pagestore: exercise portable bootstrap installation crashes

.github/workflows/pagestore-test.yml

@@ -110,6 +110,9 @@ jobs:
         working-directory: contrib/pagestore
         run: ./pagestore_fault_test
 
+      - name: Run portable bootstrap install oracle unit tests
+        run: python3 -B contrib/pagestore/harness/tests/test_bootstrap_install_oracle.py
+
       - name: Run named fault recovery harness
         working-directory: contrib/pagestore
         run: |

contrib/pagestore/MVP_COMPLETION_PLAN.md

@@ -785,7 +785,8 @@ restartpoint plans pause the checkpointer child after relation-page sync/before
 marker write and after marker sync, then stop and recover the whole
 materializer.  The prepared-receipt/service-restore branch slice and the POSIX
 image-layer create/write/seal/manifest-ADD publication slice are also covered.
-Branch bootstrap/install, manifest replacement, reclaim, and GC H1 cases remain.
+Portable bootstrap/install is covered by the golden scenario's installer
+crash/retry matrix. Manifest replacement, reclaim, and GC H1 cases remain.
 
 Deliverables:
 
@@ -831,8 +832,8 @@ remain separate gates.
 ### H1. Compose process-level crash scenarios
 
 Status: **materializer replay/restartpoint, branch prepared-receipt/service-
-restore, and POSIX image-layer publication slices implemented; branch
-bootstrap/install, manifest replacement, reclaim, and GC cases remain and
+restore, portable bootstrap/install, and POSIX image-layer publication slices
+implemented; manifest replacement, reclaim, and GC cases remain and
 depend on H0/R2-R5**.
 
 Required scenario families:
@@ -844,6 +845,16 @@ Required scenario families:
   orphan reconciliation, and timeline deletion;
 - daemon, writer, materializer, and branch-compute restart combinations.
 
+The portable install slice in `mvp_golden_test.sh` targets an offline same-build,
+default-tablespace skeleton. Four named installer-backend aborts cover maps
+installed, the pg_xact remove/rename gap, and both sides of final manifest
+publication. Each case checks the exact fault report and backend exit,
+unchanged prepared inputs and restored control, startup rejection before
+publication, full artifact recovery on retry, and byte-idempotent reinstall.
+The resulting branch must pass golden SQL fork-point, parent/child isolation,
+and restart checks. Power-loss recovery and concurrent installers/service
+managers are outside this process-abort contract.
+
 The materializer slice is split into two focused plans: one pauses after
 relation-page store sync and before marker write, and one pauses after marker
 store sync and before retention advance.  The pause is reported by the named

contrib/pagestore/MVP_STATUS.md

@@ -200,6 +200,14 @@ materializer, restores the normal writer, and advances the journal
 monotonically to `complete`. Bootstrap installation, layer recovery, and GC
 remain outside this slice.
 
+Portable bootstrap installation has a separate golden-scenario crash slice:
+installer-backend aborts after maps, in the pg_xact replacement gap, and on
+both sides of final manifest publication. It checks startup rejection while
+the manifest is absent, unchanged prepared inputs/control, exact artifact
+recovery and idempotent retry, followed by branch SQL visibility and isolation.
+The target stays offline under one installer; concurrent installation and
+power-loss durability are not claimed by these process-abort tests.
+
 The same prepare now captures every default-tablespace database relation map
 plus the global map under `RelationMappingLock` into one CRC-protected
 `pagestore_branch.bootstrap`.  Its header binds the system identifier, logical
@@ -347,7 +355,7 @@ remaining R6 queue-bound soak/tuning work.
 The POSIX image-layer publication slice is now covered by the declarative
 harness.  Other crash boundaries remain outside this slice.
 Before declaring the MVP repeatable, add process-level fault scenarios around
-branch bootstrap/install, manifest replacement, and retention/reclaim/GC, plus
+manifest replacement and retention/reclaim/GC, plus
 a persisted-format fixture for restart/upgrade compatibility.
 
 ## Recommended sequence