# Revision 3 validation — September 27, 2026

Recorded: 2026-09-27T18:15:51.904546+00:00

**224 Python tests, 78 browser assertions, and one source-surface check passed.** Counts exclude repeated development runs and expected failures against the unchanged r2 installer.

| Suite | Count | Result |
|---|---:|---|
| Packaged repair Python tests | 127 | PASS |
| Existing root integration | 20 | PASS |
| Existing receipt publisher | 39 | PASS |
| Existing private environment | 31 | PASS |
| Existing private boundary | 3 | PASS |
| Existing static fallback | 4 | PASS |
| Browser contract assertions | 78 | PASS |
| Current status source-surface check | 1 | PASS |

The 127 packaged tests include 21 additional revision-3 cases and seven native Apache loopback tests. Native checks cover readable public content, denial of private fixture files and the hosting control file, absent-runtime rejection, exact nonce-file document-root proof and cleanup, rejection of the wrong directory, and public-file readability under umask 0077.

## Before/after reproduction

Four selected checks were executed against the **unaltered revision-2 installer**. Three failed as expected: public files became 0600 rather than 0644, an explicit replacement mode 0640 was lost, and a public fixture returned HTTP 403 under a real Apache process. The fourth control confirmed private files stayed 0600. The same cases pass against revision 3. See `test-logs/r2-permissions-reproduction.log`; its expected failures are not current-candidate failures.

The layout, duplicate-public-file, external-environment, dual-restart and permission-rollback regressions also pass. A full business-workflow test touches two signals but withholds passing evidence until a distinct application instance and actual records/message readback are observed. Renewal still executes a new workflow rather than extending an old receipt.

The first stage setup lacked public documentation fixtures and produced eight fixture-file errors. Public test fixtures were then supplied from the user's source archive, without archived runtime custody, and the complete candidate suite was rerun successfully. No production check was removed or converted to PASS to resolve those setup errors.

## Scope and remaining uncertainty

Business tests execute the real Commons logic through an isolated SQLite adapter. Full runtime process observations and cron/installer transactions are fixtures. The separate public-doc client is same-host/same-owner. Prior explicit healthy-worker fixtures remain necessary in positive readiness tests; separate negative tests prove that a valid receipt without a healthy worker does not mean production-ready.

Native Apache here has no Passenger module. Native Passenger, native LiteSpeed, native MySQL/MariaDB, this host's control panel and live autonomous renewal have not been verified. The active server's exact directory layout and file modes have not been inspected. These test results therefore do not establish that the confirmed package defects are the sole production cause, or that the public site has been repaired.

The current public observation still yielded the static status pointer; the browser fetch of the readiness endpoint reported an error/404. No production writes were performed in this session. The package must be installed on the host and the actual live completion criteria in the README must pass.

Upgrade predecessor hashes were checked against both the reported deployed diagnostic ZIP and r2's application payload. Manifest validation, bytecode compilation, and extraction checks are also performed for the final archive. No production credential, receipt, or environment file is part of the package.