- CVE-2026-43619: secure receiver-side path-based syscalls (do_chmod, do_lchown, do_rename, do_unlink, do_mkdir, do_symlink, do_mknod, do_link, do_rmdir, do_utimensat, do_lstat) against symlink-race TOCTOU by routing through secure_relative_open + *at() wrappers, harden secure_relative_open to reject .. components and confine relative basedir, secure change_dir against chdir-escape, secure copy_file source/dest opens, fix absolute --partial-dir delta resume via secure_basis_open; add alt-dest-symlink-race / bare-do-open-symlink-race / copy-dest-source-symlink / secure-relpath-validation tests