Function unix_o_nofollow 

pub const fn unix_o_nofollow() -> i32

POSIX O_NOFOLLOW open-flag value for the target platform. Used alongside std::os::unix::fs::OpenOptionsExt::custom_flags to refuse to follow a symlink at the file path being opened — closes the symlink-plant confused-deputy class where a co-tenant with write access to a spool directory pre-plants a symlink at a deterministic file path so the harness’s authenticated append (running as the harness UID) is redirected to a file the attacker can then read or overwrite.

Rather than pull in a libc / rustix dependency for one constant this returns the POSIX-defined value directly; the values are stable ABI and are drawn from the libc crate’s constant.O_NOFOLLOW documentation. On unknown Unix-like platforms we fall back to the Linux value (a conservative choice: a mismatch would surface as an ELOOP/ENOTDIR/EACCES at first symlink attempt, not silent success).

CAUTION (round-99 find): on Linux the fcntl bits are per-ARCH, not per-OS. PowerPC swaps the asm-generic layout: 0x20000 there is O_DIRECT — passing it forced direct-I/O alignment on every spool append (EINVAL, all sessions fail-closed on ppc64le) while silently NOT refusing symlinks. Alpha/sparc differ too; neither has a supported Rust target here.