Operand paths in lifeboat (embark, pack, graveyard, synthesis) and the site output directory are proved with a single-level IsRealDir, so a symlinked ancestor of the operand is followed while the leaf check passes; the multi-level fsutil.EnsureRealDirAll / ProbeRealDirAll walk the inbox and the local tier now use is the canonical proof. Sweep each operand site: prove every level below the operand's declared base, or say why the operand is trusted as given.

Operand paths in lifeboat (embark, pack, graveyard, synthesis) and the site output directory are proved with a single-level IsRealDir, so a symlinked ancestor of the operand is followed while the leaf check passes; the multi-level fsutil.EnsureRealDirAll / ProbeRealDirAll walk the inbox and the local tier now use is the canonical proof. Sweep each operand site: prove every level below the operand's declared base, or say why the operand is trusted as given.

Grounds

• pursued: a symlinked ancestor of any lifeboat operand inside a checkout is refused before a write; a link at any level below the operand's checkout that is followed would show it wrong