diff --git a/packages/mosaic/framework/tools/quality/scripts/test-upgrade-durable-snapshot.sh b/packages/mosaic/framework/tools/quality/scripts/test-upgrade-durable-snapshot.sh
index ef58dab..3cf8294 100644
--- a/packages/mosaic/framework/tools/quality/scripts/test-upgrade-durable-snapshot.sh
+++ b/packages/mosaic/framework/tools/quality/scripts/test-upgrade-durable-snapshot.sh
@@ -95,17 +95,38 @@ seed_home_v1() {
 # sync), so the verify net must restore a REAL file in place WITHOUT following the
 # link (which would write the snapshot's secret out through it). $EXFIL_TARGET is
 # expanded at shim-write time from the caller's environment.
+#
+# PORTABILITY (why this shim, not the real `cp`): the CWE-59 leak this exercises is
+# `cp` writing THROUGH a symlinked destination. GNU/BSD cp — what a real operator
+# runs `mosaic update` under — follows the dest symlink and leaks. busybox cp (the
+# Alpine CI image) REPLACES a symlinked dest instead of following it, so under the
+# CI harness the leak vector simply does not exist and the negative control could
+# never reproduce it. This shim therefore emulates the real-target GNU cp behavior
+# PORTABLY: when the destination is a symlink it writes the source bytes through the
+# link via redirection (which follows symlinks on every coreutils, busybox included);
+# otherwise it delegates to the host's real cp unchanged. Both the shipped-case and
+# the negative control run through this identical shim, so the ONLY difference
+# between them remains the SYMLINK-LEAF-GUARD — the control stays load-bearing and
+# non-tautological. It does NOT touch install.sh (approved) or the real assertions:
+# with the guard present the symlinked leaf is dropped BEFORE this cp runs, so the
+# dest is a real file and the delegate path is taken exactly as on a GNU host.
 make_symlink_leaf_shim() {
   local dir="$1" home="$2"
   cat > "$dir/cp" <<SHIM
 #!/usr/bin/env bash
 dest="\${@: -1}"
+src="\${@:(-2):1}"
 case "\$dest" in
   */$POISON_REL)
     rm -f "$home/tools/_lib/credentials.json"
     ln -s "$EXFIL_TARGET" "$home/tools/_lib/credentials.json"
     ;;
 esac
+# Coreutils-agnostic emulation of GNU cp's follow-through-dest-symlink behavior.
+if [[ -L "\$dest" && -f "\$src" ]]; then
+  cat "\$src" > "\$dest"
+  exit \$?
+fi
 exec env PATH="$ORIG_PATH" cp "\$@"
 SHIM
   chmod +x "$dir/cp"