FileRootEscape

A component of a file-manager path resolved outside the root while the descriptor walk was following it.

The refusal the resolved string path gives statically, raised for the one case that path cannot see: a symlink planted or swapped into the name space between the path's validation and the act on it. The walk verified where each open landed from the descriptor itself and refused to hand the caller an object the confinement never saw.