Refuses symlinks in a path or any ancestor, including dangling links. This is a cooperative path check, not protection against a hostile local process replacing directories concurrently. Use OS isolation for that.