Merge pull request 'Register R358: a parent swapped for a link leaves its target untouched' (#80) from replay/r358 into main

replays/register.go

@@ -313,6 +313,20 @@ var Register = []Replay{
 			"refused naming the character and how a quote is written, quoting none of the line",
 		Package: "./cmd/mesh-controller", Test: "TestAQuotedValueCanHoldAQuote",
 		Files: []string{"cmd/mesh-controller/seatverbs_test.go"}},
+	// A mesh directory outside every home was changed by path (2026-10-12): the directory applier set a
+	// directory's mode and owner by calling chmod and chown on its path, which follows a link anywhere in
+	// the path, so an account able to swap a parent for a link between two applies could direct root's
+	// chmod and chown at the link's target. Found by code reading, no known exploit. A test in the
+	// node-engine, written only with what applyDirectory had before its fix, laid over the commit before
+	// (mesh-host #87). Fix is the merge of its pull request.
+	{ID: "R358", Issue: 358, Kind: InRepository, Repository: "mesh-host", Fix: "36704b5471cb7b4e585847a08e4fd7fd64aea357",
+		What: "a mesh directory outside every home was given its mode and owner by path, so a parent swapped " +
+			"for a link between two applies carried root's chmod and chown to the link's target",
+		Asserts: "no apply changes the mode or owner of anything but the directory its declaration names, " +
+			"however a parent of its path is swapped for a link between applies, and the refusal names the link " +
+			"and the account that could have made it",
+		Package: "./internal/apply", Test: "TestAParentSwappedForALinkLeavesItsTargetUntouched",
+		Files: []string{"internal/apply/replay358_test.go"}},
 	// Not a core incident, and the first of its kind: a module's. The crash loop was found by a person
 	// reading the agent server's log for another reason (issue 268); research 032 measured it, and ADR
 	// 0240 makes the node-engine judge it and the gate fail it.