Five small audit findings: honest fault-C gate, anchored wipe verdict, data-reset + hugepage coverage, installer mount trap

[VijitSingh97]

The audit wave's confirmed small findings, applied together before the KVM battery run so the battery exercises the sharpened asserts:

• Fault C asserted only the absence of "panic" — an installer that quietly ACCEPTED the corrupted bundle read as a pass. Now gated on the install command's own exit status (refusal is the assertion), panic still caught separately.
• wipe=data verdict used an unanchored grep: verdict=OK,USER-DATA-SURVIVED contains verdict=OK and passed. Anchored with grep -qx.
• pithead-data-reset — the last-resort recovery on a shell-less box — had zero verify-image coverage while every other boot-path unit is pinned. Unit shipped/enabled/script-executable/ordered-before-data.mount now asserted.
• Hugepages (called load-bearing in the Dockerfile itself) had no static or dynamic coverage: verify-image pins the baked sysctl; the battery's boot phase reads /proc/meminfo (≥3072 pages).
• pithead-install wipe=data left the data partition mounted-busy when a step failed mid-move (the script's EXIT trap installs later in main). A scoped expand-now trap (the house SC2064 pattern) releases it for the retry.

make lint green; bash -n on all three files; the fault-C and wipe legs get their live proof in the battery run queued next. Ponytail: five one-site changes, nothing speculative.

🤖 Generated with Claude Code