Development record

04-surfaces/03-embark.md:143-146 says both operands are refused when reached through a symlink inside a checkout and that outside every checkout the path is taken as given. Only a symlinked ancestor is taken as given there: a lifeboat or target named directly by a symlink outside any checkout exits 2 with 'is not a directory'. internal/core/lifeboat/operand.go separates the leaf-only IsRealDir gate from the ancestor proof.