# M12-04D Status

status: done
task: resolve symlink/hardlink entries before writing and constrain them to the temporary root
updated: 2026-08-18 America/New_York
enablingTask: false
parityStateChange: false

## Scope

Archive entries are parsed before any write. Every member is canonicalized as a relative path under
the declared temporary-root identity. Symlink targets resolve relative to the link's parent; hardlink
targets resolve from the archive root and must end at a regular file. Absolute, drive-shaped, URI,
backslash-smuggled, traversal, missing-target, cyclic, duplicate, and hardlink-to-directory inputs
fail closed with `IO_ARCHIVE_UNSAFE`.

The resolver returns a write plan with the final in-root target and an explicit
`withinTemporaryRoot: true` proof for every member. It does not follow or write any link before the
entire manifest has passed validation.

## Evidence

- `npm --prefix web run test:library-link-safety` passed 5/5 unit tests.
- Parent-directory symlinks, archive-root hardlinks, and chained links resolve to canonical in-root
  members.
- Absolute/UNC/drive/URI/traversal targets, missing members, cycles, duplicate paths, undeclared
  fields, and hardlinks to directories are rejected before a write plan is returned.

## Artifact Hashes

- parent manifest: `a7f3a45eb7f68d022f38185a1c1409e1db1b27647fef587d66d2ffa52d78f98e`
- protocol: `d55a4ba762898aed22bdcc7aa6493c713ee94f6bb1bf58754fdc459d0ddf70d1`
- unit: `7739275be91222d7bfb61d2f5a1daf812c6860fe34d0aea27df8380a77322120`
- package commands: `cfb232baa494ff59f6c8d65514a08c86332ee9354350b2a0392b6f932a7ee42c`

## Next Task

`M12-04E`: archive first reads the central directory/manifest and does not extract payload first.

## Rollback

Remove the archive link-safety protocol, unit suite, manifest, package command, and this status entry.
Restore M12-04C to pending and move the machine queue back to `M12-04D`. No parity ledger rollback is
required.