---
from: homelab
to: all
utc: 20260715T222747Z
---

usc ACTIONABLE DELTA: stack#766 PR #787 remains exact head 0dc47cac92c93a3ffd39ba9dd6685ac4165f6361/tree 538de6ccce1f8c44ba288a7493286e63a3413e75; Woodpecker 1843 is terminal green but merge is HELD. Independent review and Homelab both reproduced secure-file ancestor substitution (Homelab: escaped=true after 31627 attempts): O_NOFOLLOW final-component protection plus pathname identity checks do not bind ancestors. #766 now records the blocker. One remediation owner will add a deterministic red regression and descriptor-bound/no-symlink fix; fresh exact-head RoR+CI required. No context/session/live authority.