[Amperstrand]

What

99-tollgate-setup gains the apk-reliable delivery channel for the operator-chosen credentials: when the environment is absent (which, per #888, is ALWAYS the case under apk add on 25.12 — apk-tools does not hand the installer's environment to package scripts), operator_chosen_admin_password() and the private-WiFi key reader fall back to root-only staged secret files, consumed on first read:

printf '%s' 'my-password' > /tmp/tollgate-admin-password
printf '%s' 'my-wifi-key'   > /tmp/tollgate-wifi-key
chmod 600 /tmp/tollgate-admin-password /tmp/tollgate-wifi-key
apk add --allow-untrusted /tmp/tollgate-wrt.apk

Properties: mode-600 enforced (a world-readable staging is refused, logged, and removed — the value never sits on a world-readable path); unlinked on first read so a stale file can never re-apply an old password on a later boot; never echoed; env channel unchanged for manual re-runs (TOLLGATE_ADMIN_PASSWORD=… /etc/uci-defaults/99-tollgate-setup — proven working under sh -x in #888's evidence).

Verification

• sh -n clean; tests/packaging/uci-defaults-run-order_test.sh 8/8; tests/packaging/admin-board-requires-credential_test.sh 78/4 — the 4 failures are identical on pristine main (that suite still expects the pre-fix(setup): never print generated credentials; add TOLLGATE_PRIVATE_WIFI_PASSWORD #850 print-the-credential contract; separate follow-up, not widened here).
• End-to-end on the vlab lane with the rebuilt package: the installer-contract lane (test(installer): contract lane for built packages on a pristine apk-era VM — #888/#890 acceptance, shipped red #892) in file mode — contract:credential-applied goes green (sha256crypt match against the staged value), contract:credentials-consumed green (both files unlinked post-install), no-plaintext green. Run output attached to installer: TOLLGATE_ADMIN_PASSWORD / TOLLGATE_PRIVATE_WIFI_PASSWORD never reach the uci-defaults script under apk add on 25.12 — the documented install-time credential UX is broken #888.

Fixes #888 (file channel restores the documented install-time choice; the env channel's apk loss stays documented in the issue as an apk-tools behavior).

[Amperstrand]

Nominated to the v0.6.0 release scope (#909). If the scope holds, this is on the critical path for final — review priority requested. Deferred PRs: no action needed; the scope issue lists you for 0.6.1+.

[Amperstrand]

Closing as superseded — the content was absorbed and then superseded by design on main: #897 took the staged-secret file channel (including this PR's find -perm mode gate — the busybox-stat refusal bug this PR found and fixed did not ship), and #902+#907 then removed the package's credential-setting entirely ('the package never sets a credential') in favor of the preinst refusing passwordless installs. The end-to-end evidence trail this PR built (vlab lane runs, the apk-tools env-loss proof, the stat-applet finding) stands in #888 and carries into the lane's rc3 semantics (#892). Nothing unique remains unlanded.