Record completion of Seriatim remediation

docs/roadmap/remediation.md

@@ -127,3 +127,48 @@ Required remediation:
   `ansible-role-seriatim` commit `ca49dae` during the completion audit.
 - The expanded `tests/integration` suite passed after all remediation commits
   and restored the default Seriatim installation.
+
+## Completion Review
+
+The four original findings are resolved, and the expanded integration suite
+passes. A focused review of the malformed-state recovery identified one
+additional edge case, which has also been resolved.
+
+## Finding 5: A malformed build-state directory is not handled
+
+Severity: medium
+
+`tasks/build.yml` inspects the three state files beneath
+`seriatim_build_state_dir` without first inspecting the state-directory path.
+If that configured path exists as a regular file, the first
+`ansible.builtin.stat` fails with `Not a directory`. This is an unhandled
+malformed-state failure rather than the planned recovery behavior. A targeted
+run with an otherwise valid custom binary confirmed that the role exits before
+rebuilding or converging the state directory. A second targeted run using a
+symbolic link as the state-directory path succeeded and wrote all three
+root-owned state files into the link target while leaving the configured path
+as a symbolic link.
+
+Required remediation:
+
+- Inspect `seriatim_build_state_dir` before inspecting any child state path.
+- Define and implement deliberate behavior for an existing non-directory
+  object. Because the state directory is fully managed, replacing that object
+  and rebuilding is consistent with the existing malformed-state-file
+  behavior; alternatively, fail with a purpose-written assertion if preserving
+  an unexpected object is preferred.
+- Ensure an existing symbolic link is not silently treated as the managed
+  state directory or used to redirect root-owned state writes.
+- Add integration coverage for the selected non-directory behavior and require
+  an idempotent immediate repeat after recovery when recovery is supported.
+
+Resolution:
+
+- `ansible-role-seriatim` commit `6fb1aa2` makes the build-state directory
+  authoritative, replacing regular files and symbolic links with a root-owned
+  directory before inspecting child state.
+- Integration coverage confirms repair and immediate idempotence for both
+  regular-file and symbolic-link drift, and confirms that the symbolic-link
+  target remains untouched.
+- The complete integration suite passes and restores a verified default
+  installation.