[acamarata]

Artifact extraction now validates and opens its destination as one operation, then keeps that directory handle through every write. Replacing a parent pathname after validation cannot redirect extraction to a different directory.

Verified against freshly fetched origin/main c2eac4e. No AGENTS.md or .claude/CLAUDE.md was present at the repository root.

• D-1058 — BLOCKED in-flight: origin/fix/D-1058-bundle-ref-sweep already contains 82a1b4b for this row: https://github.com/nself-org/plugins/tree/fix/D-1058-bundle-ref-sweep . No PR exists for that branch. Main still bundles all history and removes its ref only with defer; this PR avoids duplicating the existing branch.
• D-1015 — BLOCKED in-flight: fix: debt batch j36-plugins-debt-d-1427 #459 already changes free/ci/internal/artifacts/records/collect.go. Main still stores all blobs before returning the staged values, and Sweep has a one-hour grace. The overlapping collection file is left to that in-flight work; its current diff does not fix the collection lease issue.
• D-1194 — BLOCKED in-flight: fix: debt batch j36-plugins-debt-d-1427 #459 already scrubs retry Diagnosis and Excerpt and adds a retry-excerpt regression test. Main still scrubs only JobID in the retry loop.
• D-1129 — FIXED: added OpenArtifactGetDest, which captures directory identities before validation, pins the parent, creates a missing leaf through that parent, checks the opened leaf's identity and emptiness, and returns an os.Root. Artifact Reader.Get uses that handle through extraction. Tests replace an approved parent with a symlink and verify writes remain in the original directory, for both new and existing destinations; refusal tests cover nonempty directories, symlinks, cwd and .git paths.

The choice follows the existing os.Root extraction approach: keep the pathname validator for validation-only consumers, and give artifact extraction a pinned handle. Returned paths are display values; extraction uses the handle. A refused opening can leave a newly created empty directory, since removing it by a raced pathname would be unsafe. No product decision, production access, release or HQ edit is required.

Validation from free/ci:

• go test -mod=vendor ./internal/authz ./internal/artifacts/records — PASS.
• go vet -mod=vendor ./internal/authz ./internal/artifacts/records — PASS.
• go build -mod=vendor ./internal/authz ./internal/artifacts/records — PASS.
• git diff --check — PASS.
• go test -mod=vendor ./... — BLOCKED by linker errors opening missing files under the worker's shared /Volumes/D4/dev-caches/go-build cache. A clean archive of origin/main was tested with the same command and also failed with missing cache objects. Both full-module runs were stopped after confirming that infrastructure blocker; no cache workaround was attempted. A separate clean-main go test -mod=vendor ./internal/doctor passed, so the shared-cache failure is intermittent rather than a claimed source regression.

No hooks were bypassed. One conventional commit, no attribution lines.