test(installer): make state fixture CI-portable

fix(ci): assert pinned greenfield expected red
feat(installer): add transactional P0-P9 state machine
2026-08-05 14:02:44 -05:00 · 2026-08-05 14:02:44 -05:00 · 2026-08-05 14:02:44 -05:00 · 2026-08-05 14:02:29 -05:00
27 changed files with 2861 additions and 1758 deletions
@@ -0,0 +1,49 @@
+# C1 detector gate. The fixture itself is intentionally RED; CI is green only
+# when its exact phase verdicts/reasons match the versioned expected-RED manifest.
+when:
+  - event: [pull_request, manual]
+  - event: push
+    branch: [next, main]
+
+steps:
+  greenfield-git-present:
+    image: node:22-bookworm-slim
+    commands:
+      - |
+        set +e
+        MOSAIC_GREENFIELD_CONTAINER=1 \
+          bash tools/e2e-install-test.sh --lane next --source checkout --git present \
+          > /tmp/greenfield-git-present.log 2>&1
+        fixture_status=$?
+        set -e
+        cat /tmp/greenfield-git-present.log
+        bash tools/verify-greenfield-expected-red.sh \
+          next-git-present /tmp/greenfield-git-present.log "$fixture_status"
+
+  greenfield-main-git-present:
+    image: node:22-bookworm-slim
+    commands:
+      - |
+        set +e
+        MOSAIC_GREENFIELD_CONTAINER=1 \
+          bash tools/e2e-install-test.sh --lane main --source checkout --git present \
+          > /tmp/greenfield-main-git-present.log 2>&1
+        fixture_status=$?
+        set -e
+        cat /tmp/greenfield-main-git-present.log
+        bash tools/verify-greenfield-expected-red.sh \
+          main-git-present /tmp/greenfield-main-git-present.log "$fixture_status"
+
+  greenfield-git-absent:
+    image: node:22-bookworm-slim
+    commands:
+      - |
+        set +e
+        MOSAIC_GREENFIELD_CONTAINER=1 \
+          bash tools/e2e-install-test.sh --lane next --source checkout --git absent \
+          > /tmp/greenfield-git-absent.log 2>&1
+        fixture_status=$?
+        set -e
+        cat /tmp/greenfield-git-absent.log
+        bash tools/verify-greenfield-expected-red.sh \
+          next-git-absent /tmp/greenfield-git-absent.log "$fixture_status"
@@ -7,7 +7,7 @@ Mosaic gives you a unified launcher for Claude Code, Codex, OpenCode, and Pi —
 ## Quick Install

 ```bash
-curl -fsSL https://mosaicstack.dev/install.sh | bash
+bash -o pipefail -c 'curl -fsSL https://mosaicstack.dev/install.sh | bash'
 ```

 Or use the direct URL:
@@ -30,6 +30,16 @@ This installs both components:
 | **Framework**           | Bash launcher, guides, runtime configs, tools, skills            | `~/.config/mosaic/`  |
 | **@mosaicstack/mosaic** | Unified `mosaic` CLI — TUI, gateway client, wizard, auto-updater | `~/.npm-global/bin/` |

+### Install lanes
+
+| Lane                     | Command                               | Use when                                              | Source                                                                                      |
+| ------------------------ | ------------------------------------- | ----------------------------------------------------- | ------------------------------------------------------------------------------------------- |
+| Stable                   | `bash tools/install.sh`               | You want the released Mosaic CLI/framework            | npm registry `@mosaicstack/mosaic@latest` + framework archive at `main`                     |
+| Prerelease integration   | `bash tools/install.sh --next`        | You want the current `next` integration branch        | Exact `@next` CLI/gateway versions + pinned `next` framework commit; pinned-source fallback |
+| Contributor/source build | `bash tools/install.sh --dev --ref X` | You are testing a branch before release; `--ref` wins | Build-from-source at the requested ref                                                      |
+
+`--next` selects the prerelease integration lane. It installs the exact CLI/gateway versions resolved from the aligned `@next` tags, and pins the framework archive to the resolved `next` commit. If the registry path fails, it builds from that pinned source. An explicit `--ref` or `MOSAIC_REF` wins and selects source mode.
+
 After install, the wizard runs automatically or you can invoke it manually:

 ```bash
@@ -38,10 +48,14 @@ mosaic wizard        # Full guided setup (gateway install → verify)

 ### Requirements

- Node.js ≥ 20
- npm (for global @mosaicstack/mosaic install)
+- Linux x86_64 with glibc (Debian is the greenfield CI platform; musl/Alpine, macOS, and ARM64 currently fail as unsupported)
+- Node.js ≥ 20 and npm ≥ 9
+- `bash`, `curl`, `git`, `python3`, `tar`, and standard core utilities (`awk`, `df`, `find`, `flock`, `grep`, `install`, `realpath`, `sed`, `sha256sum`, `stat`, `sync`)
+- At least 256 MiB free disk and 1,000 free inodes at the npm prefix
 - One or more runtimes: [Claude Code](https://docs.anthropic.com/en/docs/claude-code), [Codex](https://github.com/openai/codex), [OpenCode](https://opencode.ai), or [Pi](https://github.com/mariozechner/pi-coding-agent)

+The installer evaluates canonical phases P0–P9 and does not print `Done.` unless every committed postcondition passes. A failed phase exits non-zero, names the phase, and points to its durable journal under `${XDG_STATE_HOME:-~/.local/state}/mosaic/install/`. See [Installer state machine and recovery](docs/guides/installer-state-machine.md).
+
 ## Usage

 ### Launching Agent Sessions
@@ -337,7 +351,7 @@ Each stage has a dispatch mode (`exec` for research/review, `yolo` for coding),
 Run the installer again — it handles upgrades automatically:

 ```bash
-curl -fsSL https://mosaicstack.dev/install.sh | bash
+bash -o pipefail -c 'curl -fsSL https://mosaicstack.dev/install.sh | bash'
 ```

 Or use the direct URL:
@@ -358,15 +372,17 @@ The CLI also performs a background update check on every invocation (cached for
 ### Installer Flags

 ```bash
-bash tools/install.sh --check           # Version check only
+bash tools/install.sh --check           # Side-effect-free P0-P8 postcondition check
 bash tools/install.sh --framework       # Framework only (skip npm CLI)
 bash tools/install.sh --cli             # npm CLI only (skip framework)
-bash tools/install.sh --ref v1.0        # Install from a specific git ref
+bash tools/install.sh --next            # Prerelease lane: exact @next versions + pinned-source fallback
+bash tools/install.sh --dev             # Contributor lane: source build at --ref/main
+bash tools/install.sh --ref v1.0        # Install from a specific git ref (--ref wins over --next)
 bash tools/install.sh --yes             # Non-interactive, accept all defaults
 bash tools/install.sh --no-auto-launch  # Skip auto-launch of wizard
 ```

-The installer rejects unrecognized flags or positional arguments before making changes and prints the supported-option usage.
+The installer rejects unrecognized flags or positional arguments before making changes and prints the supported-option usage. `--check` reports one PASS/FAIL row for each P0–P8 predicate and exits non-zero if any row fails; it does not create the npm prefix, lock, journal, manifest, or runtime files.

 ## Contributing

@@ -1368,3 +1368,36 @@ All work is **alpha** (< 0.1.0) until Jason approves 0.1.0 beta release.
 10. ASSUMPTION: **Conversations and messages get their own PG tables** (not stored in brain's entity model). They follow a chat-specific schema with proper foreign keys to users and projects. Rationale: Chat has different access patterns (streaming, pagination, search) than brain entities.

 11. RESOLVED: **Pi handles all target LLM providers natively.** Anthropic, OpenAI/Codex, Z.ai, Ollama, LM Studio, and llama.cpp are all supported via Pi's built-in providers or `models.json` configuration with `openai-completions` API type. No custom provider adapters needed in @mosaicstack/agent — only configuration management.
+
+---
+
+## Greenfield install correctness — C1 (#1050)
+
+### Problem and objective
+
+A from-zero install can report success while leaving the target host unusable because the installer has no transactional state machine capable of certifying its own postconditions. C1 supplies the structural spine and red-first fixture; later cards repair the individual failed postconditions.
+
+### Normative requirements
+
+1. The installer SHALL implement the canonical P0–P9 numbering from the greenfield-install PRD v2: P0 Resolve context; P1 Preflight; P2 Acquire artifacts; P3 Install CLI; P4 Install framework + skills; P5 Identity; P6 Runtime linking / activation; P7 Services; P8 Shell discoverability; P9 Verify + commit. P2 is scoped to installer-distribution artifacts and SHALL NOT foreclose credentialed downstream acquisition. P5 owns validating any credential capability required by requested downstream work; P7 may provision credential-dependent resources only after that P5 postcondition commits.
+2. Every phase SHALL declare preconditions, action, committed postconditions, and rollback. An unverifiable postcondition SHALL fail the install non-zero with the named phase and a remediation line; no best-effort failure may still certify success. P1's required-tool closure includes tools invoked by later phases, including `git`; a downstream prerequisite may not remain undeclared and degrade silently.
+3. A durable mutation journal SHALL open before the first mutation and commit at P9. Fallible command output needed to diagnose a phase SHALL be journaled and surfaced, never discarded.
+4. `--check` SHALL run exactly the P0–P8 postcondition predicates without mutation, report each phase PASS/FAIL, and exit non-zero if any predicate fails.
+5. P4 SHALL consume a checkout-free, lane/versioned shipped-set declaration published by the installer. C1 SHALL NOT select among the currently disagreeing framework-payload, repository-root, sync-source, and W-jarvis populations; while no declaration exists, P4 reports `NOT-MEASURED / UNDECLARED` and remains blocking rather than fabricating a count. C5 owns the declaration's contents and containment/loadability fulfillment.
+6. The from-zero fixture SHALL be lane-parametric, use Debian/glibc, run the documented install command as a non-root target user with an isolated HOME, and inherit no host credentials, npm cache, home directory, or runtime configuration.
+7. The fixture SHALL select `next` with `--next` or `MOSAIC_NEXT=1` and assert the resolved lane version. Internal predicates use P3's absolute CLI path; shell discoverability is tested only at P8.
+8. Fault injection after each P2–P8 phase SHALL prove either clean rollback or a durable, honestly reported resumable partial state, with no journal incorrectly left in progress.
+9. Unsupported musl/Alpine and unavailable Docker SHALL fail loudly rather than skip as pass.
+
+### C1 acceptance criteria
+
+1. The pre-C1 from-zero matrix records both discriminating controls: with `git` absent, the legacy installer still exits zero while P1 fails and skill sync degrades; with `git` present, P1 passes and the observed sync store/runtime links are 101/101. The C1 installer must fail at P1 before mutation when `git` is absent.
+2. The discriminating P3 row passes: the binary exists at the expected absolute path and reports exactly the resolved `next` lane version, while P4, P5, and P8 fail.
+3. The `--check` mutation negative control proves host fingerprints are byte-identical before and after observation.
+4. Woodpecker executes and validates the expected RED fixture; C1 does not repair P4/P5/P8 or activate #869.
+
+### Explicit exclusions and dependencies
+
+- C2 owns P8/PATH, C3 owns P5/headless identity, C4 owns P6 activation policy, and C5 owns P4/skills.
+- Main-lane execution is a promotion precondition owned by #1037; C1 only makes the fixture lane-parametric.
+- RM-02 and #869 activation are out of scope.
@@ -9,6 +9,11 @@
 - [Whole mutator-class gate](architecture/mutator-class-gate.md) — default-deny policy, revoke-first/promote-last state machine, TTL, runtime adapters, and T-B/T-C assurance boundary.
 - [Compaction revocation lifecycle](architecture/compaction-revocation.md) — Claude/Pi observer matrix, same-PID generation rollover, failure fencing, and the named bounded residual stale window.

+## Installation and upgrades
+
+- [Installer state machine and recovery](guides/installer-state-machine.md) — canonical P0–P9 phases, side-effect-free checks, durable journal states, rollback/remediation, and the Debian greenfield CI gate.
+- [Upgrade safety and recovery](guides/upgrade-safety-and-recovery.md) — framework ownership, durable operator snapshots, verify net, and projection regeneration.
+
 ## CLI and skill management

 - [Skill registration user guide](guides/user-guide.md#claude-code-skill-registration) — register, unregister, list statuses, automatic install/update reconciliation, and Claude reload behavior.
@@ -0,0 +1,99 @@
+# Installer State Machine and Recovery
+
+The unified installer uses a transactional P0–P9 model. It may report success only after P9 reasserts every applicable committed postcondition. Internal phases invoke the CLI by P3's absolute path; shell discovery is checked only at P8.
+
+## Canonical phases
+
+| Phase                           | Responsibility                                                                                                                    | Failure disposition                                                              |
+| ------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
+| P0 Resolve context              | State target user, HOME, shell, privilege mode, architecture, libc, Node, and npm                                                 | Fail before mutation                                                             |
+| P1 Preflight                    | Validate downstream tool closure (including `git` and `python3`), writable prefix, registry lane, disk/inodes, and exclusive lock | Fail before target mutation                                                      |
+| P2 Acquire artifacts            | Resolve exact registry versions and an immutable framework commit; record lane and SHA-256                                        | Discard temporary work                                                           |
+| P3 Install CLI                  | Install at the configured absolute prefix and require exact resolved version                                                      | Restore the prior prefix/npmrc snapshot                                          |
+| P4 Install framework + skills   | Sync framework and consume a checkout-free, lane/versioned shipped-skill declaration                                              | Restore prior framework/runtime trees                                            |
+| P5 Identity                     | Validate SOUL/USER content, owner, and mode; establish any credential capability requested downstream                             | Restore generated identity/credential binding                                    |
+| P6 Runtime linking / activation | Evaluate activation honestly; never treat dead enforcement hooks as active readiness                                              | Restore runtime activation files                                                 |
+| P7 Services                     | Provision only requested services/resources after any required P5 credential commits                                              | Stop and restore requested services/resources                                    |
+| P8 Shell discoverability        | Require fresh login and non-login shells of the actual target shell to resolve P3's path                                          | Restore shell profiles                                                           |
+| P9 Verify + commit              | Re-run P0–P8, commit the manifest, and seal the journal                                                                           | Leave an honestly reported resumable failure or restore the pre-install snapshot |
+
+The phase numbers are a cross-workstream contract and must not be renumbered.
+
+## Side-effect-free check
+
+```bash
+bash tools/install.sh --check          # stable/latest lane
+bash tools/install.sh --check --next   # prerelease lane
+```
+
+`--check`:
+
+- emits exactly one `[P0]` through `[P8]` PASS/FAIL row;
+- exits non-zero if any predicate fails;
+- does not create the npm prefix, lock, journal, manifest, shell profile, or runtime file;
+- uses temporary npm observation storage outside the target HOME and removes it before exit.
+
+P4 currently fails as `NOT-MEASURED / UNDECLARED` until the installer publishes `~/.config/mosaic/.install-shipped-skills.json`. C1 deliberately does not select among the conflicting candidate populations; C5 owns publishing and fulfilling that declaration. Once present, the P4 predicate requires the declaration's lane/version to match the resolved install and every named skill to remain contained under `skills/<name>/SKILL.md` with matching loadable frontmatter.
+
+## Durable journal
+
+Each mutating run creates a private transaction directory:
+
+```text
+${XDG_STATE_HOME:-~/.local/state}/mosaic/install/
+  active.json
+  <UTC-run-id>/
+    journal.ndjson
+    journal.ndjson.sha256   # committed runs only
+    commands.log
+    snapshot/
+```
+
+Before each mutation scope is touched, `journal.ndjson` records:
+
+- phase and path;
+- whether prior state existed and where its snapshot lives;
+- the reversal action;
+- the captured command-output location and command status.
+
+Journal, action-status, manifest, or command-log write/sync failure is fatal. An unrecorded mutation is not allowed. Successful P9 runs append a seal event, write the SHA-256 sidecar, and make the journal and sidecar read-only. Required P4/P6 action failures are persisted in the manifest so a later `--check` cannot turn a failed action into a false pass.
+
+Rollback roots must be non-overlapping, non-symlinked, target-user-owned strict descendants of canonical `HOME`; unsafe custom `MOSAIC_HOME`/`MOSAIC_PREFIX` values fail at P0. The same validation runs again immediately before recursive rollback. The OS lock is concurrency authority: if a process dies while `active.json` still says `in-progress`, a retry that acquires the free lock preserves the stale projection as `prior-active.json` and proceeds from the honestly retained partial state.
+
+`active.json` is the current projection:
+
+- `in-progress`: incomplete/open transaction;
+- `rolled-back`: a fault restored the snapshot;
+- `rollback-failed`: restoration failed or refused a replaced/unsafe target and requires manual recovery;
+- `failed-resumable`: named postconditions failed and the recorded partial state remains for remediation;
+- `committed`: P9 passed and the journal is sealed.
+
+## Failure recovery
+
+1. Read the named phase and remediation line from installer stderr.
+2. Inspect `active.json`, then the referenced `journal.ndjson` and `commands.log`. Command output needed to diagnose a failure is preserved and surfaced; it is not redirected away.
+3. For `rolled-back`, verify the target paths match their pre-install state before retrying.
+4. For `failed-resumable`, repair the named phase owner requirement, then run `install.sh --check` before retrying the installer.
+5. Do not activate the #869 enforcement hooks merely to turn P6 green. A broker-less host with those hooks is a failed P6 state.
+
+## Greenfield CI gate
+
+`.woodpecker/greenfield-install.yml` runs `tools/e2e-install-test.sh` from zero in Debian/glibc as a non-root uid with `env -i`. No host HOME, npm cache, credentials, or bind mount enters the target process. Checkout mode packages the complete current checkout into an archive, pins its SHA-256 through an internal fixture seam, and copies the self-contained fixture into the container; framework-installer changes in the PR are therefore exercised rather than fetched from an older remote branch.
+
+The C1 fixture intentionally returns an attributable RED while C2–C5 remain open. CI itself remains green only when the fixture's final P0–P9 verdicts, required discriminator rows, and non-zero exit match the versioned contract in `tools/fixtures/greenfield-expected-red.tsv`. Any later remediation that changes an observed verdict makes CI red until the owning lane deliberately updates that manifest:
+
+- `git` present: P1 and strict P3 pass; P4/P5/P6/P8 fail for their own reasons; P9 refuses success.
+- `git` absent: P1 fails before target mutation and the installer emits no `Done.`.
+
+The fixture is lane-parametric:
+
+```bash
+bash tools/e2e-install-test.sh --lane next --git present
+bash tools/e2e-install-test.sh --lane main --git present
+```
+
+CI exercises both lane parameters as expected-RED structural checks. Delivery targets `main` under the trunk-only merge rule; `next` remains a non-merging integration lane. The linked installer issue stays open after merge and closes only after Jarvis independently validates the greenfield behavior.
+
+## Source trust boundary
+
+Remote source mode pins the resolved commit, records the archive SHA-256, limits compressed/expanded size and entry count, and rejects traversal, links, devices, and special files before extraction. This provides immutable run provenance and archive safety, not an independent authenticity root. Signed artifact metadata/provenance is explicitly deferred by the canonical greenfield PRD; C1 does not invent a signing system. The checkout CI seam does verify an expected digest supplied independently by the fixture.
@@ -12,6 +12,20 @@ with no snapshot to fall back to.
 Protection is layered. Each layer is independent; a later layer catches what an
 earlier one misses.

+## Layer 0 — Transaction journal (install-wide recovery)
+
+The unified installer opens a private journal under
+`${XDG_STATE_HOME:-~/.local/state}/mosaic/install/` before the first target
+mutation. Every mutation scope records its path, prior snapshot, and reversal
+instructions before it is touched. Journal write/sync failure is fatal, and P9
+seals successful journals with a SHA-256 sidecar. See
+[Installer state machine and recovery](./installer-state-machine.md).
+
+This transaction journal is distinct from the retained operator-only backup
+below. The transaction journal is required for correctness and rollback;
+Layer 2's durable backup remains a separately stated, fail-open recovery bonus
+for a manifest bug that the normal transaction did not detect.
+
 ## Layer 1 — Manifest-owned sync (prevention)

 The single source of truth for ownership is
@@ -1,71 +0,0 @@
-# #1019 — Zero-timeout queue-guard harness race
-
- **Issue:** #1019 (parent status remains `believed-fixed, pending jarvis validation`; do not close)
- **Branch:** `fix/1019-ci-queue-timeout-harness`
- **Owner:** `be-coder-08`
- **Base:** `origin/main` at `5916aeefd6ed12bcac086c6834c7f6c4ae38e1bc`
- **Charter:** `/home/hermes/agent-work/tl-mosaic/CHARTER-1019-HARNESS-FIX.md`
-
-## Objective
-
-Make `test-ci-queue-wait-tristate.sh` deterministic without changing any asserted outcome. Remove the indiscriminate zero-timeout race, require every status-classification case to prove the provider was observed, and prove the harness-controlled virtual clock is active.
-
-## Scope
-
- In scope: `packages/mosaic/framework/tools/git/test-ci-queue-wait-tristate.sh` only, plus this evidence scratchpad.
- Out of scope: guard parsers, D2/D3 behavior, installer/reseed staleness, PR #1060, and issue closure.
-
-## Acceptance criteria
-
-1. RED deterministically reproduces deadline pre-emption before the provider call.
-2. Every case that intends status classification positively proves provider observation.
-3. Pending observes `pending` before deterministic virtual-time expiration.
-4. The virtual clock has a positive interception control; a broken-clock mutant makes the suite red.
-5. The exact CI-base image passes the final harness repeatedly with zero failures.
-6. Baseline gates, independent code/security review, exact-head CI, and coordinator-authorized squash merge pass.
-
-## Plan
-
-1. Add deterministic RED instrumentation for the known merge/provider-unreachable pre-emption.
-2. Replace global `-t 0` with a nonzero timeout interpreted under an event-driven virtual clock; stub sleep without wall waiting.
-3. Add provider-observation and virtual-clock positive controls without changing outcome assertions.
-4. Run focused shell checks, repeat in exact CI-base image, baseline gates, and independent reviews.
-5. Commit with both identity layers, queue-guard plus direct Woodpecker terminal-state verification, push, self-post PR, verify poster/head/CI, obtain coordinator merge authorization, then squash merge without closing #1019.
-
-## Budget
-
- No explicit token cap supplied. Keep scope to one harness file and one scratchpad; stop/report at the charter's 60% context gate.
-
-## Evidence
-
- RED, deterministic pre-provider expiry: `evidence/1019-harness-fix/red-pre-provider-expiry.log` — rc 1; merge/provider-unreachable got rc 124 instead of 75, omitted CANNOT_ASSERT, did not observe the status provider, and wrote no additional audit record (four named failures).
- GREEN host focused harness: `evidence/1019-harness-fix/green-host.log` — rc 0, all outcome classes passed.
- Load-bearing clock negative control: a temporary same-directory mutant replaced the virtual `date` body with `/bin/date`; `evidence/1019-harness-fix/red-clock-not-intercepted.log` — rc 1 with named `virtual clock interception did not run` failures. The mutant file was removed after the run.
- Exact CI-base repeat: `git.mosaicstack.dev/mosaicstack/stack/ci-base:latest`, repository mounted read-only, harness work under container `/tmp`; `evidence/1019-harness-fix/ci-image-repeat/summary.log` — **100 pass / 0 fail / 100 total**.
- Synchronization design: provider-status observation creates the event marker; virtual time is 1000 before the event and 1002 afterward. Pending alone reaches the stubbed no-op sleep and a post-observation deadline check. `-t 1` is uniquely load-bearing because removing it restores the 900-second default deadline at virtual time 1900, which 1002 does not cross. The numeric timeout is subject semantics under virtual time, not a wall-clock synchronization duration.
-
-## Review remediation — semantic timeout vs. liveness bound
-
-Security review found that virtual time remained at 1000 forever before provider observation and stubbed sleep never waited. A regression looping before the status endpoint—or blocking in the first provider call—therefore could prevent `run_guard` from returning, so the post-return provider assertion could never fire.
-
-**General rule:** A timeout usually serves two purposes: semantics and liveness. Removing wall time from semantic synchronization can silently remove the only independent hang bound. Preserve deterministic virtual time for subject semantics, but provide a separately implemented real-clock liveness watchdog and prove that watchdog fires.
-
-Remediation:
-
- Every guard subject invocation is launched by absolute `/usr/bin/python3` in a new session. Python's internal monotonic `wait(timeout=...)` provides real-clock liveness independently of PATH; expiry kills the entire isolated process group, so neither PATH-front shims nor a blocked provider descendant can retain the capture pipe.
- Watchdog expiry returns distinct harness rc 90 plus `FAIL HANG watchdog`, separate from subject timeout rc 124.
- A first attempt using absolute `/usr/bin/timeout -s KILL` passed on GNU coreutils but failed in the exact Alpine CI-base image: BusyBox killed the immediate wrapper while the guard/provider descendants survived and retained the command-substitution pipe. The process-group kill is therefore required behavior, not portability polish.
- A committed positive control hangs the branch-provider stub before the status endpoint. It must terminate through the watchdog, emit the hang-specific diagnostic, return rc 90, and prove the status provider was never reached.
- RED before remediation: a temporary ordinary-success mutant hung before provider observation; only an external control could kill the suite (rc 137), and there was no internal hang-specific diagnostic (`red-watchdog-absent.log`).
- The watchdog mutant/control is load-bearing: removing the internal watchdog leaves the control unable to produce its required rc 90 and diagnostic.
-
-Post-review evidence:
-
- Host focused harness with process-group watchdog: rc 0 (`green-watchdog-process-group-host.log`).
- Exact Alpine CI-base focused harness with process-group watchdog: rc 0 (`green-watchdog-ci-image.log`).
- Hanging ordinary-success mutant: suite rc 1; success returned rc 90, emitted `FAIL HANG watchdog`, and loudly reported that provider/clock observation did not occur (`red-watchdog-fires.log`).
- Removed-`-t 1` mutant: suite rc 1; pending was terminated by the watchdog instead of producing `ASSERTED_NOT_READY`, proving the explicit timeout is load-bearing (`red-timeout-argument-removed.log`).
-
-## 60% context hold
-
-Stopped before baseline/review/commit as required by the charter. Remaining: inspect final diff, shell/static/baseline gates, independent code/security review, remediation if any, identity-bound commit/trailer verification, mandatory queue guard plus direct terminal Woodpecker `mosaic` enumeration, push, self-posted PR/provider poster read-back, exact-head terminal-green CI, coordinator merge authorization, squash merge, main CI verification, and leave #1019 unclosed as `believed-fixed, pending jarvis validation`.
@@ -0,0 +1,68 @@
+# #1050 — Installer P0–P9 state machine and red-first fixture
+
+## Objective
+
+Implement C1 from the canonical greenfield-install PRD v2: a transactional P0–P9 installer spine, a side-effect-free P0–P8 `--check`, and a lane-parametric Debian/glibc non-root from-zero fixture. The acceptance milestone is an attributable RED on the pre-C1 installer while preserving P3 PASS.
+
+## Authority and scope
+
+- Canonical requirements: `jason.woltje/jarvis-brain` `docs/plans/2026-08-04-greenfield-install-blockers-PRD-v2.md`. Currency was re-derived after compaction: authenticated fetch resolved `origin/main` to `cb23e5fbc8a282fa967b93d7a134fa48d11b4bb1`; the PRD and charters are byte-identical to the previously read remote copies.
+- Tracking: `mosaicstack/stack#1050` on `git.mosaicstack.dev` (author read back as `be-coder-05`).
+- Historical implementation base: `origin/next` `4df478cdd150fdf8d52ea109f02ade5d85017acd`. Delivery PR #1054 targets `main` under L0's trunk-only rule; `next` remains a non-merging integration lane.
+- Out of scope: PATH, skills, headless wizard/identity, activation remediation, #869 wiring, RM-02, main promotion.
+- `docs/TASKS.md` is orchestrator-single-writer and is not modified by this worker.
+
+## Plan
+
+1. Pre-register the canonical phase/output/side-effect-free/fault-injection checks and observe RED against the base installer.
+2. Commit the immutable red-first acceptance fixture before implementation.
+3. Add the state-machine/journal/postcondition spine without repairing P4/P5/P8 symptoms.
+4. Wire the expected-RED from-zero fixture into Woodpecker using Debian/glibc and a non-root target user.
+5. Run shell/static baselines, situational container validation, code review, security review, then deliver through a PR to `next` under the coordinator-owned merge path.
+
+## Budget
+
+- Working estimate: 32K reasoning/output tokens.
+- Hard external cap: none stated.
+- Adaptation: keep implementation in shell surfaces already in scope; no package dependency install unless repository gates require it.
+
+## Pre-registered acceptance checks
+
+| ID | Exact case | Expected pre-fix result |
+|---|---|---|
+| C1-R1 | `tools/e2e-install-test.sh --lane next` in a clean Debian 12 container as uid 1001 | non-zero; P3 PASS; P4 `NOT-MEASURED / UNDECLARED`; P5/P6/P8 FAIL with own reasons |
+| C1-R2 | `tools/install-state-machine.test.sh` phase table case | RED because base installer does not enumerate canonical P0–P9 contracts |
+| C1-R3 | side-effect-free `--check` case over a fingerprinted HOME | RED because base `--check` is version-only rather than P0–P8 predicates |
+| C1-R4 | fault injection after each P2…P8 | RED because base installer has no injectable durable journal/rollback state |
+| C1-R5 | Docker unavailable | base harness incorrectly exits 0; replacement must fail non-zero |
+| C1-R6 | lane resolution | bare checkout is forbidden; fixture must pass `--next` and assert the resolved prerelease version |
+| C1-R7 | same Debian fixture with `git` absent vs present | absent: P1 FAIL while legacy installer exits 0 and sync degrades; present: P1 PASS and observed store/runtime containment 101/101 |
+
+## Progress
+
+- [x] Charter, doctrine, delivery/CI/QA/docs guides read and re-anchored after compaction.
+- [x] Canonical PRD v2/v3 addenda and charters read from fetched `origin/main`; numbering reconciles with the TL spec. No numbering conflict found. INV-B/C/D are binding and implemented without renumbering.
+- [x] Target base reachability verified with `merge-base --is-ancestor`.
+- [x] Issue #1050 created and provider author read back.
+- [x] Initial RED captured; TL rejected P4's repo-root count as a false RED. Four populations disagree (framework payload 1, repo root 13, sync store 101 in the fixture, W-jarvis observation 7), so C1 now requires a checkout-free declared shipped-set artifact and reports P4 `NOT-MEASURED / UNDECLARED` until C5 supplies it.
+- [x] P6 strengthens #869: the two dead enforcement hooks reproduce from zero on a clean broker-less container. C1 asserts the breach but neither wires nor unwires it.
+- [x] P1 false pass identified from the P4 evidence row: `git` is absent from the Debian base and was undeclared even though skill sync shells out to it. C1 adds `git` to P1; the fixture matrix preserves absent/present controls. The prior claim that web1's missing runtime skills reproduce this greenfield mechanism is withdrawn by the TL and is not carried here.
+- [x] Corrected RED transcript captured and reported, including the git-present/absent controls and strict P3 PASS.
+- [x] State-machine implementation complete: private pre-mutation journal/snapshot, P0–P8 `--check`, P2–P8 fault seam, rollback, durable manifest/journal seal, action-status persistence, safe rollback roots, and stale-projection recovery.
+- [x] Debian/glibc checkout fixture now packages the complete current checkout, verifies its digest in-container, and reaches the expected attributable RED without host inheritance. CI compares its exact final phase map/reasons to `tools/fixtures/greenfield-expected-red.tsv`; the fixture remains red while the detector job is green only on an exact match.
+- [ ] Reviews complete. Automated review defects around Bash conditional errexit, explicit exits, P4/P6 persisted action status, dev/offline source resolution, stale locks, checkout coverage, and rollback path safety were remediated. Remaining automated objections are the charter-mandated expected RED/C5 boundary and signed provenance, which the canonical PRD explicitly defers; independent informed review is still required.
+
+## Risks / blockers
+
+- The deployed create wrappers do not expose `--dry-run`; identity preflight was performed through `pr-merge.sh --dry-run` on the same HOMELAB repo, which resolved `git.mosaicstack.dev` + `be-coder-05`. The issue create then fell back from tea to the API but provider read-back confirmed author `be-coder-05`.
+- `next` is a non-merging integration lane; PR #1054 targets `main`. The old “pending promotion to main” caution dissolved when the base moved. #1050 remains open after merge and closes only after Jarvis validates the greenfield behavior.
+- #869 must remain staged and inactive.
+- Late sequencing input MB-BRAIN-01 is accommodated without implementation or renumbering: P2 covers installer distribution only; P5 owns requested credential capability; P7 leaves an ordered seam for credential-dependent resource provisioning after P5.
+
+## Verification log
+
+- `bash -n` and ShellCheck pass for all changed shell surfaces; `git diff --check` passes.
+- `bash tools/install-state-machine.test.sh` passes, including exact P0–P8 rows, good/bad discrimination, persisted P4/P6 action failures, P2–P8 rollback, unsafe/overlapping/symlink roots, stale `active.json`, and fatal journal initialization.
+- `bash tools/install-next-lane.test.sh` passes, including exact `@next` versions, immutable source fallback, source-build/archive-failure rollback, offline `--dev`, explicit refs, and prerelease suffix mismatch.
+- `bash tools/e2e-install-test.sh --lane next --source checkout --git present` returns the required expected RED in clean Debian/glibc as uid 1001: installer P0/P1/P2/P3/P7 PASS; P4/P5/P6/P8 and P9 blocking; no `Done.` claim; checkout archive digest pinned and current framework installer exercised. `tools/verify-greenfield-expected-red.sh` converts that expected detector result into a green CI assertion and fails on any unreviewed verdict drift.
+- Earlier repository gates passed: `pnpm typecheck`, `pnpm lint`, `pnpm format:check`, `pnpm test:installer`, upgrade manifest/rollback/durable-snapshot/migration suites, and focused `@mosaicstack/mosaic` tests with an isolated npm prefix. Full rerun is required after final edits.
@@ -1,99 +0,0 @@
-# PR merge squash message field
-
- **Charter:** `/home/hermes/agent-work/CHARTER-PRMERGE-MESSAGE-FIELD.md`
- **Owner:** `be-coder-08`
- **Branch:** `fix/pr-merge-message-field`
- **Base:** remote `main` / local `origin/main` at `85d2108e4ed15c744ad3b87a5b629e7b2d39405a`
- **Estate:** HOMELAB tooling shared by HOMELAB and USC
-
-## Objective
-
-Add an optional, identity-checked Gitea squash message to `pr-merge.sh` so genuine multi-author PRs retain non-poster branch authors without weakening hardcoded squash behavior.
-
-## Binding requirements
-
-1. `Do` remains hardcoded to `squash`; no provider/repository default may select merge style.
-2. A verified trailer uses a PR commit's linked `author.login` and that same commit's author email. No `/users/{login}` primary-email lookup occurs. Recorded rationale: this asks only what the provider can answer.
-3. A commit with `author.login` null blocks before merge, prints both the null provider fact and commit email fact, and names the escalation principal.
-4. The BLOCK arm must be observed firing; a normal canonical single-author API payload remains explicit squash plus its reviewed `head_commit_id`.
-5. Every provider mutation is read back from the provider; no real PR is merged during tests.
-
-## Derived interface decisions
-
- Add `--co-author-trailers` rather than accepting arbitrary message text. The wrapper enumerates PR commits and constructs trailers, making an unchecked `Co-authored-by` line unexpressible.
- Require `--escalate-to PRINCIPAL` with `--co-author-trailers`, so the BLOCK diagnostic always names a principal rather than a generic role.
- Do not expose `MergeTitleField` separately. When trailers exist, set it from the provider PR title and set `MergeMessageField` only to construction-generated trailers. This preserves one provider source for the title and avoids an unrelated caller-controlled degree of freedom.
- Preserve first-commit order and emit one trailer per distinct non-poster `author.login`, using that first linked commit's own email.
-
-## Canonical delivery plan
-
-1. Port the capability into the installed source of truth, `packages/mosaic/framework/tools/git/pr-merge.sh`; do not retain `infra/fleet/tools/git` as a second copy.
-2. Preserve canonical `--expect-head`, exact head branch/repository/SHA queue inspection, Gitea atomic head pinning, GitHub `--match-head-commit`, and delete-after-merge semantics.
-3. Do not port the deployed-only `--skip-queue-guard` bypass. Add the focused harness to the canonical framework-shell suite and re-establish RED/GREEN on the packaged baseline.
-4. Deliver through a reviewed package release followed by `mosaic update` with its default framework reseed. The installer snapshots, manifest-syncs framework-owned `tools/**`, and rolls back on failure.
-5. Before either estate relies on the change, require installed/package hash equality, `MergeMessageField` presence, and a green focused harness. Release/reseed ownership is currently unassigned and blocks activation after source merge.
-
-## Evidence
-
- RED against the byte-identical deployed baseline (`sha256 08a65e8584c5…`): rc 1 with eight named failures. The wrapper rejected `--co-author-trailers`; the null-login path emitted none of the required BLOCK facts/principal; and both verified/ordinary API paths failed the stdin-config credential assertion (ordinary path exposed the fixture token through curl argv). Log: `/home/hermes/agent-work/be-coder-08/evidence/prmerge-message-field-red.log`.
- GREEN on the deployed-baseline candidate: verified linked multi-author payload, null-login BLOCK, required named principal, explicit squash, stdin-config token transport, and absence of `/users` lookup all passed. Log: `/home/hermes/agent-work/be-coder-08/evidence/prmerge-message-field-green.log`.
- RED against canonical packaged baseline `c581ef48…`: rc 1 with 32 assertions. It rejects the new option, and the first harness version did not satisfy canonical head branch/repository/SHA metadata. Log: `/home/hermes/agent-work/be-coder-08/evidence/prmerge-packaged-baseline-red.log`. The port adapts the fixture rather than weakening canonical head controls.
- Provider capability probe against `git.mosaicstack.dev`: authenticated `be-coder-08` POST to deliberately nonexistent PR `2147483647` with both message fields returned JSON HTTP 404; the unauthenticated same request returned JSON HTTP 401 (not the charter's predicted 403). The authenticated-vs-unauthenticated differential proves write authorization resolved while no mergeable subject existed. `tl-mosaic` ruled the literal non-load-bearing: preserve the observed 404/401 pair and do not manufacture a 403 case. No cause was inferred and no real PR was targeted.
- Provider-generated trailer behavior is not treated as exclusive or absent. The wrapper's VERIFIED/BLOCK decision binds each requested non-poster trailer to commit `author.login` plus that commit's email; it does not assume `MergeMessageField` is the squash's only trailer source. The poster is omitted from the constructed list because the resulting squash author already records the poster; any additional provider-generated trailer is outside this change's unmeasured mechanism.
- An early candidate SHA-256 `5de32876990e4f26920448cb3220cc7f1146d558b4dd2bc1ee1a2abee2f2cbe6` passed the initial harness, then author-side review found credential-fallback and argv-exposure defects. The live deployed wrapper was atomically restored to baseline SHA-256 `08a65e8584c52c6d41ea1c686f8b95585c21e4b37320a2447eba09359a0e02c1`; the remediated candidate remains only in the worktree.
-
-## Remediation and current review state
-
-1. Token and Basic Auth now use stdin curl configuration, not argv. PR title, contributor email, and the JSON payload also remain out of child argv.
-2. Each credential attempt binds commit inspection and merge. A token failure during either inspection or mutation causes Basic fallback to repeat inspection before mutation; the payload pins the inspected `head_commit_id`.
-3. Focused tests cover token-resolution fail-closed behavior, both HTTP-401 fallback seams, metadata/credential argv absence, null-login BLOCK, explicit squash, canonical reviewed-head binding, unchanged ordinary payload, and retained log-safe provider diagnostics. Token-resolution RED: `/home/hermes/agent-work/be-coder-08/evidence/prmerge-token-resolution-red.log`.
-4. Codex review rounds 3–5 requested retained provider error text, log-safe provider diagnostics, fail-closed credential fallback, stable value-option parsing, and PR-title trailer-injection prevention. These are remediated with regression assertions. A post-remediation independent review is still required.
-5. **Accepted linkage limitation:** `author.login` resolution proves that the commit address maps to a registered provider account. It does not prove that the named principal authored the commit because Git author metadata is self-asserted. This gate checks attribution linkage, not authorship; commit signing is out of scope and currently unadopted. Coordinators explicitly ruled that this does not add a third state.
-6. Codex's sandbox could not execute the harness because its checkout was read-only; that environmental limitation is recorded separately from host-side test results.
-
-## Disposable provider fixture acceptance
-
- Use a retained scratch repository only, with two branch authors and `author != committer` on at least one commit.
- Arm A supplies a message-field trailer for one non-poster; record whether that value lands without forcing the partial-pair result into under-specified `APPENDS`/`REPLACES` labels. Demonstrate an absence control.
- Arm B includes a registered trailer for a different non-poster on a branch commit; record whether it survives or drops. Verify identity through an existing commit whose `author.login` resolves and demonstrate an absence control.
- Parse landed trailers key-agnostically with `^[A-Za-z-]+-[Bb]y:` and record generated poster pair presence/absence plus resulting poster attribution.
- Record `/users/<login>` status and raw email only as non-gating estate telemetry. Never read `active`, `visibility`, or any profile field as an identity gate.
- Use distinct principals: poster `be-coder-08`, merger `Mos`, Arm A `be-coder-07`, and Arm B `be-coder-06`. Capture every trailer-shaped line verbatim and in order. Zero trailer lines means the generator did not fire and the run is `VOID`, not evidence that either arm dropped.
- Report the same read-back evidence to `mos-claude` on socket `default` and `tl-mosaic` on socket `mosaic-fleet`. Report values rather than mechanism inferences and stop on any poster-attribution regression.
-
-## Fixture preflight
-
- Retained public repository: `mosaicstack/prmerge-trailer-fixture`; PR `#1`, posted by `be-coder-08` and reserved for merge by `Mos`.
- Existing `mosaicstack/stack` commits resolve `be-coder-07` and `be-coder-06` through `author.login`; exact addresses are `[email protected]` and `[email protected]`.
- Non-gating HOMELAB telemetry for authenticated reader `be-coder-08`: `/api/v1/users/be-coder-06` returned HTTP 200 with raw `email` value `[email protected]`.
- Provider preflight showed PR commit enumeration is newest-first. A new RED test proved that deriving `head_commit_id` from the final array element selected the wrong commit. The candidate now reads `.head.sha` from the authenticated PR endpoint before enumeration, verifies it appears in the commit set, and atomically pins that SHA in the explicit squash payload. RED: `/home/hermes/agent-work/be-coder-08/evidence/prmerge-head-order-red.log`.
- Fixture PR head `f6ba6e5105031fa21f5ff7bd8e4379d99c16e1de` has `author.login=be-coder-07`, `committer.login=be-coder-08`, and branch-message trailer `Co-authored-by: be-coder-06 <[email protected]>`.
-
-## Fixture result
-
- `Mos` merged retained fixture PR `#1` through staged candidate SHA-256 `60e779a85fd13b729d859ea7c986d1e9b1641b97991611329226c1b3113ffb6e`; resulting squash commit: `3f550715d9bc716426fd355a65fe997b3a90fa7d` with one parent.
- Provider read-back: poster/commit author `be-coder-08`, committer/merger `Mos`. The run is non-void.
- Trailer-shaped lines, verbatim and in order:
-  1. `Co-authored-by: be-coder-07 <[email protected]>`
-  2. `Co-authored-by: be-coder-08 <[email protected]>`
- Arm A supplied field value (`be-coder-07`) landed. Arm B branch trailer (`be-coder-06`) dropped. Both fabricated absence controls remained absent. No `Co-committed-by:` line landed.
- The candidate payload construction explicitly excludes the poster and supplied only the Arm A `be-coder-07` line. Therefore the landed poster line was provider-generated, not candidate-composed. The raw result supports `FIELD LANDS`, `BRANCH DROPS`, and `POSTER GENERATED`; it does not support a claim that candidate code supplied the poster. Evidence: `/home/hermes/agent-work/be-coder-08/evidence/prmerge-fixture-readback.log` and the retained provider object.
- Retained fixture PR `#2` measured the N=2 shape needed by `#1030`: supplied `be-coder-07` then `be-coder-06`; both landed in that order, followed by the provider-generated poster line. No truncation or dedup occurred at N=2. Resulting squash: `39db9d13aed0…`.
-
-## Current hold point
-
-PR `mosaicstack/stack#1066` is open. Its first frozen head `f4b162fa…` was terminal-green in Woodpecker `mosaic` pipeline `#2225`, but that evidence becomes stale when the canonical port moves the head. The deployed wrapper remains baseline `08a65e85…`; no manual copy will occur. Canonical port tests, commit amendment, rebase, one guarded force-with-lease, exact-head CI, and new independent review remain. Even after source merge, activation remains blocked on an assigned package-release/reseed owner and installed-byte read-back.
-
-## Security review 96 remediation
-
-Exact reviewed predecessor head: `1ceb11058f64dd7f4a817ceb2124f980a1c4dd23`.
-
-RED-first focused harness produced 10 named failures: all curl calls lacked size/time/connect bounds; raw ESC email reached mutation; oversized and stalled curl failures were discarded and reached mutation; nonempty Basic output with resolver rc 91 authorized mutation.
-
-Security remediation:
-
- Removed the cross-principal HTTP-401 Basic fallback. Both inspection-401 and merge-401 paths now refuse without Basic resolution or mutation; `get_gitea_basic_auth` references in the merge subject are 0.
- Applied `--max-filesize`, `--max-time`, and `--connect-timeout` to all 3/3 provider curl sites and fail closed on curl transport rc at all 3/3 sites.
- Required linked email bytes to be ASCII and printable before constructing `MergeMessageField`; guarded construction sites 1/1.
-
-GREEN: message-field, exact-head, empty-UID/API, queue branch/repository/SHA, bash syntax, ShellCheck, and diff check pass. R7 total-removal mutants went RED: email guard 3 rows; bound switches 1 row; transport-rc guards 4 rows; HTTP-401 refusal 3 rows. R7 bound: mutants prove total removal only; explicit denominators above prove site coverage.
@@ -10,7 +10,8 @@
    "clean:generated": "node scripts/clean-generated.mjs",
    "typecheck": "pnpm preflight && turbo run typecheck",
    "test:checkout": "node --test scripts/*.test.mjs",
-    "test": "pnpm test:checkout && turbo run test",
+    "test": "pnpm test:checkout && turbo run test && pnpm run test:installer",
+    "test:installer": "bash tools/install-state-machine.test.sh && bash tools/install-next-lane.test.sh && bash tools/verify-greenfield-expected-red.test.sh",
    "format": "prettier --write \"**/*.{ts,tsx,js,jsx,json,md}\"",
    "format:check": "prettier --check \"**/*.{ts,tsx,js,jsx,json,md}\"",
    "prepare": "node scripts/install-hooks.mjs"
@@ -58,6 +58,7 @@ done
 # packages/mosaic/src/framework/manifest.ts — both consume framework-manifest.txt.
 # Sourcing does not run its CLI dispatch (guarded by BASH_SOURCE==$0).
 # shellcheck source=tools/_lib/manifest.sh
+# shellcheck disable=SC1091 # Dynamic SOURCE_DIR; the path is validated by set -e.
 source "$SOURCE_DIR/tools/_lib/manifest.sh"

 # Which paths a keep-mode upgrade may touch is no longer a hand-maintained
@@ -222,12 +223,14 @@ prune_durable_snapshots() {
  [[ "$keep" =~ ^[0-9]+$ ]] && (( keep >= 1 )) || keep=5
  list="$(mktemp)"
  if ! find "$root" -maxdepth 1 -type d -name 'pre-update-*' > "$list"; then
+    warn "Backup pruning skipped; policy: retention cleanup is optional and a failed enumeration must preserve every existing recovery snapshot."
    rm -f "$list"; return 0
  fi
  # Newest-first ordering needs `sort` (`-o` writes back in place — no `mv`
  # dependency); if it is somehow unavailable, leave the backups untouched rather
  # than risk pruning in an undefined order.
  if ! LC_ALL=C sort -r -o "$list" "$list" 2>/dev/null; then
+    warn "Backup pruning skipped; policy: ordering failure preserves all snapshots rather than risking deletion in an undefined order."
    rm -f "$list"; return 0
  fi
  while IFS= read -r d; do
@@ -266,7 +269,11 @@ make_durable_snapshot() {
    warn "Durable snapshot skipped: cannot create backup dir $root (upgrade continues; operator files remain manifest-protected)."
    return 0
  fi
-  chmod 700 "$root" 2>/dev/null || true
+  if ! chmod 700 "$root"; then
+    umask "$old_umask"
+    warn "Durable snapshot skipped: backup root permissions could not be made private; policy: never write operator data to an insufficiently protected location."
+    return 0
+  fi
  dir="$root/pre-update-$ts"
  if [[ -e "$dir" ]]; then           # same-second re-run: disambiguate
    local n=1; while [[ -e "$dir-$n" ]]; do n=$((n + 1)); done; dir="$dir-$n"
@@ -281,7 +288,10 @@ make_durable_snapshot() {
  if ! enumerate_operator_files "$list"; then
    umask "$old_umask"
    warn "Durable snapshot skipped: could not enumerate operator files (upgrade continues)."
-    rm -f "$list"; rmdir "$dir" 2>/dev/null || true
+    rm -f "$list"
+    if ! rmdir "$dir"; then
+      warn "Durable snapshot cleanup left $dir in place; policy: preserve unexpected content rather than deleting it recursively."
+    fi
    return 0
  fi
  while IFS= read -r -d '' rel; do
@@ -292,12 +302,18 @@ make_durable_snapshot() {
      warn "Durable snapshot: could not copy operator file '$rel' (skipped)."
      continue
    fi
-    chmod 600 "$dst" 2>/dev/null || true
+    if ! chmod 600 "$dst"; then
+      rm -f "$dst"
+      warn "Durable snapshot: copied '$rel' could not be made private and was removed; policy: do not retain an insecure recovery copy."
+      continue
+    fi
    count=$((count + 1))
  done < "$list"
  rm -f "$list"
-  # Tighten every dir the copy created (mkdir -p honors umask, but be explicit).
-  find "$dir" -type d -exec chmod 700 {} + 2>/dev/null || true
+  # Tighten every dir the copy created (mkdir -p already honored umask 077).
+  if ! find "$dir" -type d -exec chmod 700 {} +; then
+    warn "Durable snapshot directory permission recheck failed; policy: continue because every directory was created under umask 077, while retaining the diagnostic."
+  fi
  umask "$old_umask"   # UMASK-RESTORE-NORMAL — restore before the upgrade proper resumes (see above)
  DURABLE_SNAPSHOT_DIR="$dir"
  ok "Durable pre-update snapshot: $count operator file(s) saved to $dir (recover with: mosaic restore --list)"
@@ -344,7 +360,9 @@ verify_operator_surface() {
        continue
      fi
      if cp "$snap" "$cur"; then
-        chmod 600 "$cur" 2>/dev/null || true
+        if ! chmod 600 "$cur"; then
+          warn "Operator file '$rel' was restored but its mode could not be tightened to 0600; policy: preserve recovered content and require manual permission repair."
+        fi
        warn "Operator file was modified by the upgrade and has been restored from the pre-update snapshot: $rel"
        healed=$((healed + 1))
      else
@@ -535,7 +553,7 @@ sync_framework_keep() {
    # (unreadable dir) is surfaced as a warning rather than silently swallowed;
    # the "directory not empty" races we tolerate are ignored via -delete's own
    # rc, not by hiding stderr — so a real error is still visible to the operator.
-    if ! find "$dst/$root" -type d -empty -delete 2>/dev/null; then
+    if ! find "$dst/$root" -type d -empty -delete; then
      warn "prune: could not fully sweep empty framework dirs under $root (left as-is)"
    fi
  done < <(manifest_subtree_roots)
@@ -581,7 +599,7 @@ run_migrations() {
    MIGRATION_REMOVED_PATHS+=("bin" "rails")
    if [[ -d "$TARGET_DIR/bin" ]]; then
      ok "Removing legacy bin/ directory (executables now in npm CLI)"
-      rm -rf "$TARGET_DIR/bin"
+      rm -rf "${TARGET_DIR:?}/bin"
    fi

    # Remove old mosaic PATH entry from shell profiles
@@ -706,13 +724,23 @@ mkdir -p "$TARGET_DIR/credentials"
 # by `mosaic init` from templates with user-supplied values.
 reconcile_framework_files

-# Ensure tool scripts are executable
-find "$TARGET_DIR/tools" -name "*.sh" -exec chmod +x {} + 2>/dev/null || true
-find "$TARGET_DIR/tools/_scripts" -type f -exec chmod +x {} + 2>/dev/null || true
+# Ensure tool scripts are executable. These are P4 postconditions, not
+# best-effort cleanup: a chmod failure leaves shipped tools unloadable.
+if ! find "$TARGET_DIR/tools" -name "*.sh" -exec chmod +x {} +; then
+  fail "Could not mark shipped shell tools executable."
+  exit 1
+fi
+if ! find "$TARGET_DIR/tools/_scripts" -type f -exec chmod +x {} +; then
+  fail "Could not mark shipped runtime scripts executable."
+  exit 1
+fi
 # git-credential-mosaic (per-agent Gitea identity helper) ships without a .sh
-# suffix — git resolves credential helpers by exact name/path, not extension —
-# so the *.sh glob above does not cover it; chmod it explicitly.
-[[ -f "$TARGET_DIR/tools/git/git-credential-mosaic" ]] && chmod +x "$TARGET_DIR/tools/git/git-credential-mosaic" 2>/dev/null || true
+# suffix — git resolves credential helpers by exact name/path, not extension.
+if [[ -f "$TARGET_DIR/tools/git/git-credential-mosaic" ]] \
+  && ! chmod +x "$TARGET_DIR/tools/git/git-credential-mosaic"; then
+  fail "Could not mark git-credential-mosaic executable."
+  exit 1
+fi

 ok "Framework synced to $TARGET_DIR"

@@ -739,49 +767,110 @@ step "Post-install tasks"

 SCRIPTS="$TARGET_DIR/tools/_scripts"

+# Capture every fallible post-install command. A failure's text is surfaced and
+# also appended to the parent transaction's private command log. Failure to
+# write that log is fatal: continuing would recreate the false-clean diagnosis
+# INV-C forbids.
+record_phase_outcome() {
+  local phase="$1" status="$2" reason="$3"
+  [[ -n "${MOSAIC_INSTALL_PHASE_STATUS_FILE:-}" ]] || return 0
+  if ! printf '%s\t%s\t%s\n' "$phase" "$status" "$reason" >> "$MOSAIC_INSTALL_PHASE_STATUS_FILE" \
+    || ! sync "$MOSAIC_INSTALL_PHASE_STATUS_FILE"; then
+    fail "Could not durably record $phase action outcome for the parent transaction."
+    exit 1
+  fi
+}
+
+run_captured() {
+  local label="$1" output status=0
+  shift
+  output="$(mktemp "${TMPDIR:-/tmp}/mosaic-post-install.XXXXXX.log")"
+  if "$@" >"$output" 2>&1; then status=0; else status=$?; fi
+  if [[ -n "${MOSAIC_INSTALL_COMMAND_LOG:-}" ]]; then
+    if ! { printf '\n=== %s (exit=%s) ===\n' "$label" "$status"; cat "$output"; } >> "$MOSAIC_INSTALL_COMMAND_LOG" \
+      || ! sync "$MOSAIC_INSTALL_COMMAND_LOG"; then
+      cat "$output" >&2
+      rm -f "$output"
+      fail "Could not durably append '$label' diagnostics to the install command log."
+      exit 1
+    fi
+  fi
+  if [[ "$status" -ne 0 ]]; then cat "$output" >&2; fi
+  rm -f "$output"
+  return "$status"
+}
+
 if [[ -x "$SCRIPTS/mosaic-link-runtime-assets" ]]; then
  link_args=()
  [[ "$ALLOW_INACTIVE_ENFORCEMENT" == "1" ]] && link_args+=(--allow-inactive-enforcement)
-  # stdout is suppressed as before, but stderr is left connected: the
-  # install-ordering guard's FAIL LOUD message (#869 Point-1 C2) must reach
-  # the operator, not be swallowed silently.
-  if "$SCRIPTS/mosaic-link-runtime-assets" "${link_args[@]}" >/dev/null; then
+  if run_captured "runtime asset linking" "$SCRIPTS/mosaic-link-runtime-assets" "${link_args[@]}"; then
+    record_phase_outcome P6 committed "runtime asset linker exited zero"
    ok "Runtime assets linked"
  else
-    warn "Runtime asset linking failed (non-fatal) — see message above for details."
+    record_phase_outcome P6 failed "runtime asset linker exited non-zero"
+    warn "Runtime asset linking did not commit; policy: continue only to enumerate all phase diagnostics, while P6/P9 remain blocking."
  fi
+else
+  record_phase_outcome P6 failed "required runtime asset linker is missing or not executable"
+  warn "Runtime asset linking was not attempted; policy: a missing required linker remains a blocking P6/P9 failure."
 fi

 if [[ -x "$SCRIPTS/mosaic-ensure-sequential-thinking" ]]; then
-  if "$SCRIPTS/mosaic-ensure-sequential-thinking" >/dev/null 2>&1; then
+  if run_captured "sequential-thinking setup" "$SCRIPTS/mosaic-ensure-sequential-thinking"; then
    ok "sequential-thinking MCP configured"
+  elif [[ "${MOSAIC_ALLOW_MISSING_SEQUENTIAL_THINKING:-0}" == "1" ]]; then
+    record_phase_outcome P6 failed "sequential-thinking setup failed under diagnostic-continuation compatibility mode"
+    warn "sequential-thinking setup did not commit; policy: the unified installer compatibility flag allows diagnostic continuation, while P6/P9 remain blocking."
  else
-    if [[ "${MOSAIC_ALLOW_MISSING_SEQUENTIAL_THINKING:-0}" == "1" ]]; then
-      warn "sequential-thinking MCP setup bypassed (MOSAIC_ALLOW_MISSING_SEQUENTIAL_THINKING=1)"
-    else
-      fail "sequential-thinking MCP setup failed (hard requirement)."
-      exit 1
-    fi
+    fail "sequential-thinking MCP setup failed (hard requirement)."
+    exit 1
  fi
 fi

 if [[ -x "$SCRIPTS/mosaic-ensure-excalidraw" ]]; then
-  "$SCRIPTS/mosaic-ensure-excalidraw" >/dev/null 2>&1 && ok "excalidraw MCP configured" || warn "excalidraw MCP setup failed (non-fatal)"
+  if run_captured "excalidraw setup" "$SCRIPTS/mosaic-ensure-excalidraw"; then
+    ok "excalidraw MCP configured"
+  else
+    warn "excalidraw setup did not commit; policy: optional integration failure is retained in the journal and does not define core install readiness."
+  fi
 fi

-if [[ "${MOSAIC_SKIP_SKILLS_SYNC:-0}" != "1" ]] && [[ -x "$SCRIPTS/mosaic-sync-skills" ]]; then
-  "$SCRIPTS/mosaic-sync-skills" >/dev/null 2>&1 && ok "Skills synced" || warn "Skills sync failed (non-fatal)"
+if [[ "${MOSAIC_SKIP_SKILLS_SYNC:-0}" == "1" ]]; then
+  record_phase_outcome P4 failed "required skills sync explicitly skipped"
+  warn "Skills sync was skipped; policy: diagnostic continuation is allowed, but P4/P9 cannot certify an incomplete requested framework install."
+elif [[ -x "$SCRIPTS/mosaic-sync-skills" ]]; then
+  if run_captured "skills sync" "$SCRIPTS/mosaic-sync-skills"; then
+    record_phase_outcome P4 committed "skills sync exited zero"
+    ok "Skills synced"
+  else
+    record_phase_outcome P4 failed "skills sync exited non-zero"
+    warn "Skills sync did not commit; policy: continue to collect P4 diagnostics, but P4/P9 must not certify the install."
+  fi
+else
+  record_phase_outcome P4 failed "required skills sync command is missing or not executable"
+  warn "Skills sync was not attempted; policy: a missing required sync command remains a blocking P4/P9 failure."
 fi

 if [[ -x "$SCRIPTS/mosaic-migrate-local-skills" ]]; then
-  "$SCRIPTS/mosaic-migrate-local-skills" --apply >/dev/null 2>&1 && ok "Local skills migrated" || warn "Local skill migration failed (non-fatal)"
+  if run_captured "local skills migration" "$SCRIPTS/mosaic-migrate-local-skills" --apply; then
+    ok "Local skills migrated"
+  else
+    record_phase_outcome P4 failed "local skills migration exited non-zero"
+    warn "Local skill migration did not commit; policy: preserve user content and continue diagnostics, while P4/P9 remain blocking."
+  fi
 fi

 if [[ -x "$SCRIPTS/mosaic-doctor" ]]; then
-  "$SCRIPTS/mosaic-doctor" >/dev/null 2>&1 && ok "Health audit passed" || warn "Health audit reported issues — run 'mosaic doctor' for details"
+  if run_captured "health audit" "$SCRIPTS/mosaic-doctor"; then
+    ok "Health audit passed"
+  else
+    warn "Health audit found unresolved state; policy: preserve its diagnostics and let P9 issue the authoritative failure."
+  fi
 fi

-# Write version stamp AFTER everything succeeds
+# The version stamp records the successfully committed framework file sync.
+# Post-install failures are carried separately into P4/P6 and cannot be erased
+# by this stamp.
 write_framework_version

 # ── Summary ──────────────────────────────────────────────────
@@ -5,10 +5,7 @@

 detect_platform() {
    local remote_url
-    # `|| true` is load-bearing under `set -e`: outside a git repo this returns 128 and
-    # kills the CALLER before the -z check below can run, so the error message that is
-    # already written here was unreachable. Same idiom as get_gitea_repo_args() below.
-    remote_url=$(git remote get-url origin 2>/dev/null) || true
+    remote_url=$(git remote get-url origin 2>/dev/null)

    if [[ -z "$remote_url" ]]; then
        echo "error: not a git repository or no origin remote" >&2
@@ -42,10 +39,7 @@ detect_platform() {

 get_repo_info() {
    local remote_url
-    # `|| true` is load-bearing under `set -e`: outside a git repo this returns 128 and
-    # kills the CALLER before the -z check below can run, so the error message that is
-    # already written here was unreachable. Same idiom as get_gitea_repo_args() below.
-    remote_url=$(git remote get-url origin 2>/dev/null) || true
+    remote_url=$(git remote get-url origin 2>/dev/null)

    if [[ -z "$remote_url" ]]; then
        echo "error: not a git repository or no origin remote" >&2
@@ -1,6 +1,6 @@
 #!/bin/bash
 # pr-merge.sh - Merge pull requests on Gitea or GitHub
-# Usage: pr-merge.sh -n PR_NUMBER [-m squash] [-d] [--expect-head SHA] [--co-author-trailers --escalate-to PRINCIPAL]
+# Usage: pr-merge.sh -n PR_NUMBER [-m squash] [-d]

 set -euo pipefail

@@ -14,8 +14,6 @@ MERGE_METHOD="squash"
 DELETE_BRANCH=false
 DRY_RUN=false
 EXPECT_HEAD=""
-CO_AUTHOR_TRAILERS=false
-ESCALATE_TO=""

 usage() {
    cat <<EOF
@@ -29,16 +27,12 @@ Options:
    -d, --delete-branch     Delete the head branch after merge
        --dry-run           Run metadata/login preflight without merging
        --expect-head SHA   Refuse unless the PR head matches this full commit SHA
-        --co-author-trailers Build verified trailers from linked PR commit authors
-        --escalate-to NAME  Named principal for an unresolved-author BLOCK
    -h, --help              Show this help message

 Examples:
    $(basename "$0") -n 42                    # Merge PR #42
    $(basename "$0") -n 42 -m squash          # Squash merge
    $(basename "$0") -n 42 -d                 # Squash merge and delete branch
-    $(basename "$0") -n 42 --expect-head 0123456789abcdef0123456789abcdef01234567
-    $(basename "$0") -n 42 --co-author-trailers --escalate-to tl-mosaic
 EOF
    exit "${1:-1}"
 }
@@ -63,25 +57,9 @@ while [[ $# -gt 0 ]]; do
            shift
            ;;
        --expect-head)
-            if [[ $# -lt 2 ]]; then
-                echo "Error: --expect-head requires one full commit SHA." >&2
-                exit 1
-            fi
            EXPECT_HEAD="$2"
            shift 2
            ;;
-        --co-author-trailers)
-            CO_AUTHOR_TRAILERS=true
-            shift
-            ;;
-        --escalate-to)
-            if [[ $# -lt 2 ]]; then
-                echo "Error: --escalate-to requires one principal name." >&2
-                exit 1
-            fi
-            ESCALATE_TO="$2"
-            shift 2
-            ;;
        -h|--help)
            usage 0
            ;;
@@ -110,30 +88,17 @@ if [[ -n "$EXPECT_HEAD" && ! "$EXPECT_HEAD" =~ ^[0-9a-fA-F]{40}$ ]]; then
    echo "Error: --expect-head must be a full 40-character hexadecimal commit SHA." >&2
    exit 1
 fi
-if [[ "$CO_AUTHOR_TRAILERS" == true && -z "$ESCALATE_TO" ]]; then
-    echo "Error: --co-author-trailers requires --escalate-to with a named principal." >&2
-    exit 1
-fi
-if [[ -n "$ESCALATE_TO" && ! "$ESCALATE_TO" =~ ^[A-Za-z0-9_.-]+$ ]]; then
-    echo "Error: --escalate-to must be one exact principal name." >&2
-    exit 1
-fi
-if [[ "$CO_AUTHOR_TRAILERS" != true && -n "$ESCALATE_TO" ]]; then
-    echo "Error: --escalate-to is valid only with --co-author-trailers." >&2
-    exit 1
-fi

 PR_METADATA="$("$SCRIPT_DIR/pr-metadata.sh" -n "$PR_NUMBER")"
 BASE_BRANCH="$(printf '%s' "$PR_METADATA" | python3 -c 'import json, sys; print((json.load(sys.stdin).get("baseRefName") or "").strip())')"
 HEAD_BRANCH="$(printf '%s' "$PR_METADATA" | python3 -c 'import json, sys; print((json.load(sys.stdin).get("headRefName") or "").strip())')"
 HEAD_SHA="$(printf '%s' "$PR_METADATA" | python3 -c 'import json, sys; print((json.load(sys.stdin).get("headRefOid") or "").strip())')"
 HEAD_REPO="$(printf '%s' "$PR_METADATA" | python3 -c 'import json, sys; value=json.load(sys.stdin).get("headRepository") or ""; print((value.get("nameWithOwner") or value.get("full_name") or "") if isinstance(value, dict) else str(value).strip())')"
-PR_TITLE="$(printf '%s' "$PR_METADATA" | python3 -c 'import json, sys; print((json.load(sys.stdin).get("title") or "").strip())')"
-PR_AUTHOR="$(printf '%s' "$PR_METADATA" | python3 -c 'import json, sys; value=json.load(sys.stdin).get("author") or ""; print((value.get("login") or "").strip() if isinstance(value, dict) else str(value).strip())')"
 if [[ "$BASE_BRANCH" != "main" ]]; then
    echo "Error: Mosaic policy allows merges only for PRs targeting 'main' (found '$BASE_BRANCH')." >&2
    exit 1
 fi
+
 if [[ -z "$HEAD_BRANCH" || -z "$HEAD_REPO" || ! "$HEAD_SHA" =~ ^[0-9a-fA-F]{40}$ ]]; then
    echo "Error: Could not resolve the PR head branch, repository, and full commit SHA for queue inspection." >&2
    exit 1
@@ -157,442 +122,70 @@ PLATFORM=$(detect_platform)
 OWNER=$(get_repo_owner)
 REPO=$(get_repo_name)

-write_curl_auth_config() {
-    local mode="$1" credential="$2"
-    printf '%s' "$credential" | python3 -c '
-import sys
-mode = sys.argv[1]
-credential = sys.stdin.read()
-if not credential or any(char in credential for char in "\r\n"):
-    raise SystemExit(1)
-escaped = credential.replace("\\", "\\\\").replace("\"", "\\\"")
-if mode == "token":
-    print(f"header = \"Authorization: token {escaped}\"")
-elif mode == "basic":
-    print(f"user = \"{escaped}\"")
-else:
-    raise SystemExit(1)
-' "$mode"
-}
-
-LAST_GITEA_HTTP_CODE="000"
-LAST_GITEA_ERROR=""
-MERGE_TEMP_DIRS=()
-GITEA_CURL_MAX_BYTES="${MOSAIC_GITEA_CURL_MAX_BYTES:-1048576}"
-GITEA_CURL_MAX_TIME="${MOSAIC_GITEA_CURL_MAX_TIME_SEC:-30}"
-GITEA_CURL_CONNECT_TIMEOUT="${MOSAIC_GITEA_CURL_CONNECT_TIMEOUT_SEC:-10}"
-for bound in "$GITEA_CURL_MAX_BYTES" "$GITEA_CURL_MAX_TIME" "$GITEA_CURL_CONNECT_TIMEOUT"; do
-    if [[ ! "$bound" =~ ^[1-9][0-9]*$ ]]; then
-        echo "Error: Gitea curl bounds must be positive integers; refusing request." >&2
-        exit 1
-    fi
-done
-GITEA_CURL_BOUNDS=(
-    --max-filesize "$GITEA_CURL_MAX_BYTES"
-    --max-time "$GITEA_CURL_MAX_TIME"
-    --connect-timeout "$GITEA_CURL_CONNECT_TIMEOUT"
-)
-
-format_gitea_error_response() {
-    local response_file="$1"
-    python3 - "$response_file" <<'PY'
-import json
-import sys
-
-with open(sys.argv[1], "rb") as handle:
-    raw = handle.read(65536)
-try:
-    response = json.loads(raw.decode("utf-8", errors="replace"))
-except (UnicodeDecodeError, json.JSONDecodeError):
-    message = "non-JSON response omitted"
-else:
-    if isinstance(response, dict):
-        message = response.get("message") or response.get("error")
-        if not message and response.get("errors") is not None:
-            message = json.dumps(response["errors"], separators=(",", ":"))
-    else:
-        message = None
-    if not message:
-        message = "JSON response contained no error message"
-message = str(message)
-if len(message) > 500:
-    message = message[:500] + "..."
-print(ascii(message))
-PY
-}
-
-cleanup_merge_temp_dirs() {
-    local path
-    for path in "${MERGE_TEMP_DIRS[@]}"; do
-        [[ -n "$path" ]] && rm -rf -- "$path"
-    done
-}
-trap cleanup_merge_temp_dirs EXIT
-trap 'exit 130' INT
-trap 'exit 143' TERM
-
-fetch_gitea_pr_head() {
-    local host="$1" auth_mode="$2" credential="$3" work_root="$4"
-    local response_file raw_code api_url auth_config curl_rc
-    response_file=$(mktemp "$work_root/pr-merge-pr.XXXXXX")
-    api_url="https://${host}/api/v1/repos/${OWNER}/${REPO}/pulls/${PR_NUMBER}"
-    if ! auth_config=$(write_curl_auth_config "$auth_mode" "$credential"); then
-        echo "Error: Could not construct Gitea authentication config; refusing request." >&2
-        rm -f "$response_file"
-        return 1
-    fi
-    raw_code=$(curl -sS -K - "${GITEA_CURL_BOUNDS[@]}" -w '%{http_code}' -o "$response_file" \
-        -H "User-Agent: curl/8" "$api_url" <<<"$auth_config")
-    curl_rc=$?
-    LAST_GITEA_HTTP_CODE="${raw_code:-000}"
-    if [[ "$curl_rc" -ne 0 ]]; then
-        LAST_GITEA_ERROR="curl transport failed (rc=$curl_rc)"
-        rm -f "$response_file"
-        return 1
-    fi
-    if [[ ! "$raw_code" =~ ^2 ]]; then
-        LAST_GITEA_ERROR=$(format_gitea_error_response "$response_file")
-        rm -f "$response_file"
-        return 1
-    fi
-    if ! python3 - "$response_file" <<'PY'
-import json
-import re
-import sys
-
-with open(sys.argv[1], encoding="utf-8") as handle:
-    pull = json.load(handle)
-head = pull.get("head") if isinstance(pull, dict) else None
-sha = str(head.get("sha") or "") if isinstance(head, dict) else ""
-if not re.fullmatch(r"[0-9a-fA-F]{40}", sha):
-    raise SystemExit(1)
-print(sha)
-PY
-    then
-        echo "Error: Gitea PR response has no valid head SHA; refusing merge." >&2
-        rm -f "$response_file"
-        return 1
-    fi
-    rm -f "$response_file"
-}
-
-fetch_gitea_pr_commits() {
-    local host="$1" auth_mode="$2" credential="$3" work_root="$4"
-    local page page_file combined_file merged_file raw_code page_count api_url auth_config curl_rc
-    mkdir -p "$work_root"
-    if ! auth_config=$(write_curl_auth_config "$auth_mode" "$credential"); then
-        echo "Error: Could not construct Gitea authentication config; refusing request." >&2
-        return 1
-    fi
-    combined_file=$(mktemp "$work_root/pr-merge-commits.XXXXXX")
-    printf '[]' > "$combined_file"
-
-    page=1
-    while true; do
-        page_file=$(mktemp "$work_root/pr-merge-commits-page.XXXXXX")
-        api_url="https://${host}/api/v1/repos/${OWNER}/${REPO}/pulls/${PR_NUMBER}/commits?limit=50&page=${page}"
-        raw_code=$(curl -sS -K - "${GITEA_CURL_BOUNDS[@]}" -w '%{http_code}' -o "$page_file" \
-            -H "User-Agent: curl/8" "$api_url" <<<"$auth_config")
-        curl_rc=$?
-        LAST_GITEA_HTTP_CODE="${raw_code:-000}"
-        if [[ "$curl_rc" -ne 0 ]]; then
-            LAST_GITEA_ERROR="curl transport failed (rc=$curl_rc)"
-            rm -f "$page_file" "$combined_file"
-            return 1
-        fi
-        if [[ ! "$raw_code" =~ ^2 ]]; then
-            LAST_GITEA_ERROR=$(format_gitea_error_response "$page_file")
-            rm -f "$page_file" "$combined_file"
-            return 1
-        fi
-
-        if ! page_count=$(python3 - "$page_file" <<'PY'
-import json
-import sys
-
-with open(sys.argv[1], encoding="utf-8") as handle:
-    page = json.load(handle)
-if not isinstance(page, list):
-    raise SystemExit(1)
-print(len(page))
-PY
-        ); then
-            echo "Error: Gitea PR commits response is not a JSON array; refusing merge." >&2
-            rm -f "$page_file" "$combined_file"
-            return 1
-        fi
-
-        merged_file=$(mktemp "$work_root/pr-merge-commits-merged.XXXXXX")
-        if ! python3 - "$combined_file" "$page_file" > "$merged_file" <<'PY'
-import json
-import sys
-
-with open(sys.argv[1], encoding="utf-8") as handle:
-    combined = json.load(handle)
-with open(sys.argv[2], encoding="utf-8") as handle:
-    page = json.load(handle)
-json.dump(combined + page, sys.stdout, separators=(",", ":"))
-PY
-        then
-            echo "Error: Could not combine paginated PR commit metadata; refusing merge." >&2
-            rm -f "$page_file" "$combined_file" "$merged_file"
-            return 1
-        fi
-        mv "$merged_file" "$combined_file"
-        rm -f "$page_file"
-
-        if [[ "$page_count" -lt 50 ]]; then
-            break
-        fi
-        page=$((page + 1))
-        if [[ "$page" -gt 1000 ]]; then
-            echo "Error: PR commit pagination exceeded 1000 pages; refusing merge." >&2
-            rm -f "$combined_file"
-            return 1
-        fi
-    done
-
-    cat "$combined_file"
-    rm -f "$combined_file"
-}
-
-# LIMITATION: author.login resolution proves the commit address maps to a registered account.
-# It does NOT prove the named principal authored the commit — git author metadata is self-asserted.
-# This gate checks ATTRIBUTION LINKAGE, not AUTHORSHIP. Commit signing is out of scope and unadopted.
-build_coauthor_message_fields() {
-    local commits_file="$1" context_file="$2" head_file="$3"
-    python3 - "$commits_file" "$context_file" "$head_file" <<'PY'
-import json
-import re
-import sys
-
-commits_path, context_path, head_path = sys.argv[1:]
-with open(commits_path, encoding="utf-8") as handle:
-    commits = json.load(handle)
-head_sha = open(head_path, encoding="utf-8").read().strip()
-context_parts = open(context_path, "rb").read().split(b"\0")
-if len(context_parts) != 4 or context_parts[-1] != b"":
-    raise SystemExit(1)
-poster, title, principal = (part.decode("utf-8") for part in context_parts[:3])
-
-if not isinstance(commits, list) or not commits:
-    print(
-        f"BLOCK: provider returned no PR commits; author identity is unmeasurable. "
-        f"Refusing merge; escalate to named principal '{principal}'.",
-        file=sys.stderr,
-    )
-    raise SystemExit(75)
-if not poster:
-    print(
-        f"BLOCK: PR poster login is empty; refusing merge; "
-        f"escalate to named principal '{principal}'.",
-        file=sys.stderr,
-    )
-    raise SystemExit(75)
-
-if not re.fullmatch(r"[0-9a-fA-F]{40}", head_sha):
-    print(
-        f"BLOCK: inspected PR head SHA is invalid; refusing merge; "
-        f"escalate to named principal '{principal}'.",
-        file=sys.stderr,
-    )
-    raise SystemExit(75)
-
-seen = set()
-trailers = []
-head_seen = False
-for item in commits:
-    if not isinstance(item, dict):
-        print(f"BLOCK: malformed PR commit metadata; escalate to named principal '{principal}'.", file=sys.stderr)
-        raise SystemExit(75)
-    sha = str(item.get("sha") or "<unknown>")
-    if sha == head_sha:
-        head_seen = True
-    commit = item.get("commit") if isinstance(item.get("commit"), dict) else {}
-    commit_author = commit.get("author") if isinstance(commit.get("author"), dict) else {}
-    email = str(commit_author.get("email") or "").strip()
-    provider_author = item.get("author") if isinstance(item.get("author"), dict) else {}
-    login = str(provider_author.get("login") or "").strip()
-
-    if not login:
-        diagnostic_email = email or "<missing>"
-        print(
-            f"BLOCK: commit {sha!r} has author.login=NULL while "
-            f"commit.author.email={diagnostic_email!r}; refusing merge; "
-            f"escalate to named principal '{principal}'.",
-            file=sys.stderr,
-        )
-        raise SystemExit(75)
-    if (
-        not email.isascii()
-        or not email.isprintable()
-        or not re.fullmatch(r"[A-Za-z0-9_.-]+", login)
-        or not re.fullmatch(r"[^<>\s]+@[^<>\s]+", email)
-    ):
-        print(
-            f"BLOCK: commit {sha!r} has unusable linked identity "
-            f"author.login={login!r}, commit.author.email={email!r}; refusing merge; "
-            f"escalate to named principal '{principal}'.",
-            file=sys.stderr,
-        )
-        raise SystemExit(75)
-    if login == poster or login in seen:
-        continue
-    seen.add(login)
-    trailers.append(f"Co-authored-by: {login} <{email}>")
-
-if not head_seen:
-    print(
-        f"BLOCK: inspected PR head is absent from commit enumeration; refusing merge; "
-        f"escalate to named principal '{principal}'.",
-        file=sys.stderr,
-    )
-    raise SystemExit(75)
-if not trailers:
-    print("{}")
-    raise SystemExit(0)
-if not title:
-    print(
-        f"BLOCK: PR title is empty; refusing merge; escalate to named principal '{principal}'.",
-        file=sys.stderr,
-    )
-    raise SystemExit(75)
-if not title.isprintable() or re.match(r"^[A-Za-z-]+-[Bb]y:", title):
-    print(
-        f"BLOCK: PR title is not one printable, non-trailer line; refusing merge; "
-        f"escalate to named principal '{principal}'.",
-        file=sys.stderr,
-    )
-    raise SystemExit(75)
-
-print(json.dumps({
-    "MergeTitleField": title,
-    "MergeMessageField": "\n".join(trailers),
-}, separators=(",", ":")))
-PY
-}
-
-merge_gitea_api_attempt() {
-    local host="$1" auth_mode="$2" credential="$3"
-    local api_url attempt_dir body_file raw_code commits_file fields_file context_file head_file payload_file work_root attempt_rc auth_config curl_rc
-    LAST_GITEA_HTTP_CODE="000"
-    LAST_GITEA_ERROR=""
+merge_gitea_with_api() {
+    local host="$1" api_url token basic_auth body_file raw_code payload
    api_url="https://${host}/api/v1/repos/${OWNER}/${REPO}/pulls/${PR_NUMBER}/merge"
-    work_root="${AGENT_WORK_ROOT:-${HOME:-/tmp}/mosaic/agent-work}"
-    mkdir -p "$work_root"
-    attempt_dir=$(mktemp -d "$work_root/pr-merge-attempt.XXXXXX")
-    chmod 0700 "$attempt_dir"
-    MERGE_TEMP_DIRS+=("$attempt_dir")
-    body_file=$(mktemp "$attempt_dir/api-response.XXXXXX")
-    fields_file=$(mktemp "$attempt_dir/message-fields.XXXXXX")
-    payload_file=$(mktemp "$attempt_dir/payload.XXXXXX")
-    printf '{}' > "$fields_file"
-
-    if [[ "$CO_AUTHOR_TRAILERS" == true ]]; then
-        commits_file=$(mktemp "$attempt_dir/pr-merge-commits-input.XXXXXX")
-        context_file=$(mktemp "$attempt_dir/pr-merge-message-context.XXXXXX")
-        head_file=$(mktemp "$attempt_dir/pr-merge-head-input.XXXXXX")
-        printf '%s\0%s\0%s\0' "$PR_AUTHOR" "$PR_TITLE" "$ESCALATE_TO" > "$context_file"
-        if fetch_gitea_pr_head "$host" "$auth_mode" "$credential" "$attempt_dir" > "$head_file"; then
-            :
-        else
-            attempt_rc=$?
-            rm -f "$body_file" "$fields_file" "$payload_file" "$commits_file" "$context_file" "$head_file"
-            return "$attempt_rc"
-        fi
-        if [[ "$(<"$head_file")" != "$HEAD_SHA" ]]; then
-            echo "BLOCK: authenticated PR head moved from reviewed $HEAD_SHA to $(<"$head_file"); refusing merge; escalate to named principal '$ESCALATE_TO'." >&2
-            rm -f "$body_file" "$fields_file" "$payload_file" "$commits_file" "$context_file" "$head_file"
-            return 75
-        fi
-        if fetch_gitea_pr_commits "$host" "$auth_mode" "$credential" "$attempt_dir" > "$commits_file"; then
-            :
-        else
-            attempt_rc=$?
-            rm -f "$body_file" "$fields_file" "$payload_file" "$commits_file" "$context_file" "$head_file"
-            return "$attempt_rc"
-        fi
-        if build_coauthor_message_fields "$commits_file" "$context_file" "$head_file" > "$fields_file"; then
-            :
-        else
-            attempt_rc=$?
-            rm -f "$body_file" "$fields_file" "$payload_file" "$commits_file" "$context_file" "$head_file"
-            return "$attempt_rc"
-        fi
-        rm -f "$commits_file" "$context_file" "$head_file"
-    fi
-
-    if ! python3 - "$fields_file" "$HEAD_SHA" "$DELETE_BRANCH" > "$payload_file" <<'PY'
+    mkdir -p "${AGENT_WORK_ROOT:-${HOME:-/tmp}/mosaic/agent-work}"
+    body_file=$(mktemp "${AGENT_WORK_ROOT:-${HOME:-/tmp}/mosaic/agent-work}/pr-merge-api-response.XXXXXX")
+    payload=$(python3 - "$HEAD_SHA" "$DELETE_BRANCH" <<'PY'
 import json
 import sys

-with open(sys.argv[1], encoding="utf-8") as handle:
-    fields = json.load(handle)
-head_sha, delete_branch = sys.argv[2:]
+head_sha, delete_branch = sys.argv[1:]
 payload = {"Do": "squash", "head_commit_id": head_sha}
 if delete_branch == "true":
    payload["delete_branch_after_merge"] = True
-payload.update(fields)
-allowed = {"Do", "head_commit_id", "delete_branch_after_merge", "MergeTitleField", "MergeMessageField"}
-if payload.get("Do") != "squash" or set(payload) - allowed:
-    raise SystemExit(1)
 print(json.dumps(payload, separators=(",", ":")))
 PY
-    then
-        rm -f "$body_file" "$fields_file" "$payload_file"
-        return 1
-    fi
-    rm -f "$fields_file"
+)

-    if ! auth_config=$(write_curl_auth_config "$auth_mode" "$credential"); then
-        echo "Error: Could not construct Gitea authentication config; refusing request." >&2
-        rm -f "$body_file" "$payload_file"
-        return 1
+    token=$(get_gitea_token "$host" || true)
+    if [[ -n "$token" ]]; then
+        raw_code=$(curl -sS -w '%{http_code}' -o "$body_file" \
+            -X POST \
+            -H "User-Agent: curl/8" \
+            -H "Authorization: token $token" \
+            -H 'Content-Type: application/json' \
+            -d "$payload" \
+            "$api_url" || true)
+        if [[ "$raw_code" =~ ^2 ]]; then
+            rm -f "$body_file"
+            return 0
+        fi
    fi
-    raw_code=$(curl -sS -K - "${GITEA_CURL_BOUNDS[@]}" -w '%{http_code}' -o "$body_file" \
-        -X POST -H "User-Agent: curl/8" \
-        -H 'Content-Type: application/json' \
-        --data-binary "@$payload_file" "$api_url" <<<"$auth_config")
-    curl_rc=$?
-    LAST_GITEA_HTTP_CODE="${raw_code:-000}"
-    if [[ "$curl_rc" -ne 0 ]]; then
-        LAST_GITEA_ERROR="curl transport failed (rc=$curl_rc)"
-        rm -f "$body_file" "$payload_file"
-        rm -rf -- "$attempt_dir"
-        return 1
-    fi
-    if [[ ! "$raw_code" =~ ^2 ]]; then
-        LAST_GITEA_ERROR=$(format_gitea_error_response "$body_file")
-    fi
-    rm -f "$body_file" "$payload_file"
-    rm -rf -- "$attempt_dir"
-    [[ "$raw_code" =~ ^2 ]]
-}

-merge_gitea_with_api() {
-    local host="$1" token attempt_rc
+    basic_auth=$(get_gitea_basic_auth "$host" || true)
+    if [[ -n "$basic_auth" ]]; then
+        raw_code=$(curl -sS -w '%{http_code}' -o "$body_file" \
+            -X POST \
+            -u "$basic_auth" \
+            -H "User-Agent: curl/8" \
+            -H 'Content-Type: application/json' \
+            -d "$payload" \
+            "$api_url" || true)
+        if [[ "$raw_code" =~ ^2 ]]; then
+            rm -f "$body_file"
+            return 0
+        fi
+    fi

-    if ! token=$(get_gitea_token "$host"); then
-        echo "Error: Could not resolve the required Gitea token; refusing merge without changing principals." >&2
-        return 1
-    fi
-    if [[ -z "$token" ]]; then
-        echo "Error: Required Gitea token resolved empty; refusing merge without changing principals." >&2
-        return 1
-    fi
-    if merge_gitea_api_attempt "$host" token "$token"; then
-        return 0
-    else
-        attempt_rc=$?
-    fi
-    if [[ "$attempt_rc" -eq 75 ]]; then
-        return 75
-    fi
-    if [[ "$LAST_GITEA_HTTP_CODE" != "401" ]]; then
-        echo "Error: Gitea API merge failed with the identity-bound token (HTTP ${LAST_GITEA_HTTP_CODE:-000}).${LAST_GITEA_ERROR:+ Provider response: $LAST_GITEA_ERROR}" >&2
-        return 1
-    fi
-    echo "Error: Gitea API rejected the identity-bound token with HTTP 401; refusing cross-principal credential fallback." >&2
+    python3 - "${raw_code:-000}" "$body_file" <<'PY' >&2
+import json
+import sys
+code, path = sys.argv[1], sys.argv[2]
+try:
+    with open(path, encoding="utf-8", errors="replace") as handle:
+        raw = handle.read(500)
+    data = json.loads(raw) if raw else {}
+    message = data.get("message") or data.get("error") or raw or "empty response"
+except Exception:
+    try:
+        message = open(path, encoding="utf-8", errors="replace").read(500) or "empty response"
+    except Exception:
+        message = "unreadable response"
+print(f"Error: Gitea API merge failed with HTTP {code}: {message}")
+PY
+    rm -f "$body_file"
    return 1
 }

@@ -602,10 +195,11 @@ if [[ "$DRY_RUN" == true ]]; then
            echo "Error: Cannot determine host from origin remote URL" >&2
            exit 1
        }
-        if [[ "$CO_AUTHOR_TRAILERS" == true ]]; then
-            echo "Dry run: would verify PR commit authors and merge PR #$PR_NUMBER on $HOST with authenticated Gitea API message fields (base=$BASE_BRANCH, method=squash)."
+        TEA_LOGIN="$(get_gitea_login_for_host "$HOST" || true)"
+        if [[ -n "$TEA_LOGIN" ]]; then
+            echo "Dry run: would merge PR #$PR_NUMBER on $HOST with tea login '$TEA_LOGIN' (base=$BASE_BRANCH, method=squash)."
        else
-            echo "Dry run: would merge PR #$PR_NUMBER on $HOST with the authenticated exact-head Gitea API path (base=$BASE_BRANCH, method=squash)."
+            echo "Dry run: would merge PR #$PR_NUMBER on $HOST with authenticated Gitea API fallback (base=$BASE_BRANCH, method=squash)."
        fi
    else
        echo "Dry run: would merge PR #$PR_NUMBER on $PLATFORM (base=$BASE_BRANCH, method=squash)."
@@ -615,10 +209,6 @@ fi

 case "$PLATFORM" in
    github)
-        if [[ "$CO_AUTHOR_TRAILERS" == true ]]; then
-            echo "Error: --co-author-trailers currently requires the Gitea REST message-field contract." >&2
-            exit 1
-        fi
        cmd=(gh pr merge "$PR_NUMBER" --squash --match-head-commit "$HEAD_SHA")
        [[ "$DELETE_BRANCH" == true ]] && cmd+=(--delete-branch)
        "${cmd[@]}"
@@ -629,7 +219,7 @@ case "$PLATFORM" in
            exit 1
        }
        # Gitea's API head_commit_id is an atomic compare-and-merge precondition.
-        # tea cannot express it, so every Gitea merge uses the authenticated API path.
+        # tea cannot express it, so exact-head merges use the authenticated API path.
        merge_gitea_with_api "$HOST"
        ;;
    *)
@@ -9,51 +9,10 @@ WORK_DIR="${MOSAIC_TEST_WORK_DIR:-$PWD/.mosaic-test-work/ci-queue-wait-tristate}
 REPO_DIR="$WORK_DIR/repo"
 STUB_DIR="$WORK_DIR/stubs"
 AUDIT_LOG="$WORK_DIR/audit/ci-queue-wait.jsonl"
-STATUS_OBSERVED="$WORK_DIR/status-observed"
-CLOCK_LOG="$WORK_DIR/clock.log"
-WATCHDOG_PYTHON="/usr/bin/python3"
-WATCHDOG_SCRIPT="$WORK_DIR/real-clock-watchdog.py"
-WATCHDOG_TIMEOUT_SEC=5
-WATCHDOG_EXIT=90
 FEATURE_BRANCH="fix/rm-03-fixture"

-if [[ ! -x "$WATCHDOG_PYTHON" ]]; then
-    echo "FAIL setup: required real-clock watchdog runtime is unavailable at $WATCHDOG_PYTHON" >&2
-    exit 1
-fi
-
 rm -rf "$WORK_DIR"
 mkdir -p "$REPO_DIR" "$STUB_DIR"
-cat > "$WATCHDOG_SCRIPT" <<'PY'
-import os
-import signal
-import subprocess
-import sys
-
-if len(sys.argv) < 3:
-    raise SystemExit(2)
-
-timeout_seconds = float(sys.argv[1])
-process = subprocess.Popen(sys.argv[2:], start_new_session=True)
-try:
-    return_code = process.wait(timeout=timeout_seconds)
-except subprocess.TimeoutExpired:
-    try:
-        os.killpg(process.pid, signal.SIGKILL)
-    except ProcessLookupError:
-        pass
-    process.wait()
-    print(
-        f"FAIL HANG watchdog: subject exceeded {timeout_seconds:g}s "
-        "before completing its intended path",
-        file=sys.stderr,
-    )
-    raise SystemExit(90)
-
-if return_code < 0:
-    raise SystemExit(128 - return_code)
-raise SystemExit(return_code)
-PY
 git -C "$REPO_DIR" init -q
 git -C "$REPO_DIR" checkout -q -b "$FEATURE_BRANCH"
 git -C "$REPO_DIR" remote add origin https://git.example.test/acme/widgets.git
@@ -74,9 +33,6 @@ printf '%s\n' "$url" >> "${MOSAIC_STUB_URL_LOG:?}"

 case "$url" in
    */branches/*)
-        if [[ "${MOSAIC_STUB_BRANCH_MODE:-ok}" == "hang-before-provider" ]]; then
-            while :; do :; done
-        fi
        if [[ "${MOSAIC_STUB_BRANCH_MODE:-ok}" == "unreachable" ]]; then
            exit 7
        fi
@@ -88,7 +44,6 @@ case "$url" in
        fi
        ;;
    */status)
-        : > "${MOSAIC_STUB_STATUS_OBSERVED:?}"
        case "${MOSAIC_STUB_STATUS_MODE:?}" in
            success)   printf '%s' '{"state":"success","statuses":[{"status":"success"}]}' ;;
            pending)   printf '%s' '{"state":"pending","statuses":[{"status":"pending","context":"ci/test"}]}' ;;
@@ -108,31 +63,7 @@ case "$url" in
    *) echo "unexpected curl URL: $url" >&2; exit 2 ;;
 esac
 SH
-
-cat > "$STUB_DIR/date" <<'SH'
-#!/usr/bin/env bash
-set -euo pipefail
-
-if [[ "$#" -ne 1 || "$1" != "+%s" ]]; then
-    echo "unexpected date invocation: $*" >&2
-    exit 2
-fi
-
-if [[ -e "${MOSAIC_STUB_STATUS_OBSERVED:?}" ]]; then
-    printf 'date-phase=after-status\n' >> "${MOSAIC_STUB_CLOCK_LOG:?}"
-    printf '1002\n'
-else
-    printf 'date-phase=before-status\n' >> "${MOSAIC_STUB_CLOCK_LOG:?}"
-    printf '1000\n'
-fi
-SH
-
-cat > "$STUB_DIR/sleep" <<'SH'
-#!/usr/bin/env bash
-set -euo pipefail
-printf 'sleep-after-status=%s\n' "$*" >> "${MOSAIC_STUB_CLOCK_LOG:?}"
-SH
-chmod +x "$STUB_DIR/curl" "$STUB_DIR/date" "$STUB_DIR/sleep"
+chmod +x "$STUB_DIR/curl"

 run_guard() {
    local status_mode="$1"
@@ -152,46 +83,13 @@ run_guard() {
            export GITEA_URL=https://git.example.test
            export MOSAIC_STUB_STATUS_MODE="$status_mode"
        fi
-        rm -f "$STATUS_OBSERVED" "$CLOCK_LOG"
        export MOSAIC_STUB_URL_LOG="$WORK_DIR/urls.log"
-        export MOSAIC_STUB_STATUS_OBSERVED="$STATUS_OBSERVED"
-        export MOSAIC_STUB_CLOCK_LOG="$CLOCK_LOG"
        export MOSAIC_CI_QUEUE_AUDIT_LOG="$audit_log"
-        # Provider observation is the synchronization event. The one-second
-        # timeout is subject semantics under virtual time, never a wall wait.
-        # The absolute Python runtime uses an internal monotonic wait and kills
-        # the subject's isolated process group. Neither operation can resolve
-        # to the virtual date/sleep stubs at the front of PATH.
-        local subject_rc
-        if "$WATCHDOG_PYTHON" "$WATCHDOG_SCRIPT" "$WATCHDOG_TIMEOUT_SEC" \
-            "$SCRIPT_DIR/ci-queue-wait.sh" --purpose "${MOSAIC_TEST_PURPOSE:-push}" -t 1 -i 1 "$@"; then
-            subject_rc=0
-        else
-            subject_rc=$?
-        fi
-        return "$subject_rc"
+        "$SCRIPT_DIR/ci-queue-wait.sh" --purpose "${MOSAIC_TEST_PURPOSE:-push}" -t 0 -i 0 "$@"
    )
 }

 failures=0
-assert_provider_observed() {
-    local name="$1" require_expiration="${2:-0}"
-    if [[ ! -e "$STATUS_OBSERVED" ]]; then
-        echo "FAIL $name: status provider was not observed" >&2
-        failures=$((failures + 1))
-    fi
-    if [[ ! -s "$CLOCK_LOG" ]] || ! grep -q '^date-phase=before-status$' "$CLOCK_LOG"; then
-        echo "FAIL $name: virtual clock interception did not run before provider observation" >&2
-        failures=$((failures + 1))
-    fi
-    if [[ "$require_expiration" -eq 1 ]]; then
-        if ! grep -q '^sleep-after-status=' "$CLOCK_LOG" || ! grep -q '^date-phase=after-status$' "$CLOCK_LOG"; then
-            echo "FAIL $name: pending path did not expire after provider observation" >&2
-            failures=$((failures + 1))
-        fi
-    fi
-}
-
 run_assertion() {
    local name="$1" expected_rc="$2" status_mode="$3" required_text="$4"
    local output rc
@@ -226,13 +124,6 @@ run_assertion() {
        printf '%s\n' "$output" >&2
        failures=$((failures + 1))
    fi
-    if [[ "$status_mode" != "credential-unresolvable" ]]; then
-        if [[ "$status_mode" == "pending" ]]; then
-            assert_provider_observed "$name" 1
-        else
-            assert_provider_observed "$name"
-        fi
-    fi
 }

 set -e
@@ -249,27 +140,6 @@ run_assertion large-payload not126 large-success 'state=terminal-success'
 run_assertion credential-unresolvable zero credential-unresolvable 'CANNOT_ASSERT'
 run_assertion provider-unreachable zero unreachable 'CANNOT_ASSERT'

-# Positive liveness control: a subject mutant hangs before the branch lookup
-# can reach the status provider. Only the independent real-clock watchdog may
-# terminate it, and its failure must be distinct from subject timeout rc=124.
-set +e
-watchdog_output=$(MOSAIC_STUB_BRANCH_MODE=hang-before-provider run_guard success "$AUDIT_LOG" 2>&1)
-watchdog_rc=$?
-set -e
-if [[ "$watchdog_rc" -ne "$WATCHDOG_EXIT" ]]; then
-    echo "FAIL watchdog-control: expected hang-specific rc=$WATCHDOG_EXIT, got rc=$watchdog_rc" >&2
-    failures=$((failures + 1))
-fi
-if [[ "$watchdog_output" != *"FAIL HANG watchdog:"* ]]; then
-    echo "FAIL watchdog-control: expected distinct hang-specific diagnostic" >&2
-    printf '%s\n' "$watchdog_output" >&2
-    failures=$((failures + 1))
-fi
-if [[ -e "$STATUS_OBSERVED" ]]; then
-    echo "FAIL watchdog-control: hanging mutant unexpectedly reached the status provider" >&2
-    failures=$((failures + 1))
-fi
-
 if [[ ! -s "$AUDIT_LOG" ]] || ! grep -q '"outcome":"CANNOT_ASSERT"' "$AUDIT_LOG"; then
    echo "FAIL provider-unreachable-audit: expected durable CANNOT_ASSERT JSONL record" >&2
    failures=$((failures + 1))
@@ -290,7 +160,6 @@ if [[ "$merge_unreachable_output" != *"CANNOT_ASSERT"* ]]; then
    echo "FAIL merge-provider-unreachable: expected loud CANNOT_ASSERT diagnostic" >&2
    failures=$((failures + 1))
 fi
-assert_provider_observed merge-provider-unreachable
 merge_audit_lines_after=$(wc -l < "$AUDIT_LOG")
 if [[ "$merge_audit_lines_after" -le "$merge_audit_lines_before" ]]; then
    echo "FAIL merge-provider-unreachable: expected an additional audit record" >&2
@@ -354,7 +223,6 @@ if [[ "$audit_failure_output" != *"audit"* ]]; then
    echo "FAIL audit-unavailable: expected loud audit failure diagnostic" >&2
    failures=$((failures + 1))
 fi
-assert_provider_observed audit-unavailable

 if [[ "$failures" -ne 0 ]]; then
    echo "ci-queue-wait tri-state regression failed ($failures assertions)" >&2
@@ -1,58 +0,0 @@
-#!/bin/bash
-# Regression: detect_platform / get_repo_info must FAIL LOUDLY outside a git repo,
-# not kill the caller silently.
-#
-# Both functions already contained the right error path:
-#     if [[ -z "$remote_url" ]]; then echo "error: not a git repository..." >&2; return 1; fi
-# but under `set -e` -- which every wrapper in this directory uses -- the preceding
-# assignment `remote_url=$(git remote get-url origin 2>/dev/null)` returns git's 128
-# outside a repo and terminates the CALLER first. The message was unreachable.
-#
-# Observed cost: pr-review.sh invoked from a non-repo cwd exits 128 with NO stdout and
-# NO stderr, even when -r/--repo and -H/--host are supplied -- the flags documented as
-# "skips git-remote inference". Two reviewer seats hit this and correctly reported
-# `blocked` with no diagnostic to report.
-#
-# The control that matters is the LOUD one: asserting "rc != 0" passes on the broken
-# build too, because 128 is also non-zero. The test must assert the MESSAGE.
-set -uo pipefail
-fail=0
-HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT
-
-run_outside() { # $1=function name -> "rc:sawmessage"
-    local fn="$1" out rc
-    out=$( cd "$TMP" && bash -c "set -e; source '$HERE/detect-platform.sh'; $fn" 2>&1 ); rc=$?
-    printf '%s:%s' "$rc" "$(grep -qi 'not a git repository' <<<"$out" && echo yes || echo no)"
-}
-check() { if [ "$2" = "$3" ]; then echo "  PASS  $1 ($2)"; else echo "  FAIL  $1: got $2, want $3"; fail=1; fi; }
-
-# $TMP must not be inside a git repo. Do not SKIP on failure: be-coder-07 showed the
-# original SKIP exited 0, so pointing TMPDIR beneath a git worktree made this test PASS
-# against unchanged main. A skip that exits 0 is indistinguishable from a pass.
-# GIT_CEILING_DIRECTORIES stops git walking above $TMP, making the condition hold
-# regardless of where TMPDIR lives, rather than merely detecting when it does not.
-# GIT_CEILING_DIRECTORIES is matched against the PHYSICAL path -- a symlinked TMPDIR
-# (/tmp is commonly one) makes the logical path never match, and the ceiling silently
-# does nothing. Resolve it before exporting.
-TMP="$(cd "$TMP" && pwd -P)"
-export GIT_CEILING_DIRECTORIES="$TMP"
-if ( cd "$TMP" && git rev-parse --git-dir >/dev/null 2>&1 ); then
-    echo "  FAIL  scratch dir is inside a git repo even with GIT_CEILING_DIRECTORIES set;"
-    echo "        the outside-a-repo precondition cannot be established -- refusing to report a result"
-    exit 1
-fi
-
-echo "== outside a git repo: rc=1 AND the diagnostic is emitted =="
-check "detect_platform" "$(run_outside detect_platform)" "1:yes"
-check "get_repo_info"   "$(run_outside get_repo_info)"   "1:yes"
-
-echo "== inside a git repo the functions still work =="
-git init -q "$TMP/repo" 2>/dev/null
-git -C "$TMP/repo" remote add origin https://git.mosaicstack.dev/mosaicstack/stack.git 2>/dev/null
-out=$( cd "$TMP/repo" && bash -c "set -e; source '$HERE/detect-platform.sh'; detect_platform" 2>&1 ); rc=$?
-if [ "$rc" -eq 0 ] && grep -qi 'gitea' <<<"$out"; then echo "  PASS  detect_platform in-repo (rc=0, $out)"
-else echo "  FAIL  detect_platform in-repo: rc=$rc out=$out"; fail=1; fi
-
-[ "$fail" -eq 0 ] && echo "OK  detect-platform fails loudly outside a repo" || echo "FAILED"
-exit "$fail"
@@ -51,23 +51,22 @@ for arg in "$@"; do
        prev=""
        continue
    fi
-    if [[ "$prev" == "data" ]]; then
+    if [[ "$prev" == "-d" ]]; then
        post_data="$arg"
-        [[ "$post_data" == @* ]] && post_data=$(<"${post_data#@}")
        prev=""
        continue
    fi
-    if [[ "$prev" == "config" ]]; then
-        [[ "$arg" == "-" ]] && cat >/dev/null
-        prev=""
+    if [[ "$arg" == "-o" ]]; then
+        prev="-o"
        continue
    fi
-    case "$arg" in
-        -o) prev="-o" ;;
-        -d|--data|--data-binary) prev="data" ;;
-        -K|--config) prev="config" ;;
-        -w) write_code=true ;;
-    esac
+    if [[ "$arg" == "-d" ]]; then
+        prev="-d"
+        continue
+    fi
+    if [[ "$arg" == "-w" ]]; then
+        write_code=true
+    fi
 done
 emit_response() {
    local body="$1"
@@ -36,30 +36,13 @@ cat > "$WORK_DIR/gitea/curl" <<'SH'
 #!/usr/bin/env bash
 set -euo pipefail
 payload=""
-out_file=""
-while [[ $# -gt 0 ]]; do
-    case "$1" in
-        -d|--data|--data-binary)
-            payload="$2"
-            [[ "$payload" == @* ]] && payload=$(<"${payload#@}")
-            shift 2
-            ;;
-        -o)
-            out_file="$2"
-            shift 2
-            ;;
-        -K|--config)
-            [[ "$2" == "-" ]] && cat >/dev/null
-            shift 2
-            ;;
-        -w|-X|-H)
-            shift 2
-            ;;
-        *) shift ;;
-    esac
+for ((i=1; i<=$#; i++)); do
+    if [[ "${!i}" == "-d" ]]; then
+        j=$((i + 1))
+        payload="${!j}"
+    fi
 done
 printf '%s' "$payload" > "${MOSAIC_MERGE_PAYLOAD_LOG:?}"
-[[ -n "$out_file" ]] && printf '{}' > "$out_file"
 printf '200'
 SH
 chmod +x "$WORK_DIR/gitea/curl"
@@ -1,541 +0,0 @@
-#!/usr/bin/env bash
-# Regression harness for the optional, identity-checked Gitea squash message.
-
-set -u
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-SUBJECT="${MOSAIC_TEST_SUBJECT:-$SCRIPT_DIR/pr-merge.sh}"
-WORK_DIR="${MOSAIC_TEST_WORK_DIR:-$PWD/.mosaic-test-work/pr-merge-message-field}"
-ORIG_PATH="$PATH"
-failures=0
-
-rm -rf "$WORK_DIR"
-mkdir -p "$WORK_DIR"
-
-fail() {
-    echo "FAIL $1" >&2
-    failures=$((failures + 1))
-}
-
-make_case() {
-    local name="$1" case_dir
-    case_dir="$WORK_DIR/$name"
-    mkdir -p "$case_dir/bin" "$case_dir/agent"
-    cp "$SUBJECT" "$case_dir/pr-merge.sh"
-    chmod +x "$case_dir/pr-merge.sh"
-
-    cat > "$case_dir/detect-platform.sh" <<'SH'
-#!/usr/bin/env bash
-detect_platform() { PLATFORM=gitea; printf 'gitea\n'; }
-get_repo_owner() { printf 'acme\n'; }
-get_repo_name() { printf 'widgets\n'; }
-get_remote_host() { printf 'git.example.test\n'; }
-get_gitea_token() {
-    printf 'resolved\n' >> "${MOSAIC_TEST_TOKEN_RESOLUTION_LOG:?}"
-    if [[ "${MOSAIC_TEST_TOKEN_AVAILABLE:-true}" != "true" ]]; then
-        return 1
-    fi
-    printf 'fixture-token\n'
-}
-get_gitea_basic_auth() {
-    printf 'resolved\n' >> "${MOSAIC_TEST_BASIC_RESOLUTION_LOG:?}"
-    if [[ "${MOSAIC_TEST_BASIC_AVAILABLE:-false}" == "true" ]]; then
-        printf 'fixture-user:fixture-password\n'
-        return "${MOSAIC_TEST_BASIC_RC:-0}"
-    fi
-    return 1
-}
-get_gitea_login_for_host() { return 1; }
-SH
-
-    cat > "$case_dir/pr-metadata.sh" <<'SH'
-#!/usr/bin/env bash
-if [[ "${MOSAIC_TEST_TITLE_MODE:-safe}" == "injection" ]]; then
-    title='Preserve authors\n\nCo-authored-by: victim <[email protected]>'
-else
-    title='Preserve both branch authors'
-fi
-case "${MOSAIC_TEST_COMMITS_MODE:?}" in
-    verified) head_sha=2222222222222222222222222222222222222222 ;;
-    null-login|unsafe-identity) head_sha=3333333333333333333333333333333333333333 ;;
-    single) head_sha=1111111111111111111111111111111111111111 ;;
-    *) echo "unknown commits mode" >&2; exit 2 ;;
-esac
-printf '{"number":42,"title":"%s","author":"poster","baseRefName":"main","headRefName":"feature/fixture","headRefOid":"%s","headRepository":"acme/widgets"}\n' "$title" "$head_sha"
-SH
-
-    cat > "$case_dir/ci-queue-wait.sh" <<'SH'
-#!/usr/bin/env bash
-exit 0
-SH
-
-    cat > "$case_dir/bin/python3" <<'SH'
-#!/usr/bin/env bash
-for arg in "$@"; do
-    case "$arg" in
-        *"Preserve both branch authors"*|*"[email protected]"*)
-            : > "${MOSAIC_TEST_METADATA_ARGV_MARKER:?}"
-            ;;
-    esac
-done
-exec "${MOSAIC_TEST_REAL_PYTHON:?}" "$@"
-SH
-
-    cat > "$case_dir/bin/curl" <<'SH'
-#!/usr/bin/env bash
-set -eu
-
-for arg in "$@"; do
-    case "$arg" in
-        *"Preserve both branch authors"*|*"[email protected]"*)
-            : > "${MOSAIC_TEST_METADATA_ARGV_MARKER:?}"
-            ;;
-    esac
-done
-
-url=""
-method="GET"
-out_file=""
-data=""
-config=""
-auth_mode="none"
-has_max_filesize=0
-has_max_time=0
-has_connect_timeout=0
-while [[ $# -gt 0 ]]; do
-    case "$1" in
-        -o)
-            out_file="$2"
-            shift 2
-            ;;
-        -w)
-            shift 2
-            ;;
-        -X)
-            method="$2"
-            shift 2
-            ;;
-        -d|--data|--data-binary)
-            data="$2"
-            if [[ "$data" == @* ]]; then
-                data=$(<"${data#@}")
-            fi
-            shift 2
-            ;;
-        -K|--config)
-            if [[ "$2" == "-" ]]; then
-                config=$(cat)
-            fi
-            shift 2
-            ;;
-        --max-filesize)
-            has_max_filesize=1
-            shift 2
-            ;;
-        --max-time)
-            has_max_time=1
-            shift 2
-            ;;
-        --connect-timeout)
-            has_connect_timeout=1
-            shift 2
-            ;;
-        -H|--header|-u|--user)
-            if [[ "$2" == *"fixture-token"* ]]; then
-                : > "${MOSAIC_TEST_TOKEN_ARGV_MARKER:?}"
-            fi
-            if [[ "$2" == *"fixture-password"* ]]; then
-                : > "${MOSAIC_TEST_BASIC_ARGV_MARKER:?}"
-            fi
-            shift 2
-            ;;
-        http://*|https://*)
-            url="$1"
-            shift
-            ;;
-        *)
-            shift
-            ;;
-    esac
-done
-
-if [[ "$config" == *"Authorization: token fixture-token"* ]]; then
-    auth_mode="token"
-    : > "${MOSAIC_TEST_AUTH_CONFIG_MARKER:?}"
-elif [[ "$config" == *"user = \"fixture-user:fixture-password\""* ]]; then
-    auth_mode="basic"
-    : > "${MOSAIC_TEST_BASIC_CONFIG_MARKER:?}"
-fi
-printf '%s %s %s\n' "$method" "$auth_mode" "$url" >> "${MOSAIC_TEST_CURL_LOG:?}"
-printf '%s:%s:%s\n' "$has_max_filesize" "$has_max_time" "$has_connect_timeout" >> "${MOSAIC_TEST_CURL_BOUNDS_LOG:?}"
-
-case "$url" in
-    */pulls/42)
-        case "${MOSAIC_TEST_COMMITS_MODE:?}" in
-            verified) head_sha=2222222222222222222222222222222222222222 ;;
-            null-login|unsafe-identity) head_sha=3333333333333333333333333333333333333333 ;;
-            single) head_sha=1111111111111111111111111111111111111111 ;;
-            *) echo "unknown commits mode" >&2; exit 2 ;;
-        esac
-        if [[ "${MOSAIC_TEST_HEAD_MODE:-stable}" == "moved" ]]; then
-            head_sha=4444444444444444444444444444444444444444
-        fi
-        body="{\"head\":{\"sha\":\"$head_sha\"}}"
-        code=200
-        if [[ "${MOSAIC_TEST_FALLBACK_MODE:-none}" == "inspection" && "$auth_mode" == "token" ]]; then
-            body='{"message":"token rejected"}'
-            code=401
-        fi
-        ;;
-    */pulls/42/commits*)
-        case "${MOSAIC_TEST_COMMITS_MODE:?}" in
-            verified)
-                if [[ "${MOSAIC_TEST_EMAIL_MODE:-safe}" == "escape" ]]; then
-                    body='[{"sha":"2222222222222222222222222222222222222222","commit":{"author":{"name":"Alice","email":"alice+\u001b[[email protected]"}},"author":{"login":"alice"}},{"sha":"1111111111111111111111111111111111111111","commit":{"author":{"name":"Poster","email":"[email protected]"}},"author":{"login":"poster"}}]'
-                else
-                    body='[{"sha":"2222222222222222222222222222222222222222","commit":{"author":{"name":"Alice","email":"[email protected]"}},"author":{"login":"alice"}},{"sha":"1111111111111111111111111111111111111111","commit":{"author":{"name":"Poster","email":"[email protected]"}},"author":{"login":"poster"}}]'
-                fi
-                ;;
-            null-login)
-                body='[{"sha":"1111111111111111111111111111111111111111","commit":{"author":{"name":"Poster","email":"[email protected]"}},"author":{"login":"poster"}},{"sha":"3333333333333333333333333333333333333333","commit":{"author":{"name":"Unresolved Author","email":"[email protected]\n\u001b[31m"}},"author":null}]'
-                ;;
-            unsafe-identity)
-                body='[{"sha":"unsafe\n\u001b[31m","commit":{"author":{"name":"Unsafe","email":"not-an-email"}},"author":{"login":"unsafe"}},{"sha":"3333333333333333333333333333333333333333","commit":{"author":{"name":"Poster","email":"[email protected]"}},"author":{"login":"poster"}}]'
-                ;;
-            single)
-                body='[{"sha":"1111111111111111111111111111111111111111","commit":{"author":{"name":"Poster","email":"[email protected]"}},"author":{"login":"poster"}}]'
-                ;;
-            *)
-                echo "unknown commits mode" >&2
-                exit 2
-                ;;
-        esac
-        code=200
-        if [[ "${MOSAIC_TEST_FALLBACK_MODE:-none}" == "inspection" && "$auth_mode" == "token" ]]; then
-            body='{"message":"token rejected"}'
-            code=401
-        fi
-        ;;
-    */pulls/42/merge)
-        body='{}'
-        code=200
-        if [[ "${MOSAIC_TEST_FALLBACK_MODE:-none}" == "merge" && "$auth_mode" == "token" ]]; then
-            body='{"message":"token rejected"}'
-            code=401
-        elif [[ "${MOSAIC_TEST_FALLBACK_MODE:-none}" == "provider-error" ]]; then
-            body='{"message":"branch policy rejected\n\u001b[31m"}'
-            code=409
-        elif [[ "${MOSAIC_TEST_FALLBACK_MODE:-none}" == "forbidden" ]]; then
-            body='{"message":"permission denied"}'
-            code=403
-        else
-            printf '%s' "$data" > "${MOSAIC_TEST_MERGE_PAYLOAD:?}"
-        fi
-        ;;
-    */users/*)
-        body='{"message":"not found"}'
-        code=404
-        ;;
-    *)
-        body='{"message":"unexpected URL"}'
-        code=500
-        ;;
-esac
-
-if [[ -n "$out_file" ]]; then
-    printf '%s' "$body" > "$out_file"
-else
-    printf '%s' "$body"
-fi
-printf '%s' "$code"
-case "${MOSAIC_TEST_CURL_FAILURE:-none}" in
-    oversize) exit 63 ;;
-    stalled) exit 28 ;;
-esac
-SH
-
-    chmod +x "$case_dir/detect-platform.sh" "$case_dir/pr-metadata.sh" \
-        "$case_dir/ci-queue-wait.sh" "$case_dir/bin/curl" "$case_dir/bin/python3"
-    printf '%s\n' "$case_dir"
-}
-
-run_case() {
-    local case_dir="$1" mode="$2"
-    shift 2
-    MOSAIC_TEST_COMMITS_MODE="$mode" \
-    MOSAIC_TEST_CURL_LOG="$case_dir/curl.log" \
-    MOSAIC_TEST_CURL_BOUNDS_LOG="$case_dir/curl-bounds.log" \
-    MOSAIC_TEST_MERGE_PAYLOAD="$case_dir/merge-payload.json" \
-    MOSAIC_TEST_TOKEN_ARGV_MARKER="$case_dir/token-in-argv" \
-    MOSAIC_TEST_BASIC_ARGV_MARKER="$case_dir/basic-in-argv" \
-    MOSAIC_TEST_AUTH_CONFIG_MARKER="$case_dir/auth-via-config" \
-    MOSAIC_TEST_BASIC_CONFIG_MARKER="$case_dir/basic-via-config" \
-    MOSAIC_TEST_TOKEN_RESOLUTION_LOG="$case_dir/token-resolution.log" \
-    MOSAIC_TEST_BASIC_RESOLUTION_LOG="$case_dir/basic-resolution.log" \
-    MOSAIC_TEST_METADATA_ARGV_MARKER="$case_dir/metadata-in-argv" \
-    MOSAIC_TEST_REAL_PYTHON="$(command -v python3)" \
-    AGENT_WORK_ROOT="$case_dir/agent" \
-    PATH="$case_dir/bin:$ORIG_PATH" \
-        "$case_dir/pr-merge.sh" -n 42 "$@"
-}
-
-# Verified multi-author path: the non-poster trailer is built from one commit's
-# linked author.login and that same commit's author email. No /users lookup.
-verified_dir=$(make_case verified)
-set +e
-verified_output=$(run_case "$verified_dir" verified --co-author-trailers --escalate-to tl-mosaic 2>&1)
-verified_rc=$?
-set -e
-if [[ "$verified_rc" -ne 0 ]]; then
-    fail "verified multi-author merge expected rc=0, got rc=$verified_rc: $verified_output"
-elif [[ ! -s "$verified_dir/merge-payload.json" ]]; then
-    fail "verified multi-author merge did not reach the API payload"
-else
-    python3 - "$verified_dir/merge-payload.json" <<'PY' || fail "verified payload did not preserve squash and exact message fields"
-import json
-import sys
-payload = json.load(open(sys.argv[1], encoding="utf-8"))
-assert payload == {
-    "Do": "squash",
-    "head_commit_id": "2222222222222222222222222222222222222222",
-    "MergeTitleField": "Preserve both branch authors",
-    "MergeMessageField": "Co-authored-by: alice <[email protected]>",
-}, payload
-PY
-fi
-[[ -e "$verified_dir/auth-via-config" ]] || fail "verified path did not authenticate curl through stdin config"
-[[ ! -e "$verified_dir/token-in-argv" ]] || fail "verified path placed the Gitea token in curl argv"
-[[ ! -e "$verified_dir/metadata-in-argv" ]] || fail "verified path placed PR title or contributor email in child argv"
-[[ "$(wc -l < "$verified_dir/token-resolution.log")" -eq 1 ]] || fail "verified path did not bind inspection and merge to one credential resolution"
-if grep -q '/users/' "$verified_dir/curl.log" 2>/dev/null; then
-    fail "verified path performed a forbidden second /users lookup"
-fi
-if grep -qv '^1:1:1$' "$verified_dir/curl-bounds.log"; then
-    fail "verified path did not apply size/max-time/connect-time bounds to every provider download"
-fi
-
-# A linked email containing a terminal escape must block before mutation.
-escape_email_dir=$(make_case escape-email)
-set +e
-escape_email_output=$(MOSAIC_TEST_EMAIL_MODE=escape run_case "$escape_email_dir" verified --co-author-trailers --escalate-to tl-mosaic 2>&1)
-escape_email_rc=$?
-set -e
-[[ "$escape_email_rc" -ne 0 ]] || fail "control-byte email unexpectedly passed"
-[[ "$escape_email_output" == *"unusable linked identity"* ]] || fail "control-byte email refusal lost its diagnostic"
-[[ ! -e "$escape_email_dir/merge-payload.json" ]] || fail "control-byte email reached the merge API"
-
-# Curl transfer and duration failures must remain failures even with HTTP 200.
-for failure_mode in oversize stalled; do
-    failure_dir=$(make_case "curl-$failure_mode")
-    set +e
-    failure_output=$(MOSAIC_TEST_CURL_FAILURE="$failure_mode" run_case "$failure_dir" verified --co-author-trailers --escalate-to tl-mosaic 2>&1)
-    failure_rc=$?
-    set -e
-    [[ "$failure_rc" -ne 0 ]] || fail "curl $failure_mode failure was discarded: $failure_output"
-    [[ ! -e "$failure_dir/merge-payload.json" ]] || fail "curl $failure_mode failure reached the merge API"
-done
-
-# The authenticated head is re-read under the mutation credential but cannot
-# replace the canonical preflight/review head. A move blocks before enumeration
-# or mutation even though the provider returned a valid new SHA.
-moved_dir=$(make_case moved-head)
-set +e
-moved_output=$(MOSAIC_TEST_HEAD_MODE=moved \
-    run_case "$moved_dir" verified --co-author-trailers --escalate-to tl-mosaic 2>&1)
-moved_rc=$?
-set -e
-[[ "$moved_rc" -ne 0 ]] || fail "moved authenticated head unexpectedly passed"
-[[ "$moved_output" == *"authenticated PR head moved from reviewed"* ]] || fail "moved head refusal lost its diagnostic"
-[[ "$moved_output" == *"tl-mosaic"* ]] || fail "moved head refusal omitted the named escalation principal"
-[[ ! -e "$moved_dir/merge-payload.json" ]] || fail "moved head refusal reached the merge API"
-moved_sequence=$(awk '{print $1 ":" $2}' "$moved_dir/curl.log" | paste -sd, -)
-[[ "$moved_sequence" == "GET:token" ]] || fail "moved head refusal performed post-move inspection/mutation (calls=$moved_sequence)"
-
-# Token resolution failure is not an authentication response. It must fail
-# closed instead of borrowing a Basic credential under a different principal.
-token_missing_dir=$(make_case token-missing)
-set +e
-token_missing_output=$(MOSAIC_TEST_TOKEN_AVAILABLE=false MOSAIC_TEST_BASIC_AVAILABLE=true \
-    run_case "$token_missing_dir" single 2>&1)
-token_missing_rc=$?
-set -e
-[[ "$token_missing_rc" -ne 0 ]] || fail "missing token unexpectedly borrowed Basic Auth"
-[[ "$token_missing_output" == *"required Gitea token"* ]] || fail "missing token refusal lost its diagnostic"
-[[ ! -e "$token_missing_dir/basic-resolution.log" ]] || fail "missing token resolved Basic Auth after identity failure"
-[[ ! -e "$token_missing_dir/curl.log" ]] || fail "missing token reached a provider request"
-
-# A failed Basic resolver must never use its nonempty output or reach mutation.
-basic_rc_dir=$(make_case basic-resolver-rc)
-set +e
-basic_rc_output=$(MOSAIC_TEST_BASIC_AVAILABLE=true MOSAIC_TEST_BASIC_RC=91 MOSAIC_TEST_FALLBACK_MODE=inspection \
-    run_case "$basic_rc_dir" verified --co-author-trailers --escalate-to tl-mosaic 2>&1)
-basic_rc_rc=$?
-set -e
-[[ "$basic_rc_rc" -ne 0 ]] || fail "failed Basic resolver output unexpectedly authorized a merge: $basic_rc_output"
-[[ ! -e "$basic_rc_dir/merge-payload.json" ]] || fail "failed Basic resolver reached the merge API"
-
-# HTTP 401 never changes principals: inspection rejection fails closed without
-# resolving or attempting Basic Auth.
-fallback_inspect_dir=$(make_case fallback-inspection)
-set +e
-fallback_inspect_output=$(MOSAIC_TEST_BASIC_AVAILABLE=true MOSAIC_TEST_FALLBACK_MODE=inspection \
-    run_case "$fallback_inspect_dir" verified --co-author-trailers --escalate-to tl-mosaic 2>&1)
-fallback_inspect_rc=$?
-set -e
-[[ "$fallback_inspect_rc" -ne 0 ]] || fail "inspection token rejection unexpectedly changed principals"
-[[ "$fallback_inspect_output" == *"refusing cross-principal credential fallback"* ]] || fail "inspection token rejection lost its refusal diagnostic"
-[[ ! -e "$fallback_inspect_dir/basic-resolution.log" ]] || fail "inspection token rejection resolved Basic Auth"
-[[ ! -e "$fallback_inspect_dir/merge-payload.json" ]] || fail "inspection token rejection reached merge mutation"
-inspect_sequence=$(awk '{print $1 ":" $2}' "$fallback_inspect_dir/curl.log" | paste -sd, -)
-[[ "$inspect_sequence" == "GET:token" ]] || fail "inspection rejection made unexpected provider calls (calls=$inspect_sequence)"
-
-# Token rejection at merge likewise fails closed without cross-principal retry.
-fallback_merge_dir=$(make_case fallback-merge)
-set +e
-fallback_merge_output=$(MOSAIC_TEST_BASIC_AVAILABLE=true MOSAIC_TEST_FALLBACK_MODE=merge \
-    run_case "$fallback_merge_dir" verified --co-author-trailers --escalate-to tl-mosaic 2>&1)
-fallback_merge_rc=$?
-set -e
-[[ "$fallback_merge_rc" -ne 0 ]] || fail "merge token rejection unexpectedly changed principals"
-[[ "$fallback_merge_output" == *"refusing cross-principal credential fallback"* ]] || fail "merge token rejection lost its refusal diagnostic"
-[[ ! -e "$fallback_merge_dir/basic-resolution.log" ]] || fail "merge token rejection resolved Basic Auth"
-[[ ! -e "$fallback_merge_dir/merge-payload.json" ]] || fail "merge token rejection recorded a successful payload"
-merge_sequence=$(awk '{print $1 ":" $2}' "$fallback_merge_dir/curl.log" | paste -sd, -)
-[[ "$merge_sequence" == "GET:token,GET:token,POST:token" ]] || fail "merge rejection made unexpected provider calls (calls=$merge_sequence)"
-
-# BLOCK path: a commit email exists but author.login is null. It must name both
-# facts, name the escalation principal, and never reach the merge endpoint.
-null_dir=$(make_case null-login)
-set +e
-null_output=$(run_case "$null_dir" null-login --co-author-trailers --escalate-to tl-mosaic 2>&1)
-null_rc=$?
-set -e
-[[ "$null_rc" -ne 0 ]] || fail "null-login author expected a non-zero BLOCK"
-[[ "$null_output" == *"BLOCK"* ]] || fail "null-login author omitted BLOCK diagnostic"
-[[ "$null_output" == *"author.login=NULL"* ]] || fail "null-login author omitted the null provider fact"
-[[ "$null_output" == *"[email protected]"* ]] || fail "null-login author omitted the commit email fact"
-[[ "$null_output" == *'\n\x1b[31m'* ]] || fail "null-login author diagnostic did not escape control characters"
-[[ "$null_output" != *$'\033'* ]] || fail "null-login author diagnostic emitted a raw terminal escape"
-[[ "$(printf '%s\n' "$null_output" | wc -l)" -eq 1 ]] || fail "null-login author diagnostic permitted newline injection"
-[[ "$null_output" == *"tl-mosaic"* ]] || fail "null-login author omitted the named escalation principal"
-[[ ! -e "$null_dir/merge-payload.json" ]] || fail "null-login BLOCK still reached the merge API"
-
-# Every provider-derived field in alternate BLOCK diagnostics is log-safe too,
-# including an invalid non-head SHA that contains control characters.
-unsafe_dir=$(make_case unsafe-identity)
-set +e
-unsafe_output=$(run_case "$unsafe_dir" unsafe-identity --co-author-trailers --escalate-to tl-mosaic 2>&1)
-unsafe_rc=$?
-set -e
-[[ "$unsafe_rc" -ne 0 ]] || fail "unsafe identity expected a non-zero BLOCK"
-[[ "$unsafe_output" == *"unusable linked identity"* ]] || fail "unsafe identity omitted its BLOCK reason"
-[[ "$unsafe_output" == *'\n\x1b[31m'* ]] || fail "unsafe identity SHA did not escape control characters"
-[[ "$unsafe_output" != *$'\033'* ]] || fail "unsafe identity diagnostic emitted a raw terminal escape"
-[[ "$(printf '%s\n' "$unsafe_output" | wc -l)" -eq 1 ]] || fail "unsafe identity diagnostic permitted newline injection"
-[[ ! -e "$unsafe_dir/merge-payload.json" ]] || fail "unsafe identity BLOCK still reached the merge API"
-
-# The provider PR title cannot add an unchecked trailer outside the constructed
-# message field: multi-line and trailer-shaped titles block before mutation.
-title_dir=$(make_case title-injection)
-set +e
-title_output=$(MOSAIC_TEST_TITLE_MODE=injection \
-    run_case "$title_dir" verified --co-author-trailers --escalate-to tl-mosaic 2>&1)
-title_rc=$?
-set -e
-[[ "$title_rc" -ne 0 ]] || fail "title trailer injection unexpectedly passed"
-[[ "$title_output" == *"not one printable, non-trailer line"* ]] || fail "title injection refusal lost its diagnostic"
-[[ ! -e "$title_dir/merge-payload.json" ]] || fail "title injection reached the merge API"
-
-# Provider failures remain diagnosable after their temporary response file is
-# removed, but provider-controlled control characters stay log-safe.
-error_dir=$(make_case provider-error)
-set +e
-error_output=$(MOSAIC_TEST_BASIC_AVAILABLE=true MOSAIC_TEST_FALLBACK_MODE=provider-error \
-    run_case "$error_dir" single 2>&1)
-error_rc=$?
-set -e
-[[ "$error_rc" -ne 0 ]] || fail "provider error unexpectedly passed"
-[[ "$error_output" == *"HTTP 409"* ]] || fail "provider error omitted the HTTP status"
-[[ "$error_output" == *"branch policy rejected"* ]] || fail "provider error response was discarded"
-[[ "$error_output" == *'\n\x1b[31m'* ]] || fail "provider error response did not escape control characters"
-[[ "$error_output" != *$'\033'* ]] || fail "provider error response emitted a raw terminal escape"
-[[ "$error_output" != *"Basic Auth fallback"* ]] || fail "provider error advertised removed Basic Auth fallback"
-[[ ! -e "$error_dir/basic-resolution.log" ]] || fail "HTTP 409 policy denial incorrectly triggered Basic Auth fallback"
-
-# Authorization denials likewise fail closed instead of changing principals.
-forbidden_dir=$(make_case forbidden)
-set +e
-forbidden_output=$(MOSAIC_TEST_BASIC_AVAILABLE=true MOSAIC_TEST_FALLBACK_MODE=forbidden \
-    run_case "$forbidden_dir" single 2>&1)
-forbidden_rc=$?
-set -e
-[[ "$forbidden_rc" -ne 0 ]] || fail "HTTP 403 authorization denial unexpectedly passed"
-[[ "$forbidden_output" == *"HTTP 403"* ]] || fail "authorization denial omitted the HTTP status"
-[[ "$forbidden_output" != *"Basic Auth fallback"* ]] || fail "authorization denial advertised removed Basic Auth fallback"
-[[ ! -e "$forbidden_dir/basic-resolution.log" ]] || fail "HTTP 403 authorization denial incorrectly triggered Basic Auth fallback"
-
-# The BLOCK destination cannot be generic or inferred after failure: opting in
-# without a named principal is refused before any provider operation.
-principal_dir=$(make_case missing-principal)
-set +e
-principal_output=$(run_case "$principal_dir" verified --co-author-trailers 2>&1)
-principal_rc=$?
-set -e
-[[ "$principal_rc" -ne 0 ]] || fail "co-author mode without a named principal unexpectedly passed"
-[[ "$principal_output" == *"requires --escalate-to with a named principal"* ]] || fail "missing-principal refusal lost its diagnostic"
-[[ ! -e "$principal_dir/merge-payload.json" ]] || fail "missing-principal refusal reached the merge API"
-
-# A trailing value-taking option receives a stable CLI diagnostic instead of a
-# set -u unbound-variable crash.
-value_dir=$(make_case missing-principal-value)
-set +e
-value_output=$(run_case "$value_dir" verified --co-author-trailers --escalate-to 2>&1)
-value_rc=$?
-set -e
-[[ "$value_rc" -ne 0 ]] || fail "missing --escalate-to value unexpectedly passed"
-[[ "$value_output" == *"--escalate-to requires one principal name"* ]] || fail "missing --escalate-to value lost its diagnostic"
-[[ "$value_output" != *"unbound variable"* ]] || fail "missing --escalate-to value crashed under set -u"
-[[ ! -e "$value_dir/merge-payload.json" ]] || fail "missing --escalate-to value reached the merge API"
-
-# Negative control: ordinary single-author merge remains byte-for-byte payload
-# compatible and hardcoded to squash, with no optional message fields.
-single_dir=$(make_case single)
-set +e
-single_output=$(run_case "$single_dir" single 2>&1)
-single_rc=$?
-set -e
-if [[ "$single_rc" -ne 0 ]]; then
-    fail "ordinary single-author merge expected rc=0, got rc=$single_rc: $single_output"
-elif [[ ! -s "$single_dir/merge-payload.json" ]]; then
-    fail "ordinary single-author merge did not reach the API payload"
-else
-    python3 - "$single_dir/merge-payload.json" <<'PY' || fail "ordinary single-author payload changed"
-import json
-import sys
-payload = json.load(open(sys.argv[1], encoding="utf-8"))
-assert payload == {
-    "Do": "squash",
-    "head_commit_id": "1111111111111111111111111111111111111111",
-}, payload
-PY
-fi
-[[ -e "$single_dir/auth-via-config" ]] || fail "ordinary path did not authenticate curl through stdin config"
-[[ ! -e "$single_dir/token-in-argv" ]] || fail "ordinary path placed the Gitea token in curl argv"
-[[ "$(wc -l < "$single_dir/token-resolution.log")" -eq 1 ]] || fail "ordinary path did not use exactly one credential resolution"
-
-# Squash is not defaultable: an explicit non-squash method must remain refused.
-method_dir=$(make_case method-refusal)
-set +e
-method_output=$(run_case "$method_dir" single -m merge 2>&1)
-method_rc=$?
-set -e
-[[ "$method_rc" -ne 0 ]] || fail "non-squash method unexpectedly passed"
-[[ "$method_output" == *"enforces squash merge only"* ]] || fail "non-squash refusal lost its policy diagnostic"
-[[ ! -e "$method_dir/merge-payload.json" ]] || fail "non-squash refusal reached the merge API"
-
-if [[ "$failures" -ne 0 ]]; then
-    echo "pr-merge message-field regression failed ($failures assertions)" >&2
-    exit 1
-fi
-
-echo "pr-merge message-field regression passed (verified, BLOCK, and unchanged squash control)"
@@ -39,12 +39,11 @@ ORIG_PATH="$PATH"
 # loop — which would make the control a false negative. A root dotfile is
 # operator-owned (unknown→operator), so the sync loop skips it. Clean up on exit.
 STRIPPED="$FW/.install-rollback-control.tmp.sh"
-SIGNALED="$FW/.install-signal-control.tmp.sh"
 NOEXIT="$FW/.install-noexit-control.tmp.sh"
 D1CTRL="$FW/.install-d1guard-control.tmp.sh"
 D2CTRL="$FW/.install-d2guard-control.tmp.sh"
-rm -f "$STRIPPED" "$SIGNALED" "$NOEXIT" "$D1CTRL" "$D2CTRL"
-trap 'rm -f "$STRIPPED" "$SIGNALED" "$NOEXIT" "$D1CTRL" "$D2CTRL"' EXIT
+rm -f "$STRIPPED" "$NOEXIT" "$D1CTRL" "$D2CTRL"
+trap 'rm -f "$STRIPPED" "$NOEXIT" "$D1CTRL" "$D2CTRL"' EXIT

 pass=0; fail=0
 chk() { if eval "$2"; then echo "  ✓ $1"; pass=$((pass + 1)); else echo "  ✗ $1"; fail=$((fail + 1)); fi; }
@@ -181,86 +180,41 @@ chk "[control] without -E the mid-sync corruption survives (no rollback)" \
 # ── Part C: an INT/TERM interrupt must terminate, not resume (blocker-A) ──────
 # A bash signal trap that merely returns lets the script continue past the
 # interrupt — restoring the snapshot, then resuming the sync and reporting
-# success. The earlier test used a child cp shim to signal its parent, making
-# child completion race Bash's interrupted wait. Concurrency is not part of the
-# guarded property: sync_framework_keep() runs in the installer's own Bash
-# process, and `kill` is a builtin. Generate two installer fixtures that signal
-# themselves at the same known mid-sync point. Their TERM handlers emit the same
-# observable before diverging, so missing signal delivery fails BOTH arms rather
-# than manufacturing a pass. The only semantic difference between fixtures is
-# the explicit `exit 1` whose load-bearing behavior this control proves.
-TERM_MARKER='[test-control] TERM handler entered'
-HANDLER_WITH_EXIT="trap 'echo \"$TERM_MARKER\" >&2; restore_snapshot; exit 1' TERM  # TEST-TERM-HANDLER"
-HANDLER_WITHOUT_EXIT="trap 'echo \"$TERM_MARKER\" >&2; restore_snapshot' TERM  # TEST-TERM-HANDLER"
-
-make_signal_installer() {
-  local output="$1" handler="$2"
-  local target_trap="trap 'restore_snapshot; exit 1' ERR INT TERM"
-  local target_cp='    cp "$abs" "$dst/$rel"'
-  local inject_open="    if [[ \"\$rel\" == \"$POISON_REL\" ]]; then"
-  local inject_kill='      kill -TERM "$$"  # TEST-TERM-INJECTION'
-  local inject_close='    fi'
-
-  if ! awk \
-    -v target_trap="$target_trap" -v target_cp="$target_cp" \
-    -v handler="$handler" -v inject_open="$inject_open" \
-    -v inject_kill="$inject_kill" -v inject_close="$inject_close" '
-      $0 == target_cp {
-        print inject_open
-        print inject_kill
-        print inject_close
-        injection_sites++
-      }
-      { print }
-      $0 == target_trap {
-        print handler
-        handler_sites++
-      }
-      END {
-        if (handler_sites != 1 || injection_sites != 1) exit 42
-      }
-    ' "$INSTALL" > "$output"; then
-    rm -f "$output"
-    fail "Could not construct the self-TERM control installer at the exact trap/copy sites"
-    exit 1
-  fi
-  chmod +x "$output"
+# success. We inject a SIGTERM mid-sync with a cp that SUCCEEDS (so set -e never
+# fires and ONLY the signal path governs), and assert the shipped installer
+# restores AND exits without reporting success. The control strips `exit 1` from
+# the trap and shows the buggy resume-to-success.
+make_term_shim() {
+  local dir="$1"
+  cat > "$dir/cp" <<SHIM
+#!/usr/bin/env bash
+dest="\${@: -1}"
+case "\$dest" in
+  */$POISON_REL)
+    kill -TERM "\$PPID" 2>/dev/null   # signal install.sh; the copy still succeeds
+    exec env PATH="$ORIG_PATH" cp "\$@" ;;
+esac
+exec env PATH="$ORIG_PATH" cp "\$@"
+SHIM
+  chmod +x "$dir/cp"
 }

-make_signal_installer "$SIGNALED" "$HANDLER_WITH_EXIT"
-make_signal_installer "$NOEXIT" "$HANDLER_WITHOUT_EXIT"
-signal_fixture_ready() {
-  local fixture="$1" expected_handler="$2"
-  [[ "$(grep -cF '# TEST-TERM-INJECTION' "$fixture")" -eq 1 ]] \
-    && [[ "$(grep -cF '# TEST-TERM-HANDLER' "$fixture")" -eq 1 ]] \
-    && grep -Fqx "$expected_handler" "$fixture"
-}
-signaled_fixture_ready() { signal_fixture_ready "$SIGNALED" "$HANDLER_WITH_EXIT"; }
-noexit_fixture_ready() { signal_fixture_ready "$NOEXIT" "$HANDLER_WITHOUT_EXIT"; }
-chk "[signal] shipped fixture has exactly one self-TERM injection and marked handler" \
-  "signaled_fixture_ready"
-chk "[control] no-exit fixture has exactly one self-TERM injection and marked handler" \
-  "noexit_fixture_ready"
-chk "[control] removing the explicit TERM exit changes the fixture" \
-  "! cmp -s '$SIGNALED' '$NOEXIT'"
-
-# Run one keep-mode upgrade whose own shell delivers SIGTERM synchronously at
-# the selected copy. Echoes "<exit>\t<out>\t<home>".
+# Run one keep-mode upgrade with the SIGTERM shim. Echoes "<exit>\t<out>\t<home>".
 run_signal_upgrade() {
-  local installer="$1" H OUT rc
-  H=$(mktemp -d); OUT=$(mktemp)
+  local installer="$1" H OUT SHIM rc
+  H=$(mktemp -d); OUT=$(mktemp); SHIM=$(mktemp -d)
  seed_home "$H"
+  make_term_shim "$SHIM"
  set +e
-  PATH="$ORIG_PATH" \
+  PATH="$SHIM:$ORIG_PATH" \
    MOSAIC_HOME="$H" MOSAIC_INSTALL_MODE=keep MOSAIC_SYNC_ONLY=1 bash "$installer" >"$OUT" 2>&1
  rc=$?
  set -e 2>/dev/null || true
+  rm -rf "$SHIM"
  printf '%s\t%s\t%s\n' "$rc" "$OUT" "$H"
 }

-IFS=$'\t' read -r rcC OUTC HC < <(run_signal_upgrade "$SIGNALED")
-chk "[signal] TERM handler observable fires exactly once" \
-  "[ \"\$(grep -cF '$TERM_MARKER' '$OUTC')\" -eq 1 ]"
+IFS=$'\t' read -r rcC OUTC HC < <(run_signal_upgrade "$INSTALL")
 chk "[signal] SIGTERM mid-sync aborts non-zero (trap exits, does not resume)" \
  "[ '$rcC' -ne 0 ]"
 chk "[signal] restore_snapshot fires on the interrupt" \
@@ -268,13 +222,13 @@ chk "[signal] restore_snapshot fires on the interrupt" \
 chk "[signal] does NOT resume to report sync success after the interrupt" \
  "! grep -q 'file phase complete' '$OUTC'"

-IFS=$'\t' read -r rcD OUTD HD < <(run_signal_upgrade "$NOEXIT")
-chk "[control] TERM handler observable fires exactly once" \
-  "[ \"\$(grep -cF '$TERM_MARKER' '$OUTD')\" -eq 1 ]"
-chk "[control] without 'exit 1' the handler restores before returning" \
-  "grep -q 'restoring previous state from snapshot' '$OUTD'"
-chk "[control] without 'exit 1' the installer exits zero after resuming" \
-  "[ '$rcD' -eq 0 ]"
+# Control: strip `exit 1` from the signal trap → the handler returns, the script
+# resumes past the interrupt and wrongly reports success. In $FW so SOURCE_DIR resolves.
+sed "s/trap 'restore_snapshot; exit 1' ERR INT TERM/trap 'restore_snapshot' ERR INT TERM/" \
+  "$INSTALL" > "$NOEXIT"
+chk "[control] the exit-strip actually changed the installer" \
+  "! cmp -s '$INSTALL' '$NOEXIT'"
+IFS=$'\t' read -r _rcD OUTD HD < <(run_signal_upgrade "$NOEXIT")
 chk "[control] without 'exit 1' the trap resumes and reports sync success (the bug)" \
  "grep -q 'file phase complete' '$OUTD'"

@@ -355,10 +309,10 @@ chk "[control] without the D2 recovery line the operator gets no snapshot pointe
 # Reap any snapshot the reset-fail runs left in /tmp (reset failed → never cleaned).
 grep -o '/[^ ]*mosaic-snapshot[^ ]*' "$OUTH" 2>/dev/null | head -1 | while read -r s; do rm -rf "$s"; done

-# Cleanup (generated installer controls are also removed by the EXIT trap).
+# Cleanup ($STRIPPED / $NOEXIT / $D1CTRL / $D2CTRL are also removed by the EXIT trap).
 for d in "$HA" "$REFA" "$HB" "$REFB" "$HC" "$HD" "$HE" "$REFE" "$HF" "$REFF" "$HG" "$HH"; do rm -rf "$d"; done
 rm -f "$OUTA" "$OUTB" "$OUTC" "$OUTD" "$OUTE" "$OUTF" "$OUTG" "$OUTH" \
-  "$STRIPPED" "$SIGNALED" "$NOEXIT" "$D1CTRL" "$D2CTRL"
+  "$STRIPPED" "$NOEXIT" "$D1CTRL" "$D2CTRL"

 echo
 echo "RESULT: $pass passed, $fail failed"
@@ -25,7 +25,7 @@
    "lint": "eslint src",
    "typecheck": "tsc --noEmit",
    "test": "vitest run --passWithNoTests && pnpm run test:framework-shell",
-    "test:framework-shell": "bash framework/tools/quality/scripts/check-test-enumeration.sh && bash framework/tools/quality/scripts/test-check-test-enumeration.sh && python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 src/mutator-gate/version_coupling_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh && bash framework/tools/git/test-pr-review-repo-host-override.sh && bash framework/tools/git/test-ci-queue-wait-branch-absent.sh && bash framework/tools/git/test-ci-queue-wait-tristate.sh && bash framework/tools/git/test-ci-queue-wait-github-checks.sh && bash framework/tools/git/test-pr-merge-queue-branch.sh && bash framework/tools/git/test-pr-merge-head-pin.sh && bash framework/tools/git/test-pr-merge-message-field.sh && bash framework/tools/git/test-git-credential-mosaic.sh && bash framework/tools/git/test-gitea-token-identity.sh && bash framework/tools/git/test-detect-platform-outside-repo.sh && bash framework/tools/woodpecker/test-terminal-green-contract.sh && bash framework/tools/_scripts/test-install-ordering-guard.sh && bash framework/tools/tmux/agent-send.test.sh && bash framework/tools/wake/test-wake-store-ack.sh && bash framework/tools/wake/test-wake-store-enqueue-race.sh && bash framework/tools/wake/test-wake-digest-hmac.sh && bash framework/tools/wake/test-wake-digest-quarantine.sh && bash framework/tools/wake/test-wake-detector.sh && bash framework/tools/wake/test-wake-fn-oracle.sh && bash framework/tools/wake/test-wake-reconcile.sh && bash framework/tools/wake/test-wake-beacon.sh && bash framework/tools/wake/test-wake-preimage.sh && bash framework/tools/wake/test-wake-install.sh"
+    "test:framework-shell": "bash framework/tools/quality/scripts/check-test-enumeration.sh && bash framework/tools/quality/scripts/test-check-test-enumeration.sh && python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 src/mutator-gate/version_coupling_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh && bash framework/tools/git/test-pr-review-repo-host-override.sh && bash framework/tools/git/test-ci-queue-wait-branch-absent.sh && bash framework/tools/git/test-ci-queue-wait-tristate.sh && bash framework/tools/git/test-ci-queue-wait-github-checks.sh && bash framework/tools/git/test-pr-merge-queue-branch.sh && bash framework/tools/git/test-pr-merge-head-pin.sh && bash framework/tools/git/test-git-credential-mosaic.sh && bash framework/tools/git/test-gitea-token-identity.sh && bash framework/tools/woodpecker/test-terminal-green-contract.sh && bash framework/tools/_scripts/test-install-ordering-guard.sh && bash framework/tools/tmux/agent-send.test.sh && bash framework/tools/wake/test-wake-store-ack.sh && bash framework/tools/wake/test-wake-store-enqueue-race.sh && bash framework/tools/wake/test-wake-digest-hmac.sh && bash framework/tools/wake/test-wake-digest-quarantine.sh && bash framework/tools/wake/test-wake-detector.sh && bash framework/tools/wake/test-wake-fn-oracle.sh && bash framework/tools/wake/test-wake-reconcile.sh && bash framework/tools/wake/test-wake-beacon.sh && bash framework/tools/wake/test-wake-preimage.sh && bash framework/tools/wake/test-wake-install.sh"
  },
  "dependencies": {
    "@mosaicstack/brain": "workspace:*",
@@ -1,184 +1,360 @@
 #!/usr/bin/env bash
-# ─── Mosaic Stack — End-to-End Install Test ────────────────────────────────────
+# Greenfield installer acceptance fixture.
 #
-# Runs a clean-container install test to verify the full first-run flow:
-#   tools/install.sh  ->  mosaic wizard (non-interactive)
-#                     ->  mosaic gateway install
-#                     ->  mosaic gateway verify
-#
-# Usage:
-#   bash tools/e2e-install-test.sh
-#
-# Requirements:
-#   - Docker (skips gracefully if not available)
-#   - Run from the repository root
-#
-# How it works:
-#   1. Mounts the repository into a node:22-alpine container.
-#   2. Installs prerequisites (bash, curl, jq, git) inside the container.
-#   3. Runs `bash tools/install.sh --yes --no-auto-launch` to install the
-#      framework and CLI from the Gitea registry.
-#   4. Runs `mosaic wizard --non-interactive` to set up SOUL/USER.
-#   5. Runs `mosaic gateway install` with piped defaults (non-interactive).
-#   6. Runs `mosaic gateway verify` and checks its exit code.
-#      NOTE: `mosaic gateway verify` is a new command added in the
-#      feat/mosaic-first-run-ux branch. If the installed CLI version
-#      pre-dates this branch (does not have `gateway verify`), the test
-#      marks this step as EXPECTED-SKIP and reports the installed version.
-#   7. Reports PASS or FAIL with a summary.
-#
-# To run manually:
-#   cd /path/to/mosaic-stack
-#   bash tools/e2e-install-test.sh
-#
-# ──────────────────────────────────────────────────────────────────────────────
+# The fixture itself is intentionally RED until the C2-C5 phase owners repair
+# their postconditions. C1's CI gate executes it and validates that the RED is
+# attributable (including the discriminating P3 PASS); it does not turn the
+# failed install into a false green.

 set -euo pipefail

-REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-IMAGE="node:22-alpine"
-CONTAINER_NAME="mosaic-e2e-install-$$"
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+LANE="${MOSAIC_INSTALL_LANE:-next}"
+SOURCE="${MOSAIC_INSTALL_SOURCE:-checkout}"
+IMAGE="${MOSAIC_INSTALL_IMAGE:-node:22-bookworm-slim}"
+GIT_MODE="${MOSAIC_INSTALL_GIT_MODE:-present}"
+INSTALLER_FILE="${MOSAIC_FIXTURE_INSTALLER_FILE:-$ROOT/tools/install.sh}"
+IN_CLEAN_CONTAINER="${MOSAIC_GREENFIELD_CONTAINER:-0}"

-# ─── Colour helpers ───────────────────────────────────────────────────────────
-if [[ -t 1 ]]; then
-  R=$'\033[0;31m' G=$'\033[0;32m' Y=$'\033[0;33m' BOLD=$'\033[1m' RESET=$'\033[0m'
-else
-  R="" G="" Y="" BOLD="" RESET=""
-fi
+usage() {
+  cat <<'EOF'
+Usage: tools/e2e-install-test.sh [--lane next|main] [--source checkout|remote] [--git present|absent]

-info()  { echo "${BOLD}[e2e]${RESET} $*"; }
-ok()    { echo "${G}[PASS]${RESET} $*"; }
-fail()  { echo "${R}[FAIL]${RESET} $*" >&2; }
-warn()  { echo "${Y}[WARN]${RESET} $*"; }
-
-# ─── Docker availability check ────────────────────────────────────────────────
-if ! command -v docker &>/dev/null; then
-  warn "Docker not found — skipping e2e install test."
-  warn "Install Docker and re-run this script to exercise the full install flow."
-  exit 0
-fi
-
-if ! docker info &>/dev/null 2>&1; then
-  warn "Docker daemon is not running or not accessible — skipping e2e install test."
-  exit 0
-fi
-
-info "Docker available — proceeding with e2e install test."
-info "Repo root: ${REPO_ROOT}"
-info "Container image: ${IMAGE}"
-
-# ─── Inline script that runs INSIDE the container ────────────────────────────
-INNER_SCRIPT="$(mktemp /tmp/mosaic-e2e-inner-XXXXXX.sh)"
-trap 'rm -f "$INNER_SCRIPT"' EXIT
-
-cat > "$INNER_SCRIPT" <<'INNER_SCRIPT_EOF'
-#!/bin/sh
-# Bootstrap: /bin/sh until bash is installed, then re-exec.
-set -e
-
-echo "=== [inner] Installing system prerequisites ==="
-apk add --no-cache bash curl jq git 2>/dev/null || \
-  apt-get install -y -q bash curl jq git 2>/dev/null || true
-
-# Re-exec under bash.
-if [ -z "${BASH_VERSION:-}" ] && command -v bash >/dev/null 2>&1; then
-  exec bash "$0" "$@"
-fi
-
-# ── bash from here ────────────────────────────────────────────────────────────
-set -euo pipefail
-
-echo "=== [inner] Node.js / npm versions ==="
-node --version
-npm --version
-
-echo "=== [inner] Setting up npm global prefix ==="
-export NPM_PREFIX="/root/.npm-global"
-mkdir -p "$NPM_PREFIX/bin"
-npm config set prefix "$NPM_PREFIX" 2>/dev/null || true
-export PATH="$NPM_PREFIX/bin:$PATH"
-
-echo "=== [inner] Running install.sh --yes --no-auto-launch ==="
-# Install both framework and CLI from the Gitea registry.
-MOSAIC_SKIP_SKILLS_SYNC=1 \
-MOSAIC_ASSUME_YES=1 \
-  bash /repo/tools/install.sh --yes --no-auto-launch
-
-INSTALLED_VERSION="$(mosaic --version 2>/dev/null || echo 'unknown')"
-echo "[inner] mosaic CLI installed: ${INSTALLED_VERSION}"
-
-echo "=== [inner] Running mosaic wizard (non-interactive) ==="
-mosaic wizard \
-  --non-interactive \
-  --name "test-agent" \
-  --user-name "tester" \
-  --pronouns "they/them" \
-  --timezone "UTC" || {
-  echo "[WARN] mosaic wizard exited non-zero — continuing"
+Runs the documented installer command from zero in Debian/glibc as a non-root
+uid with an isolated HOME. The fixture exits non-zero when any P0-P8
+postcondition fails. `next` is always selected with the --next installer flag.
+EOF
 }

-echo "=== [inner] Running mosaic gateway install ==="
-# Feed non-interactive answers:
-#   "1"   → storage tier: local
-#   ""    → port: accept default (14242)
-#   ""    → ANTHROPIC_API_KEY: skip
-#   ""    → CORS origin: accept default
-#   Then admin bootstrap: name, email, password
-printf '1\n\n\n\nTest Admin\[email protected]\ntestpassword123\n' \
-  | mosaic gateway install
-INSTALL_EXIT="$?"
-if [ "${INSTALL_EXIT}" -ne 0 ]; then
-  echo "[ERR] mosaic gateway install exited ${INSTALL_EXIT}"
-  mosaic gateway status 2>/dev/null || true
-  exit "${INSTALL_EXIT}"
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --lane) LANE="${2:-}"; shift 2 ;;
+    --source) SOURCE="${2:-}"; shift 2 ;;
+    --git) GIT_MODE="${2:-}"; shift 2 ;;
+    -h|--help) usage; exit 0 ;;
+    *) echo "[fixture] unknown argument: $1" >&2; usage >&2; exit 2 ;;
+  esac
+done
+
+case "$LANE" in next|main) ;; *) echo "[fixture] unsupported lane '$LANE' (expected next|main)" >&2; exit 2 ;; esac
+case "$SOURCE" in checkout|remote) ;; *) echo "[fixture] unsupported source '$SOURCE' (expected checkout|remote)" >&2; exit 2 ;; esac
+case "$GIT_MODE" in present|absent) ;; *) echo "[fixture] unsupported git mode '$GIT_MODE' (expected present|absent)" >&2; exit 2 ;; esac
+
+if [[ "$IN_CLEAN_CONTAINER" != "1" ]]; then
+  if ! command -v docker >/dev/null 2>&1; then
+    echo "[fixture] FAIL: Docker is required; greenfield validation was NOT RUN." >&2
+    exit 2
+  fi
+  if ! docker info >/dev/null 2>&1; then
+    echo "[fixture] FAIL: Docker daemon is unavailable; greenfield validation was NOT RUN." >&2
+    exit 2
+  fi
 fi

-echo "=== [inner] Running mosaic gateway verify ==="
-# `gateway verify` was added in feat/mosaic-first-run-ux.
-# If the installed version pre-dates this, skip gracefully.
-if ! mosaic gateway --help 2>&1 | grep -q 'verify'; then
-  echo "[SKIP] 'mosaic gateway verify' not available in installed version ${INSTALLED_VERSION}."
-  echo "[SKIP] This command was added in the feat/mosaic-first-run-ux release."
-  echo "[SKIP] Re-run after the new version is published to validate this step."
-  # Treat as pass — the install flow itself worked.
-  exit 0
+installer_b64=""
+framework_payload_count="NOT-MEASURED"
+repo_root_count="NOT-MEASURED"
+checkout_archive=""
+checkout_digest=""
+checkout_content_id=""
+if [[ "$SOURCE" == "checkout" ]]; then
+  installer_b64="$(base64 -w0 "$INSTALLER_FILE")"
+  [[ -d "$ROOT/packages/mosaic/framework/skills" ]] \
+    && framework_payload_count="$(find "$ROOT/packages/mosaic/framework/skills" -mindepth 1 -maxdepth 1 -type d | wc -l | tr -d ' ')"
+  [[ -d "$ROOT/skills" ]] \
+    && repo_root_count="$(find "$ROOT/skills" -mindepth 1 -maxdepth 1 -type d | wc -l | tr -d ' ')"
+  checkout_archive="$(mktemp "${TMPDIR:-/tmp}/mosaic-greenfield-checkout.XXXXXX.tar.gz")"
+  repo_parent="$(dirname "$ROOT")"
+  repo_name="$(basename "$ROOT")"
+  tar -C "$repo_parent" \
+    --exclude='*/.git' --exclude='*/node_modules' --exclude='*/dist' \
+    --exclude='*/coverage' --exclude='*/.turbo' --exclude='*/.mosaic-test-work' \
+    --exclude='*/.env' --exclude='*/.env.*' \
+    -czf "$checkout_archive" "$repo_name"
+  checkout_digest="$(sha256sum "$checkout_archive" | awk '{print $1}')"
+  checkout_content_id="${checkout_digest:0:40}"
 fi

-mosaic gateway verify
-VERIFY_EXIT="$?"
-echo "=== [inner] verify exit code: ${VERIFY_EXIT} ==="
-exit "${VERIFY_EXIT}"
-INNER_SCRIPT_EOF
+inner="$(mktemp "${TMPDIR:-/tmp}/mosaic-greenfield-inner.XXXXXX.sh")"
+trap 'rm -f "$inner" "$checkout_archive"' EXIT
+cat > "$inner" <<'INNER'
+#!/usr/bin/env bash
+set -euo pipefail

-chmod +x "$INNER_SCRIPT"
+export DEBIAN_FRONTEND=noninteractive
+apt-get update -qq
+packages=(bash ca-certificates curl jq passwd python3 util-linux)
+[[ "$FIXTURE_GIT_MODE" == "present" ]] && packages+=(git)
+apt-get install -y -qq "${packages[@]}" >/dev/null

-# ─── Pull image ───────────────────────────────────────────────────────────────
-info "Pulling ${IMAGE}…"
-docker pull "${IMAGE}" --quiet
+if [[ "$FIXTURE_SOURCE" == "checkout" ]]; then
+  awk 'found { print } /^__MOSAIC_CHECKOUT_ARCHIVE__$/ { found=1; next }' "$0" | base64 -d > /tmp/source-checkout.tar.gz
+  actual_checkout_digest="$(sha256sum /tmp/source-checkout.tar.gz | awk '{print $1}')"
+  if [[ "$actual_checkout_digest" != "$FIXTURE_CHECKOUT_SHA256" ]]; then
+    echo "[fixture] checkout archive transport digest mismatch" >&2
+    exit 1
+  fi
+fi

-# ─── Run container ────────────────────────────────────────────────────────────
-info "Starting container ${CONTAINER_NAME}…"
+useradd --create-home --uid 1001 --shell /bin/bash mosaic
+install -d -o mosaic -g mosaic /home/mosaic/work

-EXIT_CODE=0
-docker run --rm \
-  --name "${CONTAINER_NAME}" \
-  --volume "${REPO_ROOT}:/repo:ro" \
-  --volume "${INNER_SCRIPT}:/e2e-inner.sh:ro" \
-  --network host \
-  "${IMAGE}" \
-  /bin/sh /e2e-inner.sh \
-  || EXIT_CODE=$?
+case "$FIXTURE_SOURCE" in
+  checkout)
+    printf '%s' "$FIXTURE_INSTALLER_B64" | base64 -d > /tmp/install.sh
+    ;;
+  remote)
+    curl -fsSL "https://git.mosaicstack.dev/mosaicstack/stack/raw/branch/${FIXTURE_LANE}/tools/install.sh" > /tmp/install.sh
+    ;;
+esac
+chmod 0755 /tmp/install.sh
+sha256sum /tmp/install.sh | sed 's/^/[fixture] installer sha256: /'

-# ─── Report ───────────────────────────────────────────────────────────────────
-echo ""
-if [[ "$EXIT_CODE" -eq 0 ]]; then
-  ok "End-to-end install test PASSED (exit ${EXIT_CODE})"
+cat > /tmp/run-as-target.sh <<'TARGET'
+#!/usr/bin/env bash
+set -uo pipefail
+
+lane="$FIXTURE_LANE"
+home="$HOME"
+prefix="$home/.npm-global"
+mosaic_home="$home/.config/mosaic"
+install_log="$home/install.log"
+failures=0
+
+phase_pass() { printf '[%s] PASS: %s\n' "$1" "$2"; }
+phase_fail() { printf '[%s] FAIL: %s\n' "$1" "$2"; failures=$((failures + 1)); }
+
+lane_args=()
+resolved_spec='@mosaicstack/mosaic'
+if [[ "$lane" == "next" ]]; then
+  lane_args+=(--next)
+  resolved_spec='@mosaicstack/mosaic@next'
+fi
+
+resolved_version="$(npm view "$resolved_spec" version --registry=https://git.mosaicstack.dev/api/packages/mosaicstack/npm/ 2>/dev/null || true)"
+printf '[fixture] resolved lane=%s package=%s version=%s\n' "$lane" "$resolved_spec" "${resolved_version:-UNRESOLVED}"
+
+set +e
+MOSAIC_NO_COLOR=1 MOSAIC_ASSUME_YES=1 \
+  bash /tmp/install.sh "${lane_args[@]}" --yes --no-auto-launch >"$install_log" 2>&1
+install_status=$?
+set -e
+cat "$install_log"
+printf '[fixture] installer_exit=%d done_claims=%s\n' \
+  "$install_status" "$(grep -cF 'Done.' "$install_log" || true)"
+
+# P0 Resolve context
+shell="$(getent passwd "$(id -u)" | cut -d: -f7)"
+if [[ "$(id -u)" -ne 0 && "$home" == "/home/mosaic" && "$shell" == "/bin/bash" ]] \
+  && ldd --version 2>&1 | grep -i 'glibc\|gnu libc' >/dev/null \
+  && [[ "$(node -p 'Number(process.versions.node.split(".")[0])')" -ge 20 ]]; then
+  phase_pass P0 "target=mosaic uid=$(id -u) HOME=$home shell=$shell libc=glibc node=$(node --version)"
 else
-  fail "End-to-end install test FAILED (exit ${EXIT_CODE})"
-  echo ""
-  echo "  Troubleshooting:"
-  echo "    - Review the output above for the failing step."
-  echo "    - Re-run with bash -x tools/e2e-install-test.sh for verbose trace."
-  echo "    - Run mosaic gateway logs inside a manual container for daemon output."
+  phase_fail P0 "context unresolved or unsupported (uid=$(id -u) HOME=$home shell=${shell:-unknown})"
+fi
+
+# P1 Preflight
+missing_tools=()
+for tool in bash curl git node npm python3 tar; do
+  command -v "$tool" >/dev/null 2>&1 || missing_tools+=("$tool")
+done
+if [[ "${#missing_tools[@]}" -eq 0 && -n "$resolved_version" && -w "$home" ]]; then
+  phase_pass P1 "required tools present (including downstream git); target HOME writable; registry lane resolved"
+else
+  phase_fail P1 "undeclared/missing prerequisite(s)=${missing_tools[*]:-none}; target_writable=$([[ -w "$home" ]] && echo yes || echo no) registry_resolved=$([[ -n "$resolved_version" ]] && echo yes || echo no)"
+fi
+
+# P2 Acquire artifacts
+if [[ -n "$resolved_version" ]] && grep -qF "$resolved_version" "$install_log"; then
+  phase_pass P2 "lane=$lane pinned_version=$resolved_version recorded in installer transcript"
+else
+  phase_fail P2 "lane=$lane did not resolve and record a pinned artifact version"
+fi
+
+# P3 Install CLI — the discriminating row. Use the known absolute path only.
+cli="$prefix/bin/mosaic"
+cli_version=""
+if [[ -x "$cli" ]]; then
+  cli_version="$($cli --version 2>/dev/null | tail -n 1 | tr -d '\r' || true)"
+fi
+if [[ -x "$cli" && "$cli_version" == "$resolved_version" ]]; then
+  phase_pass P3 "absolute_path=$cli version=$cli_version equals resolved lane version"
+else
+  phase_fail P3 "absolute_path=$cli executable=$([[ -x "$cli" ]] && echo yes || echo no) got=${cli_version:-missing} expected=${resolved_version:-unresolved}"
+fi
+
+# P4 Framework + skills. C1 does not choose among the four disagreeing
+# candidate populations. It requires the installer to publish a lane/versioned
+# shipped-set declaration that a checkout-free install can resolve; C5 owns its
+# contents. Without that artifact P4 is NOT-MEASURED, never a fabricated count.
+declared_set="$mosaic_home/.install-shipped-skills.json"
+sync_store_count=0
+runtime_link_count=0
+[[ -d "$mosaic_home/skills" ]] \
+  && sync_store_count="$(find "$mosaic_home/skills" -mindepth 1 -maxdepth 1 -type d | wc -l | tr -d ' ')"
+[[ -d "$home/.pi/agent/skills" ]] \
+  && runtime_link_count="$(find "$home/.pi/agent/skills" -mindepth 1 -maxdepth 1 \( -type d -o -type l \) | wc -l | tr -d ' ')"
+printf '[P4-EVIDENCE] candidate_populations framework_payload=%s repo_root=%s sync_store=%s jarvis_W-jarvis_observation=7 runtime_links=%s\n' \
+  "$FIXTURE_FRAMEWORK_PAYLOAD_COUNT" "$FIXTURE_REPO_ROOT_COUNT" "$sync_store_count" "$runtime_link_count"
+if [[ ! -s "$declared_set" ]]; then
+  phase_fail P4 "NOT-MEASURED / UNDECLARED: installer published no checkout-free, lane/versioned shipped-set artifact at $declared_set"
+elif EXPECTED_LANE="$([[ "$lane" == next ]] && echo next || echo latest)" EXPECTED_VERSION="$resolved_version" \
+  MOSAIC_SKILLS_ROOT="$mosaic_home/skills" node - "$declared_set" <<'NODE'
+const fs = require('fs');
+const path = require('path');
+const data = JSON.parse(fs.readFileSync(process.argv[2], 'utf8'));
+const root = path.resolve(process.env.MOSAIC_SKILLS_ROOT);
+if (!data || data.lane !== process.env.EXPECTED_LANE || data.version !== process.env.EXPECTED_VERSION ||
+    !Array.isArray(data.skills) || data.skills.length === 0) process.exit(1);
+for (const name of data.skills) {
+  if (typeof name !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(name)) process.exit(1);
+  const skill = path.join(root, name, 'SKILL.md');
+  let real;
+  try { real = fs.realpathSync(skill); } catch { process.exit(1); }
+  const text = fs.readFileSync(real, 'utf8');
+  const declaredName = text.match(/^---\s*$[\s\S]*?^name:\s*([^\s]+)\s*$/m)?.[1];
+  if (!real.startsWith(root + path.sep) || !fs.statSync(real).isFile() || !text || declaredName !== name) process.exit(1);
+}
+NODE
+then
+  declared_count="$(node -p "require('$declared_set').skills.length")"
+  if [[ -s "$mosaic_home/.install-manifest.json" ]] \
+    && [[ "$(node -p "require('$mosaic_home/.install-manifest.json').phaseOutcomes?.P4 || 'committed'")" == failed ]]; then
+    phase_fail P4 "declared skills are present but the required framework/skills action reported failure"
+  else
+    phase_pass P4 "declared shipped-set matches lane/version and all $declared_count skill(s) are contained and loadable"
+  fi
+else
+  phase_fail P4 "shipped-set artifact is malformed, wrong-lane/version, or its declared skills are not contained and loadable"
+fi
+
+# P5 Identity
+identity_ok=true
+identity_reason=()
+for f in SOUL.md USER.md; do
+  path="$mosaic_home/$f"
+  if [[ ! -s "$path" ]]; then
+    identity_ok=false; identity_reason+=("$f missing-or-empty"); continue
+  fi
+  owner="$(stat -c '%u' "$path")"; mode="$(stat -c '%a' "$path")"
+  if [[ "$owner" != "$(id -u)" || "$mode" =~ [2367]$ ]]; then
+    identity_ok=false; identity_reason+=("$f owner=$owner mode=$mode")
+  fi
+done
+if [[ "$identity_ok" == true ]]; then
+  phase_pass P5 "SOUL.md and USER.md are non-empty and target-user owned with non-world-writable modes"
+else
+  phase_fail P5 "${identity_reason[*]}"
+fi
+
+# P6 Runtime linking / activation. #869 must remain unwired without its broker.
+manifest="$mosaic_home/.install-manifest.json"
+broker_present=false
+[[ -S "${XDG_RUNTIME_DIR:-/run/user/$(id -u)}/mosaic-lease/broker.sock" ]] && broker_present=true
+dead_hooks=0
+if [[ -f "$home/.claude/settings.json" ]]; then
+  dead_hooks="$(grep -Ec 'mutator-gate\.py|receipt-observer-client\.py' "$home/.claude/settings.json" || true)"
+fi
+p6_action_failed=false
+if [[ -s "$manifest" ]]; then
+  p6_action_failed="$(node -p "require('$manifest').phaseOutcomes?.P6 === 'failed' ? 'true' : 'false'" 2>/dev/null || echo true)"
+fi
+if [[ "$p6_action_failed" == true ]]; then
+  phase_fail P6 "runtime linking/activation action reported a required failure"
+elif [[ "$broker_present" == false && "$dead_hooks" -eq 0 ]]; then
+  phase_pass P6 "broker absent and #869 enforcement hooks remain inactive"
+elif [[ "$broker_present" == true ]]; then
+  phase_pass P6 "activation broker present; hook state is evaluable"
+else
+  phase_fail P6 "broker absent but dead enforcement hooks are active (count=$dead_hooks)"
+fi
+
+# P7 Services — none requested by --no-auto-launch.
+phase_pass P7 "no services requested by this fixture"
+
+# P8 Shell discoverability — actual target shell, fresh login and non-login.
+base_env=(env -i HOME="$home" USER=mosaic LOGNAME=mosaic SHELL=/bin/bash PATH=/usr/local/bin:/usr/bin:/bin)
+login_path="$("${base_env[@]}" /bin/bash -lc 'command -v mosaic' 2>/dev/null || true)"
+nonlogin_path="$("${base_env[@]}" /bin/bash -c 'command -v mosaic' 2>/dev/null || true)"
+if [[ "$login_path" == "$cli" && "$nonlogin_path" == "$cli" ]]; then
+  phase_pass P8 "login=$login_path nonlogin=$nonlogin_path equals P3 path"
+else
+  phase_fail P8 "fresh bash login=${login_path:-missing} nonlogin=${nonlogin_path:-missing} expected=$cli"
+fi
+
+manifest="$mosaic_home/.install-manifest.json"
+p0_p8_failures="$failures"
+if [[ "$p0_p8_failures" -eq 0 && -s "$manifest" ]]; then
+  phase_pass P9 "P0-P8 reasserted; manifest present"
+else
+  phase_fail P9 "P0-P8_failed_postconditions=$p0_p8_failures manifest=$([[ -s "$manifest" ]] && echo present || echo missing); install must not certify success"
+fi
+
+printf '[fixture] P0-P9_failed_rows=%d (includes P9 aggregate row)\n' "$failures"
+if [[ "$failures" -ne 0 ]]; then
  exit 1
 fi
+TARGET
+chmod 0755 /tmp/run-as-target.sh
+chown mosaic:mosaic /tmp/run-as-target.sh
+
+exec runuser -u mosaic -- env -i \
+  HOME=/home/mosaic USER=mosaic LOGNAME=mosaic SHELL=/bin/bash \
+  PATH=/usr/local/bin:/usr/bin:/bin \
+  FIXTURE_LANE="$FIXTURE_LANE" \
+  FIXTURE_GIT_MODE="$FIXTURE_GIT_MODE" \
+  FIXTURE_FRAMEWORK_PAYLOAD_COUNT="$FIXTURE_FRAMEWORK_PAYLOAD_COUNT" \
+  FIXTURE_REPO_ROOT_COUNT="$FIXTURE_REPO_ROOT_COUNT" \
+  MOSAIC_INSTALL_LOCAL_SOURCE_ARCHIVE="$([[ "$FIXTURE_SOURCE" == "checkout" ]] && echo /tmp/source-checkout.tar.gz)" \
+  MOSAIC_INSTALL_LOCAL_SOURCE_COMMIT="$FIXTURE_CHECKOUT_CONTENT_ID" \
+  MOSAIC_INSTALL_LOCAL_SOURCE_SHA256="$FIXTURE_CHECKOUT_SHA256" \
+  /bin/bash /tmp/run-as-target.sh
+INNER
+if [[ "$SOURCE" == "checkout" ]]; then
+  {
+    printf '\n__MOSAIC_CHECKOUT_ARCHIVE__\n'
+    base64 "$checkout_archive"
+  } >> "$inner"
+fi
+chmod 0755 "$inner"
+
+printf '[fixture] platform=Debian/glibc image=%s target_uid=1001 lane=%s source=%s git=%s\n' "$IMAGE" "$LANE" "$SOURCE" "$GIT_MODE"
+printf '[fixture] host inheritance: no bind mounts, no host HOME, no npm cache, no credentials\n'
+
+if [[ "$IN_CLEAN_CONTAINER" == "1" ]]; then
+  # Woodpecker already supplies the clean Debian container. The target install
+  # still runs through runuser + env -i, so CI variables/credentials do not
+  # enter the target user's process.
+  FIXTURE_LANE="$LANE" \
+  FIXTURE_SOURCE="$SOURCE" \
+  FIXTURE_GIT_MODE="$GIT_MODE" \
+  FIXTURE_INSTALLER_B64="$installer_b64" \
+  FIXTURE_CHECKOUT_SHA256="$checkout_digest" \
+  FIXTURE_CHECKOUT_CONTENT_ID="$checkout_content_id" \
+  FIXTURE_FRAMEWORK_PAYLOAD_COUNT="$framework_payload_count" \
+  FIXTURE_REPO_ROOT_COUNT="$repo_root_count" \
+    /bin/bash "$inner"
+else
+  # Copy the self-contained script+archive into a stopped container instead of
+  # bind-mounting the checkout or passing host paths. The target runtime still
+  # inherits no host HOME/cache/credentials, and the multi-megabyte checkout
+  # payload avoids argv/environment size limits.
+  fixture_cid="$(docker create \
+    --network bridge \
+    --env FIXTURE_LANE="$LANE" \
+    --env FIXTURE_SOURCE="$SOURCE" \
+    --env FIXTURE_GIT_MODE="$GIT_MODE" \
+    --env FIXTURE_INSTALLER_B64="$installer_b64" \
+    --env FIXTURE_CHECKOUT_SHA256="$checkout_digest" \
+    --env FIXTURE_CHECKOUT_CONTENT_ID="$checkout_content_id" \
+    --env FIXTURE_FRAMEWORK_PAYLOAD_COUNT="$framework_payload_count" \
+    --env FIXTURE_REPO_ROOT_COUNT="$repo_root_count" \
+    "$IMAGE" /bin/bash /tmp/mosaic-greenfield-fixture.sh)"
+  docker cp "$inner" "$fixture_cid:/tmp/mosaic-greenfield-fixture.sh"
+  set +e
+  docker start -a "$fixture_cid"
+  fixture_status=$?
+  set -e
+  docker rm "$fixture_cid" >/dev/null
+  exit "$fixture_status"
+fi
@@ -0,0 +1,51 @@
+# Pinned C1 expected-RED contract. Updating a verdict/reason requires review by the owning remediation lane.
+# case	kind	key/value
+next-git-present	exit	1
+next-git-present	phase	P0=PASS
+next-git-present	phase	P1=PASS
+next-git-present	phase	P2=PASS
+next-git-present	phase	P3=PASS
+next-git-present	phase	P4=FAIL
+next-git-present	phase	P5=FAIL
+next-git-present	phase	P6=FAIL
+next-git-present	phase	P7=PASS
+next-git-present	phase	P8=FAIL
+next-git-present	phase	P9=FAIL
+next-git-present	require	^\[fixture\] resolved lane=next .*version=[0-9]+\.[0-9]+\.[0-9]+-next\.
+next-git-present	require	^\[fixture\] installer_exit=1 done_claims=0$
+next-git-present	require	^\[P3\] PASS: absolute_path=.* version=.* equals resolved lane version$
+next-git-present	require	^\[P4\] FAIL: NOT-MEASURED / UNDECLARED:
+next-git-present	require	^\[P6\] FAIL:
+next-git-present	forbid	Done\.
+main-git-present	exit	1
+main-git-present	phase	P0=PASS
+main-git-present	phase	P1=PASS
+main-git-present	phase	P2=PASS
+main-git-present	phase	P3=PASS
+main-git-present	phase	P4=FAIL
+main-git-present	phase	P5=FAIL
+main-git-present	phase	P6=FAIL
+main-git-present	phase	P7=PASS
+main-git-present	phase	P8=FAIL
+main-git-present	phase	P9=FAIL
+main-git-present	require	^\[fixture\] resolved lane=main .*version=[0-9]+\.[0-9]+\.[0-9]+$
+main-git-present	require	^\[fixture\] installer_exit=1 done_claims=0$
+main-git-present	require	^\[P3\] PASS: absolute_path=.* version=.* equals resolved lane version$
+main-git-present	require	^\[P4\] FAIL: NOT-MEASURED / UNDECLARED:
+main-git-present	require	^\[P6\] FAIL:
+main-git-present	forbid	Done\.
+next-git-absent	exit	1
+next-git-absent	phase	P0=PASS
+next-git-absent	phase	P1=FAIL
+next-git-absent	phase	P2=FAIL
+next-git-absent	phase	P3=FAIL
+next-git-absent	phase	P4=FAIL
+next-git-absent	phase	P5=FAIL
+next-git-absent	phase	P6=PASS
+next-git-absent	phase	P7=PASS
+next-git-absent	phase	P8=FAIL
+next-git-absent	phase	P9=FAIL
+next-git-absent	require	^\[fixture\] installer_exit=1 done_claims=0$
+next-git-absent	require	^\[P1\] FAIL: undeclared/missing prerequisite\(s\)=git;
+next-git-absent	require	^\[P3\] FAIL: .*executable=no
+next-git-absent	forbid	Done\.
@@ -0,0 +1,359 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+TMP="$(mktemp -d "${TMPDIR:-/tmp}/mosaic-next-install-test-XXXXXX")"
+trap 'rm -rf "$TMP"' EXIT
+
+FAKE_BIN="$TMP/bin"
+HOME_DIR="$TMP/home"
+PREFIX="$HOME_DIR/prefix"
+MOSAIC_HOME="$HOME_DIR/mosaic"
+STATE="$TMP/state"
+LOG="$TMP/npm.log"
+mkdir -p "$FAKE_BIN" "$HOME_DIR" "$STATE"
+
+cat > "$FAKE_BIN/npm" <<'FAKE_NPM'
+#!/usr/bin/env bash
+set -euo pipefail
+LOG="${MOSAIC_TEST_NPM_LOG:?}"
+STATE="${MOSAIC_TEST_STATE:?}"
+echo "$*" >> "$LOG"
+
+if [[ "${1:-}" == "--version" ]]; then
+  echo "10.6.2"
+  exit 0
+fi
+
+install_cli() {
+  local version="$1"
+  echo "$version" > "$STATE/mosaic"
+  mkdir -p "${MOSAIC_PREFIX:?}/bin"
+  cat > "$MOSAIC_PREFIX/bin/mosaic" <<CLI
+#!/usr/bin/env bash
+printf '%s\\n' '$version'
+CLI
+  chmod +x "$MOSAIC_PREFIX/bin/mosaic"
+}
+
+if [[ "$1" == "view" ]]; then
+  if [[ "${MOSAIC_TEST_FAIL_NPM_VIEW:-0}" == "1" ]]; then
+    echo "forced registry metadata failure" >&2
+    exit 1
+  fi
+  case "$2 $3" in
+    "@mosaicstack/mosaic@next version") echo "0.0.49-next.999" ;;
+    "@mosaicstack/gateway@next version") echo "${MOSAIC_TEST_GATEWAY_NEXT_VERSION:-0.0.7-next.999}" ;;
+    "@mosaicstack/mosaic version") echo "0.0.48" ;;
+    *) echo "unexpected npm view: $*" >&2; exit 1 ;;
+  esac
+  exit 0
+fi
+
+if [[ "$1" == "install" ]]; then
+  case "$*" in
+    *"@mosaicstack/[email protected]"*)
+      install_cli "0.0.49-next.999"
+      ;;
+    *"@mosaicstack/[email protected]"*)
+      if [[ "${MOSAIC_TEST_FAIL_NEXT_GATEWAY_INSTALL:-0}" == "1" ]]; then
+        echo "forced gateway install failure" >&2
+        exit 1
+      fi
+      echo "0.0.7-next.999" > "$STATE/gateway"
+      ;;
+    *"mosaicstack-mosaic-0.0.0-source.tgz"*)
+      install_cli "0.0.0-source"
+      ;;
+    *"mosaicstack-gateway-0.0.0-source.tgz"*)
+      echo "0.0.0-source" > "$STATE/gateway"
+      ;;
+    *) echo "unexpected npm install: $*" >&2; exit 1 ;;
+  esac
+  exit 0
+fi
+
+if [[ "$1" == "ls" ]]; then
+  cli="$(cat "$STATE/mosaic" 2>/dev/null || true)"
+  gateway="$(cat "$STATE/gateway" 2>/dev/null || true)"
+  node -e '
+    const cli = process.argv[1];
+    const gateway = process.argv[2];
+    const dependencies = {};
+    if (cli) dependencies["@mosaicstack/mosaic"] = { version: cli };
+    if (gateway) dependencies["@mosaicstack/gateway"] = { version: gateway };
+    process.stdout.write(JSON.stringify({ dependencies }));
+  ' "$cli" "$gateway"
+  exit 0
+fi
+
+echo "unexpected npm command: $*" >&2
+exit 1
+FAKE_NPM
+chmod +x "$FAKE_BIN/npm"
+
+cat > "$FAKE_BIN/curl" <<'FAKE_CURL'
+#!/usr/bin/env bash
+set -euo pipefail
+headers=""; output=""; url=""
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    -D) headers="$2"; shift 2 ;;
+    -o) output="$2"; shift 2 ;;
+    --max-filesize) shift 2 ;;
+    -*) shift ;;
+    *) url="$1"; shift ;;
+  esac
+done
+case "$url" in
+  */api/v1/repos/mosaicstack/stack/commits?sha=*)
+    printf 'HTTP/1.1 200 OK\r\ncontent-type: application/json; charset=utf-8\r\n\r\n' > "$headers"
+    printf '[{"sha":"1111111111111111111111111111111111111111"}]\n' > "$output"
+    ;;
+  */archive/*.tar.gz)
+    if [[ "${MOSAIC_TEST_CORRUPT_ARCHIVE:-0}" == "1" ]]; then
+      printf 'not-a-tarball\n' > "$output"
+    else
+      archive_root="$(mktemp -d)"
+      mkdir -p "$archive_root/stack"
+      printf 'fixture\n' > "$archive_root/stack/.fixture"
+      /bin/tar czf "$output" -C "$archive_root" stack
+      rm -rf "$archive_root"
+    fi
+    ;;
+esac
+FAKE_CURL
+chmod +x "$FAKE_BIN/curl"
+
+cat > "$FAKE_BIN/tar" <<'FAKE_TAR'
+#!/usr/bin/env bash
+set -euo pipefail
+dest=""; list=false
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    -C) dest="$2"; shift 2 ;;
+    -*t*|t*) list=true; shift ;;
+    *) shift ;;
+  esac
+done
+[[ "$list" == true ]] && exit 0
+if [[ -z "$dest" ]]; then
+  echo "fake tar missing -C destination" >&2
+  exit 1
+fi
+mkdir -p "$dest/stack/packages/mosaic" "$dest/stack/apps/gateway"
+FAKE_TAR
+chmod +x "$FAKE_BIN/tar"
+
+cat > "$FAKE_BIN/pnpm" <<'FAKE_PNPM'
+#!/usr/bin/env bash
+set -euo pipefail
+LOG="${MOSAIC_TEST_NPM_LOG:?}"
+echo "pnpm $*" >> "$LOG"
+
+if [[ "$1" == "pack" ]]; then
+  out=""
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      --pack-destination) out="$2"; shift 2 ;;
+      *) shift ;;
+    esac
+  done
+  if [[ -z "$out" ]]; then
+    echo "fake pnpm pack missing destination" >&2
+    exit 1
+  fi
+  mkdir -p "$out"
+  case "$PWD" in
+    */apps/gateway) touch "$out/mosaicstack-gateway-0.0.0-source.tgz" ;;
+    */packages/mosaic) touch "$out/mosaicstack-mosaic-0.0.0-source.tgz" ;;
+    *) echo "unexpected pnpm pack cwd: $PWD" >&2; exit 1 ;;
+  esac
+  exit 0
+fi
+
+if [[ "${MOSAIC_TEST_FAIL_PNPM_INSTALL:-0}" == "1" && "$1" == "install" ]]; then
+  echo "forced pnpm install failure" >&2
+  exit 42
+fi
+
+# Other install/build commands are no-ops in this harness.
+exit 0
+FAKE_PNPM
+chmod +x "$FAKE_BIN/pnpm"
+
+reset_state() {
+  : > "$LOG"
+  rm -f "$STATE"/*
+}
+
+prefix_fingerprint() {
+  if [[ ! -d "$PREFIX" ]]; then printf 'ABSENT\n'; return; fi
+  (
+    cd "$PREFIX"
+    find . -mindepth 1 -printf '%P|%y|%m|%l\n' | LC_ALL=C sort
+    find . -type f -print0 | LC_ALL=C sort -z | xargs -0 -r sha256sum
+  ) | sha256sum | awk '{print $1}'
+}
+
+reset_state
+echo "[test] --next fast path pins resolved package versions"
+OUTPUT="$(
+  HOME="$HOME_DIR" \
+  MOSAIC_HOME="$MOSAIC_HOME" \
+  MOSAIC_PREFIX="$PREFIX" \
+  MOSAIC_NO_COLOR=1 \
+  MOSAIC_TEST_NPM_LOG="$LOG" \
+  MOSAIC_TEST_STATE="$STATE" \
+  PATH="$FAKE_BIN:$PATH" \
+  bash "$ROOT/tools/install.sh" --cli --next --yes --no-auto-launch
+)"
+
+grep -qF 'Installed @next packages: CLI 0.0.49-next.999, gateway 0.0.7-next.999' <<<"$OUTPUT"
+grep -qF 'install -g @mosaicstack/[email protected]' "$LOG"
+grep -qF 'install -g @mosaicstack/[email protected]' "$LOG"
+if grep -qE '^install -g .+@next( |$)' "$LOG"; then
+  echo "expected exact-version installs, found mutable @next install" >&2
+  exit 1
+fi
+if grep -qF 'Downloading source ref next at pinned commit' <<<"$OUTPUT"; then
+  echo "fast path unexpectedly fell back to source" >&2
+  exit 1
+fi
+
+ACTIVE="$HOME_DIR/.local/state/mosaic/install/active.json"
+[[ "$(node -p "require('$ACTIVE').status")" == "committed" ]]
+JOURNAL="$(node -p "require('$ACTIVE').journal")"
+[[ "$(stat -c '%a' "$JOURNAL")" == "444" ]]
+( cd "$(dirname "$JOURNAL")" && sha256sum -c "$(basename "$JOURNAL").sha256" >/dev/null )
+grep -q '"event":"mutation".*"phase":"P3".*path=.*prior=.*reverse=' "$JOURNAL"
+
+reset_state
+echo "[test] fast path failure falls back to source build"
+OUTPUT="$(
+  HOME="$HOME_DIR" \
+  MOSAIC_HOME="$MOSAIC_HOME" \
+  MOSAIC_PREFIX="$PREFIX" \
+  MOSAIC_NO_COLOR=1 \
+  MOSAIC_TEST_NPM_LOG="$LOG" \
+  MOSAIC_TEST_STATE="$STATE" \
+  MOSAIC_TEST_FAIL_NEXT_GATEWAY_INSTALL=1 \
+  PATH="$FAKE_BIN:$PATH" \
+  bash "$ROOT/tools/install.sh" --cli --next --yes --no-auto-launch
+)"
+
+grep -qF 'Fast gateway @next install failed.' <<<"$OUTPUT"
+grep -qF 'Falling back to source build at ref next; --next will not hard-fail on registry issues.' <<<"$OUTPUT"
+grep -qF 'Downloading source ref next at pinned commit 1111111111111111111111111111111111111111' <<<"$OUTPUT"
+grep -qF 'Installed from source: CLI 0.0.0-source' <<<"$OUTPUT"
+grep -qF 'install -g @mosaicstack/[email protected]' "$LOG"
+grep -qE 'install -g .*/mosaicstack-gateway-0\.0\.0-source\.tgz' "$LOG"
+grep -qE 'install -g .*/mosaicstack-mosaic-0\.0\.0-source\.tgz' "$LOG"
+[[ "$(cat "$STATE/mosaic")" == "0.0.0-source" ]]
+[[ "$(cat "$STATE/gateway")" == "0.0.0-source" ]]
+
+reset_state
+echo "[test] source-build failure is fatal and restores the pre-install prefix"
+before_prefix="$(prefix_fingerprint)"
+set +e
+OUTPUT="$(
+  HOME="$HOME_DIR" \
+  MOSAIC_HOME="$MOSAIC_HOME" \
+  MOSAIC_PREFIX="$PREFIX" \
+  MOSAIC_NO_COLOR=1 \
+  MOSAIC_TEST_NPM_LOG="$LOG" \
+  MOSAIC_TEST_STATE="$STATE" \
+  MOSAIC_TEST_FAIL_NEXT_GATEWAY_INSTALL=1 \
+  MOSAIC_TEST_FAIL_PNPM_INSTALL=1 \
+  PATH="$FAKE_BIN:$PATH" \
+  bash "$ROOT/tools/install.sh" --cli --next --yes --no-auto-launch 2>&1
+)"
+FAIL_STATUS=$?
+set -e
+[[ "$FAIL_STATUS" -ne 0 ]]
+[[ "$(prefix_fingerprint)" == "$before_prefix" ]]
+grep -qF 'forced pnpm install failure' <<<"$OUTPUT"
+[[ "$(node -p "require('$ACTIVE').status")" == "rolled-back" ]]
+
+reset_state
+echo "[test] corrupt source archive is fatal and restores the pre-install prefix"
+before_prefix="$(prefix_fingerprint)"
+set +e
+OUTPUT="$(
+  HOME="$HOME_DIR" \
+  MOSAIC_HOME="$MOSAIC_HOME" \
+  MOSAIC_PREFIX="$PREFIX" \
+  MOSAIC_NO_COLOR=1 \
+  MOSAIC_TEST_NPM_LOG="$LOG" \
+  MOSAIC_TEST_STATE="$STATE" \
+  MOSAIC_TEST_FAIL_NEXT_GATEWAY_INSTALL=1 \
+  MOSAIC_TEST_CORRUPT_ARCHIVE=1 \
+  PATH="$FAKE_BIN:$PATH" \
+  bash "$ROOT/tools/install.sh" --cli --next --yes --no-auto-launch 2>&1
+)"
+FAIL_STATUS=$?
+set -e
+[[ "$FAIL_STATUS" -ne 0 ]]
+[[ "$(prefix_fingerprint)" == "$before_prefix" ]]
+grep -qF 'archive safety/integrity check failed' <<<"$OUTPUT"
+[[ "$(node -p "require('$ACTIVE').status")" == "rolled-back" ]]
+
+reset_state
+echo "[test] --dev source install does not require registry version resolution"
+OUTPUT="$(
+  HOME="$HOME_DIR" \
+  MOSAIC_HOME="$MOSAIC_HOME" \
+  MOSAIC_PREFIX="$PREFIX" \
+  MOSAIC_NO_COLOR=1 \
+  MOSAIC_TEST_NPM_LOG="$LOG" \
+  MOSAIC_TEST_STATE="$STATE" \
+  MOSAIC_TEST_FAIL_NPM_VIEW=1 \
+  PATH="$FAKE_BIN:$PATH" \
+  bash "$ROOT/tools/install.sh" --cli --dev --ref feature-x --yes --no-auto-launch
+)"
+grep -qF 'Downloading source ref feature-x at pinned commit 1111111111111111111111111111111111111111' <<<"$OUTPUT"
+grep -qF 'Installed from source: CLI 0.0.0-source' <<<"$OUTPUT"
+grep -q '^\[P2\] PASS: source_ref=feature-x pinned_commit=1111111111111111111111111111111111111111 sha256=' <<<"$OUTPUT"
+
+reset_state
+echo "[test] explicit --ref keeps source lane and avoids @next lookup"
+set +e
+OUTPUT="$(
+  HOME="$HOME_DIR" \
+  MOSAIC_HOME="$MOSAIC_HOME" \
+  MOSAIC_PREFIX="$PREFIX" \
+  MOSAIC_NO_COLOR=1 \
+  MOSAIC_TEST_NPM_LOG="$LOG" \
+  MOSAIC_TEST_STATE="$STATE" \
+  PATH="$FAKE_BIN:$PATH" \
+  bash "$ROOT/tools/install.sh" --check --cli --next --ref feature-x
+)"
+CHECK_STATUS=$?
+set -e
+[[ "$CHECK_STATUS" -ne 0 ]]
+grep -q '^\[P2\] PASS: source_ref=feature-x pinned_commit=1111111111111111111111111111111111111111 sha256=' <<<"$OUTPUT"
+if grep -qF '@next version' "$LOG"; then
+  echo "explicit ref should not query @next dist-tags" >&2
+  exit 1
+fi
+
+reset_state
+echo "[test] --check --next rejects mismatched prerelease pipeline suffixes"
+set +e
+OUTPUT="$(
+  HOME="$HOME_DIR" \
+  MOSAIC_HOME="$MOSAIC_HOME" \
+  MOSAIC_PREFIX="$PREFIX" \
+  MOSAIC_NO_COLOR=1 \
+  MOSAIC_TEST_NPM_LOG="$LOG" \
+  MOSAIC_TEST_STATE="$STATE" \
+  MOSAIC_TEST_GATEWAY_NEXT_VERSION="0.0.7-next.1000" \
+  PATH="$FAKE_BIN:$PATH" \
+  bash "$ROOT/tools/install.sh" --check --cli --next
+)"
+CHECK_STATUS=$?
+set -e
+[[ "$CHECK_STATUS" -ne 0 ]]
+grep -q '^\[P2\] FAIL: resolved_version=unavailable' <<<"$OUTPUT"
+
+echo "[test] installer next lane tests passed"
@@ -0,0 +1,338 @@
+#!/usr/bin/env bash
+# Red-first acceptance checks for #1050. This file is committed before the
+# installer implementation. Do not weaken these properties to make it green.
+
+# pass_case always returns zero and fail_case records the aggregate failure;
+# the compact A&&pass||fail assertions are intentional.
+# shellcheck disable=SC2015
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+TMP="$(mktemp -d "${TMPDIR:-/tmp}/mosaic-install-state-test.XXXXXX")"
+trap 'rm -rf "$TMP"' EXIT
+failures=0
+COMPAT_BIN="$TMP/compat-bin"
+mkdir -p "$COMPAT_BIN"
+cat > "$COMPAT_BIN/realpath" <<'REALPATH'
+#!/usr/bin/env python3
+import os
+import sys
+
+args = sys.argv[1:]
+mode = args.pop(0) if args and args[0] in ("-e", "-m") else "-m"
+if args and args[0] == "--":
+    args.pop(0)
+if len(args) != 1 or (mode == "-e" and not os.path.exists(args[0])):
+    raise SystemExit(1)
+print(os.path.realpath(args[0]))
+REALPATH
+chmod 0755 "$COMPAT_BIN/realpath"
+
+fail_case() { printf '[test] FAIL: %s\n' "$*" >&2; failures=$((failures + 1)); }
+pass_case() { printf '[test] PASS: %s\n' "$*"; }
+
+fingerprint() {
+  local dir="$1"
+  if [[ ! -d "$dir" ]]; then printf 'ABSENT\n'; return; fi
+  python3 - "$dir" <<'PY'
+import hashlib
+import os
+import stat
+import sys
+
+root = os.path.abspath(sys.argv[1])
+rows = []
+for current, dirs, files in os.walk(root, topdown=True, followlinks=False):
+    for name in dirs + files:
+        path = os.path.join(current, name)
+        rel = os.path.relpath(path, root)
+        meta = os.lstat(path)
+        target = os.readlink(path) if stat.S_ISLNK(meta.st_mode) else ""
+        digest = ""
+        if stat.S_ISREG(meta.st_mode):
+            with open(path, "rb") as handle:
+                digest = hashlib.sha256(handle.read()).hexdigest()
+        rows.append((rel, stat.S_IFMT(meta.st_mode), stat.S_IMODE(meta.st_mode), meta.st_uid, meta.st_gid, target, digest))
+payload = "\n".join("|".join(map(str, row)) for row in sorted(rows)).encode()
+print(hashlib.sha256(payload).hexdigest())
+PY
+}
+
+make_fake_npm() {
+  local bin="$1"
+  mkdir -p "$bin"
+  cat > "$bin/npm" <<'FAKE'
+#!/bin/bash
+set -euo pipefail
+if [[ "${1:-}" == "--version" ]]; then echo '10.6.2'; exit 0; fi
+case "${1:-} ${2:-} ${3:-}" in
+  'view @mosaicstack/mosaic@next version') echo '0.0.50-next.999' ;;
+  'view @mosaicstack/gateway@next version') echo '0.0.7-next.999' ;;
+  'view @mosaicstack/mosaic version') echo '0.0.49' ;;
+  'ls -g --depth=0'|'ls -g --json') echo '{"dependencies":{"@mosaicstack/mosaic":{"version":"0.0.50-next.999"},"@mosaicstack/gateway":{"version":"0.0.7-next.999"}}}' ;;
+  ls*) echo '{"dependencies":{"@mosaicstack/mosaic":{"version":"0.0.50-next.999"},"@mosaicstack/gateway":{"version":"0.0.7-next.999"}}}' ;;
+  *) echo "unexpected fake npm command: $*" >&2; exit 1 ;;
+esac
+FAKE
+  chmod 0755 "$bin/npm"
+}
+
+printf '[test] case: --check enumerates exactly P0-P8, discriminates, and mutates nothing\n'
+check_home="$TMP/check-home"
+check_bin="$TMP/check-bin"
+mkdir -p "$check_home/.config/mosaic/skills/alpha" "$check_home/.npm-global/bin" "$check_bin"
+printf '# framework\n' > "$check_home/.config/mosaic/AGENTS.md"
+printf '# skill\n' > "$check_home/.config/mosaic/skills/alpha/SKILL.md"
+cat > "$check_home/.npm-global/bin/mosaic" <<'CLI'
+#!/usr/bin/env bash
+printf '0.0.50-next.999\n'
+CLI
+chmod 0755 "$check_home/.npm-global/bin/mosaic"
+make_fake_npm "$check_bin"
+before="$(fingerprint "$check_home")"
+set +e
+HOME="$check_home" MOSAIC_HOME="$check_home/.config/mosaic" MOSAIC_PREFIX="$check_home/.npm-global" \
+  MOSAIC_NO_COLOR=1 PATH="$check_bin:/usr/local/bin:/usr/bin:/bin" \
+  bash "$ROOT/tools/install.sh" --check --next >"$TMP/check.log" 2>&1
+check_status=$?
+set -e
+after="$(fingerprint "$check_home")"
+
+[[ "$before" == "$after" ]] && pass_case '--check left the complete HOME fingerprint unchanged' \
+  || fail_case "--check mutated HOME (before=$before after=$after)"
+[[ "$check_status" -ne 0 ]] && pass_case '--check exited non-zero for failed P4/P5/P8 predicates' \
+  || fail_case '--check returned zero on the deliberately broken host'
+
+phase_rows=0
+for phase in P0 P1 P2 P3 P4 P5 P6 P7 P8; do
+  count="$(grep -Ec "^\[$phase\] (PASS|FAIL):" "$TMP/check.log" || true)"
+  [[ "$count" -eq 1 ]] || fail_case "$phase expected exactly one PASS/FAIL row, got $count"
+  phase_rows=$((phase_rows + count))
+done
+[[ "$phase_rows" -eq 9 ]] && pass_case '--check emitted exactly nine P0-P8 result rows' \
+  || fail_case "--check emitted $phase_rows canonical rows instead of 9"
+grep -q '^\[P3\] PASS:.*0\.0\.50-next\.999' "$TMP/check.log" \
+  && pass_case 'P3 preserves the absolute-path exact-version discriminator' \
+  || fail_case 'P3 did not PASS with the exact resolved next-lane version'
+grep -q '^\[P4\] FAIL: NOT-MEASURED / UNDECLARED:' "$TMP/check.log" \
+  && pass_case 'P4 refuses fabricated precision when no shipped-set declaration exists' \
+  || fail_case 'P4 did not report the declared-set population as NOT-MEASURED / UNDECLARED'
+for phase in P5 P8; do
+  grep -q "^\[$phase\] FAIL:" "$TMP/check.log" \
+    && pass_case "$phase remains an attributable expected RED" \
+    || fail_case "$phase did not report its own expected failure"
+done
+
+printf '[test] case: --check discriminates a constructed good host without mutation\n'
+good_home="$TMP/good-home"
+good_bin="$TMP/good-bin"
+good_prefix="$good_home/.npm-global"
+good_mosaic="$good_home/.config/mosaic"
+mkdir -p "$good_bin" "$good_prefix/bin" "$good_mosaic/skills/declared-skill"
+make_fake_npm "$good_bin"
+cp "$COMPAT_BIN/realpath" "$good_bin/realpath"
+cat > "$good_bin/id" <<'ID'
+#!/bin/bash
+case "${1:-}" in
+  -u) echo 1001 ;;
+  -g) echo 1001 ;;
+  -un) echo fixture-user ;;
+  *) exec /bin/id "$@" ;;
+esac
+ID
+cat > "$good_bin/stat" <<'STAT'
+#!/bin/bash
+if [[ "${1:-} ${2:-}" == '-c %u' ]]; then echo 1001; exit 0; fi
+exec /bin/stat "$@"
+STAT
+cat > "$good_bin/curl" <<'CURL'
+#!/bin/bash
+exit 0
+CURL
+cat > "$good_bin/ldd" <<'LDD'
+#!/bin/bash
+echo 'ldd (GNU libc) 2.36'
+LDD
+chmod 0755 "$good_bin/id" "$good_bin/stat" "$good_bin/curl" "$good_bin/ldd"
+cat > "$good_prefix/bin/mosaic" <<'CLI'
+#!/usr/bin/env bash
+printf '0.0.50-next.999\n'
+CLI
+chmod 0755 "$good_prefix/bin/mosaic"
+cat > "$good_bin/getent" <<GETENT
+#!/bin/bash
+printf '%s:x:%s:%s::%s:%s\\n' '$(id -un)' '$(id -u)' '$(id -g)' '$good_home' '$good_bin/bash'
+GETENT
+cat > "$good_bin/bash" <<SHELL
+#!/bin/bash
+if [[ "\${*: -1}" == 'command -v mosaic' ]]; then
+  printf '%s\\n' '$good_prefix/bin/mosaic'
+  exit 0
+fi
+exec /bin/bash "\$@"
+SHELL
+chmod 0755 "$good_bin/getent" "$good_bin/bash"
+printf '# Soul\n\nConfigured.\n' > "$good_mosaic/SOUL.md"
+printf '# User\n\nConfigured.\n' > "$good_mosaic/USER.md"
+chmod 0600 "$good_mosaic/SOUL.md" "$good_mosaic/USER.md"
+cat > "$good_mosaic/skills/declared-skill/SKILL.md" <<'SKILL'
+---
+name: declared-skill
+description: Constructed loadable acceptance skill.
+---
+
+# Declared skill
+SKILL
+printf '{"lane":"next","version":"0.0.50-next.999","skills":["declared-skill"]}\n' > "$good_mosaic/.install-shipped-skills.json"
+printf '{\n  "lane": "next",\n  "cliVersion": "0.0.50-next.999"\n}\n' > "$good_mosaic/.install-manifest.json"
+before="$(fingerprint "$good_home")"
+set +e
+HOME="$good_home" MOSAIC_HOME="$good_mosaic" MOSAIC_PREFIX="$good_prefix" \
+  MOSAIC_NO_COLOR=1 PATH="$good_bin:/usr/local/bin:/usr/bin:/bin" \
+  bash "$ROOT/tools/install.sh" --check --next >"$TMP/good-check.log" 2>&1
+status=$?
+set -e
+after="$(fingerprint "$good_home")"
+[[ "$status" -eq 0 ]] && pass_case 'good-host --check exited zero' || fail_case "good-host --check exited $status"
+[[ "$before" == "$after" ]] && pass_case 'good-host --check left HOME unchanged' || fail_case 'good-host --check mutated HOME'
+good_rows="$(grep -Ec '^\[P[0-8]\] PASS:' "$TMP/good-check.log" || true)"
+[[ "$good_rows" -eq 9 ]] && pass_case 'good-host --check emitted nine PASS rows' \
+  || { cat "$TMP/good-check.log" >&2; fail_case "good-host --check emitted $good_rows PASS rows"; }
+
+printf '[test] case: persisted required-action failures remain blocking\n'
+for blocked_phase in P4 P6; do
+  node -e '
+    const fs=require("fs"); const p=process.argv[1]; const phase=process.argv[2];
+    const m=JSON.parse(fs.readFileSync(p,"utf8")); m.phaseOutcomes={P4:"committed",P6:"committed"};
+    m.phaseOutcomes[phase]="failed"; fs.writeFileSync(p,JSON.stringify(m)+"\n");
+  ' "$good_mosaic/.install-manifest.json" "$blocked_phase"
+  set +e
+  HOME="$good_home" MOSAIC_HOME="$good_mosaic" MOSAIC_PREFIX="$good_prefix" \
+    MOSAIC_NO_COLOR=1 PATH="$good_bin:/usr/local/bin:/usr/bin:/bin" \
+    bash "$ROOT/tools/install.sh" --check --next >"$TMP/action-$blocked_phase.log" 2>&1
+  status=$?
+  set -e
+  [[ "$status" -ne 0 ]] || fail_case "$blocked_phase action failure returned zero"
+  grep -q "^\[$blocked_phase\] FAIL:.*action reported a required $blocked_phase failure" "$TMP/action-$blocked_phase.log" \
+    && pass_case "$blocked_phase action failure remained blocking in a later --check" \
+    || fail_case "$blocked_phase persisted action failure was not attributed"
+done
+printf '{\n  "lane": "next",\n  "cliVersion": "0.0.50-next.999",\n  "phaseOutcomes": {"P4":"committed","P6":"committed"}\n}\n' > "$good_mosaic/.install-manifest.json"
+
+printf '[test] case: per-phase P2-P8 fault injection restores representative host mutations\n'
+for phase in P2 P3 P4 P5 P6 P7 P8; do
+  home="$TMP/fault-$phase/home"
+  state="$TMP/fault-$phase/state"
+  mkdir -p "$home/.config/mosaic" "$home/.npm-global/bin" "$home/.claude" "$state"
+  printf 'operator-framework-sentinel\n' > "$home/.config/mosaic/operator.txt"
+  printf '@scope:registry=https://pre.example.invalid/\n' > "$home/.npmrc"
+  printf 'old-cli\n' > "$home/.npm-global/bin/mosaic"
+  printf '{"hooks":{"safe":true}}\n' > "$home/.claude/settings.json"
+  before="$(fingerprint "$home")"
+  set +e
+  HOME="$home" MOSAIC_HOME="$home/.config/mosaic" MOSAIC_PREFIX="$home/.npm-global" \
+    MOSAIC_INSTALL_STATE_DIR="$state" MOSAIC_INSTALL_FAULT_AFTER="$phase" \
+    MOSAIC_NO_COLOR=1 PATH="$COMPAT_BIN:$PATH" bash "$ROOT/tools/install.sh" --state-machine-self-test \
+    >"$TMP/fault-$phase.log" 2>&1
+  status=$?
+  set -e
+  after="$(fingerprint "$home")"
+  [[ "$status" -ne 0 ]] || fail_case "$phase injected fault returned zero"
+  grep -q "phase=$phase" "$TMP/fault-$phase.log" \
+    || fail_case "$phase fault transcript did not name the injected phase"
+  [[ "$before" == "$after" ]] \
+    && pass_case "$phase rollback restored framework/npmrc/prefix/runtime representative state" \
+    || fail_case "$phase rollback mismatch (before=$before after=$after)"
+  if find "$state" -type f -exec grep -l '"status"[[:space:]]*:[[:space:]]*"in-progress"' {} + 2>/dev/null | grep -q .; then
+    fail_case "$phase left a journal in-progress"
+  else
+    pass_case "$phase left no journal falsely in-progress"
+  fi
+done
+
+printf '[test] case: unsafe and overlapping rollback roots fail before mutation\n'
+unsafe_home="$TMP/unsafe-home"
+mkdir -p "$unsafe_home"
+for case_name in root-target home-target overlap-target; do
+  case "$case_name" in
+    root-target) unsafe_mosaic=/; unsafe_prefix="$unsafe_home/.npm-global" ;;
+    home-target) unsafe_mosaic="$unsafe_home"; unsafe_prefix="$unsafe_home/.npm-global" ;;
+    overlap-target) unsafe_mosaic="$unsafe_home/.config"; unsafe_prefix="$unsafe_home/.config/mosaic/prefix" ;;
+  esac
+  before="$(fingerprint "$unsafe_home")"
+  set +e
+  HOME="$unsafe_home" MOSAIC_HOME="$unsafe_mosaic" MOSAIC_PREFIX="$unsafe_prefix" \
+    MOSAIC_NO_COLOR=1 PATH="$good_bin:/usr/local/bin:/usr/bin:/bin" \
+    bash "$ROOT/tools/install.sh" --check --next >"$TMP/$case_name.log" 2>&1
+  status=$?
+  set -e
+  after="$(fingerprint "$unsafe_home")"
+  [[ "$status" -ne 0 ]] || fail_case "$case_name unsafe path returned zero"
+  grep -q '^\[P0\] FAIL:.*unsafe context' "$TMP/$case_name.log" \
+    && pass_case "$case_name was rejected by P0" || fail_case "$case_name lacked an attributable P0 failure"
+  [[ "$before" == "$after" ]] || fail_case "$case_name mutated HOME"
+done
+
+symlink_home="$TMP/symlink-home"
+symlink_outside="$TMP/symlink-outside"
+mkdir -p "$symlink_home" "$symlink_outside"
+ln -s "$symlink_outside" "$symlink_home/.config"
+set +e
+HOME="$symlink_home" MOSAIC_HOME="$symlink_home/.config/mosaic" MOSAIC_PREFIX="$symlink_home/.npm-global" \
+  MOSAIC_NO_COLOR=1 PATH="$good_bin:/usr/local/bin:/usr/bin:/bin" \
+  bash "$ROOT/tools/install.sh" --check --next >"$TMP/symlink-target.log" 2>&1
+status=$?
+set -e
+[[ "$status" -ne 0 ]] || fail_case 'symlink-parent unsafe path returned zero'
+grep -q '^\[P0\] FAIL:.*unsafe context' "$TMP/symlink-target.log" \
+  && pass_case 'symlinked rollback parent was rejected by P0' \
+  || fail_case 'symlinked rollback parent lacked an attributable P0 failure'
+[[ -z "$(find "$symlink_outside" -mindepth 1 -print -quit)" ]] || fail_case 'symlink target was mutated'
+
+printf '[test] case: stale in-progress projection does not impersonate a live OS lock\n'
+stale_home="$TMP/stale/home"
+stale_state="$TMP/stale/state"
+mkdir -p "$stale_home/.config/mosaic" "$stale_state"
+printf '{"status":"in-progress","journal":"%s"}\n' "$stale_state/dead-run/journal.ndjson" > "$stale_state/active.json"
+set +e
+HOME="$stale_home" MOSAIC_HOME="$stale_home/.config/mosaic" MOSAIC_PREFIX="$stale_home/.npm-global" \
+  MOSAIC_INSTALL_STATE_DIR="$stale_state" MOSAIC_INSTALL_FAULT_AFTER=P2 MOSAIC_NO_COLOR=1 \
+  PATH="$COMPAT_BIN:$PATH" bash "$ROOT/tools/install.sh" --state-machine-self-test >"$TMP/stale.log" 2>&1
+status=$?
+set -e
+[[ "$status" -eq 97 ]] || fail_case "stale projection recovery expected injected status 97, got $status"
+if find "$stale_state" -name prior-active.json -type f -print -quit | grep -q .; then
+  pass_case 'stale projection was preserved and superseded after the free OS lock was acquired'
+else
+  fail_case 'stale projection was not preserved for recovery evidence'
+fi
+[[ "$(node -p "require('$stale_state/active.json').status")" == "rolled-back" ]] \
+  || fail_case 'stale retry did not reach an honest rolled-back terminal state'
+
+printf '[test] case: journal initialization failure is fatal before mutation\n'
+journal_home="$TMP/journal-failure/home"
+mkdir -p "$journal_home/.config/mosaic"
+printf 'journal-sentinel\n' > "$journal_home/.config/mosaic/operator.txt"
+before="$(fingerprint "$journal_home")"
+set +e
+HOME="$journal_home" MOSAIC_HOME="$journal_home/.config/mosaic" MOSAIC_PREFIX="$journal_home/.npm-global" \
+  MOSAIC_INSTALL_STATE_DIR="/proc/mosaic-journal-denied-$$" MOSAIC_INSTALL_FAULT_AFTER=P2 \
+  MOSAIC_NO_COLOR=1 bash "$ROOT/tools/install.sh" --state-machine-self-test \
+  >"$TMP/journal-failure.log" 2>&1
+status=$?
+set -e
+after="$(fingerprint "$journal_home")"
+[[ "$status" -ne 0 ]] && pass_case 'unwritable journal directory failed non-zero' \
+  || fail_case 'unwritable journal directory returned zero'
+grep -q 'cannot create private journal directory' "$TMP/journal-failure.log" \
+  && pass_case 'journal initialization failure was named' \
+  || fail_case 'journal initialization failure lacked a named diagnostic'
+[[ "$before" == "$after" ]] && pass_case 'journal failure occurred before target mutation' \
+  || fail_case "journal failure mutated target HOME (before=$before after=$after)"
+
+if [[ "$failures" -ne 0 ]]; then
+  printf '[test] install state-machine acceptance RED: %d failed assertion(s)\n' "$failures" >&2
+  printf '[test] --check transcript: %s\n' "$TMP/check.log" >&2
+  exit 1
+fi
+printf '[test] installer state-machine acceptance passed\n'
@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+# Verify that the detector found exactly the pinned C1 phase verdicts. The
+# fixture is expected to exit non-zero; this verifier is the green CI contract.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+MANIFEST="${MOSAIC_EXPECTED_RED_MANIFEST:-$ROOT/tools/fixtures/greenfield-expected-red.tsv}"
+CASE="${1:?usage: verify-greenfield-expected-red.sh <case> <log> <fixture-exit>}"
+LOG="${2:?usage: verify-greenfield-expected-red.sh <case> <log> <fixture-exit>}"
+FIXTURE_EXIT="${3:?usage: verify-greenfield-expected-red.sh <case> <log> <fixture-exit>}"
+
+[[ -r "$MANIFEST" ]] || { echo "expected-RED manifest is unreadable: $MANIFEST" >&2; exit 2; }
+[[ -r "$LOG" ]] || { echo "fixture log is unreadable: $LOG" >&2; exit 2; }
+[[ "$FIXTURE_EXIT" =~ ^[0-9]+$ ]] || { echo "fixture exit is not numeric: $FIXTURE_EXIT" >&2; exit 2; }
+
+checks=0
+failures=0
+while IFS=$'\t' read -r case_name kind expectation; do
+  [[ -n "$case_name" && "${case_name:0:1}" != "#" ]] || continue
+  [[ "$case_name" == "$CASE" ]] || continue
+  checks=$((checks + 1))
+  case "$kind" in
+    exit)
+      if [[ "$FIXTURE_EXIT" != "$expectation" ]]; then
+        echo "expected-RED mismatch: case=$CASE fixture_exit=$FIXTURE_EXIT expected=$expectation" >&2
+        failures=$((failures + 1))
+      fi
+      ;;
+    phase)
+      phase="${expectation%%=*}"
+      expected_verdict="${expectation#*=}"
+      last_row="$(grep -E "^\[$phase\] (PASS|FAIL):" "$LOG" | tail -n 1 || true)"
+      actual_verdict="$(printf '%s\n' "$last_row" | sed -n "s/^\[$phase\] \(PASS\|FAIL\):.*/\1/p")"
+      if [[ "$actual_verdict" != "$expected_verdict" ]]; then
+        echo "expected-RED mismatch: case=$CASE phase=$phase got=${actual_verdict:-missing} expected=$expected_verdict" >&2
+        failures=$((failures + 1))
+      fi
+      ;;
+    require)
+      if ! grep -Eq -- "$expectation" "$LOG"; then
+        echo "expected-RED missing required evidence: case=$CASE regex=$expectation" >&2
+        failures=$((failures + 1))
+      fi
+      ;;
+    forbid)
+      if grep -Eq -- "$expectation" "$LOG"; then
+        echo "expected-RED found forbidden evidence: case=$CASE regex=$expectation" >&2
+        failures=$((failures + 1))
+      fi
+      ;;
+    *)
+      echo "invalid expected-RED manifest kind: case=$case_name kind=$kind" >&2
+      exit 2
+      ;;
+  esac
+done < "$MANIFEST"
+
+[[ "$checks" -gt 0 ]] || { echo "expected-RED manifest has no checks for case=$CASE" >&2; exit 2; }
+if [[ "$failures" -ne 0 ]]; then
+  echo "expected-RED verification failed: case=$CASE failures=$failures checks=$checks" >&2
+  exit 1
+fi
+printf 'expected-RED verification passed: case=%s checks=%d\n' "$CASE" "$checks"
@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+set -euo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+TMP="$(mktemp -d "${TMPDIR:-/tmp}/mosaic-expected-red-test.XXXXXX")"
+trap 'rm -rf "$TMP"' EXIT
+
+cat > "$TMP/match.log" <<'LOG'
+[fixture] resolved lane=next package=@mosaicstack/mosaic@next version=0.0.50-next.999
+[fixture] installer_exit=1 done_claims=0
+[P0] PASS: supported context
+[P1] PASS: preflight complete
+[P2] PASS: pinned artifact
+[P3] PASS: absolute_path=/home/test/.npm-global/bin/mosaic version=0.0.50-next.999 equals resolved lane version
+[P4] FAIL: NOT-MEASURED / UNDECLARED: declaration absent
+[P5] FAIL: identity absent
+[P6] FAIL: activation unavailable
+[P7] PASS: no services requested
+[P8] FAIL: shell path absent
+[P9] FAIL: aggregate refusal
+LOG
+
+bash "$ROOT/tools/verify-greenfield-expected-red.sh" next-git-present "$TMP/match.log" 1 >/dev/null
+printf '[test] PASS: matching detector findings make the CI verifier green\n'
+
+sed 's/^\[P4\] FAIL:/[P4] PASS:/' "$TMP/match.log" > "$TMP/drift.log"
+if bash "$ROOT/tools/verify-greenfield-expected-red.sh" next-git-present "$TMP/drift.log" 1 >/dev/null 2>&1; then
+  echo '[test] FAIL: changed P4 verdict did not invalidate the pinned manifest' >&2
+  exit 1
+fi
+printf '[test] PASS: changed phase verdict requires a deliberate manifest update\n'
+
+if bash "$ROOT/tools/verify-greenfield-expected-red.sh" next-git-present "$TMP/match.log" 0 >/dev/null 2>&1; then
+  echo '[test] FAIL: unexpected fixture exit did not invalidate the pinned manifest' >&2
+  exit 1
+fi
+printf '[test] PASS: unexpected fixture exit remains blocking\n'
Author	SHA1	Message	Date
be-coder-05	3934e03fa6	test(installer): make state fixture CI-portable ci/woodpecker/pr/ci Pipeline failed Details ci/woodpecker/pr/greenfield-install Pipeline was successful Details	2026-08-05 14:02:44 -05:00
be-coder-05	fd26532757	fix(ci): assert pinned greenfield expected red	2026-08-05 14:02:44 -05:00
be-coder-05	c395ecae84	feat(installer): add transactional P0-P9 state machine	2026-08-05 14:02:44 -05:00
be-coder-05	c5a5f9d362	test(installer): preregister P0-P9 greenfield RED	2026-08-05 14:02:29 -05:00