Port-lag goes BOTH directions: a fork can LAG its upstream (Incus<LXD) OR REGRESS a guard the upstream has (OpenTofu<Terraform)

Banked: 2026-07-15, cycle362 (Terraform port-lag of the OpenTofu provider-cache symlink = WALK, Terraform already guards it).

The two fork/upstream failure modes (check BOTH directions)

Fork LAGS upstream's complete fix (Incus<-LXD, cycle360): LXD confined both drivers via os.Root; incus ported it to LXC only -> incus has the live gap. Upstream = the reference remediation.
Fork REGRESSED a guard the upstream always had (OpenTofu<-Terraform, cycle362): Terraform's installFromLocalArchive (package_install.go:130-134) has ALWAYS rejected a symlinked provider-cache target dir (os.Lstat+ModeSymlink -> error "cannot install package ... because it is a symlink", with a security comment); installFromLocalDir os.RemoveAlls the target first. OpenTofu's diverged provider installer LOST this reject -> that's where the bug was (OpenTofu-only, GHSA-wcmj); OpenTofu already re-added a guard in 1.10.10. So: UPSTREAM safe, FORK regressed-then-fixed = NO live port-lag gap.

The rule

When a symlink/path bug is found in ONE of a fork/upstream pair, diff BOTH directions: - Does the OTHER project SHARE the vulnerable code? (if not = N/A, cf Gogs<-Gitea cycle324). - If it shares the FEATURE: does the other have the guard (it may be the REFERENCE that did it right - Terraform here, LXD in Incus) or LACK it (a live gap)? - A fork can regress an upstream guard (OpenTofu) OR lag an upstream fix (Incus) - opposite directions, same "diff both ways" discipline. - The one WITH the guard is the reference remediation to cite; the one WITHOUT is the finding (if live+undisclosed).

Reference remediation banked (provider-cache/install target symlink)

Terraform installFromLocalArchive: os.Lstat(targetDir) + reject-if-ModeSymlink BEFORE install; installFromLocalDir: os.RemoveAll(targetDir) before linking (removes a pre-existing symlink rather than following it). Simple, correct, cite-able.

Tar-symlink vein = FULLY TRIAGED (cycle358-362)

Incus (HIT, staged, Critical-class) | consul-template (Low/operator-decision) | go-getter (WALK wrong-class) | OpenTofu/BentoML (deprioritized old/vetted) | Terraform port-lag (WALK, upstream-safe). 1 strong hit (Incus). Vein done -> back to periodic trigger watch.