[helly25]

Preserve filesystem-native name matching when the first case-sensitive comparison reaches a dangling symlink or a link into another volume. Resolve the link name using its containing directory only after verifying that both belong to the same device.

AG;DR

Behavior and boundaries

#1143 made filesystem-native case detection lazy. On Darwin, pathconf(..., _PC_CASE_SENSITIVE) follows its final symlink (XNU implementation). A dangling link can fail that query, and a link into another volume can answer using the target's policy while the cache key comes from the link's non-followed device metadata. That can suppress a valid folded name match and cache the wrong answer for later entries.

On a reached device-cache miss for a symlink, the resolver obtains its containing directory's metadata through the VFS. It uses that directory's case query only after verifying directory type and the same device as the link. A bare relative link uses .. An unavailable or different-device parent retains the entry query; an unavailable case answer retains the conservative exact fallback. Optional parent observations do not introduce reported metadata errors. Regular entries, uniform-case backends, explicit case modes, and exact/folded comparisons that agree retain their existing paths.

The optional parent stat is confined to a relevant symlink/device cache miss, not every entry. No speedup is claimed, and no filesystem case rule is inferred across unverified device boundaries. Followed entries retain their existing metadata/type path and device-cache policy.

Regression tests

The identical deterministic dangling-link fixture passes on actual pre-#1143 main c997dc338e1adea1ccb5d4fab83f5c85a44dee40 and fails on merged #1143 main 52c153549739546e02af7480d6d338096548528f without production changes. The committed in-memory tests cover dangling, folding-target and sensitive-target links, ordinary/deferred fuzzy evaluation, bare relative roots, different-device parents, denied/nondirectory parent observations, and unavailable case answers. They assert complete output, diagnostics and query paths. No host symlink is created.

Update CHANGELOG and the native-case expression design contract. No public API, flag, generated-help, archive policy, benchmark sampling, or suppression changes.

Current-head validation

Signed head 6b165cc8849cea6d9e281245912d87101e07aaa6 contains actual main 3e546dbef0993486217eb58f3f9276dd0003651c. Its own Test run 42426240775 is fully successful: all three platform test jobs, ASan/MSan/TSan, coverage, both actual CI lint translation units, GCC/minimal/reference/site/policy checks, all six initial Linux/macOS benchmark candidates, agreement, final fastest-seven-of-nine comparison and done. Optional fourth/fifth candidates skipped normally. Digest-verified CI coverage reports 12/12 changed lines and 10/10 branches, both 100%. No earlier PR or commit checks substitute for this context.

Development feedback also includes four executed optimized focused targets on macOS, plus the final expanded uniform-case tests. Normal changed-file/manual/commit/push policies and Trunk pass; local clang-tidy is intentionally excluded under the user's instruction. A local Darwin coverage invocation emitted only empty baseline counters and is not counted as coverage evidence; the successful current-head Linux CI is authoritative. The test-only follow-up resolved the real 7/10 branch gap and one initializer-comma finding without changing production bytes or lowering policy.

Ordering

This isolated correctness recovery precedes the remaining #1140 → #1141 → #1142 sequence. #1139 already merged after its fresh post-#1143 run succeeded. Exact predecessor main Test 42424228394 is successful. Verify this repair's post-merge main automation, then synchronize downstream work normally and collect its required fresh benchmark/check contexts. Existing reports and measurements retain their original source identities; no data is relabeled. Broader optimization work remains paused.