#1050 C1 ROUND 5 — ARM COVERAGE + CHECKOUT PURITY

IDENTITY / SCOPE
- predecessor head: f33bd0da96bee3ce518744d6888d018bebb1c841
- branch: feat/1050-install-state-machine-red-fixture
- review inputs: be-coder-06 review 110; rev-security-02 review 111
- in scope: exact required pipeline-arm set including greenfield-remote-installer-contract; success-only arm marks; skipped-remote RED control; coverage-state exclusion from checkout source archives
- unchanged/fenced: tools/fixtures/greenfield-expected-red.tsv, tools/verify-greenfield-expected-red.sh, tools/e2e-install-test.sh, #869, and all per-case dispositions
- status: believed-fixed, pending jarvis validation

RED-FIRST — FOUR ARMS WERE REPRESENTED BY THREE CASES
The f33bd0d gate represented only the three expected-RED case identities. With all three case names marked and no remote-arm identity available, the production checker returned:
  SKIPPED_REMOTE_ARM_CURRENT_GATE_RC=0
  [fixture-suite] cases_defined=3 cases_executed=3
The fourth required arm, greenfield-remote-installer-contract, reused next-git-present and therefore could skip without changing case-set equality.

RED-FIRST — COVERAGE STATE CONTAMINATED CHECKOUT ARCHIVES
The f33bd0d workflow created .greenfield-case-state in the shared repository before the checkout-mode fixture arms. An independent reproduction using the exact e2e-install-test.sh tar exclusions created .greenfield-case-state/remote-arm.ran and measured:
  OLD_STATE_ARCHIVE_MATCHES=1
The state instrument was therefore part of the checkout source payload it was intended only to observe.

IMPLEMENTATION
- Renamed the checker to tools/verify-greenfield-execution-coverage.sh and generalized it over two validated dimensions: cases and arms.
- Added tools/fixtures/greenfield-expected-arms.txt as the explicit required arm set:
  greenfield-git-present
  greenfield-main-git-present
  greenfield-remote-installer-contract
  greenfield-git-absent
- Expected cases remain derived from the unchanged expected-RED TSV. Expected arms are derived from the new one-name-per-line arm declaration. Both inputs allow comments/blanks and validate every resulting name.
- Each of the four fixture arms writes its unique arm marker only after its exact per-case verifier succeeds. The three distinct expected-RED cases continue to write case markers after successful verification.
- The final step checks both dimensions even when the first check fails, emits both denominators, and fails unless both exact name sets match.
- Coverage state moved to .mosaic-test-work/greenfield-execution-coverage/${CI_PIPELINE_NUMBER}-${CI_WORKFLOW_NUMBER}/{cases,arms}. The checkout archive already excludes every */.mosaic-test-work subtree.
- The expected-RED manifest, per-case verifier, and detector are untouched.

MEASURED SKIPPED-REMOTE CONTROL
With all three cases marked and only the three non-remote arms marked:
  case gate rc=0
  [fixture-suite] cases_defined=3 cases_executed=3
  arm gate rc=1
  [fixture-suite] arms_defined=4 arms_executed=3
  [fixture-suite] missing_arm=greenfield-remote-installer-contract
This is the discriminating control: the case denominator remains green while the arm denominator catches the exact previously invisible skip.

OTHER DYNAMIC CONTROLS
- missing case: cases 3/2 => rc1
- case count inflation (one missing + one unexpected): cases 3/3 => rc1
- stale case markers after re-init: cases 3/0 => rc1
- exact case set: cases 3/3 => rc0
- future manifest case: cases 4/3 => rc1
- arm count inflation (remote missing + unexpected): arms 4/4 => rc1
- exact arm set: arms 4/4 => rc0
- production expected-RED manifest comments/blanks: accepted; exact set 3/3 => rc0
- archive selector firing control: a non-excluded root marker is present in the archive
- archive purity control: no .mosaic-test-work path is present in the archive

STATIC / STRUCTURAL CONTROLS
- every case mark follows that arm's successful per-case verifier
- every arm mark, including the remote contract, follows that arm's successful per-case verifier
- all four arms depend on coverage initialization
- final denominator depends on all four arms and is eligible after success or failure
- final denominator runs both checks and aggregates their statuses
- workflow contains the already-excluded .mosaic-test-work state root and no .greenfield-case-state reference

LOCAL BASELINES
- bash -n + ShellCheck on generalized checker/test: PASS
- pnpm test:installer: PASS, including execution-coverage controls
- pnpm typecheck: PASS, 45/45
- pnpm lint: PASS, 25/25
- pnpm format:check: PASS
- woodpecker-cli lint --strict: PASS
- git diff --check: PASS
- /home free before/after: 11G

INDEPENDENT REVIEW
- Codex code review: APPROVE, confidence 0.93, zero findings. It confirmed exact arm coverage, success-only marking, dual-status aggregation, excluded state, checkout-purity controls, and PRD alignment.
- Codex security review: risk NONE, confidence 0.96, zero findings. CI/path identifiers are constrained, expansions quoted, expected sets treated as data, and checks fail closed.
- Review sandboxes could not execute their own dynamic suite/ShellCheck because their filesystem is read-only; the local measured baselines above provide that evidence.

PENDING
- commit, queue guard, one push, attribution read-back
- announce the new full SHA; no merge or closure