Implement final fixes and close out the implemetation roadmap

internal/framework/chunkplan/store_test.go

@@ -163,6 +163,61 @@ func TestFilesystemStoreRejectsSymlinkedEntries(t *testing.T) {
 	}
 }
 
+func TestOpenDigestRootRejectsEntryReplacedDuringOpen(t *testing.T) {
+	rootPath := t.TempDir()
+	digestDir := strings.TrimPrefix(testSourceDigest, "sha256:")
+	if err := os.Mkdir(filepath.Join(rootPath, digestDir), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Mkdir(filepath.Join(rootPath, "redirect"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	root, err := os.OpenRoot(rootPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer root.Close()
+
+	traced := false
+	opened, state, err := openDigestRootWithHooks(root, digestDir, false, digestOpenHooks{BeforeOpen: func() error {
+		if traced {
+			return nil
+		}
+		traced = true
+		if err := os.Rename(filepath.Join(rootPath, digestDir), filepath.Join(rootPath, "original")); err != nil {
+			return err
+		}
+		return os.Symlink("redirect", filepath.Join(rootPath, digestDir))
+	}})
+	if opened != nil {
+		_ = opened.Close()
+	}
+	if err != nil || state != entryRejected {
+		t.Fatalf("openDigestRootWithHooks() root=%v state=%v error=%v, want nil/rejected/nil", opened, state, err)
+	}
+}
+
+func TestReadPlanRejectsEntryReplacedDuringOpen(t *testing.T) {
+	rootPath := t.TempDir()
+	writeFile(t, filepath.Join(rootPath, planFileName), []byte("original"), 0o600)
+	writeFile(t, filepath.Join(rootPath, "redirect.json"), []byte("redirect"), 0o600)
+	root, err := os.OpenRoot(rootPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer root.Close()
+
+	data, state, err := readPlanWithHooks(root, planReadHooks{BeforeOpen: func() error {
+		if err := os.Remove(filepath.Join(rootPath, planFileName)); err != nil {
+			return err
+		}
+		return os.Symlink("redirect.json", filepath.Join(rootPath, planFileName))
+	}})
+	if err != nil || state != entryRejected || data != nil {
+		t.Fatalf("readPlanWithHooks() data=%q state=%v error=%v, want nil/rejected/nil", data, state, err)
+	}
+}
+
 func TestFilesystemStoreRejectsUnexpectedEntryTypes(t *testing.T) {
 	tests := []struct {
 		name  string