# Repository Bootstrap Negative Knowledge and Failure Lineage

These failures are retained because they changed the operating procedure.

| Event | Classification | Durable rule |
|---|---|---|
| `set -euo pipefail` was pasted into an interactive PuTTY shell and a later nonzero diagnostic closed the session | Procedure defect; no repository damage | Never enable shell-exit behavior in the user's interactive login shell. Run diagnostic blocks in a child script and capture statuses explicitly. |
| The initial import treated “small and source-like” as equivalent to “belongs in main” | Scope-model defect | Repository boundaries follow engineering responsibility and lifecycle, not byte size or file extension. |
| Scope-audit v1 failed with a Markdown-table `NameError` | Audit-kit defect; read-only | Compile and execute an end-to-end synthetic self-test before delivery. Preserve the failed kit when it explains later corrections. |
| The first promotion run referenced a candidate report ZIP absent from the server | Input-staging failure; preflight only | Verify exact input path and SHA-256 before privileged execution. |
| Promotion v1 treated a missing nested ref as fatal on the installed Git version | Git compatibility defect; preflight only | Validate ref syntax separately and use `rev-parse --verify --quiet` for existence checks. |
| Promotion v1.1 compared CRLF checkout inventory against LF canonical Git blobs | Representation-model defect; temporary ref only | Maintain separate Git-blob and checkout/export inventories when attributes transform content. |
| Promotion v1.2 preflight and promotion passed | Accepted procedure | Require a read-only preflight before the atomic authority transition. |

None of the failed promotion attempts changed canonical `main`. The accepted
promotion is represented by the v1.2 kit and the final promotion report.

## PFES history installation additions

| Event | Classification | Durable rule |
|---|---|---|
| The first installation invocation could not find the generated verification report at the assumed home-directory path | Input-staging failure; no repository change | Verify exact paths and hashes for generated server-side reports before running a privileged procedure. |
| Installer v1 ran `git -C` as root against a temporary clone created by the `git` service account and triggered dubious-ownership protection | Procedure defect; no final-path changes | Validate service-owned repositories and worktrees as the service account. Do not bypass the protection with a global `safe.directory` exception. |
| Installer v1.1 completed all release, repository, bundle, and clean-clone checks | Accepted procedure | Preserve the failed v1 package and the corrected v1.1 package together. |


## PFES v0.15.2 append procedure lineage

| Event | Classification | Durable rule |
|---|---|---|
| Append v1 attempted to fetch a bundle beneath `/home/jtryba` as the `git` service account and failed because that account could not traverse the user-home path | Input-access/staging defect; no canonical ref change | Stage validated service-account inputs under `/srv/project-frankenstein/tmp`, verify the staged copy hash, and fetch from the service-owned path. |
| Append v1.1 staged the bundle under the server temporary root and completed | Accepted procedure | Never solve service-account input access by broadly loosening home-directory permissions. |

The failed v1 append did not create the v0.15.2 tag, move `main`, install the
release, or activate PFES Git authority. Its procedure kit is retained at
`Migration/Repository_Bootstrap/Evidence/PFES_History/Procedure_Kits/PFES_REPO_005_append_v0152_authority_gate_v1.zip`.


## PFES-REPO-006 source-intake Windows path failures

Source-intake v1 copied selected files into a second deeply nested temporary
tree and failed with `WinError 3`. v1.1 used extended-length paths for the copy,
but reopened the destination through ordinary `pathlib` during post-copy hashing
and failed at the same long path.

The accepted v1.2 procedure streams source files directly from their original
extended-length paths into the ZIP and verifies bytes while streaming.

These failures did not modify the emulator source workspace or any repository.
