Executed 2026-10-12 under installation-release protocol revision 4. All four positive cells passed; all six deliberately defective package controls were detected at their registered checks. These are finite local guest measurements, not deployment qualification or authenticated-console acceptance.

Frozen source a5dbda7a4fd6465c94f6505b3214cbcbc2130c82; minimal source snapshot f23830d5f70dd3029d540def41fdaf50fe0facf3. PR #53 was merged with a merge commit, preserving all six commits and separate trust-boundary changes. Its exact tested tree was retained. Epic #33 supersedes historical #32.

Debian 0.1.0~alpha.1 SHA-256 54cddf548c1a307aade8c3ac4332ede2007e2bc9603ab0cba72d8297287d6cee. RPM 0.1.0-0.alpha.1 SHA-256 982ad6923e17f64b35700dcfafb2994ed68e32b2c6b368589a8b6a0d550cac79. Both package families were built twice with matching hashes; all twelve packaged console files matched with diff exit 0 and no output. RPM repackages the exact Debian12-sysroot binaries; it is not an independent Fedora compiler result.

Build and provenance record; CANDIDATE-PROVENANCE.json SHA-256 b02f2ebbf66e61b4b2b9133174fd787516af1a54701a6c02fd26041454b59f90. Rust 1.99.0, default features, epoch 1791817558, Cargo.lock SHA-256 b8c9010b1a694b809ac35c4b3eaf1e6882eda83278db0ae0906797f8126f2a8c. P1 package content checks were completed in that record; L1 separately rechecked installed console hashes after upgrade.

Positive baseline cells used the exact replacement packages on fresh guests. Upgrade cells first accepted the registered older predecessor, then separately graded replacement L1, L2, A13a/A13b and Fedora F4. A passing predecessor baseline is not attributed to the replacement candidate. L1 preserved exact row identities, configuration, credentials, account identity, Spool and history; L2 required a genuinely different boot ID and active services after reboot.

Predecessor fixture hashes: Debian alpha.0 27a733e1bcef571ac9c1b110131b1afedefa6b3806233c24e639f6b0bf0e85c3; constructed Fedora alpha.0 3c0a64a10b088a9add12e8837c12ad2f8d6aad01c3ce3dab55cfd75baad469a3. They are registered migration fixtures, not claims of historical RPM release acceptance.

The root-user controls required A6; no-collision-check required A2a and A2b; no-memory-max required A8. Every control had actual guest exit 1 and detector exit 0, the named failures were present, and no check was NOT-RUN. Additional failures shown in the table are retained. Mutated packages are labelled negative controls and are never candidates.

DEB baseline guest:

os=debian:13
systemd=systemd 257 (257.13-1~deb13u1)
pid1=systemd
cgroup=cgroup2fs
controllers=cpuset cpu io memory hugetlb pids rdma misc
MemTotal:        6073784 kB
2
kernel=6.12.111+deb13-cloud-amd64

RPM baseline guest:

os=fedora:44
systemd=systemd 259 (259.5-1.fc44)
pid1=systemd
cgroup=cgroup2fs
controllers=cpuset cpu io memory hugetlb pids rdma misc dmem
MemTotal:        6053248 kB
2
kernel=6.19.10-300.fc44.x86_64

Images were rechecked against official HTTPS manifests before each boot: Debian 13 genericcloud amd64 build 20261001-2618, SHA-512 f46f0671a6e5bdec5291ab8972bae2f10e5408c2f64a74078f11efc2f06a436a9d0313ed50e0472542eeabf780e9f7c792ac0a314c6c20507fcd9fd81b468c3d; Fedora Cloud Base Generic 44-1.7 x86_64, SHA-256 28680fe5b371a5a82ebf43a31926e086a168e59949d03969c5093e7071f90b7f. This does not claim independent OpenPGP signature validation.

Fedora remained SELinux Enforcing before delivery and after reboot/removal, and its boot audits contained no Fabric-process AVC. No permissive switch or broad allow policy was used. RPM removal retained state and configuration; A13b explicitly deleted the disposable fixture as an operator reset. RPM has no purge guarantee. Debian exercised native removal and purge.

Both roles were exercised: server with its mandatory companion Spindle, and a standalone Spindle. Supplemental read-only process observations saw all three live processes before removal, then absent binaries, both services inactive and no Fabric process after removal. The unchanged harness supplied the removal verdict; these observations supplement it.

Each project command ran through python3 -B tools/resource_group.py --; QEMU verified a stricter 7 GiB high / 8 GiB maximum, no swap, 1,800-second deadline, two vCPUs, 6 GiB guest RAM and an 8 GiB disk. Only one guest ran at a time. All scratch and caches used the mounted data drive. Admission reserved 9 GiB against the unchanged 95 GB line; strict namespace observations counted every path, including hard-linked paths, and stopped on observation failure. Observed aggregate peak across these cells: 85,744,200,311 bytes. Every cell recorded QEMU process cleanup, owned scratch removal and stopped outer cgroup.

The frozen runner automatically removes successfully detected guest-repacked Debian controls, but retains stopped external RPM control disks. Their original receipts still record scratch_removed=false. Separate capped cleanup dry runs checked ownership, no remaining processes or mounts, hashes of all archived logs/harness copies and the exact defective RPM; execution then removed only those owned disks. This follows the same evidence-preservation boundary without editing the frozen runner or regrading a result. The table below binds the separate follow-ups.

The first no-collision RPM VM attempt was NOT RUN: aggregate admission refused its full disk reservation while the correctly detected root-user disk was retained. After that stopped scratch was cleaned, a new run ID was used. No admission ceiling or reservation was reduced. The read-only compiler-cache cleanup preview was not executed; no additional compiler cache was removed.

All commands used the source snapshot above and --memory-stressor parallel. Baselines used run-qemu.py --family debian|fedora --package EXACT_PACKAGE --run-id RUN_ID; lifecycle cells additionally used --upgrade-from EXACT_PREDECESSOR. Debian controls used the exact baseline package plus --mutate NAME. Fedora controls first used the unchanged packaging/build-rpm.sh OWNED_EXISTING_OUTPUT EXACT_DEB --candidate-deb EXACT_DEB_RECEIPT --mutate=NAME, then run-qemu.py --family fedora --package MUTANT --expected-mutation NAME. Exact argument vectors and exit statuses remain in the data-drive command receipts.

Controlled archive: results/installation-qemu/<run-id> contains receipts, acceptance output, journals and exact harness copies. results/service-opening-candidate/installation-completion.json SHA-256 f027638744c5440052bcfd39756a2d08b35cae639360b20f76a88ec258a5fdb0 binds the ten cells and process observations. No credentials, private keys, binaries or bulk telemetry are published here.

All cells retained the same source-bound acceptance and lifecycle helpers; the lifecycle header’s stale “Revision3” comment was left unchanged. A first Fedora mutant construction exited 1 before staging because its output directory was missing. That failure and its stopped cgroup were retained; the corrected caller setup used a fresh retry label and did not change the package recipe, candidate, protocol or grader. An earlier private bookkeeping guard mistook the expected guest exit 1 for a detector failure; it was corrected from the existing raw receipts without rerunning or regrading those completed controls.

Previous failed candidate run 02 remains failed and preserved. Service-opening repair records the native causal regression. This replacement acceptance does not erase earlier failures.

These legacy-admin installation/migration fixtures do not establish passkey roles or the authenticated production console. #42–#46 remain separate exact-candidate gates; #47 requires the complete ledger before release approval. Packages remain private and no tag or release has been published.