Development record

The status-line trust check resolves a recorded entry with EvalSymlinks and judges the link's own directory and the final target's directory, but not the directory of a link in the middle of a longer chain. Example: the install record names ~/.local/bin/abcd, a link to /opt/homebrew/bin/abcd (a group-writable root:admin directory), itself a link to the real binary. Both judged directories pass, another admin account can repoint the middle link, and the status line then runs their binary on every refresh. Neither install shape abcd writes is a chain (a copy, or one link to the pinned plugin binary), so it is reachable only through a hand-edited install record that vouches for a hand-made chain.