Same race-safety as cac: drop_symlink and the logs/ symlink sweep run as the customer, so a parent dir swapped for a symlink between check and rm cannot redirect a root unlink. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Same race-safety as cac: drop_symlink and the logs/ symlink sweep run as the customer, so a parent dir swapped for a symlink between check and rm cannot redirect a root unlink. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>