# netem-tc sudoers install verification -- 2026-07-21 (read-only, successor session)
#
# The install itself was OPERATOR-RUN interactively 2026-07-21 (in-session
# `!` prefix, per the fragment header's exact command):
#   sudo install -m 0440 -o root -g root scripts/sudoers.d/netem-tc /etc/sudoers.d/netem-tc && sudo visudo -c
# The running session disconnected before the output could be recorded, so
# this capture is the successor session's independent read-only
# re-verification. Note: a sudoers parse error disables the file entirely,
# so the non-interactive grant checks below ALSO prove the installed file
# parses (they could not exit 0 otherwise).

$ ls -l /etc/sudoers.d/netem-tc
-r--r----- 1 root root 1888 Jul 21 18:09 /etc/sudoers.d/netem-tc

$ wc -c scripts/sudoers.d/netem-tc
1888 scripts/sudoers.d/netem-tc
# byte count identical to the repo fragment at HEAD 8a9c04c -> installed
# copy is the shipped fragment (mode 0440 root:root as ruled).

# Behavioral grant checks (sudo -n -l <cmd>: non-interactive; exit 0 =
# command permitted with NOPASSWD; nothing is executed):

$ sudo -n -l /usr/sbin/tc qdisc del dev virbr5 root
/usr/sbin/tc qdisc del dev virbr5 root
exit=0

$ sudo -n -l /usr/sbin/tc qdisc replace dev virbr5 root netem delay 5ms
/usr/sbin/tc qdisc replace dev virbr5 root netem delay 5ms
exit=0

$ sudo -n -l /usr/sbin/tc qdisc del dev virbr7 root        # exit=0
$ sudo -n -l /usr/sbin/tc qdisc replace dev virbr3 root netem delay 5ms   # exit=0

# VERDICT: install VERIFIED. Both verbs live on virbr5 (the step-E
# dc0<->dc1 target); spot checks pass on virbr7/virbr3. Bridge names
# remain drifting IDs -- the step-E runbook re-measures before any apply
# (fragment header, fail-closed property).