The Debian collision mutation run 01 remains interrupted (outer exit 2). Its guest reported the named rejection, but the full-drive census raced successful removal of its scratch directory. No acceptance credit is recovered from it. The source protocol was committed before correction at 1c2ade8: docs/experiments/formal/installation-census-race-protocol.md.

Raw records are under DATA results/installation-census-race-01. The original helper (d044822…) and driver (f1a560d…) remain immutable. A pinned fixture substitutes only the helper's literal data root with a small owned DATA fixture. A real unlink between enumeration and metadata inspection reproduced ENOENT (exit 1; stopped receipt; failures: []). The unknown-path control stayed fatal.

The first exact-directory supplement exited 1 because its test wrapper omitted dir_fd forwarding. That is a preserved fixture failure, not a reproduced directory race. The corrected fixture 04 forwards filesystem API arguments.

The new helper admits retries only for the exact scratch path derived from the pinned mutation command, its descendants, or the pre-existing runner-controls rule. Each attempt restarts the entire scan with zero counters. Permission/I/O errors and unknown missing paths remain fatal. The new driver handles Debian's --mutate and Fedora's --expected-mutation forms explicitly and rejects mixed forms, duplicate identities and outer/native identity mismatches.

All commands used the required launcher through the registered source driver, default resource limits, DATA scratch and a 1 GiB reservation. Source: clean 1c2ade8. Fixture calls ran as the ordinary user; production census invocation still uses the existing full user-namespace scan and requires namespace UID/GID 0.

Command suffix	Exit	Whole stop	Result
census-race-fixture-04.py --mode baseline --helper <original> --source-sha256 <d044 pin>	1	confirmed	Real file and exact-root directory deletion produced ENOENT; named reds observed; other controls matched
census-race-fixture-04.py --mode candidate --helper <corrected> --source-sha256 <85d pin>	0	confirmed	Real file/root/runner-controls deletion recovered on a second complete scan; independent totals matched
Original census-race-fixture.py --mode candidate --helper <corrected> --source-sha256 <85d pin>	0	confirmed	Original regression and unknown-path control matched

The candidate refused simulated unknown ENOENT, prefix siblings, permission and I/O errors without retry. Simulated repeated owned ENOENT stopped after ten attempts and nine 0.25-second delay calls. These are injected exceptions; only the deletion controls exercise actual filesystem races. The isolated path-binding function accepted two literal examples and all six original frozen native commands, and rejected fourteen malformed bindings. These commands were never executed by that function test. Every completed report had failures: [].

Final control stop: 2026-10-18T00:44:40.406850Z. Full argv, hashes and outcomes are in controls-plan-04.json and controls-actual-results-04.json; original failed receipts remain alongside them.

Input	SHA-256
Fixture 04	96e1b7d7b4aad2b3d93f4085c01198b052c6540a469981ed1ce716fc6fcfaac6
Corrected census helper	85d05a9ba51f5fa8210e9b81a565e5b9fc2d5e62019d2583e3811ce63ca3523b
Corrected mutation driver 02	0456207df82d9bba91843d13386fa8e0587f245a66bea4303045741d5df39ea3

The 95 GB stop, complete reservation, resource containment, guest expectations, packages and independent oracles are unchanged. A rescan is not an atomic snapshot or protection against arbitrary hostile writers. A fresh native run still needs every original acceptance check, exit, stop and cleanup condition; these source controls alone cannot close installation acceptance.

Full controls registration/readback pins controls-plan-04.json SHA 0074b5cc9b17cbb1ca37ef1cf27d06af7c6115a256046171d060df74afa1beb5 and the actual source driver 5eedb7607e7c069ac7b47bb9ea2f799e1687e48b175a640556f42dd61cc03c71. The source contract at 1c2ade8fe39c942b5ecef211417423b83b77fc27 has actual file SHA 2929666ba5fb5d6abd061f69025ab80080cc94520b7f3672f3777b8d01499c67. An earlier parent-provided transcription contained an extra character; a stale DATA draft hash also appeared in the initial board text. The explicit audit correction preserves those records and identifies the immutable repository contract as authority. Neither altered the executed fixture/helper pins or replaced the contract. Current non-authoritative DATA note bytes were archived before the second run.

Controlled cell	Actual exit	Wrapper SHA-256	Resource receipt SHA-256
source-census-baseline-04	1	9a9ec6e47d882273e9bc89e8d833ef7c8f1b43e7b2997005cedec27f31663107	67f11dad70f46b09f746e3b7e909489524cd0886acaca2db733587d5d74a335a
source-census-candidate-04	0	3a108ad97e79f2714213fcf0fbd46ad7145ac7a3e50e4232572e545fa5b2ab8b	55fa1541a69b23e77ae17b956154b5c977edc68efd8730178637102544d1bb9c
source-census-original-compatibility-04	0	9bad8b69c17ab9eb9079a287b797074db95976e784b0c444ef242eb2e503e09b	2e144c41794ac8848bcd6c6a9f63abf0131f63b63eeb06b5238df4e3d9a333f0

Prelaunch checks also caught an unrun fixture's incorrect scratch prefix and its driver's missing Fedora flag support. Those files remain retained as unrun; fixture04/driver02 use the actual production mapping and both original family command forms. Separately, my first corrective invocation plan omitted the original required source-owner positional argument. The operator caught this before launch; plan02 remains unrun, and no driver check was bypassed.

Corrective native plan03, SHA cd0e986f7a3c09b095b80543e952d374d6aa9d986f305651e901967f6d4718fc, copies each complete original native invocation and replaces only its administrative driver path and the fresh Debian retry label/run ID. It preserves the original owner argument, reservation and inner command vector. The new Debian no-collision run02 and three remaining mutation controls are admitted under the original cases and hard gates; their completion is still pending at publication of this report. Interrupted run01 is not relabelled or credited.