topher
2435e74b8e
ci/woodpecker/pr/ci Pipeline was successful
B1 (rev-code-02): fleet/bin/** made keep-mode update prune existing estate executables absent from the package source. Replaced with exact entries (fleet/bin/mosaic, fleet/bin/test-mosaic-launcher.sh); parity spec gains a dedicated ownership probe asserting the two shipped files are framework-owned while seat-up.sh, launch-seat.sh and the directory itself stay operator-owned, on both resolvers. B2: a relative HOME bypassed the fallback guard (component probes were absolute-prefixed, so a relative candidate walked nonexistent absolute paths and a planted cwd-relative CLI executed). The untrusted fallback candidate is now refused unless absolute, with parent-escape (..) components refused as well; the symlink walk then applies. B3: A6 planted the executable off the resolved candidate path, so a guard-bypass mutant stayed green (nothing executable at the candidate). The symlink now points at $PLANT/.npm-global so the candidate resolves exactly to the planted binary, and the suite gains two mutation controls: a guard-bypassed copy MUST execute both the absolute-symlink plant and the new relative-HOME plant (sentinels asserted present), while the real launcher refuses both (rc 127, diagnostics, sentinels absent). Marker T110-DISPATCH-TOPHER-1N2O / ORCH-T110-REWORK-M5N6.