[acamarata]

Four small debt rows fixed, one verified as not reproducing (regression tests added).

Per row

D-0604 (fixed). The core env no-match warning is now built from pluginServiceCandidates(pluginName, manifestName), so a plugin whose plugin.json name differs from its directory is told all six candidate names. Test fails before, passes after.

D-0571 (fixed). certRE in snippet_tls.go maps only the nested /etc/nginx/ssl/certificates/<dir>/ shape. The flat /etc/nginx/ssl/<dir>/ path is recorded as unmodelled (ssl_dir ""). The routemodel fixtures render ${SSL_DIR} as certificates/example-test (goldens keep ssl_dir example-test). Four goldens (compliance, geocoding, idme, object-storage) change: they hand-write the flat ${NSELF_DOMAIN}/${DOMAIN} path, which is now unmodelled, as the row asks. Two internal/build snippet fixtures moved to the nested path.

D-0573 (fixed).

• config.DefaultPluginDir, config.ResolvePluginDir, config.ExpandPluginDir, config.ExpandHomeDir (internal/config/plugin_dir.go) are now the one plugin-dir rule. build.DefaultPluginDir, cmd/commands.resolvePluginDir, resolvePluginNginxDir, buildTemplateVars and the plugin migrations dir (database.migrationsDir) all call them.
• The ~ expansion stays v1.5 only (the D-0478 compat marker moved with it, wiki row path updated). v1.4 behaviour is unchanged; under v1.5 compose discovery and plugin migrations now expand a literal ~ like nginx injection did.
• nginxtopo.CertDirName / CertDirNameOrLocalhost are the one domain-to-cert-dir rule. ssl.DomainToDirName, nginx.sslDirName, routemodel (build, SetSSL, api-docs route), apidocs.NginxConf and build.pluginSSLDir use it.
• internal/nginx no longer imports internal/ssl, so the stale nginx -> ssl edge is removed from layers.yaml and layering_basis_test.go (a shrink; TestLayering told me to delete it).
• Not touched: the other readers of NSELF_PLUGIN_DIR that have different semantics (license/entitlement, importer, doctor, bundle installer, compose/object_storage, exporter, deploy). They are a follow-up.

D-0252 (not reproduced, tests added). Every production read hashes the bytes: Reader.Open streams through verifyingReader (E516 at EOF on a length or SHA-256 mismatch) and Verify re-hashes against the snapshot, so a same-size in-place edit with the mtime restored, or a parent directory swapped for a symlink, is never accepted. A swap also changes dev/ino, which the snapshot check refuses. reader_race_test.go pins both. The one unhashed path is Reader.OpenFile, which returns a bare *os.File by contract and has no caller outside the package; closing that means changing its contract (a decision), so no change here.

D-0490 (fixed, with one deviation). resolvedFragment/resolvedService now decode include, extends and build; isolationViolations() (plugins_fragment_isolation.go) flags: top-level include, extends of another file: (or a malformed extends), build.network other than none/default, a service listing a network its fragment does not declare (other than the project network, default or the legacy literals), and a service named like a core service (compose.CoreServices(): postgres, hasura, auth, nginx). It is wired into normalizeComposeNetworks: E129 in v1.5, a warning in v1.4 (compat marker D-0490, wiki table regenerated). Scanned the 91 docker-compose.plugin.yml files in the sibling plugins and plugins-pro checkouts: zero violations. TestLockUsesRediscoveredComposeFiles used a fragment that redefined hasura; it now uses redis.
Deviation: the row prefers folding this into the ADR 0027 / E130 socket guard. That guard inspects merged compose inputs at a later phase, so I kept the rules in the existing decoded-view network checker (one place, E129) rather than splitting the refactor. Merging the two checkers is still open.

Commands run

• gofmt -l internal cmd clean; go build ./...; go vet ./internal/... ./cmd/... clean
• go test ./internal/... ./cmd/... exit 0
• bash scripts/ci/compat-markers.sh --check exit 0