Sign-off: fractal#4848 installer ownership review #4901

Source

#4848

Merge SHA: f78787b.

Question for Nathan

Does Nathan accept the merged hosted replacement for #4762 and its installer ownership receipts?

Risk

medium — Installer receipts control ownership and rollback.

Evidence

• Install ownership receipts for script and setup installers (hosted #4762) #4848

Merged receipt follow-up fixes

Compounding Manager records two valid Codex P2 findings reported by Fractal Rename:

• #4848 / #4762: macOS installer receipt, install.sh:250: downgrading to a pre-receipt release replaces the app but leaves .fractal-install.json bound to the replaced executable. The next install refuses because the receipt no longer matches.
• #4975 / #4620: Home Manager rollback receipt, nix/hm-module.nix:367: rollback to a pre-receipt generation leaves a receipt for the newer executable. Forward activation then refuses for the same ownership mismatch.

Fractal Rename merged the fixes: #5053 at 3b402fbf59faeb536145f5b09df31d0976686cdd and #5054 at a3dde10e61b7becb82c3d76466c60f032b2cede8. Nathan can review the linked fixes with this item. Their review questions are tracked in #5162 and #5163. Fractal Rename owns follow-up answers. Merge does not close these sign-off sub-issues or assert release delivery.

Completion rule

Compounding Manager records Nathan's answer or sign-off before this sub-issue closes. Agents do not wait for Nathan to self-merge, but all normal gates, exact-head GOs, checks and rulesets still apply. No --admin and no auto-merge. If the source is not merged, Compounding Manager records its merge SHA and asks Nathan for review after merge.