From 615b7f107a21b67532944f3f321c61dd282060c3 Mon Sep 17 00:00:00 2001
From: affaan-m <124439313+affaan-m@users.noreply.github.com>
Date: Mon, 28 Sep 2026 02:28:29 -0400
Subject: [PATCH] test(install): mutate postimage fixtures through owned
 descriptors

Preserve contributor history and current-main behavior while resolving the exact reviewed follow-up.

Source-PR: https://github.com/affaan-m/ECC/pull/3008
Source-Parent: be9fe61ef75bd907e62e800b464704d3fa2509eb
Review-Manifest-SHA256: 1e03bb3845a5bb2f3d48a943e137a291c52dd4079c9d5ae941d1e04265df7946
---
 tests/lib/opencode-consent-legacy-lock.test.js | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/tests/lib/opencode-consent-legacy-lock.test.js b/tests/lib/opencode-consent-legacy-lock.test.js
index 5937a92a1..dabfb47a1 100644
--- a/tests/lib/opencode-consent-legacy-lock.test.js
+++ b/tests/lib/opencode-consent-legacy-lock.test.js
@@ -455,12 +455,15 @@ function runTests() {
   }
   for (const defect of ['identity', 'bytes', 'path snapshot']) {
     test(`descriptor postimage assertion refuses different ${defect}`, value => {
-      const fd = fs.openSync(value.legacyFile, 'r');
+      const flags = defect === 'bytes' ? fs.constants.O_RDWR : fs.constants.O_RDONLY;
+      const fd = fs.openSync(value.legacyFile, flags | (fs.constants.O_NOFOLLOW || 0), 0o600);
       let identity;
-      try { identity = fs.fstatSync(fd, { bigint: true }); }
+      try {
+        identity = fs.fstatSync(fd, { bigint: true });
+        if (defect === 'bytes') fs.writeFileSync(fd, 'changed private fixture bytes');
+      }
       finally { fs.closeSync(fd); }
       if (defect === 'identity') identity = { ...identity, ino: identity.ino + 1n };
-      if (defect === 'bytes') fs.writeFileSync(value.legacyFile, 'changed private fixture bytes');
       const opened = [];
       const closed = [];
       const facade = { ...fs,