[acamarata]

Rows

D-0450 — ALREADY-FIXED, no change. addPluginCoreEnvVars (internal/build/plugins_core_env.go) writes S3_ENDPOINT/S3_REGION for the active core object store (SeaweedFS, or MinIO on its configured port) into .nself/compose.env; landed in 3d070ba (#809). Covered by internal/build/compose_env_object_storage_test.go (passes on this branch). The storage plugin's own minio:9000 default is now only a no-store fallback.

D-0777 — BLOCKED, no change. The preferred resolution needs a product decision (a manifest field declaring a public route or auth gate, and the default-deny semantics for plugin routes) plus changes in the plugins repo (gating or exempting the 38 ungated plugins, the ratchet test). Neither is local to this repo. Today pluginSnippetSkip still refuses bare top-level location snippets, so nothing is newly exposed.

D-1161 — FIXED. removeTree recursed with a path-based Lstat followed by ReadDir/Remove, so a directory swapped for a symlink in between redirected the deletion. It now carries each directory's Lstat identity and re-checks (os.SameFile on a non-following Lstat) after the listing and before every removal, aborting with errTreeSwapped instead of deleting through the link. This narrows the window to the instant between the check and the unlink; it does not make the walk fd-based, since the Sink interface is path-based. The review report named in the row was not available to me, so I fixed the described TOCTOU only. Nested marker handling is unchanged (a nested .nself-generated is still removed last in its own directory, and plan and apply walk the same way).

New test TestProxyRestoreDirSwappedForSymlinkMidWalk swaps a subdirectory for a symlink to a victim directory as the walk lists it. Without the fix it returns nil and deletes through the link; with it the cleanup stops and the victim is untouched.

Commands

• go build ./... OK
• go vet ./internal/build OK
• go test ./internal/build -count=1 ok (24s)
• New test run against the pre-fix proxy_restore.go (with a stub for the new error var): FAIL as expected; with the fix: PASS.