stack/docs/reports/verification/1050-c1-fix-round/README.md

#1050 C1 fix-round verification

Frozen reviewed head before remediation: 378bc1afe3bc485adb8614897d66c5edccd4a527.

Status: believed-fixed, pending jarvis validation. PR #1054 is not self-merged and issue #1050 remains open.

Blocker B — fail-closed test enumeration

The RED-first control used a real filesystem permission failure, not binary shadowing or PATH interception.

1. A planted {"status":"in-progress"} file in a readable P2 fault tree made the complete real walk fail the frozen suite at P2 left an in-progress transaction (01-pre-fix-positive-control.log, exit 1).
2. The same planted defect beneath a target-owned mode-0100 directory made real find report a permission failure. The frozen suite erased the producer failure and exited 0 with installer next lane tests passed (02-pre-fix-permission-failure-attack.log).
3. The committed regression control initially failed because the child full-suite attack still exited 0 (03-regression-test-red.log).
4. After remediation, the same child full-suite input exits 1 and names [test] ERROR: P2 fault-state enumeration failed (04-post-fix-permission-failure-attack.log). The ordinary full suite remains green.

tools/test-enumeration-assertions.sh now captures each complete NUL-delimited population and checks the producer status before asserting absence. Content checks inspect the captured population and distinguish “no match” from a read error. The shared fail-closed implementation covers:

• tools/install-next-lane.test.sh: redacted staging-file cleanup and fault-state transaction scan;
• tools/verified-installer-fetch.test.sh: temporary-download cleanup;
• tools/install-state-machine.test.sh: symlink-target non-mutation;
• docs/reports/verification/1050-b8-redaction-control/positive-control.test.sh: both copied counterparts.

No assertion was loosened. A1, A2, upgrade-guard, source-root, the species-2 sweep, #869, and expected-RED verdict rows remain outside this remediation.

Blocker A — installer digest

The stale sidecar value was replaced with the exact sha256sum record for tools/install.sh:

e59cb441a2f37ae9150f8eae470238e9d858a1816df93343d9784a6796676096  install.sh

Local sha256sum -c tools/install.sh.sha256 and the workflow's exact expected/actual equality both pass. The immutable provider-fetch arm at the new ${CI_COMMIT_SHA} is recorded in the freeze artifact after push; local equality alone is not treated as sufficient evidence.