v0.328.0 (unreleased): live finding on 9201 (rc.4) — roots resolved through their nearest existing ancestor; no symlink resolve for the placeholder check

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/stacks/allowlist.go

@@ -50,11 +50,14 @@ func (m *Manager) policyEnv(env map[string]string) map[string]string {
 // app's refusal line.
 func (m *Manager) admitCompose(name string, data []byte, env map[string]string) error {
 	e := privpolicy.PlaceholderEnv()
+	pol := privpolicy.Policy{SystemDataPath: m.sysDataPath}
 	if env != nil {
 		e = m.policyEnv(env)
+		// Resolve (real paths only — the placeholder env names no real folder): a bind source that is a symlink out
+		// of its data root is outside; it is judged where it points.
+		pol.Resolve = filepath.EvalSymlinks
 	}
-	// Resolve: a bind source that is a symlink out of its data root is outside (it is judged where it points).
-	err := privpolicy.Admit(name, data, e, privpolicy.Policy{SystemDataPath: m.sysDataPath, Resolve: filepath.EvalSymlinks})
+	err := privpolicy.Admit(name, data, e, pol)
 	m.noteAdmission(name, data, err)
 	return err
 }