapshot the reset-fail runs left in /tmp (reset failed → never cleaned).
 grep -o '/[^ ]*mosaic-snapshot[^ ]*' "$OUTH" 2>/dev/null | head -1 | while read -r s; do rm -rf "$s"; done

-# Cleanup ($STRIPPED / $NOEXIT / $D1CTRL / $D2CTRL are also removed by the EXIT trap).
+# Cleanup (generated installer controls are also removed by the EXIT trap).
 for d in "$HA" "$REFA" "$HB" "$REFB" "$HC" "$HD" "$HE" "$REFE" "$HF" "$REFF" "$HG" "$HH"; do rm -rf "$d"; done
 rm -f "$OUTA" "$OUTB" "$OUTC" "$OUTD" "$OUTE" "$OUTF" "$OUTG" "$OUTH" \
-  "$STRIPPED" "$NOEXIT" "$D1CTRL" "$D2CTRL"
+  "$STRIPPED" "$SIGNALED" "$NOEXIT" "$D1CTRL" "$D2CTRL"

 echo
 echo "RESULT: $pass passed, $fail failed"
@@ -14,6 +14,10 @@ SOURCE="${MOSAIC_INSTALL_SOURCE:-checkout}"
 IMAGE="${MOSAIC_INSTALL_IMAGE:-node:22-bookworm-slim}"
 GIT_MODE="${MOSAIC_INSTALL_GIT_MODE:-present}"
 INSTALLER_FILE="${MOSAIC_FIXTURE_INSTALLER_FILE:-$ROOT/tools/install.sh}"
+INSTALLER_URL="${MOSAIC_FIXTURE_INSTALLER_URL:-}"
+INSTALLER_SHA256="${MOSAIC_FIXTURE_INSTALLER_SHA256:-}"
+SOURCE_COMMIT="${MOSAIC_FIXTURE_SOURCE_COMMIT:-}"
+SOURCE_SHA256="${MOSAIC_FIXTURE_SOURCE_SHA256:-}"
 IN_CLEAN_CONTAINER="${MOSAIC_GREENFIELD_CONTAINER:-0}"

 usage() {
@@ -39,6 +43,15 @@ done
 case "$LANE" in next|main) ;; *) echo "[fixture] unsupported lane '$LANE' (expected next|main)" >&2; exit 2 ;; esac
 case "$SOURCE" in checkout|remote) ;; *) echo "[fixture] unsupported source '$SOURCE' (expected checkout|remote)" >&2; exit 2 ;; esac
 case "$GIT_MODE" in present|absent) ;; *) echo "[fixture] unsupported git mode '$GIT_MODE' (expected present|absent)" >&2; exit 2 ;; esac
+if [[ "$SOURCE" == remote ]]; then
+  [[ -n "$INSTALLER_URL" ]] || INSTALLER_URL="https://git.mosaicstack.dev/mosaicstack/stack/raw/branch/${LANE}/tools/install.sh"
+  [[ "$INSTALLER_SHA256" =~ ^[0-9a-f]{64}$ ]] \
+    || { echo '[fixture] remote source requires MOSAIC_FIXTURE_INSTALLER_SHA256=64hex' >&2; exit 2; }
+  [[ "$SOURCE_COMMIT" =~ ^[0-9a-f]{40}$ ]] \
+    || { echo '[fixture] remote source requires MOSAIC_FIXTURE_SOURCE_COMMIT=40hex' >&2; exit 2; }
+  [[ -z "$SOURCE_SHA256" || "$SOURCE_SHA256" =~ ^[0-9a-f]{64}$ ]] \
+    || { echo '[fixture] MOSAIC_FIXTURE_SOURCE_SHA256 must be empty or 64hex' >&2; exit 2; }
+fi

 if [[ "$IN_CLEAN_CONTAINER" != "1" ]]; then
  if ! command -v docker >/dev/null 2>&1; then
@@ -63,7 +76,7 @@ if [[ "$SOURCE" == "checkout" ]]; then
    && framework_payload_count="$(find "$ROOT/packages/mosaic/framework/skills" -mindepth 1 -maxdepth 1 -type d | wc -l | tr -d ' ')"
  [[ -d "$ROOT/skills" ]] \
    && repo_root_count="$(find "$ROOT/skills" -mindepth 1 -maxdepth 1 -type d | wc -l | tr -d ' ')"
-  checkout_archive="$(mktemp "${TMPDIR:-/tmp}/mosaic-greenfield-checkout.XXXXXX.tar.gz")"
+  checkout_archive="$(mktemp "${TMPDIR:-/tmp}/mosaic-greenfield-checkout.XXXXXX")"
  repo_parent="$(dirname "$ROOT")"
  repo_name="$(basename "$ROOT")"
  tar -C "$repo_parent" \
@@ -75,7 +88,7 @@ if [[ "$SOURCE" == "checkout" ]]; then
  checkout_content_id="${checkout_digest:0:40}"
 fi

-inner="$(mktemp "${TMPDIR:-/tmp}/mosaic-greenfield-inner.XXXXXX.sh")"
+inner="$(mktemp "${TMPDIR:-/tmp}/mosaic-greenfield-inner.XXXXXX")"
 trap 'rm -f "$inner" "$checkout_archive"' EXIT
 cat > "$inner" <<'INNER'
 #!/usr/bin/env bash
@@ -87,13 +100,20 @@ packages=(bash ca-certificates curl jq passwd python3 util-linux)
 [[ "$FIXTURE_GIT_MODE" == "present" ]] && packages+=(git)
 apt-get install -y -qq "${packages[@]}" >/dev/null

+source_archive=/tmp/source-checkout.tar.gz
+source_commit=""
+source_sha256=""
+expected_source_commit=""
+expected_source_sha256=""
+
 if [[ "$FIXTURE_SOURCE" == "checkout" ]]; then
-  awk 'found { print } /^__MOSAIC_CHECKOUT_ARCHIVE__$/ { found=1; next }' "$0" | base64 -d > /tmp/source-checkout.tar.gz
-  actual_checkout_digest="$(sha256sum /tmp/source-checkout.tar.gz | awk '{print $1}')"
-  if [[ "$actual_checkout_digest" != "$FIXTURE_CHECKOUT_SHA256" ]]; then
+  awk 'found { print } /^__MOSAIC_CHECKOUT_ARCHIVE__$/ { found=1; next }' "$0" | base64 -d > "$source_archive"
+  source_sha256="$(sha256sum "$source_archive" | awk '{print $1}')"
+  if [[ "$source_sha256" != "$FIXTURE_CHECKOUT_SHA256" ]]; then
    echo "[fixture] checkout archive transport digest mismatch" >&2
    exit 1
  fi
+  source_commit="$FIXTURE_CHECKOUT_CONTENT_ID"
 fi

 useradd --create-home --uid 1001 --shell /bin/bash mosaic
@@ -104,7 +124,25 @@ case "$FIXTURE_SOURCE" in
    printf '%s' "$FIXTURE_INSTALLER_B64" | base64 -d > /tmp/install.sh
    ;;
  remote)
-    curl -fsSL "https://git.mosaicstack.dev/mosaicstack/stack/raw/branch/${FIXTURE_LANE}/tools/install.sh" > /tmp/install.sh
+    curl -fsSL "$FIXTURE_INSTALLER_URL" -o /tmp/install.sh
+    [[ -s /tmp/install.sh ]] || { echo '[fixture] remote installer returned an empty HTTP-success body' >&2; exit 1; }
+    actual_installer_sha256="$(sha256sum /tmp/install.sh | awk '{print $1}')"
+    [[ "$actual_installer_sha256" == "$FIXTURE_INSTALLER_SHA256" ]] || {
+      echo "[fixture] remote installer digest mismatch got=$actual_installer_sha256 expected=$FIXTURE_INSTALLER_SHA256" >&2
+      exit 1
+    }
+    curl -fsSL --max-filesize 268435456 \
+      "https://git.mosaicstack.dev/mosaicstack/stack/archive/${FIXTURE_SOURCE_COMMIT}.tar.gz" \
+      -o "$source_archive"
+    [[ -s "$source_archive" ]] || { echo '[fixture] remote source archive returned an empty HTTP-success body' >&2; exit 1; }
+    source_sha256="$(sha256sum "$source_archive" | awk '{print $1}')"
+    if [[ -n "$FIXTURE_SOURCE_SHA256" && "$source_sha256" != "$FIXTURE_SOURCE_SHA256" ]]; then
+      echo "[fixture] remote source archive digest mismatch got=$source_sha256 expected=$FIXTURE_SOURCE_SHA256" >&2
+      exit 1
+    fi
+    source_commit="$FIXTURE_SOURCE_COMMIT"
+    expected_source_commit="$source_commit"
+    expected_source_sha256="$source_sha256"
    ;;
 esac
 chmod 0755 /tmp/install.sh
@@ -134,23 +172,70 @@ fi
 resolved_version="$(npm view "$resolved_spec" version --registry=https://git.mosaicstack.dev/api/packages/mosaicstack/npm/ 2>/dev/null || true)"
 printf '[fixture] resolved lane=%s package=%s version=%s\n' "$lane" "$resolved_spec" "${resolved_version:-UNRESOLVED}"

+secret_canary='MOSAIC_C1_CANARY_6f3c91e2'
+argv_capture=/tmp/mosaic-installer-argv.log
+: > "$argv_capture"
 set +e
-MOSAIC_NO_COLOR=1 MOSAIC_ASSUME_YES=1 \
-  bash /tmp/install.sh "${lane_args[@]}" --yes --no-auto-launch >"$install_log" 2>&1
+MOSAIC_NO_COLOR=1 MOSAIC_ASSUME_YES=1 MOSAIC_INSTALL_SECRET_CANARY="$secret_canary" \
+  MOSAIC_INSTALL_REDACTION_PROBE=1 \
+  bash /tmp/install.sh "${lane_args[@]}" --yes --no-auto-launch >"$install_log" 2>&1 &
+installer_pid=$!
+while kill -0 "$installer_pid" 2>/dev/null; do
+  for cmdline in /proc/[0-9]*/cmdline; do
+    [[ -r "$cmdline" ]] || continue
+    tr '\0' ' ' < "$cmdline" >> "$argv_capture" 2>/dev/null || true
+    printf '\n' >> "$argv_capture"
+  done
+  sleep 0.02
+done
+wait "$installer_pid"
 install_status=$?
 set -e
 cat "$install_log"
+
+if [[ -n "$FIXTURE_EXPECTED_SOURCE_COMMIT" ]]; then
+  manifest="$mosaic_home/.install-manifest.json"
+  realised_source_commit="$(node -p "require('$manifest').sourceCommit || ''" 2>/dev/null || true)"
+  realised_source_sha256="$(node -p "require('$manifest').sourceSha256 || ''" 2>/dev/null || true)"
+  if [[ "$realised_source_commit" != "$FIXTURE_EXPECTED_SOURCE_COMMIT" \
+    || "$realised_source_sha256" != "$FIXTURE_EXPECTED_SOURCE_SHA256" ]]; then
+    printf '[SOURCE-CONTROL] FAIL: realised_commit=%s expected_commit=%s realised_sha256=%s expected_sha256=%s\n' \
+      "${realised_source_commit:-missing}" "$FIXTURE_EXPECTED_SOURCE_COMMIT" \
+      "${realised_source_sha256:-missing}" "$FIXTURE_EXPECTED_SOURCE_SHA256" >&2
+    exit 1
+  fi
+  printf '[SOURCE-CONTROL] PASS: realised_commit=%s realised_sha256=%s\n' \
+    "$realised_source_commit" "$realised_source_sha256"
+fi
+
+probe_ok=true
+if [[ "$FIXTURE_GIT_MODE" == present ]] \
+  && ! grep -q '^\[REDACTION-PROBE\] emitted=\[REDACTED\]$' "$install_log"; then
+  probe_ok=false
+fi
+if [[ "$probe_ok" != true ]] \
+  || grep -F "$secret_canary" "$argv_capture" >/dev/null \
+  || grep -R -F "$secret_canary" "$home" >/dev/null 2>&1; then
+  phase_fail P0 'seeded credential probe missing or canary leaked to argv, output, command log, npmrc, generated files, or shell history'
+else
+  printf '[SECRET-CONTROL] PASS: seeded captured-command canary was redacted and absent from argv/output/commands.log/npmrc/generated/history populations\n'
+fi
 printf '[fixture] installer_exit=%d done_claims=%s\n' \
  "$install_status" "$(grep -cF 'Done.' "$install_log" || true)"

-# P0 Resolve context
-shell="$(getent passwd "$(id -u)" | cut -d: -f7)"
-if [[ "$(id -u)" -ne 0 && "$home" == "/home/mosaic" && "$shell" == "/bin/bash" ]] \
+# P0 Resolve context. Keep this final fixture row as discriminating as the
+# installer's own P0 row: the expected-RED comparator binds this exact reason.
+passwd_row="$(getent passwd "$(id -u)")"
+target_user="$(printf '%s' "$passwd_row" | cut -d: -f1)"
+passwd_home="$(printf '%s' "$passwd_row" | cut -d: -f6)"
+shell="$(printf '%s' "$passwd_row" | cut -d: -f7)"
+if [[ "$(id -u)" -eq 1001 && "$target_user" == "mosaic" \
+  && "$home" == "/home/mosaic" && "$home" == "$passwd_home" && "$shell" == "/bin/bash" ]] \
  && ldd --version 2>&1 | grep -i 'glibc\|gnu libc' >/dev/null \
  && [[ "$(node -p 'Number(process.versions.node.split(".")[0])')" -ge 20 ]]; then
-  phase_pass P0 "target=mosaic uid=$(id -u) HOME=$home shell=$shell libc=glibc node=$(node --version)"
+  phase_pass P0 "target=$target_user uid=$(id -u) HOME=$home passwd_HOME=$passwd_home shell=$shell privilege=user arch=$(uname -m) libc=glibc node=$(node --version) npm=$(npm --version)"
 else
-  phase_fail P0 "context unresolved or unsupported (uid=$(id -u) HOME=$home shell=${shell:-unknown})"
+  phase_fail P0 "context unresolved or unsupported (target=${target_user:-unknown} uid=$(id -u) HOME=$home passwd_HOME=${passwd_home:-unknown} shell=${shell:-unknown} privilege=user)"
 fi

 # P1 Preflight
@@ -305,9 +390,11 @@ exec runuser -u mosaic -- env -i \
  FIXTURE_GIT_MODE="$FIXTURE_GIT_MODE" \
  FIXTURE_FRAMEWORK_PAYLOAD_COUNT="$FIXTURE_FRAMEWORK_PAYLOAD_COUNT" \
  FIXTURE_REPO_ROOT_COUNT="$FIXTURE_REPO_ROOT_COUNT" \
-  MOSAIC_INSTALL_LOCAL_SOURCE_ARCHIVE="$([[ "$FIXTURE_SOURCE" == "checkout" ]] && echo /tmp/source-checkout.tar.gz)" \
-  MOSAIC_INSTALL_LOCAL_SOURCE_COMMIT="$FIXTURE_CHECKOUT_CONTENT_ID" \
-  MOSAIC_INSTALL_LOCAL_SOURCE_SHA256="$FIXTURE_CHECKOUT_SHA256" \
+  FIXTURE_EXPECTED_SOURCE_COMMIT="$expected_source_commit" \
+  FIXTURE_EXPECTED_SOURCE_SHA256="$expected_source_sha256" \
+  MOSAIC_INSTALL_LOCAL_SOURCE_ARCHIVE="$source_archive" \
+  MOSAIC_INSTALL_LOCAL_SOURCE_COMMIT="$source_commit" \
+  MOSAIC_INSTALL_LOCAL_SOURCE_SHA256="$source_sha256" \
  /bin/bash /tmp/run-as-target.sh
 INNER
 if [[ "$SOURCE" == "checkout" ]]; then
@@ -329,6 +416,10 @@ if [[ "$IN_CLEAN_CONTAINER" == "1" ]]; then
  FIXTURE_SOURCE="$SOURCE" \
  FIXTURE_GIT_MODE="$GIT_MODE" \
  FIXTURE_INSTALLER_B64="$installer_b64" \
+  FIXTURE_INSTALLER_URL="$INSTALLER_URL" \
+  FIXTURE_INSTALLER_SHA256="$INSTALLER_SHA256" \
+  FIXTURE_SOURCE_COMMIT="$SOURCE_COMMIT" \
+  FIXTURE_SOURCE_SHA256="$SOURCE_SHA256" \
  FIXTURE_CHECKOUT_SHA256="$checkout_digest" \
  FIXTURE_CHECKOUT_CONTENT_ID="$checkout_content_id" \
  FIXTURE_FRAMEWORK_PAYLOAD_COUNT="$framework_payload_count" \
@@ -345,6 +436,10 @@ else
    --env FIXTURE_SOURCE="$SOURCE" \
    --env FIXTURE_GIT_MODE="$GIT_MODE" \
    --env FIXTURE_INSTALLER_B64="$installer_b64" \
+    --env FIXTURE_INSTALLER_URL="$INSTALLER_URL" \
+    --env FIXTURE_INSTALLER_SHA256="$INSTALLER_SHA256" \
+    --env FIXTURE_SOURCE_COMMIT="$SOURCE_COMMIT" \
+    --env FIXTURE_SOURCE_SHA256="$SOURCE_SHA256" \
    --env FIXTURE_CHECKOUT_SHA256="$checkout_digest" \
    --env FIXTURE_CHECKOUT_CONTENT_ID="$checkout_content_id" \
    --env FIXTURE_FRAMEWORK_PAYLOAD_COUNT="$framework_payload_count" \
@@ -0,0 +1,5 @@
+# Required Woodpecker execution arms for C1 acceptance criterion 4.
+greenfield-git-present
+greenfield-main-git-present
+greenfield-remote-installer-contract
+greenfield-git-absent
@@ -13,10 +13,12 @@ next-git-present	phase	P8=FAIL
 next-git-present	phase	P9=FAIL
 next-git-present	require	^\[fixture\] resolved lane=next .*version=[0-9]+\.[0-9]+\.[0-9]+-next\.
 next-git-present	require	^\[fixture\] installer_exit=1 done_claims=0$
+next-git-present	phase-reason	P0=target=mosaic uid=1001 HOME=/home/mosaic passwd_HOME=/home/mosaic shell=/bin/bash privilege=user arch=x86_64 libc=glibc node=v[0-9]+\.[0-9]+\.[0-9]+ npm=[0-9]+\.[0-9]+\.[0-9]+
+next-git-present	require	^\[SECRET-CONTROL\] PASS:
 next-git-present	require	^\[P3\] PASS: absolute_path=.* version=.* equals resolved lane version$
 next-git-present	require	^\[P4\] FAIL: NOT-MEASURED / UNDECLARED:
-next-git-present	require	^\[P6\] FAIL:
-next-git-present	forbid	Done\.
+next-git-present	require	^\[P6\] FAIL: runtime linking/activation action reported a required failure$
+next-git-present	forbid	Done\.|MOSAIC_C1_CANARY_|CLI not found on PATH
 main-git-present	exit	1
 main-git-present	phase	P0=PASS
 main-git-present	phase	P1=PASS
@@ -30,10 +32,12 @@ main-git-present	phase	P8=FAIL
 main-git-present	phase	P9=FAIL
 main-git-present	require	^\[fixture\] resolved lane=main .*version=[0-9]+\.[0-9]+\.[0-9]+$
 main-git-present	require	^\[fixture\] installer_exit=1 done_claims=0$
+main-git-present	phase-reason	P0=target=mosaic uid=1001 HOME=/home/mosaic passwd_HOME=/home/mosaic shell=/bin/bash privilege=user arch=x86_64 libc=glibc node=v[0-9]+\.[0-9]+\.[0-9]+ npm=[0-9]+\.[0-9]+\.[0-9]+
+main-git-present	require	^\[SECRET-CONTROL\] PASS:
 main-git-present	require	^\[P3\] PASS: absolute_path=.* version=.* equals resolved lane version$
 main-git-present	require	^\[P4\] FAIL: NOT-MEASURED / UNDECLARED:
-main-git-present	require	^\[P6\] FAIL:
-main-git-present	forbid	Done\.
+main-git-present	require	^\[P6\] FAIL: runtime linking/activation action reported a required failure
+main-git-present	forbid	Done\.|MOSAIC_C1_CANARY_|CLI not found on PATH
 next-git-absent	exit	1
 next-git-absent	phase	P0=PASS
 next-git-absent	phase	P1=FAIL
@@ -46,6 +50,8 @@ next-git-absent	phase	P7=PASS
 next-git-absent	phase	P8=FAIL
 next-git-absent	phase	P9=FAIL
 next-git-absent	require	^\[fixture\] installer_exit=1 done_claims=0$
+next-git-absent	phase-reason	P0=target=mosaic uid=1001 HOME=/home/mosaic passwd_HOME=/home/mosaic shell=/bin/bash privilege=user arch=x86_64 libc=glibc node=v[0-9]+\.[0-9]+\.[0-9]+ npm=[0-9]+\.[0-9]+\.[0-9]+
+next-git-absent	require	^\[SECRET-CONTROL\] PASS:
 next-git-absent	require	^\[P1\] FAIL: undeclared/missing prerequisite\(s\)=git;
 next-git-absent	require	^\[P3\] FAIL: .*executable=no
-next-git-absent	forbid	Done\.
+next-git-absent	forbid	Done\.|MOSAIC_C1_CANARY_
@@ -2,8 +2,12 @@
 set -euo pipefail

 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# shellcheck source=tools/test-enumeration-assertions.sh
+source "$ROOT/tools/test-enumeration-assertions.sh"
 TMP="$(mktemp -d "${TMPDIR:-/tmp}/mosaic-next-install-test-XXXXXX")"
 trap 'rm -rf "$TMP"' EXIT
+export TMPDIR="$TMP/runtime-tmp"
+mkdir -p "$TMPDIR"

 FAKE_BIN="$TMP/bin"
 HOME_DIR="$TMP/home"
@@ -13,6 +17,73 @@ STATE="$TMP/state"
 LOG="$TMP/npm.log"
 mkdir -p "$FAKE_BIN" "$HOME_DIR" "$STATE"

+if [[ "${MOSAIC_TEST_ENUMERATION_FAILURE_CHILD:-0}" != "1" ]]; then
+  printf '[test] enumeration failure cannot mask a planted in-progress transaction\n'
+  set +e
+  if [[ "$(/usr/bin/id -u)" -eq 0 ]]; then
+    enumeration_control_output="$(
+      su -s /bin/bash nobody -c \
+        "TMPDIR=/tmp MOSAIC_TEST_ENUMERATION_FAILURE_CHILD=1 bash '$0'" 2>&1
+    )"
+    enumeration_control_status=$?
+  else
+    enumeration_control_output="$(MOSAIC_TEST_ENUMERATION_FAILURE_CHILD=1 bash "$0" 2>&1)"
+    enumeration_control_status=$?
+  fi
+  set -e
+  printf '%s\n' "$enumeration_control_output" > "$TMP/enumeration-failure-control.log"
+  if [[ "$enumeration_control_status" -eq 0 ]]; then
+    echo '[test] FAIL: planted in-progress transaction plus failed enumeration passed the full suite' >&2
+    exit 1
+  fi
+  grep -qF '[test] ERROR: P2 fault-state enumeration failed' "$TMP/enumeration-failure-control.log" || {
+    echo '[test] FAIL: failed fault-state enumeration was not named' >&2
+    exit 1
+  }
+fi
+
+# Model the supported non-root/glibc target explicitly even when this harness
+# itself runs as root in Alpine/BusyBox CI.
+cat > "$FAKE_BIN/id" <<'FAKE_ID'
+#!/usr/bin/env bash
+case "${1:-}" in
+  -u) echo 1001 ;;
+  -g) echo 1001 ;;
+  -un) echo fixture-user ;;
+  *) exec /bin/id "$@" ;;
+esac
+FAKE_ID
+cat > "$FAKE_BIN/getent" <<FAKE_GETENT
+#!/usr/bin/env bash
+printf 'fixture-user:x:1001:1001::%s:/bin/bash\n' '$HOME_DIR'
+FAKE_GETENT
+cat > "$FAKE_BIN/ldd" <<'FAKE_LDD'
+#!/usr/bin/env bash
+printf 'ldd (GNU libc) 2.36\n'
+FAKE_LDD
+cat > "$FAKE_BIN/stat" <<'FAKE_STAT'
+#!/usr/bin/env bash
+if [[ "${1:-} ${2:-}" == '-c %u' ]]; then
+  [[ "${3:-}" == "${MOSAIC_TEST_WRONG_OWNER_PATH:-__none__}" ]] && echo 9999 || echo 1001
+  exit 0
+fi
+if [[ "${1:-} ${2:-}" == '-c %g' ]]; then
+  [[ "${3:-}" == "${MOSAIC_TEST_WRONG_GROUP_PATH:-__none__}" ]] && echo 9999 || echo 1001
+  exit 0
+fi
+exec /bin/stat "$@"
+FAKE_STAT
+cat > "$FAKE_BIN/realpath" <<'FAKE_REALPATH'
+#!/usr/bin/env python3
+import os, sys
+args=sys.argv[1:]
+mode=args.pop(0) if args and args[0] in ('-e','-m') else '-m'
+if args and args[0]=='--': args.pop(0)
+if len(args)!=1 or (mode=='-e' and not os.path.exists(args[0])): raise SystemExit(1)
+print(os.path.realpath(args[0]))
+FAKE_REALPATH
+chmod 0755 "$FAKE_BIN/id" "$FAKE_BIN/getent" "$FAKE_BIN/ldd" "$FAKE_BIN/stat" "$FAKE_BIN/realpath"
+
 cat > "$FAKE_BIN/npm" <<'FAKE_NPM'
 #!/usr/bin/env bash
 set -euo pipefail
@@ -31,6 +102,15 @@ install_cli() {
  mkdir -p "${MOSAIC_PREFIX:?}/bin"
  cat > "$MOSAIC_PREFIX/bin/mosaic" <<CLI
 #!/usr/bin/env bash
+set -euo pipefail
+if [[ "\${1:-}" == "wizard" ]]; then
+  printf 'wizard\n' >> "\${MOSAIC_TEST_NPM_LOG:?}"
+  mkdir -p "\${MOSAIC_HOME:?}" "\${HOME:?}/.config/mosaic-gateway"
+  printf '# Soul\\n\\nConfigured.\\n' > "\$MOSAIC_HOME/SOUL.md"
+  printf '# User\\n\\nConfigured.\\n' > "\$MOSAIC_HOME/USER.md"
+  chmod 0600 "\$MOSAIC_HOME/SOUL.md" "\$MOSAIC_HOME/USER.md"
+  exit 0
+fi
 printf '%s\\n' '$version'
 CLI
  chmod +x "$MOSAIC_PREFIX/bin/mosaic"
@@ -51,6 +131,12 @@ if [[ "$1" == "view" ]]; then
 fi

 if [[ "$1" == "install" ]]; then
+  if [[ -n "${MOSAIC_INSTALL_SECRET_CANARY:-}" ]]; then
+    printf 'registry diagnostic authToken=%s\n' "$MOSAIC_INSTALL_SECRET_CANARY"
+    printf 'urls=https://alice:p@[email protected]/a https://bob:pa:[email protected]/b https://carol:p%%[email protected]/c https://[email protected]/d https://user%%[email protected]/e\n'
+    printf 'Authorization: Basic QWxhZGRpbjpvcGVu\n//registry/:_auth=Ym9iOnNlY3JldA==\nCookie: session=abc123\nSet-Cookie: sid=xyz789\n'
+    printf '%s\n' "$MOSAIC_INSTALL_SECRET_CANARY" > "${MOSAIC_TEST_CANARY_OBSERVATION:?}"
+  fi
  case "$*" in
    *"@mosaicstack/[email protected]"*)
      install_cli "0.0.49-next.999"
@@ -141,7 +227,24 @@ if [[ -z "$dest" ]]; then
  echo "fake tar missing -C destination" >&2
  exit 1
 fi
-mkdir -p "$dest/stack/packages/mosaic" "$dest/stack/apps/gateway"
+mkdir -p "$dest/stack/packages/mosaic/framework" "$dest/stack/apps/gateway"
+if [[ "${MOSAIC_TEST_EXTRA_ARCHIVE_ROOT:-0}" == "1" ]]; then
+  mkdir -p "$dest/unexpected-second-root"
+fi
+cat > "$dest/stack/packages/mosaic/framework/install.sh" <<'FRAMEWORK'
+#!/usr/bin/env bash
+set -euo pipefail
+expected="${MOSAIC_PREFIX:?}/bin/mosaic"
+[[ "${MOSAIC_CLI_PATH:-}" == "$expected" && -x "$MOSAIC_CLI_PATH" ]] || {
+  echo "framework did not receive P3 absolute CLI (got=${MOSAIC_CLI_PATH:-unset} expected=$expected)" >&2
+  exit 61
+}
+printf 'framework-cli=%s version=%s\n' "$MOSAIC_CLI_PATH" "$($MOSAIC_CLI_PATH --version)" >> "${MOSAIC_TEST_NPM_LOG:?}"
+mkdir -p "${MOSAIC_HOME:?}/credentials"
+chmod 0700 "$MOSAIC_HOME/credentials"
+printf '# framework fixture\n' > "$MOSAIC_HOME/AGENTS.md"
+FRAMEWORK
+chmod 0755 "$dest/stack/packages/mosaic/framework/install.sh"
 FAKE_TAR
 chmod +x "$FAKE_BIN/tar"

@@ -187,15 +290,28 @@ reset_state() {
  rm -f "$STATE"/*
 }

-prefix_fingerprint() {
-  if [[ ! -d "$PREFIX" ]]; then printf 'ABSENT\n'; return; fi
-  (
-    cd "$PREFIX"
-    find . -mindepth 1 -printf '%P|%y|%m|%l\n' | LC_ALL=C sort
-    find . -type f -print0 | LC_ALL=C sort -z | xargs -0 -r sha256sum
-  ) | sha256sum | awk '{print $1}'
+tree_fingerprint() {
+  local root="$1"
+  if [[ ! -d "$root" ]]; then printf 'ABSENT\n'; return; fi
+  python3 - "$root" <<'PY'
+import hashlib, os, stat, sys
+root=os.path.abspath(sys.argv[1]); rows=[]
+for current, dirs, files in os.walk(root, topdown=True, followlinks=False):
+    for name in dirs + files:
+        path=os.path.join(current,name); meta=os.lstat(path)
+        rel=os.path.relpath(path,root)
+        target=os.readlink(path) if stat.S_ISLNK(meta.st_mode) else ''
+        digest=''
+        if stat.S_ISREG(meta.st_mode):
+            with open(path,'rb') as handle: digest=hashlib.sha256(handle.read()).hexdigest()
+        rows.append((rel,stat.S_IFMT(meta.st_mode),stat.S_IMODE(meta.st_mode),target,digest))
+payload='\n'.join('|'.join(map(str,row)) for row in sorted(rows)).encode()
+print(hashlib.sha256(payload).hexdigest())
+PY
 }

+prefix_fingerprint() { tree_fingerprint "$PREFIX"; }
+
 reset_state
 echo "[test] --next fast path pins resolved package versions"
 OUTPUT="$(
@@ -298,6 +414,29 @@ set -e
 grep -qF 'archive safety/integrity check failed' <<<"$OUTPUT"
 [[ "$(node -p "require('$ACTIVE').status")" == "rolled-back" ]]

+reset_state
+echo "[test] source archive with multiple extracted roots fails instead of selecting by find order"
+before_prefix="$(prefix_fingerprint)"
+set +e
+OUTPUT="$(
+  HOME="$HOME_DIR" \
+  MOSAIC_HOME="$MOSAIC_HOME" \
+  MOSAIC_PREFIX="$PREFIX" \
+  MOSAIC_NO_COLOR=1 \
+  MOSAIC_TEST_NPM_LOG="$LOG" \
+  MOSAIC_TEST_STATE="$STATE" \
+  MOSAIC_TEST_FAIL_NEXT_GATEWAY_INSTALL=1 \
+  MOSAIC_TEST_EXTRA_ARCHIVE_ROOT=1 \
+  PATH="$FAKE_BIN:$PATH" \
+  bash "$ROOT/tools/install.sh" --cli --next --yes --no-auto-launch 2>&1
+)"
+FAIL_STATUS=$?
+set -e
+[[ "$FAIL_STATUS" -ne 0 ]]
+[[ "$(prefix_fingerprint)" == "$before_prefix" ]]
+grep -qF 'expected exactly one extracted source root' <<<"$OUTPUT"
+[[ "$(node -p "require('$ACTIVE').status")" == "rolled-back" ]]
+
 reset_state
 echo "[test] --dev source install does not require registry version resolution"
 OUTPUT="$(
@@ -356,4 +495,141 @@ set -e
 [[ "$CHECK_STATUS" -ne 0 ]]
 grep -q '^\[P2\] FAIL: resolved_version=unavailable' <<<"$OUTPUT"

+printf '[test] full framework path receives P3 absolute CLI without relying on PATH\n'
+rm -rf "$HOME_DIR" "$STATE"; mkdir -p "$HOME_DIR" "$STATE"; reset_state
+set +e
+OUTPUT="$(
+  HOME="$HOME_DIR" MOSAIC_HOME="$MOSAIC_HOME" MOSAIC_PREFIX="$PREFIX" \
+  MOSAIC_INSTALL_STATE_DIR="$TMP/full-state" MOSAIC_NO_COLOR=1 \
+  MOSAIC_TEST_NPM_LOG="$LOG" MOSAIC_TEST_STATE="$STATE" \
+  PATH="$FAKE_BIN:/usr/local/bin:/usr/bin:/bin" \
+  bash "$ROOT/tools/install.sh" --next --yes --no-auto-launch 2>&1
+)"
+FULL_STATUS=$?
+set -e
+[[ "$FULL_STATUS" -ne 0 ]] # P4 remains intentionally undeclared until C5.
+grep -qF "framework-cli=$PREFIX/bin/mosaic version=0.0.49-next.999" "$LOG"
+if grep -q "CLI not found on PATH\|did not receive P3 absolute CLI" <<<"$OUTPUT"; then
+  echo "internal framework phase depended on PATH instead of P3 absolute CLI" >&2
+  exit 1
+fi
+
+printf '[test] captured diagnostics redact seeded credential canary everywhere\n'
+rm -rf "$HOME_DIR" "$STATE"; mkdir -p "$HOME_DIR" "$STATE"; reset_state
+canary='C1_SECRET_CANARY_7df4c2'
+OUTPUT="$(
+  HOME="$HOME_DIR" MOSAIC_HOME="$MOSAIC_HOME" MOSAIC_PREFIX="$PREFIX" \
+  MOSAIC_INSTALL_STATE_DIR="$TMP/secret-state" MOSAIC_NO_COLOR=1 \
+  MOSAIC_INSTALL_SECRET_CANARY="$canary" MOSAIC_TEST_CANARY_OBSERVATION="$TMP/canary-observed" \
+  MOSAIC_TEST_NPM_LOG="$LOG" MOSAIC_TEST_STATE="$STATE" \
+  PATH="$FAKE_BIN:/usr/local/bin:/usr/bin:/bin" \
+  bash "$ROOT/tools/install.sh" --cli --next --yes --no-auto-launch 2>&1
+)"
+if grep -qF "$canary" <<<"$OUTPUT"; then echo 'credential canary leaked to terminal output' >&2; exit 1; fi
+if grep -Eq 'alice:p@ss|bob:pa:ss|carol:p%40ss|token@example|user%3Apass|QWxhZGRpbjpvcGVu|Ym9iOnNlY3JldA|session=abc123|sid=xyz789' <<<"$OUTPUT"; then
+  echo 'credentialed URL userinfo leaked to terminal output' >&2; exit 1
+fi
+for host in example.com example.net example.org example.dev example.io; do
+  grep -qF "https://[REDACTED]@$host" <<<"$OUTPUT" \
+    || { echo "credentialed URL redaction control missing for $host" >&2; exit 1; }
+done
+secret_active="$TMP/secret-state/active.json"
+secret_journal="$(node -p "require('$secret_active').journal")"
+secret_command_log="$(dirname "$secret_journal")/commands.log"
+if grep -R -F "$canary" "$secret_command_log" "$HOME_DIR" 2>/dev/null; then
+  echo 'credential canary leaked to persistent installer output' >&2; exit 1
+fi
+if grep -E 'alice:p@ss|bob:pa:ss|carol:p%40ss|token@example|user%3Apass|QWxhZGRpbjpvcGVu|Ym9iOnNlY3JldA|session=abc123|sid=xyz789' "$secret_command_log" >/dev/null; then
+  echo 'credentialed URL userinfo leaked to persistent installer output' >&2; exit 1
+fi
+if [[ "$(cat "$TMP/canary-observed" 2>/dev/null || true)" != "$canary" ]]; then
+  echo 'credential canary positive control was not exercised' >&2; exit 1
+fi
+test_assert_find_empty 'redacted diagnostic staging files' \
+  "$TMPDIR" -maxdepth 1 -type f \
+  \( -name 'mosaic-phase-redacted.*' -o -name 'mosaic-post-redacted.*' \) || exit 1
+
+printf '[test] framework nested capture redacts the same canary and URL variants\n'
+framework_test_home="$TMP/framework-redact-home"
+framework_target="$framework_test_home/.config/mosaic"
+framework_cli="$TMP/framework-redact-cli"
+framework_log="$TMP/framework-redact-commands.log"
+framework_status="$TMP/framework-redact-status.tsv"
+mkdir -p "$framework_test_home"; : > "$framework_log"; : > "$framework_status"
+cat > "$framework_cli" <<'FRAMEWORK_CLI'
+#!/usr/bin/env bash
+printf 'nested authToken=%s\n' "${MOSAIC_INSTALL_SECRET_CANARY:?}"
+printf 'nested=https://alice:p@[email protected]/a https://bob:pa:[email protected]/b https://carol:p%%[email protected]/c https://[email protected]/d https://user%%[email protected]/e\n'
+printf 'Authorization: Basic QWxhZGRpbjpvcGVu\n//registry/:_auth=Ym9iOnNlY3JldA==\nCookie: session=abc123\nSet-Cookie: sid=xyz789\n'
+exit 1
+FRAMEWORK_CLI
+chmod 0755 "$framework_cli"
+set +e
+FRAMEWORK_OUTPUT="$(
+  HOME="$framework_test_home" MOSAIC_HOME="$framework_target" MOSAIC_INSTALL_MODE=overwrite \
+  MOSAIC_CLI_PATH="$framework_cli" MOSAIC_INSTALL_SECRET_CANARY="$canary" \
+  MOSAIC_INSTALL_COMMAND_LOG="$framework_log" MOSAIC_INSTALL_PHASE_STATUS_FILE="$framework_status" \
+  MOSAIC_ALLOW_MISSING_SEQUENTIAL_THINKING=1 MOSAIC_SKIP_SKILLS_SYNC=1 \
+  bash "$ROOT/packages/mosaic/framework/install.sh" 2>&1
+)"
+framework_install_status=$?
+set -e
+[[ "$framework_install_status" -eq 0 ]]
+if grep -Eq "$canary|alice:p@ss|bob:pa:ss|carol:p%40ss|token@example|user%3Apass|QWxhZGRpbjpvcGVu|Ym9iOnNlY3JldA|session=abc123|sid=xyz789" <<<"$FRAMEWORK_OUTPUT" \
+  || grep -Eq "$canary|alice:p@ss|bob:pa:ss|carol:p%40ss|token@example|user%3Apass|QWxhZGRpbjpvcGVu|Ym9iOnNlY3JldA|session=abc123|sid=xyz789" "$framework_log"; then
+  echo 'framework nested capture leaked credential diagnostics' >&2; exit 1
+fi
+for host in example.com example.net example.org example.dev example.io; do
+  grep -qF "https://[REDACTED]@$host" "$framework_log" \
+    || { echo "framework URL redaction control missing for $host" >&2; exit 1; }
+done
+
+printf '[test] real P2-P8 actions run under fault injection and restore actual surfaces\n'
+for phase in P2 P3 P4 P5 P6 P7 P8; do
+  rm -rf "$HOME_DIR" "$STATE" "$TMP/fault-$phase"; mkdir -p "$HOME_DIR" "$STATE" "$TMP/fault-$phase"
+  printf 'operator-sentinel\n' > "$HOME_DIR/operator.txt"
+  reset_state
+  before="$(tree_fingerprint "$HOME_DIR")"
+  set +e
+  HOME="$HOME_DIR" MOSAIC_HOME="$MOSAIC_HOME" MOSAIC_PREFIX="$PREFIX" \
+    MOSAIC_INSTALL_STATE_DIR="$TMP/fault-$phase" MOSAIC_INSTALL_FAULT_AFTER="$phase" \
+    MOSAIC_INSTALL_SELF_TEST_ALLOW=1 MOSAIC_NO_COLOR=1 \
+    MOSAIC_TEST_NPM_LOG="$LOG" MOSAIC_TEST_STATE="$STATE" \
+    PATH="$FAKE_BIN:/usr/local/bin:/usr/bin:/bin" \
+    bash "$ROOT/tools/install.sh" --state-machine-self-test --next --yes \
+    >"$TMP/fault-$phase.log" 2>&1
+  status=$?
+  set -e
+  [[ "$status" -eq 97 ]] || { echo "$phase real fault expected 97, got $status" >&2; exit 1; }
+  [[ -s "$LOG" ]] || { echo "$phase fault never entered the real action path" >&2; exit 1; }
+  [[ "$(tree_fingerprint "$HOME_DIR")" == "$before" ]] || { echo "$phase real rollback mismatch" >&2; exit 1; }
+  grep -q "phase=$phase" "$TMP/fault-$phase.log"
+  if [[ "${MOSAIC_TEST_ENUMERATION_FAILURE_CHILD:-0}" == "1" && "$phase" == "P2" ]]; then
+    mkdir -p "$TMP/fault-$phase/blocked"
+    printf '{"status":"in-progress"}\n' > "$TMP/fault-$phase/blocked/planted-in-progress.json"
+    chmod 0666 "$TMP/fault-$phase/blocked/planted-in-progress.json"
+    chmod 0100 "$TMP/fault-$phase/blocked"
+    trap 'chmod 0700 "$TMP/fault-P2/blocked" 2>/dev/null || true; rm -rf "$TMP"' EXIT
+  fi
+  test_assert_no_file_content_match "$phase fault-state" \
+    '"status"[[:space:]]*:[[:space:]]*"in-progress"' "$TMP/fault-$phase" || exit 1
+done
+
+printf '[test] stale projection is preserved while the real fault path acquires a free OS lock\n'
+rm -rf "$HOME_DIR" "$STATE" "$TMP/stale-state"; mkdir -p "$HOME_DIR" "$STATE" "$TMP/stale-state"
+printf '{"status":"in-progress","journal":"%s"}\n' "$TMP/stale-state/dead-run/journal.ndjson" > "$TMP/stale-state/active.json"
+reset_state
+set +e
+HOME="$HOME_DIR" MOSAIC_HOME="$MOSAIC_HOME" MOSAIC_PREFIX="$PREFIX" \
+  MOSAIC_INSTALL_STATE_DIR="$TMP/stale-state" MOSAIC_INSTALL_FAULT_AFTER=P2 \
+  MOSAIC_INSTALL_SELF_TEST_ALLOW=1 MOSAIC_NO_COLOR=1 \
+  MOSAIC_TEST_NPM_LOG="$LOG" MOSAIC_TEST_STATE="$STATE" \
+  PATH="$FAKE_BIN:/usr/local/bin:/usr/bin:/bin" \
+  bash "$ROOT/tools/install.sh" --state-machine-self-test --next --yes >"$TMP/stale.log" 2>&1
+stale_status=$?
+set -e
+[[ "$stale_status" -eq 97 ]]
+find "$TMP/stale-state" -name prior-active.json -type f -print -quit | grep -q .
+[[ "$(node -p "require('$TMP/stale-state/active.json').status")" == rolled-back ]]
+
 echo "[test] installer next lane tests passed"
@@ -8,6 +8,8 @@
 set -uo pipefail

 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# shellcheck source=tools/test-enumeration-assertions.sh
+source "$ROOT/tools/test-enumeration-assertions.sh"
 TMP="$(mktemp -d "${TMPDIR:-/tmp}/mosaic-install-state-test.XXXXXX")"
 trap 'rm -rf "$TMP"' EXIT
 failures=0
@@ -133,16 +135,26 @@ make_fake_npm "$good_bin"
 cp "$COMPAT_BIN/realpath" "$good_bin/realpath"
 cat > "$good_bin/id" <<'ID'
 #!/bin/bash
+uid="${MOSAIC_TEST_UID:-1001}"
+gid="${MOSAIC_TEST_GID:-1001}"
+user="${MOSAIC_TEST_USER:-fixture-user}"
 case "${1:-}" in
-  -u) echo 1001 ;;
-  -g) echo 1001 ;;
-  -un) echo fixture-user ;;
+  -u) echo "$uid" ;;
+  -g) echo "$gid" ;;
+  -un) echo "$user" ;;
  *) exec /bin/id "$@" ;;
 esac
 ID
 cat > "$good_bin/stat" <<'STAT'
 #!/bin/bash
-if [[ "${1:-} ${2:-}" == '-c %u' ]]; then echo 1001; exit 0; fi
+if [[ "${1:-} ${2:-}" == '-c %u' ]]; then
+  [[ "${3:-}" == "${MOSAIC_TEST_WRONG_OWNER_PATH:-__none__}" ]] && echo 9999 || echo "${MOSAIC_TEST_UID:-1001}"
+  exit 0
+fi
+if [[ "${1:-} ${2:-}" == '-c %g' ]]; then
+  [[ "${3:-}" == "${MOSAIC_TEST_WRONG_GROUP_PATH:-__none__}" ]] && echo 9999 || echo "${MOSAIC_TEST_GID:-1001}"
+  exit 0
+fi
 exec /bin/stat "$@"
 STAT
 cat > "$good_bin/curl" <<'CURL'
@@ -161,7 +173,7 @@ CLI
 chmod 0755 "$good_prefix/bin/mosaic"
 cat > "$good_bin/getent" <<GETENT
 #!/bin/bash
-printf '%s:x:%s:%s::%s:%s\\n' '$(id -un)' '$(id -u)' '$(id -g)' '$good_home' '$good_bin/bash'
+printf '%s:x:%s:%s::%s:%s\\n' "\${MOSAIC_TEST_USER:-fixture-user}" "\${MOSAIC_TEST_UID:-1001}" "\${MOSAIC_TEST_GID:-1001}" "\${MOSAIC_TEST_PASSWD_HOME:-$good_home}" '$good_bin/bash'
 GETENT
 cat > "$good_bin/bash" <<SHELL
 #!/bin/bash
@@ -199,6 +211,129 @@ good_rows="$(grep -Ec '^\[P[0-8]\] PASS:' "$TMP/good-check.log" || true)"
 [[ "$good_rows" -eq 9 ]] && pass_case 'good-host --check emitted nine PASS rows' \
  || { cat "$TMP/good-check.log" >&2; fail_case "good-host --check emitted $good_rows PASS rows"; }

+printf '[test] case: P0 binds uid, username, passwd HOME, shell, and privilege mode\n'
+passwd_home="$TMP/passwd-authoritative-home"
+mkdir -p "$passwd_home"
+set +e
+HOME="$good_home" MOSAIC_HOME="$good_mosaic" MOSAIC_PREFIX="$good_prefix" \
+  MOSAIC_TEST_PASSWD_HOME="$passwd_home" MOSAIC_NO_COLOR=1 \
+  PATH="$good_bin:/usr/local/bin:/usr/bin:/bin" \
+  bash "$ROOT/tools/install.sh" --check --next >"$TMP/wrong-home.log" 2>&1
+wrong_home_status=$?
+set -e
+[[ "$wrong_home_status" -ne 0 ]] || fail_case 'P0 accepted ambient HOME that disagrees with passwd HOME'
+grep -q '^\[P0\] FAIL:.*HOME mismatch' "$TMP/wrong-home.log" \
+  && pass_case 'P0 rejects ambient HOME that disagrees with passwd HOME' \
+  || fail_case 'P0 did not attribute the passwd HOME mismatch'
+
+for privilege_case in root-with-home sudo-with-inherited-home; do
+  extra_env=()
+  [[ "$privilege_case" == sudo-with-inherited-home ]] && extra_env+=(SUDO_USER=fixture-user SUDO_UID=1001)
+  set +e
+  env HOME="$good_home" MOSAIC_HOME="$good_mosaic" MOSAIC_PREFIX="$good_prefix" \
+    MOSAIC_TEST_UID=0 MOSAIC_TEST_GID=0 MOSAIC_TEST_USER=root MOSAIC_TEST_PASSWD_HOME=/root \
+    MOSAIC_NO_COLOR=1 PATH="$good_bin:/usr/local/bin:/usr/bin:/bin" "${extra_env[@]}" \
+    bash "$ROOT/tools/install.sh" --check --next >"$TMP/$privilege_case.log" 2>&1
+  privilege_status=$?
+  set -e
+  [[ "$privilege_status" -ne 0 ]] || fail_case "P0 accepted unsafe $privilege_case context"
+  grep -q '^\[P0\] FAIL:.*privilege=' "$TMP/$privilege_case.log" \
+    && pass_case "P0 states and rejects $privilege_case privilege context" \
+    || fail_case "P0 did not state $privilege_case privilege mode"
+done
+
+printf '[test] case: P3/P5 reject unsafe owner, group, and mode\n'
+chmod 0777 "$good_prefix/bin/mosaic"
+set +e
+HOME="$good_home" MOSAIC_HOME="$good_mosaic" MOSAIC_PREFIX="$good_prefix" MOSAIC_NO_COLOR=1 \
+  PATH="$good_bin:/usr/local/bin:/usr/bin:/bin" bash "$ROOT/tools/install.sh" --check --next >"$TMP/p3-mode.log" 2>&1
+p3_mode_status=$?
+set -e
+[[ "$p3_mode_status" -ne 0 ]] || fail_case 'P3 accepted mode-0777 CLI'
+grep -q '^\[P3\] FAIL:.*unsafe owner/group/mode' "$TMP/p3-mode.log" \
+  && pass_case 'P3 rejects group/world-writable CLI' || fail_case 'P3 did not attribute unsafe CLI mode'
+chmod 0755 "$good_prefix/bin/mosaic"
+
+for ownership_case in owner group; do
+  wrong_env=()
+  [[ "$ownership_case" == owner ]] && wrong_env+=(MOSAIC_TEST_WRONG_OWNER_PATH="$good_prefix/bin/mosaic")
+  [[ "$ownership_case" == group ]] && wrong_env+=(MOSAIC_TEST_WRONG_GROUP_PATH="$good_prefix/bin/mosaic")
+  set +e
+  env HOME="$good_home" MOSAIC_HOME="$good_mosaic" MOSAIC_PREFIX="$good_prefix" MOSAIC_NO_COLOR=1 \
+    PATH="$good_bin:/usr/local/bin:/usr/bin:/bin" "${wrong_env[@]}" \
+    bash "$ROOT/tools/install.sh" --check --next >"$TMP/p3-$ownership_case.log" 2>&1
+  owner_status=$?
+  set -e
+  [[ "$owner_status" -ne 0 ]] || fail_case "P3 accepted wrong CLI $ownership_case"
+  grep -q '^\[P3\] FAIL:.*unsafe owner/group/mode' "$TMP/p3-$ownership_case.log" \
+    && pass_case "P3 rejects wrong CLI $ownership_case" || fail_case "P3 did not attribute wrong CLI $ownership_case"
+done
+
+chmod 0644 "$good_mosaic/SOUL.md" "$good_mosaic/USER.md"
+set +e
+HOME="$good_home" MOSAIC_HOME="$good_mosaic" MOSAIC_PREFIX="$good_prefix" MOSAIC_NO_COLOR=1 \
+  PATH="$good_bin:/usr/local/bin:/usr/bin:/bin" bash "$ROOT/tools/install.sh" --check --next >"$TMP/p5-mode.log" 2>&1
+p5_mode_status=$?
+set -e
+[[ "$p5_mode_status" -ne 0 ]] || fail_case 'P5 accepted world-readable identity files'
+grep -q '^\[P5\] FAIL:' "$TMP/p5-mode.log" \
+  && pass_case 'P5 rejects world-readable identity files' || fail_case 'P5 did not reject identity mode 0644'
+chmod 0600 "$good_mosaic/SOUL.md" "$good_mosaic/USER.md"
+
+mkdir -p "$good_mosaic/credentials"
+chmod 0755 "$good_mosaic/credentials"
+set +e
+HOME="$good_home" MOSAIC_HOME="$good_mosaic" MOSAIC_PREFIX="$good_prefix" MOSAIC_NO_COLOR=1 \
+  PATH="$good_bin:/usr/local/bin:/usr/bin:/bin" bash "$ROOT/tools/install.sh" --check --next >"$TMP/p5-credentials.log" 2>&1
+credential_status=$?
+set -e
+[[ "$credential_status" -ne 0 ]] || fail_case 'P5 accepted mode-0755 credentials directory'
+grep -q '^\[P5\] FAIL:.*credentials' "$TMP/p5-credentials.log" \
+  && pass_case 'P5 rejects group/world-readable credential storage' \
+  || fail_case 'P5 did not attribute unsafe credential directory mode'
+chmod 0700 "$good_mosaic/credentials"
+
+printf '# framework\n' > "$good_mosaic/AGENTS.md"
+chmod 0666 "$good_mosaic/AGENTS.md"
+set +e
+HOME="$good_home" MOSAIC_HOME="$good_mosaic" MOSAIC_PREFIX="$good_prefix" MOSAIC_NO_COLOR=1 \
+  PATH="$good_bin:/usr/local/bin:/usr/bin:/bin" bash "$ROOT/tools/install.sh" --check --next >"$TMP/p4-tree-mode.log" 2>&1
+framework_mode_status=$?
+set -e
+[[ "$framework_mode_status" -ne 0 ]] || fail_case 'P4 accepted group/world-writable framework path'
+grep -q '^\[P4\] FAIL:.*owner/mode policy' "$TMP/p4-tree-mode.log" \
+  && pass_case 'P4 inventories and rejects unsafe created framework paths' \
+  || fail_case 'P4 did not attribute unsafe created-path mode'
+chmod 0644 "$good_mosaic/AGENTS.md"
+
+printf '[test] case: P4 fails closed when created-path enumeration is incomplete\n'
+real_find="$(command -v find)"
+cat > "$good_bin/find" <<FIND
+#!/bin/bash
+if [[ "\${1:-}" == '$good_mosaic' && "\${2:-}" == '-xdev' && "\${3:-}" == '-print0' ]]; then
+  printf '%s\\0' '$good_mosaic'
+  exit 73
+fi
+exec '$real_find' "\$@"
+FIND
+chmod 0755 "$good_bin/find"
+printf '# hidden unsafe child\n' > "$good_mosaic/AGENTS.md"
+chmod 0666 "$good_mosaic/AGENTS.md"
+set +e
+HOME="$good_home" MOSAIC_HOME="$good_mosaic" MOSAIC_PREFIX="$good_prefix" MOSAIC_NO_COLOR=1 \
+  PATH="$good_bin:/usr/local/bin:/usr/bin:/bin" bash "$ROOT/tools/install.sh" --check --next \
+  >"$TMP/p4-enumeration-failure.log" 2>&1
+p4_enumeration_status=$?
+set -e
+rm -f "$good_bin/find"
+[[ "$p4_enumeration_status" -ne 0 ]] \
+  && pass_case 'P4 rejects an incomplete created-path inventory' \
+  || fail_case 'P4 accepted a partial created-path inventory after find failed'
+grep -q '^\[P4\] FAIL:.*enumeration failed' "$TMP/p4-enumeration-failure.log" \
+  && pass_case 'P4 attributes the failed created-path enumeration' \
+  || fail_case 'P4 did not report failed created-path enumeration'
+chmod 0644 "$good_mosaic/AGENTS.md"
+
 printf '[test] case: persisted required-action failures remain blocking\n'
 for blocked_phase in P4 P6; do
  node -e '
@@ -219,36 +354,12 @@ for blocked_phase in P4 P6; do
 done
 printf '{\n  "lane": "next",\n  "cliVersion": "0.0.50-next.999",\n  "phaseOutcomes": {"P4":"committed","P6":"committed"}\n}\n' > "$good_mosaic/.install-manifest.json"

-printf '[test] case: per-phase P2-P8 fault injection restores representative host mutations\n'
-for phase in P2 P3 P4 P5 P6 P7 P8; do
-  home="$TMP/fault-$phase/home"
-  state="$TMP/fault-$phase/state"
-  mkdir -p "$home/.config/mosaic" "$home/.npm-global/bin" "$home/.claude" "$state"
-  printf 'operator-framework-sentinel\n' > "$home/.config/mosaic/operator.txt"
-  printf '@scope:registry=https://pre.example.invalid/\n' > "$home/.npmrc"
-  printf 'old-cli\n' > "$home/.npm-global/bin/mosaic"
-  printf '{"hooks":{"safe":true}}\n' > "$home/.claude/settings.json"
-  before="$(fingerprint "$home")"
-  set +e
-  HOME="$home" MOSAIC_HOME="$home/.config/mosaic" MOSAIC_PREFIX="$home/.npm-global" \
-    MOSAIC_INSTALL_STATE_DIR="$state" MOSAIC_INSTALL_FAULT_AFTER="$phase" \
-    MOSAIC_NO_COLOR=1 PATH="$COMPAT_BIN:$PATH" bash "$ROOT/tools/install.sh" --state-machine-self-test \
-    >"$TMP/fault-$phase.log" 2>&1
-  status=$?
-  set -e
-  after="$(fingerprint "$home")"
-  [[ "$status" -ne 0 ]] || fail_case "$phase injected fault returned zero"
-  grep -q "phase=$phase" "$TMP/fault-$phase.log" \
-    || fail_case "$phase fault transcript did not name the injected phase"
-  [[ "$before" == "$after" ]] \
-    && pass_case "$phase rollback restored framework/npmrc/prefix/runtime representative state" \
-    || fail_case "$phase rollback mismatch (before=$before after=$after)"
-  if find "$state" -type f -exec grep -l '"status"[[:space:]]*:[[:space:]]*"in-progress"' {} + 2>/dev/null | grep -q .; then
-    fail_case "$phase left a journal in-progress"
-  else
-    pass_case "$phase left no journal falsely in-progress"
-  fi
-done
+printf '[test] case: fault injection has no synthetic mutation implementation\n'
+if grep -q '\.selftest-' "$ROOT/tools/install.sh"; then
+  fail_case 'synthetic .selftest mutation path remains in the production fault seam'
+else
+  pass_case 'fault seam is attached only to real P2-P8 action flow (exercised by install-next-lane.test.sh)'
+fi

 printf '[test] case: unsafe and overlapping rollback roots fail before mutation\n'
 unsafe_home="$TMP/unsafe-home"
@@ -262,7 +373,7 @@ for case_name in root-target home-target overlap-target; do
  before="$(fingerprint "$unsafe_home")"
  set +e
  HOME="$unsafe_home" MOSAIC_HOME="$unsafe_mosaic" MOSAIC_PREFIX="$unsafe_prefix" \
-    MOSAIC_NO_COLOR=1 PATH="$good_bin:/usr/local/bin:/usr/bin:/bin" \
+    MOSAIC_TEST_PASSWD_HOME="$unsafe_home" MOSAIC_NO_COLOR=1 PATH="$good_bin:/usr/local/bin:/usr/bin:/bin" \
    bash "$ROOT/tools/install.sh" --check --next >"$TMP/$case_name.log" 2>&1
  status=$?
  set -e
@@ -279,7 +390,7 @@ mkdir -p "$symlink_home" "$symlink_outside"
 ln -s "$symlink_outside" "$symlink_home/.config"
 set +e
 HOME="$symlink_home" MOSAIC_HOME="$symlink_home/.config/mosaic" MOSAIC_PREFIX="$symlink_home/.npm-global" \
-  MOSAIC_NO_COLOR=1 PATH="$good_bin:/usr/local/bin:/usr/bin:/bin" \
+  MOSAIC_TEST_PASSWD_HOME="$symlink_home" MOSAIC_NO_COLOR=1 PATH="$good_bin:/usr/local/bin:/usr/bin:/bin" \
  bash "$ROOT/tools/install.sh" --check --next >"$TMP/symlink-target.log" 2>&1
 status=$?
 set -e
@@ -287,27 +398,8 @@ set -e
 grep -q '^\[P0\] FAIL:.*unsafe context' "$TMP/symlink-target.log" \
  && pass_case 'symlinked rollback parent was rejected by P0' \
  || fail_case 'symlinked rollback parent lacked an attributable P0 failure'
-[[ -z "$(find "$symlink_outside" -mindepth 1 -print -quit)" ]] || fail_case 'symlink target was mutated'
-
-printf '[test] case: stale in-progress projection does not impersonate a live OS lock\n'
-stale_home="$TMP/stale/home"
-stale_state="$TMP/stale/state"
-mkdir -p "$stale_home/.config/mosaic" "$stale_state"
-printf '{"status":"in-progress","journal":"%s"}\n' "$stale_state/dead-run/journal.ndjson" > "$stale_state/active.json"
-set +e
-HOME="$stale_home" MOSAIC_HOME="$stale_home/.config/mosaic" MOSAIC_PREFIX="$stale_home/.npm-global" \
-  MOSAIC_INSTALL_STATE_DIR="$stale_state" MOSAIC_INSTALL_FAULT_AFTER=P2 MOSAIC_NO_COLOR=1 \
-  PATH="$COMPAT_BIN:$PATH" bash "$ROOT/tools/install.sh" --state-machine-self-test >"$TMP/stale.log" 2>&1
-status=$?
-set -e
-[[ "$status" -eq 97 ]] || fail_case "stale projection recovery expected injected status 97, got $status"
-if find "$stale_state" -name prior-active.json -type f -print -quit | grep -q .; then
-  pass_case 'stale projection was preserved and superseded after the free OS lock was acquired'
-else
-  fail_case 'stale projection was not preserved for recovery evidence'
-fi
-[[ "$(node -p "require('$stale_state/active.json').status")" == "rolled-back" ]] \
-  || fail_case 'stale retry did not reach an honest rolled-back terminal state'
+test_assert_find_empty 'symlink target mutation check' "$symlink_outside" -mindepth 1 \
+  || fail_case 'symlink target was mutated or could not be enumerated'

 printf '[test] case: journal initialization failure is fatal before mutation\n'
 journal_home="$TMP/journal-failure/home"
@@ -316,8 +408,9 @@ printf 'journal-sentinel\n' > "$journal_home/.config/mosaic/operator.txt"
 before="$(fingerprint "$journal_home")"
 set +e
 HOME="$journal_home" MOSAIC_HOME="$journal_home/.config/mosaic" MOSAIC_PREFIX="$journal_home/.npm-global" \
-  MOSAIC_INSTALL_STATE_DIR="/proc/mosaic-journal-denied-$$" MOSAIC_INSTALL_FAULT_AFTER=P2 \
-  MOSAIC_NO_COLOR=1 bash "$ROOT/tools/install.sh" --state-machine-self-test \
+  MOSAIC_TEST_PASSWD_HOME="$journal_home" MOSAIC_INSTALL_STATE_DIR="/proc/mosaic-journal-denied-$$" \
+  MOSAIC_NO_COLOR=1 PATH="$good_bin:/usr/local/bin:/usr/bin:/bin" \
+  bash "$ROOT/tools/install.sh" --cli --next --yes --no-auto-launch \
  >"$TMP/journal-failure.log" 2>&1
 status=$?
 set -e
@@ -510,27 +510,77 @@ state_action_failed() {
  fi
 }

+state_redact_stream() {
+  python3 /dev/fd/3 3<<'PY'
+import os, re, sys
+text = sys.stdin.read()
+secret_name = re.compile(r"(?:TOKEN|PASSWORD|PASSWD|SECRET|API_KEY|AUTH|CREDENTIAL|CANARY)", re.I)
+secrets = {value for name, value in os.environ.items() if secret_name.search(name) and len(value) >= 4}
+for value in sorted(secrets, key=len, reverse=True):
+    text = text.replace(value, "[REDACTED]")
+patterns = (
+    (re.compile(r"(?im)^(\s*(?:proxy-)?authorization\s*:\s*)[^\r\n]+"), r"\1[REDACTED]"),
+    (re.compile(r"(?im)^(\s*(?:set-)?cookie\s*:\s*)[^\r\n]+"), r"\1[REDACTED]"),
+    (re.compile(r"(?i)(Bearer\s+)[^\s'\"]+"), r"\1[REDACTED]"),
+    (re.compile(r"(?i)((?:[_-]?auth(?:Token)?|token|password|passwd|secret|api[_-]?key)\s*[=:]\s*)[^\s'\"]+"), r"\1[REDACTED]"),
+)
+for pattern, replacement in patterns:
+    text = pattern.sub(replacement, text)
+url_pattern = re.compile(r"https?://[^\s'\"<>]+", re.I)
+def redact_url(match):
+    url = match.group(0)
+    scheme_end = url.find("://") + 3
+    authority_end = len(url)
+    for separator in "/?#":
+        position = url.find(separator, scheme_end)
+        if position != -1:
+            authority_end = min(authority_end, position)
+    authority = url[scheme_end:authority_end]
+    at = authority.rfind("@")
+    if at != -1:
+        return url[:scheme_end] + "[REDACTED]@" + authority[at + 1:] + url[authority_end:]
+    return url
+sys.stdout.write(url_pattern.sub(redact_url, text))
+PY
+}
+
+state_redaction_probe() {
+  printf '[REDACTION-PROBE] emitted=%s\n' "${MOSAIC_INSTALL_SECRET_CANARY:?redaction probe requires canary}"
+}
+
 state_run_captured() {
-  local label="$1" output status=0
+  local label="$1" redacted redactor_pid capture_fd status=0 redact_status=0
  shift
-  output="$(mktemp "${TMPDIR:-/tmp}/mosaic-phase-command.XXXXXX.log")" || return
-  # The command is deliberately called in a conditional so its status can be
-  # journaled before the caller's ERR trap rolls back. Bash disables errexit in
-  # functions invoked this way, so every multi-command phase helper below must
-  # explicitly return on each required command failure.
-  if "$@" >"$output" 2>&1; then status=0; else status=$?; fi
-  cat "$output" || { rm -f "$output"; return 1; }
-  if ! { printf '\n=== %s (exit=%s) ===\n' "$label" "$status"; cat "$output"; } >> "$STATE_COMMAND_LOG"; then
-    rm -f "$output"
+  redacted="$(mktemp "${TMPDIR:-/tmp}/mosaic-phase-redacted.XXXXXX")" || return
+  chmod 0600 "$redacted" || { rm -f "$redacted"; return 1; }
+  # Process substitution preserves in-shell phase side effects while ensuring
+  # plaintext diagnostics exist only in a pipe, never in a filesystem body.
+  exec {capture_fd}> >(state_redact_stream > "$redacted")
+  redactor_pid=$!
+  set +e
+  "$@" >&"$capture_fd" 2>&1
+  status=$?
+  exec {capture_fd}>&-
+  wait "$redactor_pid"
+  redact_status=$?
+  set -e
+  if [[ "$redact_status" -ne 0 ]]; then
+    rm -f "$redacted"
+    fail "Could not redact '$label' diagnostics; refusing to expose or persist raw command output."
+    return 1
+  fi
+  cat "$redacted" || { rm -f "$redacted"; return 1; }
+  if ! { printf '\n=== %s (exit=%s) ===\n' "$label" "$status"; cat "$redacted"; } >> "$STATE_COMMAND_LOG"; then
+    rm -f "$redacted"
    fail "Could not append '$label' output to $STATE_COMMAND_LOG; refusing to continue."
    return 1
  fi
  if ! sync "$STATE_COMMAND_LOG"; then
-    rm -f "$output"
+    rm -f "$redacted"
    fail "Could not sync '$label' output in $STATE_COMMAND_LOG; refusing to continue."
    return 1
  fi
-  rm -f "$output"
+  rm -f "$redacted"
  state_json_line command "$STATE_CURRENT_PHASE" "$([[ "$status" -eq 0 ]] && echo committed || echo failed)" "label=$label output_log=$STATE_COMMAND_LOG exit=$status"
  return "$status"
 }
@@ -569,6 +619,67 @@ state_target_shell() {
  printf '%s' "${shell:-${SHELL:-}}"
 }

+STATE_POLICY_REASON=""
+state_path_owner_mode_ok() {
+  local path="$1" policy="${2:-shared-read}" uid gid mode mode_value original resolved
+  original="$path"
+  [[ -e "$path" ]] || { STATE_POLICY_REASON="$path missing"; return 1; }
+  if [[ -L "$path" ]]; then
+    resolved="$(realpath -e -- "$path" 2>/dev/null)" \
+      || { STATE_POLICY_REASON="$path has an unresolved symlink target"; return 1; }
+    if [[ "$resolved" != "$HOME"/* && "$resolved" != "$PREFIX"/* ]]; then
+      STATE_POLICY_REASON="$path escapes target-owned roots via symlink to $resolved"
+      return 1
+    fi
+    path="$resolved"
+  fi
+  uid="$(stat -c '%u' "$path" 2>/dev/null)" || { STATE_POLICY_REASON="$original owner unreadable"; return 1; }
+  gid="$(stat -c '%g' "$path" 2>/dev/null)" || { STATE_POLICY_REASON="$path group unreadable"; return 1; }
+  mode="$(stat -c '%a' "$path" 2>/dev/null)" || { STATE_POLICY_REASON="$path mode unreadable"; return 1; }
+  [[ "$uid" == "$(id -u)" && "$gid" == "$(id -g)" && "$mode" =~ ^[0-7]{3,4}$ ]] \
+    || { STATE_POLICY_REASON="$original owner=$uid group=$gid mode=$mode expected=$(id -u):$(id -g)"; return 1; }
+  mode_value=$((8#$mode))
+  case "$policy" in
+    private)
+      (( (mode_value & 077) == 0 )) \
+        || { STATE_POLICY_REASON="$original mode=$mode exposes private material to group/other"; return 1; }
+      ;;
+    executable)
+      (( (mode_value & 0111) != 0 && (mode_value & 022) == 0 )) \
+        || { STATE_POLICY_REASON="$original mode=$mode is not executable or is group/world-writable"; return 1; }
+      ;;
+    shared-read)
+      (( (mode_value & 022) == 0 )) \
+        || { STATE_POLICY_REASON="$original mode=$mode is group/world-writable"; return 1; }
+      ;;
+    *) STATE_POLICY_REASON="unknown owner/mode policy=$policy for $path"; return 1 ;;
+  esac
+}
+
+state_tree_owner_mode_ok() {
+  local root="$1" path policy scan valid=true
+  [[ -e "$root" ]] || return 0
+  scan="$(mktemp)" \
+    || { STATE_POLICY_REASON="$root enumeration staging failed"; return 1; }
+  if ! find "$root" -xdev -print0 > "$scan"; then
+    STATE_POLICY_REASON="$root enumeration failed; created-path inventory is incomplete"
+    rm -f "$scan"
+    return 1
+  fi
+  while IFS= read -r -d '' path; do
+    policy=shared-read
+    case "$path" in
+      "$MOSAIC_HOME/credentials"|"$MOSAIC_HOME/credentials"/*|"$MOSAIC_HOME/SOUL.md"|"$MOSAIC_HOME/USER.md") policy=private ;;
+    esac
+    if ! state_path_owner_mode_ok "$path" "$policy"; then
+      valid=false
+      break
+    fi
+  done < "$scan"
+  rm -f "$scan"
+  [[ "$valid" == true ]]
+}
+
 state_resolved_version() {
  local cli gateway
  if [[ "$FLAG_DEV" == "true" ]]; then
@@ -598,21 +709,37 @@ state_predicate() {
  local phase="$1" shell node_major installed expected
  local missing=() login_path nonlogin_path broker=false dead_hooks=0
  local prefix_parent disk_kb inode_count min_disk_kb min_inodes npm_major privilege_mode
+  local passwd_row passwd_user passwd_uid passwd_home passwd_shell actual_user actual_uid
  STATE_REASON=""
  case "$phase" in
    P0)
-      shell="$(state_target_shell)"
+      actual_uid="$(id -u 2>/dev/null || true)"
+      actual_user="$(id -un 2>/dev/null || true)"
+      passwd_row="$(getent passwd "$actual_uid" 2>/dev/null || true)"
+      IFS=: read -r passwd_user _ passwd_uid _ _ passwd_home passwd_shell <<<"$passwd_row"
+      shell="$passwd_shell"
      node_major="$(node -p 'Number(process.versions.node.split(".")[0])' 2>/dev/null || echo 0)"
      npm_major="$(npm --version 2>/dev/null | cut -d. -f1 || echo 0)"
-      privilege_mode="$([[ "$(id -u)" -eq 0 ]] && echo root-without-explicit-target || echo user)"
-      if [[ -n "$HOME" && -n "$shell" && "$privilege_mode" == "user" && "$(uname -s)" == "Linux" ]] \
+      if [[ "$actual_uid" == 0 && -n "${SUDO_USER:-}" ]]; then
+        privilege_mode="sudo-with-inherited-home"
+      elif [[ "$actual_uid" == 0 ]]; then
+        privilege_mode="root-without-explicit-target"
+      else
+        privilege_mode="user"
+      fi
+      if [[ -z "$passwd_row" || "$actual_uid" != "$passwd_uid" || "$actual_user" != "$passwd_user" \
+        || -z "$passwd_home" || "$HOME" != "$passwd_home" ]]; then
+        STATE_REASON="unsupported or unresolved target account: HOME mismatch or passwd identity mismatch (target=${actual_user:-unknown} uid=${actual_uid:-unknown} HOME=${HOME:-unset} passwd_user=${passwd_user:-unset} passwd_uid=${passwd_uid:-unset} passwd_HOME=${passwd_home:-unset} shell=${passwd_shell:-unset} privilege=$privilege_mode)"
+        return 1
+      fi
+      if [[ -n "$shell" && "$privilege_mode" == "user" && "$(uname -s)" == "Linux" ]] \
        && ldd --version 2>&1 | grep -i 'glibc\|gnu libc' >/dev/null \
        && [[ "$(uname -m)" == "x86_64" ]] && [[ "$node_major" -ge 20 ]] && [[ "$npm_major" -ge 9 ]] \
        && state_validate_target_paths; then
-        STATE_REASON="target=$(id -un) uid=$(id -u) HOME=$HOME shell=$shell privilege=$privilege_mode arch=x86_64 libc=glibc node=$(node --version) npm=$(npm --version)"
+        STATE_REASON="target=$actual_user uid=$actual_uid HOME=$HOME passwd_HOME=$passwd_home shell=$shell privilege=$privilege_mode arch=x86_64 libc=glibc node=$(node --version) npm=$(npm --version)"
        return 0
      fi
-      STATE_REASON="unsupported, unresolved, or unsafe context (target=$(id -un 2>/dev/null || echo unknown) uid=$(id -u) HOME=${HOME:-unset} shell=${shell:-unset} privilege=$privilege_mode arch=$(uname -m 2>/dev/null || echo unknown) node_major=$node_major npm_major=$npm_major path_check=${STATE_PATH_REASON:-not-reached})"
+      STATE_REASON="unsupported, unresolved, or unsafe context (target=${actual_user:-unknown} uid=${actual_uid:-unknown} HOME=${HOME:-unset} passwd_HOME=${passwd_home:-unset} shell=${shell:-unset} privilege=$privilege_mode arch=$(uname -m 2>/dev/null || echo unknown) node_major=$node_major npm_major=$npm_major path_check=${STATE_PATH_REASON:-not-reached})"
      return 1
      ;;
    P1)
@@ -684,11 +811,12 @@ state_predicate() {
      expected="$(state_expected_cli_version)"
      installed=""
      [[ -x "$PREFIX/bin/mosaic" ]] && installed="$("$PREFIX/bin/mosaic" --version 2>&1 | tail -n 1 | tr -d '\r' || true)"
-      if [[ -n "$expected" && -x "$PREFIX/bin/mosaic" && "$installed" == "$expected" ]]; then
-        STATE_REASON="absolute_path=$PREFIX/bin/mosaic version=$installed equals resolved lane version"
+      if [[ -n "$expected" && -x "$PREFIX/bin/mosaic" && "$installed" == "$expected" ]] \
+        && state_path_owner_mode_ok "$PREFIX/bin/mosaic" executable; then
+        STATE_REASON="absolute_path=$PREFIX/bin/mosaic version=$installed equals resolved lane version; owner/mode policy satisfied"
        return 0
      fi
-      STATE_REASON="absolute_path=$PREFIX/bin/mosaic executable=$([[ -x "$PREFIX/bin/mosaic" ]] && echo yes || echo no) got=${installed:-missing} expected=${expected:-unresolved}"
+      STATE_REASON="absolute_path=$PREFIX/bin/mosaic executable=$([[ -x "$PREFIX/bin/mosaic" ]] && echo yes || echo no) got=${installed:-missing} expected=${expected:-unresolved}; unsafe owner/group/mode=${STATE_POLICY_REASON:-not-evaluated}"
      return 1
      ;;
    P4)
@@ -699,6 +827,10 @@ state_predicate() {
      local expected_lane expected_version
      expected_lane="$([[ "$FLAG_NEXT" == true ]] && echo next || echo latest)"
      expected_version="$(state_expected_cli_version)"
+      if [[ -e "$MOSAIC_HOME" ]] && ! state_tree_owner_mode_ok "$MOSAIC_HOME"; then
+        STATE_REASON="framework created-path owner/mode policy failed: $STATE_POLICY_REASON"
+        return 1
+      fi
      if [[ ! -s "$declared_set" ]]; then
        STATE_REASON="NOT-MEASURED / UNDECLARED: installer published no checkout-free, lane/versioned shipped-set artifact at $declared_set"
        return 1
@@ -738,12 +870,14 @@ NODE
      for skill in SOUL.md USER.md; do
        local path="$MOSAIC_HOME/$skill"
        if [[ ! -s "$path" ]] || ! grep -q '^# ' "$path" 2>/dev/null \
-          || [[ "$(stat -c '%u' "$path" 2>/dev/null || echo -1)" != "$(id -u)" ]] \
-          || [[ "$(stat -c '%a' "$path" 2>/dev/null || echo 777)" =~ [2367]$ ]]; then
+          || ! state_path_owner_mode_ok "$path" private; then
          missing+=("$skill")
        fi
      done
-      if [[ "${#missing[@]}" -eq 0 ]]; then STATE_REASON="SOUL.md and USER.md parse and have target owner/mode"; return 0; fi
+      if [[ -e "$MOSAIC_HOME/credentials" ]] && ! state_tree_owner_mode_ok "$MOSAIC_HOME/credentials"; then
+        missing+=("credentials(owner/mode=$STATE_POLICY_REASON)")
+      fi
+      if [[ "${#missing[@]}" -eq 0 ]]; then STATE_REASON="SOUL.md and USER.md parse and have private target owner/mode; credential paths are private"; return 0; fi
      STATE_REASON="identity missing, empty, malformed, wrong-owner, or unsafe-mode: ${missing[*]}"
      return 1
      ;;
@@ -863,7 +997,8 @@ state_validate_target_paths() {
 }

 state_snapshot_create() {
-  local dst list path key index=0
+  local dst list path key index=0 parent parent_list parent_status
+  local -A recorded_parents=()
  if ! state_validate_target_paths; then
    fail "P1 Preflight refused snapshot creation: $STATE_PATH_REASON"
    return 1
@@ -871,7 +1006,9 @@ state_snapshot_create() {
  STATE_SNAPSHOT_DIR="$STATE_RUN_DIR/snapshot"
  mkdir -p "$STATE_SNAPSHOT_DIR/data"
  list="$STATE_SNAPSHOT_DIR/paths.tsv"
+  parent_list="$STATE_SNAPSHOT_DIR/parents.tsv"
  : > "$list"
+  : > "$parent_list"
  for path in "$MOSAIC_HOME" "$PREFIX" "$HOME/.npmrc" "$HOME/.bashrc" "$HOME/.bash_profile" \
    "$HOME/.profile" "$HOME/.zshrc" "$HOME/.config/fish/config.fish" "$HOME/.claude" \
    "$HOME/.pi" "$HOME/.codex" "$HOME/.config/opencode" "$HOME/.config/mosaic-gateway" \
@@ -886,12 +1023,22 @@ state_snapshot_create() {
    else
      printf 'absent\t%s\t%s\n' "$path" "$key" >> "$list"
    fi
+    parent="$(dirname "$path")"
+    while [[ "$parent" != "$HOME" && "$parent" == "$HOME"/* ]]; do
+      if [[ -z "${recorded_parents[$parent]:-}" ]]; then
+        recorded_parents[$parent]=1
+        parent_status=absent
+        [[ -d "$parent" ]] && parent_status=present
+        printf '%s\t%s\n' "$parent_status" "$parent" >> "$parent_list"
+      fi
+      parent="$(dirname "$parent")"
+    done
  done
  state_json_line snapshot P1 committed "pre-install snapshot=$STATE_SNAPSHOT_DIR"
 }

 state_snapshot_restore() {
-  local status target key saved
+  local status target key saved parent
  [[ -s "$STATE_SNAPSHOT_DIR/paths.tsv" ]] || return 1
  while IFS=$'\t' read -r status target key; do
    [[ -n "$target" ]] || continue
@@ -906,6 +1053,19 @@ state_snapshot_restore() {
      cp -a "$saved" "$target" || return
    fi
  done < "$STATE_SNAPSHOT_DIR/paths.tsv"
+  # Mutating a previously absent nested target can leave empty parents behind
+  # after the target itself is restored. Remove only parents proven absent in
+  # the pre-install snapshot; repeated passes handle arbitrary nesting without
+  # depending on GNU tac/sort behavior.
+  if [[ -s "$STATE_SNAPSHOT_DIR/parents.tsv" ]]; then
+    for _ in {1..16}; do
+      while IFS=$'\t' read -r status parent; do
+        [[ "$status" == absent ]] || continue
+        [[ "$parent" != "$HOME" && "$parent" == "$HOME"/* ]] || return 1
+        rmdir "$parent" 2>/dev/null || true
+      done < "$STATE_SNAPSHOT_DIR/parents.tsv"
+    done
+  fi
 }

 state_begin_install() {
@@ -980,44 +1140,19 @@ state_mark_resumable_failure() {
  echo "  Remediation: fix each named phase, then run this installer with --check; journal: $STATE_JOURNAL" >&2
 }

-state_self_test() {
-  local phase path
-  state_begin_install
-  state_snapshot_create
-  trap 'state_handle_unexpected_failure "$?" "$STATE_CURRENT_PHASE"' ERR INT TERM
-  for phase in P2 P3 P4 P5 P6 P7 P8; do
-    state_phase_begin "$phase"
-    case "$phase" in
-      P2) path="$MOSAIC_HOME/.selftest-artifact" ;;
-      P3) path="$PREFIX/bin/mosaic" ;;
-      P4) path="$MOSAIC_HOME/.selftest-framework" ;;
-      P5) path="$MOSAIC_HOME/SOUL.md" ;;
-      P6) path="$HOME/.claude/settings.json" ;;
-      P7) path="$MOSAIC_HOME/.selftest-service" ;;
-      P8) path="$HOME/.bashrc" ;;
-    esac
-    state_record_mutation "$phase" "$path" "restore representative path from $STATE_SNAPSHOT_DIR"
-    mkdir -p "$(dirname "$path")"
-    printf 'mutated-by-%s\n' "$phase" > "$path"
-    state_phase_finish "$phase" committed "representative mutation committed"
-    if [[ "${MOSAIC_INSTALL_FAULT_AFTER:-}" == "$phase" ]]; then
-      state_json_line fault "$phase" injected "phase=$phase"
-      echo "Injected installer fault: phase=$phase" >&2
-      state_snapshot_restore
-      state_json_line install "$phase" rolled-back "fault injection restored pre-install snapshot"
-      state_write_active "$(printf '{\"status\":\"rolled-back\",\"phase\":\"%s\",\"journal\":\"%s\"}' "$phase" "$STATE_JOURNAL")"
-      exit 97
-    fi
-  done
-  fail "self-test requires MOSAIC_INSTALL_FAULT_AFTER=P2..P8"
-  exit 2
+state_maybe_inject_fault() {
+  local phase="$1"
+  [[ "${MOSAIC_INSTALL_FAULT_AFTER:-}" == "$phase" ]] || return 0
+  state_json_line fault "$phase" injected "phase=$phase after real phase action"
+  echo "Injected installer fault after real action: phase=$phase" >&2
+  state_handle_unexpected_failure 97 "$phase"
 }

 resolve_source_commit() {
  local encoded_ref body headers content_type
  encoded_ref="$(node -p 'encodeURIComponent(process.argv[1])' "$GIT_REF")"
-  body="$(mktemp "${TMPDIR:-/tmp}/mosaic-ref.XXXXXX.json")" || return
-  headers="$(mktemp "${TMPDIR:-/tmp}/mosaic-ref.XXXXXX.headers")" || { rm -f "$body"; return 1; }
+  body="$(mktemp "${TMPDIR:-/tmp}/mosaic-ref-body.XXXXXX")" || return
+  headers="$(mktemp "${TMPDIR:-/tmp}/mosaic-ref-headers.XXXXXX")" || { rm -f "$body"; return 1; }
  if ! curl -fsSL -D "$headers" -o "$body" \
    "https://git.mosaicstack.dev/api/v1/repos/mosaicstack/stack/commits?sha=${encoded_ref}&limit=1"; then
    rm -f "$body" "$headers"
@@ -1132,13 +1267,25 @@ PY
  tar xzf "$archive" -C "$WORK_DIR" || return
  state_json_line artifact P2 committed "lane=$GIT_REF source_commit=$RESOLVED_SOURCE_COMMIT sha256=$RESOLVED_SOURCE_DIGEST" || return

-  # Gitea archives extract to <repo-name>/ inside the work dir
-  EXTRACTED_DIR="$(find "$WORK_DIR" -maxdepth 1 -mindepth 1 -type d | head -1)" || return
-  if [[ -z "$EXTRACTED_DIR" ]] || [[ ! -d "$EXTRACTED_DIR" ]]; then
-    fail "Could not locate extracted source in archive."
-    ls -la "$WORK_DIR" >&2 || true # Diagnostic only; the named P2 failure is authoritative.
+  # Gitea archives must extract to exactly one <repo-name>/ directory. Capture
+  # and check the complete walk before selecting it: `find | head -1` both hides
+  # a failed enumeration and makes multiple roots depend on filesystem order.
+  local extracted_roots_file
+  local -a extracted_roots=()
+  extracted_roots_file="$(mktemp)" \
+    || { fail "P2 Acquire artifacts failed: could not stage extracted-root inventory."; return 1; }
+  if ! find "$WORK_DIR" -maxdepth 1 -mindepth 1 -type d -print0 > "$extracted_roots_file"; then
+    rm -f "$extracted_roots_file"
+    fail "P2 Acquire artifacts failed: could not enumerate extracted source roots."
    return 1
  fi
+  mapfile -d '' -t extracted_roots < "$extracted_roots_file"
+  rm -f "$extracted_roots_file"
+  if [[ "${#extracted_roots[@]}" -ne 1 ]] || [[ ! -d "${extracted_roots[0]:-}" ]]; then
+    fail "P2 Acquire artifacts failed: expected exactly one extracted source root; found ${#extracted_roots[@]}."
+    return 1
+  fi
+  EXTRACTED_DIR="${extracted_roots[0]}"
 }

 # Build @mosaicstack/mosaic + @mosaicstack/gateway from source and install both
@@ -1252,9 +1399,10 @@ install_next_cli_from_registry() {
 # ─── preflight / state-machine dispatch ──────────────────────────────────────

 if [[ "$FLAG_STATE_SELF_TEST" == "true" ]]; then
-  require_cmd node
-  require_cmd flock
-  state_self_test
+  if [[ "${MOSAIC_INSTALL_SELF_TEST_ALLOW:-0}" != 1 || ! "${MOSAIC_INSTALL_FAULT_AFTER:-}" =~ ^P[2-8]$ ]]; then
+    fail "state-machine self-test requires MOSAIC_INSTALL_SELF_TEST_ALLOW=1 and MOSAIC_INSTALL_FAULT_AFTER=P2..P8"
+    exit 2
+  fi
 fi

 # `--check` exits before mkdir, npm-prefix setup, locks, snapshots, downloads, or
@@ -1306,6 +1454,9 @@ state_phase_finish P0 committed "$P0_REASON"
 state_phase_finish P1 committed "$P1_REASON; exclusive lock acquired; journal opened"
 state_snapshot_create
 trap 'state_handle_unexpected_failure "$?" "$STATE_CURRENT_PHASE"' ERR INT TERM
+if [[ "${MOSAIC_INSTALL_REDACTION_PROBE:-0}" == 1 ]]; then
+  state_run_captured "credential redaction acceptance probe" state_redaction_probe
+fi

 state_phase_begin P2
 state_record_mutation P2 "$STATE_RUN_DIR/work" "discard acquired temporary artifacts"
@@ -1322,6 +1473,7 @@ if [[ "$FLAG_FRAMEWORK" == "true" || "$FLAG_DEV" == "true" ]]; then
  state_run_captured "P2 acquire pinned source archive" ensure_monorepo
 fi
 state_phase_finish P2 committed "lane=$([[ "$FLAG_NEXT" == true ]] && echo next || echo latest) cli_version=${RESOLVED_CLI_VERSION:-pending-source-package-build} source_commit=${RESOLVED_SOURCE_COMMIT:-deferred-until-source-fallback} sha256=${RESOLVED_SOURCE_DIGEST:-deferred-until-source-fallback}"
+state_maybe_inject_fault P2

 # ═══════════════════════════════════════════════════════════════════════════════
 # PART 1: Framework (bash launcher + guides + runtime configs + tools)
@@ -1366,6 +1518,7 @@ if [[ "$FLAG_FRAMEWORK" == "true" ]]; then
    # Run the framework's own install.sh (handles keep/overwrite for SOUL.md etc.)
    info "Installing framework to ${MOSAIC_HOME}…"
    MOSAIC_INSTALL_MODE="${MOSAIC_INSTALL_MODE:-keep}" \
+      MOSAIC_CLI_PATH="$PREFIX/bin/mosaic" \
      MOSAIC_ALLOW_MISSING_SEQUENTIAL_THINKING=1 \
      MOSAIC_SKIP_SKILLS_SYNC="${MOSAIC_SKIP_SKILLS_SYNC:-0}" \
      bash "$FRAMEWORK_SRC/install.sh" || return
@@ -1539,6 +1692,7 @@ else
  fail "P3 Install CLI failed: $STATE_REASON"
  false
 fi
+state_maybe_inject_fault P3

 state_phase_begin P4
 if [[ "$FLAG_FRAMEWORK" == "true" ]]; then
@@ -1550,6 +1704,7 @@ if [[ "$FLAG_FRAMEWORK" == "true" ]]; then
  state_record_mutation P4 "$HOME/.local/state/mosaic/backups" "restore framework backup state from $STATE_SNAPSHOT_DIR"
  state_record_mutation P6 "$HOME/.claude/settings.json" "restore activation settings from $STATE_SNAPSHOT_DIR"
 fi
+export MOSAIC_CLI_PATH="$PREFIX/bin/mosaic"
 state_run_captured "P4 install framework and skills; P6 evaluate activation" install_phase_p4_action
 if [[ "$FLAG_FRAMEWORK" == "false" ]]; then
  state_phase_finish P4 not-requested "framework component excluded by --cli"
@@ -1560,6 +1715,7 @@ else
  # absent. Keep the partial state for P5-P8 diagnostics; P9 fails non-zero.
  state_phase_finish P4 failed-resumable "$STATE_REASON"
 fi
+state_maybe_inject_fault P4

 # P5/P7 actions (wizard/service requests) live in the summary flow below and
 # bind their mutation records immediately before the wizard executes. P8 is
@@ -1579,7 +1735,7 @@ if [[ "$FLAG_CHECK" == "false" ]]; then
  # First install guidance / auto-launch
  if [[ ! -f "$MOSAIC_HOME/SOUL.md" ]]; then
    echo ""
-    if [[ "$FLAG_NO_AUTO_LAUNCH" == "false" ]] && [[ -t 0 ]] && [[ -t 1 ]]; then
+    if [[ "$FLAG_NO_AUTO_LAUNCH" == "false" ]] && { { [[ -t 0 ]] && [[ -t 1 ]]; } || [[ "$FLAG_STATE_SELF_TEST" == true ]]; }; then
      # Interactive TTY and auto-launch not suppressed: run the unified wizard.
      # `mosaic wizard` now runs the full first-run flow end-to-end: identity
      # setup → runtimes → hooks preview → skills → finalize → gateway
@@ -1589,15 +1745,11 @@ if [[ "$FLAG_CHECK" == "false" ]]; then

      MOSAIC_BIN="$PREFIX/bin/mosaic"

-      if ! command -v "$MOSAIC_BIN" &>/dev/null && ! command -v mosaic &>/dev/null; then
-        warn "mosaic binary not found on PATH — skipping auto-launch."
-        warn "Add $PREFIX/bin to PATH and run: mosaic wizard"
+      if [[ ! -x "$MOSAIC_BIN" ]]; then
+        warn "P3 absolute mosaic binary is unavailable — skipping auto-launch."
+        warn "Repair $MOSAIC_BIN and run it with: $MOSAIC_BIN wizard"
      else
-        # Prefer the absolute path from the prefix we just installed to
-        MOSAIC_CMD="mosaic"
-        if [[ -x "$MOSAIC_BIN" ]]; then
-          MOSAIC_CMD="$MOSAIC_BIN"
-        fi
+        MOSAIC_CMD="$MOSAIC_BIN"

        state_record_mutation P5 "$MOSAIC_HOME/SOUL.md" "restore identity from $STATE_SNAPSHOT_DIR"
        state_record_mutation P5 "$MOSAIC_HOME/USER.md" "restore identity from $STATE_SNAPSHOT_DIR"
@@ -1741,6 +1893,7 @@ if [[ "$FLAG_CHECK" == "false" ]]; then
    else
      state_phase_finish "$phase" failed-resumable "$STATE_REASON"
    fi
+    state_maybe_inject_fault "$phase"
  done

  echo ""
@@ -0,0 +1 @@
+e59cb441a2f37ae9150f8eae470238e9d858a1816df93343d9784a6796676096  install.sh
@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+# Fail-closed filesystem-enumeration assertions for shell test harnesses.
+
+# Usage: test_assert_find_empty <label> <find arguments...>
+test_assert_find_empty() {
+  local label="$1"
+  shift
+  local inventory
+
+  inventory="$(mktemp "${TMPDIR:-/tmp}/mosaic-test-find.XXXXXX")" || {
+    printf '[test] ERROR: %s inventory allocation failed\n' "$label" >&2
+    return 2
+  }
+
+  if ! find "$@" -print0 > "$inventory"; then
+    rm -f "$inventory"
+    printf '[test] ERROR: %s enumeration failed\n' "$label" >&2
+    return 2
+  fi
+
+  if [[ -s "$inventory" ]]; then
+    rm -f "$inventory"
+    printf '[test] FAIL: %s was not empty\n' "$label" >&2
+    return 1
+  fi
+
+  rm -f "$inventory"
+  return 0
+}
+
+# Usage: test_assert_no_file_content_match <label> <extended-regex> <find roots/options...>
+test_assert_no_file_content_match() {
+  local label="$1"
+  local pattern="$2"
+  shift 2
+  local inventory path grep_status result=0
+
+  inventory="$(mktemp "${TMPDIR:-/tmp}/mosaic-test-find.XXXXXX")" || {
+    printf '[test] ERROR: %s inventory allocation failed\n' "$label" >&2
+    return 2
+  }
+
+  if ! find "$@" -type f -print0 > "$inventory"; then
+    rm -f "$inventory"
+    printf '[test] ERROR: %s enumeration failed\n' "$label" >&2
+    return 2
+  fi
+
+  while IFS= read -r -d '' path; do
+    grep_status=0
+    grep -Eq -- "$pattern" "$path" || grep_status=$?
+    if [[ "$grep_status" -eq 0 ]]; then
+      result=1
+      break
+    fi
+    if [[ "$grep_status" -ne 1 ]]; then
+      result=2
+      break
+    fi
+  done < "$inventory"
+
+  rm -f "$inventory"
+  if [[ "$result" -eq 1 ]]; then
+    printf '[test] FAIL: %s contained a forbidden match\n' "$label" >&2
+    return 1
+  fi
+  if [[ "$result" -eq 2 ]]; then
+    printf '[test] ERROR: %s content inspection failed\n' "$label" >&2
+    return 2
+  fi
+  return 0
+}
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# Fetch, authenticate, and execute the exact downloaded installer body.
+set -euo pipefail
+url="${1:?usage: verified-installer-fetch.sh <url> <sha256> [-- installer-args...]}"
+expected="${2:?usage: verified-installer-fetch.sh <url> <sha256> [-- installer-args...]}"
+shift 2
+[[ "${1:-}" != -- ]] || shift
+[[ "$expected" =~ ^[0-9a-f]{64}$ ]] || { echo 'installer expected SHA-256 must be 64 lowercase hex characters' >&2; exit 2; }
+tmp="$(mktemp "${TMPDIR:-/tmp}/mosaic-installer-body.XXXXXX")"
+trap 'rm -f "$tmp"' EXIT
+chmod 0600 "$tmp"
+curl -fsSL "$url" -o "$tmp"
+[[ -s "$tmp" ]] || { echo 'installer fetch returned an empty HTTP-success body' >&2; exit 1; }
+actual="$(sha256sum "$tmp" | awk '{print $1}')"
+[[ "$actual" == "$expected" ]] || { echo "installer SHA-256 mismatch (got=$actual expected=$expected)" >&2; exit 1; }
+status=0
+bash "$tmp" "$@" || status=$?
+rm -f "$tmp"
+trap - EXIT
+exit "$status"
@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+set -euo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# shellcheck source=tools/test-enumeration-assertions.sh
+source "$ROOT/tools/test-enumeration-assertions.sh"
+TMP="$(mktemp -d "${TMPDIR:-/tmp}/mosaic-fetch-contract.XXXXXX")"
+trap 'rm -rf "$TMP"' EXIT
+FAKE_BIN="$TMP/bin"; mkdir -p "$FAKE_BIN"
+cat > "$FAKE_BIN/curl" <<'CURL'
+#!/usr/bin/env bash
+set -euo pipefail
+url=""; output=""
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    -o) output="$2"; shift 2 ;;
+    -*) shift ;;
+    *) url="$1"; shift ;;
+  esac
+done
+emit() { if [[ -n "$output" ]]; then cat > "$output"; else cat; fi; }
+case "$url" in
+  fixture://ok)
+    emit <<'SCRIPT'
+#!/usr/bin/env bash
+set -euo pipefail
+printf 'executed:%s\n' "${1:-missing}"
+SCRIPT
+    ;;
+  fixture://empty) : > "$output" ;;
+  fixture://failed) exit 22 ;;
+  *) exit 2 ;;
+esac
+CURL
+chmod 0755 "$FAKE_BIN/curl"
+cat > "$TMP/ok.sh" <<'SCRIPT'
+#!/usr/bin/env bash
+set -euo pipefail
+printf 'executed:%s\n' "${1:-missing}"
+SCRIPT
+ok_sha="$(sha256sum "$TMP/ok.sh" | awk '{print $1}')"
+empty_sha="$(printf '' | sha256sum | awk '{print $1}')"
+
+mkdir -p "$TMP/downloads"
+output="$(TMPDIR="$TMP/downloads" PATH="$FAKE_BIN:$PATH" bash "$ROOT/tools/verified-installer-fetch.sh" fixture://ok "$ok_sha" -- marker)"
+[[ "$output" == 'executed:marker' ]]
+test_assert_find_empty 'verified-installer temporary downloads' "$TMP/downloads" -mindepth 1
+printf '[test] PASS: digest-pinned fetched artifact executes and its temporary body is removed\n'
+
+for row in 'fixture://empty empty-body' 'fixture://failed failed-fetch'; do
+  url="${row%% *}"; name="${row#* }"
+  set +e
+  PATH="$FAKE_BIN:$PATH" bash "$ROOT/tools/verified-installer-fetch.sh" "$url" "$empty_sha" -- marker \
+    >"$TMP/$name.log" 2>&1
+  status=$?
+  set -e
+  [[ "$status" -ne 0 ]] || { echo "[test] FAIL: $name certified success" >&2; exit 1; }
+done
+printf '[test] PASS: failed fetch and HTTP-200 empty body are both rejected\n'
+
+set +e
+PATH="$FAKE_BIN:$PATH" bash "$ROOT/tools/verified-installer-fetch.sh" fixture://ok "${ok_sha/0/1}" -- marker \
+  >"$TMP/mismatch.log" 2>&1
+status=$?
+set -e
+[[ "$status" -ne 0 ]] || { echo '[test] FAIL: digest mismatch was accepted' >&2; exit 1; }
+printf '[test] PASS: fetched installer digest mismatch is blocking\n'
@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  echo "usage: $0 <coverage-checker> <case-manifest> <arm-manifest> <state-root> <run-id>" >&2
+}
+
+[[ "$#" -eq 5 ]] || { usage; exit 2; }
+checker="$1"
+case_manifest="$2"
+arm_manifest="$3"
+state_root="$4"
+run_id="$5"
+
+[[ -f "$checker" ]] \
+  || { echo "[fixture-suite] coverage checker missing: $checker" >&2; exit 2; }
+
+set +e
+bash "$checker" check cases "$case_manifest" "$state_root" "$run_id"
+cases_status=$?
+bash "$checker" check arms "$arm_manifest" "$state_root" "$run_id"
+arms_status=$?
+set -e
+
+if [ "$cases_status" -ne 0 ] || [ "$arms_status" -ne 0 ]; then
+  exit 1
+fi
@@ -0,0 +1,108 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  echo "usage: $0 <init|mark|check> <cases|arms> <expected-set> <state-root> <run-id> [name]" >&2
+}
+
+[[ "$#" -ge 5 ]] || { usage; exit 2; }
+mode="$1"
+dimension="$2"
+expected_set="$3"
+state_root="$4"
+run_id="$5"
+name="${6:-}"
+
+[[ "$dimension" == cases || "$dimension" == arms ]] \
+  || { echo "[fixture-suite] invalid coverage dimension: $dimension" >&2; exit 2; }
+[[ -s "$expected_set" ]] \
+  || { echo "[fixture-suite] expected set missing or empty: $expected_set" >&2; exit 2; }
+[[ -n "$state_root" && "$state_root" != / ]] \
+  || { echo "[fixture-suite] unsafe state root" >&2; exit 2; }
+[[ "$run_id" =~ ^[A-Za-z0-9][A-Za-z0-9._-]*$ ]] \
+  || { echo "[fixture-suite] invalid run id: $run_id" >&2; exit 2; }
+
+singular="${dimension%s}"
+run_dir="$state_root/$run_id/$dimension"
+
+expected_names() {
+  awk -F '\t' 'NF && $0 !~ /^[[:space:]]*#/ && !seen[$1]++ { sub(/\r$/, "", $1); print $1 }' \
+    "$expected_set" | LC_ALL=C sort
+}
+
+validate_expected_names() {
+  local found=0 expected
+  while IFS= read -r expected; do
+    [[ -n "$expected" ]] || continue
+    found=1
+    [[ "$expected" =~ ^[A-Za-z0-9][A-Za-z0-9._-]*$ ]] \
+      || { echo "[fixture-suite] invalid expected $singular name: $expected" >&2; return 1; }
+  done < <(expected_names)
+  [[ "$found" -eq 1 ]] \
+    || { echo "[fixture-suite] expected set defines no $dimension" >&2; return 1; }
+}
+
+validate_expected_names
+
+case "$mode" in
+  init)
+    [[ "$#" -eq 5 ]] || { usage; exit 2; }
+    mkdir -p "$run_dir"
+    find "$run_dir" -mindepth 1 -delete
+    ;;
+  mark)
+    [[ "$#" -eq 6 ]] || { usage; exit 2; }
+    [[ "$name" =~ ^[A-Za-z0-9][A-Za-z0-9._-]*$ ]] \
+      || { echo "[fixture-suite] invalid $singular marker name: $name" >&2; exit 2; }
+    [[ -d "$run_dir" ]] \
+      || { echo "[fixture-suite] $dimension state was not initialized: $run_id" >&2; exit 1; }
+    if ! expected_snapshot="$(expected_names)"; then
+      echo "[fixture-suite] failed to read expected $dimension" >&2
+      exit 1
+    fi
+    grep -Fxq -- "$name" <<<"$expected_snapshot" \
+      || { echo "[fixture-suite] $singular is not in the expected set: $name" >&2; exit 1; }
+    : > "$run_dir/$name.ran"
+    ;;
+  check)
+    [[ "$#" -eq 5 ]] || { usage; exit 2; }
+    mkdir -p "$run_dir"
+    expected_file="$(mktemp "$run_dir/.expected.XXXXXX")"
+    actual_file="$(mktemp "$run_dir/.actual.XXXXXX")"
+    cleanup() { rm -f "$expected_file" "$actual_file"; }
+    trap cleanup EXIT
+
+    expected_names > "$expected_file"
+    [[ -r "$run_dir" && -x "$run_dir" ]] \
+      || { echo "[fixture-suite] coverage state is not readable: $run_dir" >&2; exit 1; }
+    (
+      shopt -s nullglob dotglob
+      for marker in "$run_dir"/*.ran; do
+        [[ -f "$marker" && ! -L "$marker" ]] || continue
+        marker_name="${marker##*/}"
+        printf '%s\n' "${marker_name%.ran}"
+      done
+    ) | LC_ALL=C sort -u > "$actual_file"
+
+    defined="$(wc -l < "$expected_file" | tr -d ' ')"
+    executed="$(wc -l < "$actual_file" | tr -d ' ')"
+    printf '[fixture-suite] %s_defined=%s %s_executed=%s\n' \
+      "$dimension" "$defined" "$dimension" "$executed"
+
+    if ! cmp -s "$expected_file" "$actual_file"; then
+      while IFS= read -r missing; do
+        [[ -n "$missing" ]] \
+          && printf '[fixture-suite] missing_%s=%s\n' "$singular" "$missing" >&2
+      done < <(comm -23 "$expected_file" "$actual_file")
+      while IFS= read -r unexpected; do
+        [[ -n "$unexpected" ]] \
+          && printf '[fixture-suite] unexpected_%s=%s\n' "$singular" "$unexpected" >&2
+      done < <(comm -13 "$expected_file" "$actual_file")
+      exit 1
+    fi
+    ;;
+  *)
+    usage
+    exit 2
+    ;;
+esac
@@ -0,0 +1,297 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+SUBJECT="${GREENFIELD_COVERAGE_SUBJECT:-$ROOT/tools/verify-greenfield-execution-coverage.sh}"
+GATE="${GREENFIELD_COVERAGE_GATE:-$ROOT/tools/verify-greenfield-execution-coverage-gate.sh}"
+WORKFLOW="$ROOT/.woodpecker/greenfield-install.yml"
+INSTALLER="${GREENFIELD_E2E_INSTALLER:-$ROOT/tools/e2e-install-test.sh}"
+mkdir -p "$ROOT/.mosaic-test-work"
+TMP="$(mktemp -d "$ROOT/.mosaic-test-work/execution-coverage.XXXXXX")"
+selector_control="$ROOT/greenfield-coverage-selector-control.ran"
+cleanup() {
+  rm -f "$selector_control"
+  rm -rf "$TMP"
+}
+trap cleanup EXIT
+
+manifest="$TMP/expected-red.tsv"
+state_root="$TMP/state"
+run_id="pipeline-1"
+printf '%s\n' \
+  '# representative manifest comment' \
+  $'# case\tkind\tkey/value' \
+  '' \
+  $'next-git-present\texit\t1' \
+  $'main-git-present\texit\t1' \
+  $'next-git-absent\texit\t1' > "$manifest"
+
+bash "$SUBJECT" init cases "$manifest" "$state_root" "$run_id"
+
+# Positive firing control: a skipped expected case makes the final gate red.
+bash "$SUBJECT" mark cases "$manifest" "$state_root" "$run_id" next-git-present
+bash "$SUBJECT" mark cases "$manifest" "$state_root" "$run_id" main-git-present
+set +e
+skipped_output="$(bash "$SUBJECT" check cases "$manifest" "$state_root" "$run_id" 2>&1)"
+skipped_status=$?
+set -e
+[[ "$skipped_status" -eq 1 ]]
+grep -qF '[fixture-suite] cases_defined=3 cases_executed=2' <<<"$skipped_output"
+grep -qF '[fixture-suite] missing_case=next-git-absent' <<<"$skipped_output"
+
+# Count inflation cannot pass: equal counts with one missing and one unexpected remain red.
+: > "$state_root/$run_id/cases/unexpected-case.ran"
+set +e
+inflated_output="$(bash "$SUBJECT" check cases "$manifest" "$state_root" "$run_id" 2>&1)"
+inflated_status=$?
+set -e
+[[ "$inflated_status" -eq 1 ]]
+grep -qF '[fixture-suite] cases_defined=3 cases_executed=3' <<<"$inflated_output"
+grep -qF '[fixture-suite] missing_case=next-git-absent' <<<"$inflated_output"
+grep -qF '[fixture-suite] unexpected_case=unexpected-case' <<<"$inflated_output"
+
+# Re-initializing the same run clears stale markers instead of certifying a later run.
+bash "$SUBJECT" init cases "$manifest" "$state_root" "$run_id"
+set +e
+stale_output="$(bash "$SUBJECT" check cases "$manifest" "$state_root" "$run_id" 2>&1)"
+stale_status=$?
+set -e
+[[ "$stale_status" -eq 1 ]]
+grep -qF '[fixture-suite] cases_defined=3 cases_executed=0' <<<"$stale_output"
+
+# Exact case-set equality is green.
+for case_name in next-git-present main-git-present next-git-absent; do
+  bash "$SUBJECT" mark cases "$manifest" "$state_root" "$run_id" "$case_name"
+done
+complete_output="$(bash "$SUBJECT" check cases "$manifest" "$state_root" "$run_id")"
+grep -qF '[fixture-suite] cases_defined=3 cases_executed=3' <<<"$complete_output"
+
+# A successful early match must consume the full producer and remain green under pipefail.
+large_manifest="$TMP/large-expected.tsv"
+awk 'BEGIN {
+  print "a-target\texit\t1"
+  for (i = 0; i < 20000; i++) printf "z-case-%05d\texit\t1\n", i
+}' > "$large_manifest"
+bash "$SUBJECT" init cases "$large_manifest" "$state_root" large-set
+bash "$SUBJECT" mark cases "$large_manifest" "$state_root" large-set a-target
+
+# The production manifest, including comments, initializes and checks.
+production_manifest="$ROOT/tools/fixtures/greenfield-expected-red.tsv"
+production_arms="$ROOT/tools/fixtures/greenfield-expected-arms.txt"
+production_state="$TMP/production-state"
+bash "$SUBJECT" init cases "$production_manifest" "$production_state" production-1
+for case_name in next-git-present main-git-present next-git-absent; do
+  bash "$SUBJECT" mark cases "$production_manifest" "$production_state" production-1 "$case_name"
+done
+production_output="$(bash "$SUBJECT" check cases "$production_manifest" "$production_state" production-1)"
+grep -qF '[fixture-suite] cases_defined=3 cases_executed=3' <<<"$production_output"
+
+mark_all_cases() {
+  local root="$1" run="$2"
+  for case_name in next-git-present main-git-present next-git-absent; do
+    bash "$SUBJECT" mark cases "$production_manifest" "$root" "$run" "$case_name"
+  done
+}
+
+mark_all_arms() {
+  local root="$1" run="$2"
+  for arm_name in \
+    greenfield-git-present \
+    greenfield-main-git-present \
+    greenfield-remote-installer-contract \
+    greenfield-git-absent; do
+    bash "$SUBJECT" mark arms "$production_arms" "$root" "$run" "$arm_name"
+  done
+}
+
+gate_state="$TMP/gate-state"
+gate_run="truth-table"
+
+# Final aggregation truth table: cases PASS / arms FAIL is red.
+bash "$SUBJECT" init cases "$production_manifest" "$gate_state" "$gate_run"
+bash "$SUBJECT" init arms "$production_arms" "$gate_state" "$gate_run"
+mark_all_cases "$gate_state" "$gate_run"
+for arm_name in greenfield-git-present greenfield-main-git-present greenfield-git-absent; do
+  bash "$SUBJECT" mark arms "$production_arms" "$gate_state" "$gate_run" "$arm_name"
+done
+set +e
+gate_cases_pass_output="$(bash "$GATE" "$SUBJECT" "$production_manifest" "$production_arms" "$gate_state" "$gate_run" 2>&1)"
+gate_cases_pass_status=$?
+set -e
+[[ "$gate_cases_pass_status" -eq 1 ]]
+grep -qF '[fixture-suite] cases_defined=3 cases_executed=3' <<<"$gate_cases_pass_output"
+grep -qF '[fixture-suite] arms_defined=4 arms_executed=3' <<<"$gate_cases_pass_output"
+grep -qF '[fixture-suite] missing_arm=greenfield-remote-installer-contract' <<<"$gate_cases_pass_output"
+
+# Final aggregation truth table: cases FAIL / arms PASS is red.
+bash "$SUBJECT" init cases "$production_manifest" "$gate_state" "$gate_run"
+bash "$SUBJECT" init arms "$production_arms" "$gate_state" "$gate_run"
+for case_name in next-git-present main-git-present; do
+  bash "$SUBJECT" mark cases "$production_manifest" "$gate_state" "$gate_run" "$case_name"
+done
+mark_all_arms "$gate_state" "$gate_run"
+set +e
+gate_arms_pass_output="$(bash "$GATE" "$SUBJECT" "$production_manifest" "$production_arms" "$gate_state" "$gate_run" 2>&1)"
+gate_arms_pass_status=$?
+set -e
+[[ "$gate_arms_pass_status" -eq 1 ]]
+grep -qF '[fixture-suite] cases_defined=3 cases_executed=2' <<<"$gate_arms_pass_output"
+grep -qF '[fixture-suite] missing_case=next-git-absent' <<<"$gate_arms_pass_output"
+grep -qF '[fixture-suite] arms_defined=4 arms_executed=4' <<<"$gate_arms_pass_output"
+
+# Final aggregation truth table: both FAIL emits both failures and is red.
+bash "$SUBJECT" init cases "$production_manifest" "$gate_state" "$gate_run"
+bash "$SUBJECT" init arms "$production_arms" "$gate_state" "$gate_run"
+for case_name in next-git-present main-git-present; do
+  bash "$SUBJECT" mark cases "$production_manifest" "$gate_state" "$gate_run" "$case_name"
+done
+for arm_name in greenfield-git-present greenfield-main-git-present greenfield-git-absent; do
+  bash "$SUBJECT" mark arms "$production_arms" "$gate_state" "$gate_run" "$arm_name"
+done
+set +e
+gate_both_fail_output="$(bash "$GATE" "$SUBJECT" "$production_manifest" "$production_arms" "$gate_state" "$gate_run" 2>&1)"
+gate_both_fail_status=$?
+set -e
+[[ "$gate_both_fail_status" -eq 1 ]]
+grep -qF '[fixture-suite] missing_case=next-git-absent' <<<"$gate_both_fail_output"
+grep -qF '[fixture-suite] missing_arm=greenfield-remote-installer-contract' <<<"$gate_both_fail_output"
+
+# Final aggregation truth table: both PASS is green.
+bash "$SUBJECT" init cases "$production_manifest" "$gate_state" "$gate_run"
+bash "$SUBJECT" init arms "$production_arms" "$gate_state" "$gate_run"
+mark_all_cases "$gate_state" "$gate_run"
+mark_all_arms "$gate_state" "$gate_run"
+gate_both_pass_output="$(bash "$GATE" "$SUBJECT" "$production_manifest" "$production_arms" "$gate_state" "$gate_run")"
+grep -qF '[fixture-suite] cases_defined=3 cases_executed=3' <<<"$gate_both_pass_output"
+grep -qF '[fixture-suite] arms_defined=4 arms_executed=4' <<<"$gate_both_pass_output"
+
+# A future manifest case changes the derived set and cannot silently escape coverage.
+printf '%s\n' $'future-case\texit\t1' >> "$manifest"
+set +e
+future_output="$(bash "$SUBJECT" check cases "$manifest" "$state_root" "$run_id" 2>&1)"
+future_status=$?
+set -e
+[[ "$future_status" -eq 1 ]]
+grep -qF '[fixture-suite] cases_defined=4 cases_executed=3' <<<"$future_output"
+grep -qF '[fixture-suite] missing_case=future-case' <<<"$future_output"
+
+# A skipped remote arm is red even while the three case identities are complete.
+bash "$SUBJECT" init arms "$production_arms" "$production_state" production-1
+for arm_name in greenfield-git-present greenfield-main-git-present greenfield-git-absent; do
+  bash "$SUBJECT" mark arms "$production_arms" "$production_state" production-1 "$arm_name"
+done
+set +e
+remote_skipped_output="$(bash "$SUBJECT" check arms "$production_arms" "$production_state" production-1 2>&1)"
+remote_skipped_status=$?
+set -e
+[[ "$remote_skipped_status" -eq 1 ]]
+grep -qF '[fixture-suite] arms_defined=4 arms_executed=3' <<<"$remote_skipped_output"
+grep -qF '[fixture-suite] missing_arm=greenfield-remote-installer-contract' <<<"$remote_skipped_output"
+
+# Arm counts cannot be inflated either.
+: > "$production_state/production-1/arms/unexpected-arm.ran"
+set +e
+arm_inflated_output="$(bash "$SUBJECT" check arms "$production_arms" "$production_state" production-1 2>&1)"
+arm_inflated_status=$?
+set -e
+[[ "$arm_inflated_status" -eq 1 ]]
+grep -qF '[fixture-suite] arms_defined=4 arms_executed=4' <<<"$arm_inflated_output"
+grep -qF '[fixture-suite] missing_arm=greenfield-remote-installer-contract' <<<"$arm_inflated_output"
+grep -qF '[fixture-suite] unexpected_arm=unexpected-arm' <<<"$arm_inflated_output"
+
+# Exact arm-set equality is green.
+bash "$SUBJECT" init arms "$production_arms" "$production_state" production-1
+for arm_name in \
+  greenfield-git-present \
+  greenfield-main-git-present \
+  greenfield-remote-installer-contract \
+  greenfield-git-absent; do
+  bash "$SUBJECT" mark arms "$production_arms" "$production_state" production-1 "$arm_name"
+done
+arm_complete_output="$(bash "$SUBJECT" check arms "$production_arms" "$production_state" production-1)"
+grep -qF '[fixture-suite] arms_defined=4 arms_executed=4' <<<"$arm_complete_output"
+
+# Bind archive purity to the production checkout-archive selector before proving its effect.
+python3 - "$INSTALLER" <<'PY'
+import re
+import sys
+from pathlib import Path
+
+text = Path(sys.argv[1]).read_text(encoding="utf-8")
+archive = re.search(
+    r'(?ms)^  tar -C "\$repo_parent" \\\n(?P<selectors>.*?)^    -czf "\$checkout_archive" "\$repo_name"$',
+    text,
+)
+assert archive, "production checkout-archive command not found"
+assert "--exclude='*/.mosaic-test-work'" in archive.group("selectors"), (
+    "production checkout archive does not exclude .mosaic-test-work"
+)
+PY
+
+# The production-bound checkout-archive selector excludes coverage state under .mosaic-test-work.
+: > "$selector_control"
+archive="$TMP/checkout.tar.gz"
+archive_list="$TMP/checkout.list"
+repo_parent="$(dirname "$ROOT")"
+repo_name="$(basename "$ROOT")"
+tar -C "$repo_parent" \
+  --exclude='*/.git' --exclude='*/node_modules' --exclude='*/dist' \
+  --exclude='*/coverage' --exclude='*/.turbo' --exclude='*/.mosaic-test-work' \
+  --exclude='*/.env' --exclude='*/.env.*' \
+  -czf "$archive" "$repo_name"
+tar -tzf "$archive" > "$archive_list"
+grep -qF "$repo_name/greenfield-coverage-selector-control.ran" "$archive_list"
+if grep -qF "$repo_name/.mosaic-test-work/" "$archive_list"; then
+  echo 'coverage state leaked into checkout archive' >&2
+  exit 1
+fi
+
+# Workflow contract: success-only case+arm markers, excluded state root, and complete ordering.
+python3 - "$WORKFLOW" <<'PY'
+import re
+import sys
+from pathlib import Path
+
+text = Path(sys.argv[1]).read_text(encoding="utf-8")
+steps = {
+    match.group(1): match.group(2)
+    for match in re.finditer(r"(?ms)^  ([A-Za-z0-9_-]+):\n(.*?)(?=^  [A-Za-z0-9_-]+:\n|\Z)", text)
+}
+case_steps = (
+    ("greenfield-git-present", "next-git-present"),
+    ("greenfield-main-git-present", "main-git-present"),
+    ("greenfield-git-absent", "next-git-absent"),
+)
+for step, case in case_steps:
+    block = steps[step]
+    verify = block.index("bash tools/verify-greenfield-expected-red.sh")
+    mark = block.index(f'"$coverage_run" {case}')
+    assert verify < mark, f"{step} marks its case before successful verification"
+
+arm_steps = (
+    "greenfield-git-present",
+    "greenfield-main-git-present",
+    "greenfield-remote-installer-contract",
+    "greenfield-git-absent",
+)
+for step in arm_steps:
+    block = steps[step]
+    verify = block.index("bash tools/verify-greenfield-expected-red.sh")
+    mark = block.index(f'"$coverage_run" {step}')
+    assert verify < mark, f"{step} marks its arm before successful verification"
+    assert re.search(
+        r"(?m)^    depends_on:\n      - greenfield-case-denominator-init$", block
+    ), f"{step} can race marker initialization"
+
+assert ".greenfield-case-state" not in text
+assert ".mosaic-test-work/greenfield-execution-coverage" in text
+final = steps["greenfield-case-denominator"]
+assert "status: [success, failure]" in final
+assert "bash tools/verify-greenfield-execution-coverage-gate.sh" in final
+assert "check cases" not in final and "check arms" not in final
+assert "cases_status" not in final and "arms_status" not in final
+for dependency in arm_steps:
+    assert f"      - {dependency}\n" in final, f"final gate can race {dependency}"
+PY
+
+printf 'greenfield execution coverage tests passed\n'
@@ -13,6 +13,75 @@ FIXTURE_EXIT="${3:?usage: verify-greenfield-expected-red.sh <case> <log> <fixtur
 [[ -r "$LOG" ]] || { echo "fixture log is unreadable: $LOG" >&2; exit 2; }
 [[ "$FIXTURE_EXIT" =~ ^[0-9]+$ ]] || { echo "fixture exit is not numeric: $FIXTURE_EXIT" >&2; exit 2; }

+# Validate the entire pinned contract before selecting one case. Otherwise a
+# deleted case/phase silently disappears from the gate and a one-row manifest
+# can certify any exit-1 transcript.
+expected_cases=(next-git-present main-git-present next-git-absent)
+declare -A allowed_case=(
+  [next-git-present]=1 [main-git-present]=1 [next-git-absent]=1
+)
+declare -A expected_requires=(
+  [next-git-present]=6 [main-git-present]=6 [next-git-absent]=4
+)
+declare -A row_count=() exit_count=() require_count=() forbid_count=() phase_count=() phase_reason_count=() unique_rows=()
+while IFS= read -r raw; do
+  [[ -n "$raw" && "${raw:0:1}" != "#" ]] || continue
+  field_count="$(awk -F '\t' '{print NF}' <<<"$raw")"
+  [[ "$field_count" -eq 3 ]] || { echo "invalid expected-RED manifest row (expected exactly 3 tab fields): $raw" >&2; exit 2; }
+  IFS=$'\t' read -r case_name kind expectation <<<"$raw"
+  [[ -n "${allowed_case[$case_name]:-}" ]] || { echo "invalid expected-RED manifest case: $case_name" >&2; exit 2; }
+  unique_key="$case_name|$kind|$expectation"
+  [[ -z "${unique_rows[$unique_key]:-}" ]] || { echo "duplicate expected-RED manifest row: $raw" >&2; exit 2; }
+  unique_rows[$unique_key]=1
+  row_count[$case_name]=$((${row_count[$case_name]:-0} + 1))
+  case "$kind" in
+    exit)
+      [[ "$expectation" == 1 ]] || { echo "invalid expected-RED exit contract: case=$case_name expected=$expectation" >&2; exit 2; }
+      exit_count[$case_name]=$((${exit_count[$case_name]:-0} + 1))
+      ;;
+    phase)
+      [[ "$expectation" =~ ^(P[0-9])=(PASS|FAIL)$ ]] \
+        || { echo "invalid expected-RED phase disposition: case=$case_name value=$expectation" >&2; exit 2; }
+      phase="${BASH_REMATCH[1]}"
+      phase_key="$case_name|$phase"
+      phase_count[$phase_key]=$((${phase_count[$phase_key]:-0} + 1))
+      ;;
+    phase-reason)
+      [[ "$expectation" =~ ^P0=(.+)$ ]] \
+        || { echo "invalid expected-RED phase reason: case=$case_name value=$expectation" >&2; exit 2; }
+      phase_reason_count[$case_name|P0]=$((${phase_reason_count[$case_name|P0]:-0} + 1))
+      ;;
+    require)
+      [[ -n "$expectation" ]] || { echo "empty expected-RED require row: case=$case_name" >&2; exit 2; }
+      require_count[$case_name]=$((${require_count[$case_name]:-0} + 1))
+      ;;
+    forbid)
+      [[ -n "$expectation" ]] || { echo "empty expected-RED forbid row: case=$case_name" >&2; exit 2; }
+      forbid_count[$case_name]=$((${forbid_count[$case_name]:-0} + 1))
+      ;;
+    *) echo "invalid expected-RED manifest kind: case=$case_name kind=$kind" >&2; exit 2 ;;
+  esac
+done < "$MANIFEST"
+
+for case_name in "${expected_cases[@]}"; do
+  [[ "${exit_count[$case_name]:-0}" -eq 1 ]] \
+    || { echo "expected-RED manifest requires exactly one exit row for case=$case_name" >&2; exit 2; }
+  for phase in P0 P1 P2 P3 P4 P5 P6 P7 P8 P9; do
+    [[ "${phase_count[$case_name|$phase]:-0}" -eq 1 ]] \
+      || { echo "expected-RED manifest requires exactly one $phase disposition for case=$case_name" >&2; exit 2; }
+  done
+  [[ "${phase_reason_count[$case_name|P0]:-0}" -eq 1 ]] \
+    || { echo "expected-RED manifest requires exactly one P0 reason binding for case=$case_name" >&2; exit 2; }
+  [[ "${require_count[$case_name]:-0}" -eq "${expected_requires[$case_name]}" ]] \
+    || { echo "expected-RED manifest require-row population changed for case=$case_name" >&2; exit 2; }
+  [[ "${forbid_count[$case_name]:-0}" -eq 1 ]] \
+    || { echo "expected-RED manifest requires exactly one forbid row for case=$case_name" >&2; exit 2; }
+  expected_total=$((1 + 10 + 1 + expected_requires[$case_name] + 1))
+  [[ "${row_count[$case_name]:-0}" -eq "$expected_total" ]] \
+    || { echo "expected-RED manifest row population changed for case=$case_name" >&2; exit 2; }
+done
+[[ -n "${allowed_case[$CASE]:-}" ]] || { echo "unknown expected-RED verification case: $CASE" >&2; exit 2; }
+
 checks=0
 failures=0
 while IFS=$'\t' read -r case_name kind expectation; do
@@ -36,6 +105,16 @@ while IFS=$'\t' read -r case_name kind expectation; do
        failures=$((failures + 1))
      fi
      ;;
+    phase-reason)
+      phase="${expectation%%=*}"
+      expected_reason="${expectation#*=}"
+      last_row="$(grep -E "^\[$phase\] (PASS|FAIL):" "$LOG" | tail -n 1 || true)"
+      actual_reason="${last_row#*: }"
+      if [[ -z "$last_row" ]] || ! grep -Eq -- "^${expected_reason}$" <<<"$actual_reason"; then
+        echo "expected-RED phase reason mismatch: case=$CASE phase=$phase reason=${actual_reason:-missing}" >&2
+        failures=$((failures + 1))
+      fi
+      ;;
    require)
      if ! grep -Eq -- "$expectation" "$LOG"; then
        echo "expected-RED missing required evidence: case=$CASE regex=$expectation" >&2
@@ -7,13 +7,14 @@ trap 'rm -rf "$TMP"' EXIT
 cat > "$TMP/match.log" <<'LOG'
 [fixture] resolved lane=next package=@mosaicstack/mosaic@next version=0.0.50-next.999
 [fixture] installer_exit=1 done_claims=0
-[P0] PASS: supported context
+[SECRET-CONTROL] PASS: seeded canary absent from complete scan population
+[P0] PASS: target=mosaic uid=1001 HOME=/home/mosaic passwd_HOME=/home/mosaic shell=/bin/bash privilege=user arch=x86_64 libc=glibc node=v24.0.0 npm=10.6.2
 [P1] PASS: preflight complete
 [P2] PASS: pinned artifact
 [P3] PASS: absolute_path=/home/test/.npm-global/bin/mosaic version=0.0.50-next.999 equals resolved lane version
 [P4] FAIL: NOT-MEASURED / UNDECLARED: declaration absent
 [P5] FAIL: identity absent
-[P6] FAIL: activation unavailable
+[P6] FAIL: runtime linking/activation action reported a required failure
 [P7] PASS: no services requested
 [P8] FAIL: shell path absent
 [P9] FAIL: aggregate refusal
@@ -22,6 +23,13 @@ LOG
 bash "$ROOT/tools/verify-greenfield-expected-red.sh" next-git-present "$TMP/match.log" 1 >/dev/null
 printf '[test] PASS: matching detector findings make the CI verifier green\n'

+sed 's/^\[P0\] PASS:.*/[P0] PASS: arbitrary unconditional success/' "$TMP/match.log" > "$TMP/vacuous-p0.log"
+if bash "$ROOT/tools/verify-greenfield-expected-red.sh" next-git-present "$TMP/vacuous-p0.log" 1 >/dev/null 2>&1; then
+  echo '[test] FAIL: vacuous P0 PASS satisfied the expected-RED contract without identity/context evidence' >&2
+  exit 1
+fi
+printf '[test] PASS: P0 PASS must bind target identity, HOME, shell, privilege, architecture, and runtime reason\n'
+
 sed 's/^\[P4\] FAIL:/[P4] PASS:/' "$TMP/match.log" > "$TMP/drift.log"
 if bash "$ROOT/tools/verify-greenfield-expected-red.sh" next-git-present "$TMP/drift.log" 1 >/dev/null 2>&1; then
  echo '[test] FAIL: changed P4 verdict did not invalidate the pinned manifest' >&2
@@ -34,3 +42,50 @@ if bash "$ROOT/tools/verify-greenfield-expected-red.sh" next-git-present "$TMP/m
  exit 1
 fi
 printf '[test] PASS: unexpected fixture exit remains blocking\n'
+
+printf 'next-git-present\texit\t1\n' > "$TMP/shrunk.tsv"
+if MOSAIC_EXPECTED_RED_MANIFEST="$TMP/shrunk.tsv" \
+  bash "$ROOT/tools/verify-greenfield-expected-red.sh" next-git-present "$TMP/match.log" 1 >/dev/null 2>&1; then
+  echo '[test] FAIL: one-row manifest shrink still certified the detector' >&2
+  exit 1
+fi
+printf '[test] PASS: manifest shrink cannot delete the structural contract\n'
+
+manifest="$ROOT/tools/fixtures/greenfield-expected-red.tsv"
+grep -v $'^next-git-present\tphase\tP8=' "$manifest" > "$TMP/missing-phase.tsv"
+if MOSAIC_EXPECTED_RED_MANIFEST="$TMP/missing-phase.tsv" \
+  bash "$ROOT/tools/verify-greenfield-expected-red.sh" next-git-present "$TMP/match.log" 1 >/dev/null 2>&1; then
+  echo '[test] FAIL: missing P8 disposition was accepted' >&2; exit 1
+fi
+printf '[test] PASS: every case requires one P0-P9 disposition\n'
+
+grep -v $'^next-git-present\tphase-reason\tP0=' "$manifest" > "$TMP/missing-p0-reason.tsv"
+if MOSAIC_EXPECTED_RED_MANIFEST="$TMP/missing-p0-reason.tsv" \
+  bash "$ROOT/tools/verify-greenfield-expected-red.sh" next-git-present "$TMP/match.log" 1 >/dev/null 2>&1; then
+  echo '[test] FAIL: missing P0 reason binding was accepted' >&2; exit 1
+fi
+printf '[test] PASS: every case requires one discriminating P0 reason binding\n'
+
+cp "$manifest" "$TMP/duplicate.tsv"
+printf 'next-git-present\tphase\tP3=PASS\n' >> "$TMP/duplicate.tsv"
+if MOSAIC_EXPECTED_RED_MANIFEST="$TMP/duplicate.tsv" \
+  bash "$ROOT/tools/verify-greenfield-expected-red.sh" next-git-present "$TMP/match.log" 1 >/dev/null 2>&1; then
+  echo '[test] FAIL: duplicate phase key was accepted' >&2; exit 1
+fi
+printf '[test] PASS: duplicate structural keys are rejected\n'
+
+cp "$manifest" "$TMP/unknown-case.tsv"
+printf 'invented-case\texit\t1\n' >> "$TMP/unknown-case.tsv"
+if MOSAIC_EXPECTED_RED_MANIFEST="$TMP/unknown-case.tsv" \
+  bash "$ROOT/tools/verify-greenfield-expected-red.sh" next-git-present "$TMP/match.log" 1 >/dev/null 2>&1; then
+  echo '[test] FAIL: unknown case was accepted' >&2; exit 1
+fi
+printf '[test] PASS: unknown case rows are rejected\n'
+
+cp "$manifest" "$TMP/unknown-kind.tsv"
+printf 'next-git-present\toptional\tanything\n' >> "$TMP/unknown-kind.tsv"
+if MOSAIC_EXPECTED_RED_MANIFEST="$TMP/unknown-kind.tsv" \
+  bash "$ROOT/tools/verify-greenfield-expected-red.sh" next-git-present "$TMP/match.log" 1 >/dev/null 2>&1; then
+  echo '[test] FAIL: unknown row kind was accepted' >&2; exit 1
+fi
+printf '[test] PASS: unknown manifest kinds are rejected\n'
Author	SHA1	Message	Date
be-coder-05	913f00770f	fix(installer): avoid pipefail marker race ci/woodpecker/pr/ci Pipeline was successful Details ci/woodpecker/pr/greenfield-install Pipeline was successful Details	2026-08-06 12:13:42 -05:00
be-coder-05	58ada98d2b	fix(installer): support BusyBox coverage inventory ci/woodpecker/pr/greenfield-install Pipeline was canceled Details ci/woodpecker/pr/ci Pipeline was canceled Details	2026-08-06 11:53:56 -05:00
be-coder-05	d66e91b1f2	test(installer): bind execution coverage callers ci/woodpecker/pr/ci Pipeline failed Details ci/woodpecker/pr/greenfield-install Pipeline was successful Details	2026-08-06 03:48:03 -05:00
be-coder-05	df705828a4	ci(installer): cover all greenfield execution arms ci/woodpecker/pr/ci Pipeline failed Details ci/woodpecker/pr/greenfield-install Pipeline was successful Details	2026-08-06 03:14:19 -05:00
be-coder-05	f33bd0da96	ci(installer): enforce greenfield case coverage ci/woodpecker/pr/ci Pipeline was canceled Details ci/woodpecker/pr/greenfield-install Pipeline was canceled Details	2026-08-06 02:52:14 -05:00
be-coder-05	0e2eef1c12	docs(installer): correct sidecar verification command ci/woodpecker/pr/ci Pipeline was successful Details ci/woodpecker/pr/greenfield-install Pipeline was successful Details	2026-08-06 01:38:23 -05:00
be-coder-05	4c4d16131a	fix(ci): bind remote fixture downstream source ci/woodpecker/pr/ci Pipeline was successful Details ci/woodpecker/pr/greenfield-install Pipeline was canceled Details	2026-08-06 00:49:41 -05:00
be-coder-05	ff3f0d29f1	fix(installer): fail closed on test enumeration errors ci/woodpecker/pr/ci Pipeline was successful Details ci/woodpecker/pr/greenfield-install Pipeline failed Details	2026-08-05 21:11:05 -05:00
be-coder-07	378bc1afe3	fix(installer): close detector false-pass gaps ci/woodpecker/pr/ci Pipeline was successful Details ci/woodpecker/pr/greenfield-install Pipeline failed Details	2026-08-05 19:00:22 -05:00
be-coder-05	e5d5c8495a	test(installer): pin B8 redaction evidence ci/woodpecker/pr/ci Pipeline failed Details ci/woodpecker/pr/greenfield-install Pipeline failed Details	2026-08-05 18:09:19 -05:00
be-coder-05	3edde464b3	fix(installer): harden greenfield detector contracts	2026-08-05 17:46:58 -05:00
be-coder-05	99e28d4100	test(installer): make state fixture CI-portable	2026-08-05 17:46:58 -05:00
be-coder-05	7c4a4a4a3a	fix(ci): assert pinned greenfield expected red	2026-08-05 17:46:58 -05:00
be-coder-05	049982d30e	feat(installer): add transactional P0-P9 state machine	2026-08-05 17:46:58 -05:00
be-coder-05	4904d4553c	test(installer): preregister P0-P9 greenfield RED	2026-08-05 17:46:58 -05:00
be-coder-08andMos	85d2108e4e	fix(ci): remove upgrade rollback signal race (#1060 ) ci/woodpecker/push/publish Pipeline was successful Details ci/woodpecker/push/ci Pipeline was successful Details Co-authored-by: be-coder-08 <[email protected]>	2026-08-05 22:14:15 +00:00
be-coder-08andMos	16f91157a1	test(ci): make queue guard harness deterministic (#1062 ) ci/woodpecker/push/publish Pipeline was successful Details ci/woodpecker/push/ci Pipeline was successful Details Co-authored-by: be-coder-08 <[email protected]>	2026-08-05 21:49:44 +00:00
				`@@ -0,0 +1 @@`
				`e59cb441a2f37ae9150f8eae470238e9d858a1816df93343d9784a6796676096 install.sh`