Resolve contained symlinks in import directory prefixes

docs/roadmap/remediation.md

@@ -1,6 +1,6 @@
 # Import Integration Correctness Audit
 
-Status: open; three findings require correction.
+Status: in progress; finding 1 complete, findings 2 and 3 remain.
 
 Reviewed tree: `91db99b` (including the six completed fixes through `5747ec4`).
 Scope: import discovery/defaults and shared dependency-ready scheduling, including
@@ -10,11 +10,11 @@ resource contexts, and maintained consumer examples. The completed design and
 implementation plan remain available at `5747ec4:docs/roadmap/imports.md` and
 `5747ec4:docs/roadmap/implementation.md`.
 
-This review changes no production code or existing contracts. Preserve the
+The audit made no production code or contract changes. Preserve the
 accepted syntax, defaults, scheduling, containment, and namespace decisions when
 addressing these findings.
 
-## 1. [ ] P2 — Accept contained absolute symlinks in directory-root prefixes
+## 1. [x] P2 — Accept contained absolute symlinks in directory-root prefixes
 
 Owners: [`importEntryTarget`](../../internal/engine/filesystem_links.go),
 especially the initial host `a.root.Lstat(relative)` around line 30, and
@@ -53,6 +53,16 @@ solve this by prohibiting absolute symlinks or relaxing root containment. Add a
 focused public regression for a directory root below an absolute contained link;
 reuse existing escaping-link and cycle coverage.
 
+Completed: host entry inspection resolves intermediate parent components through
+the existing containment-aware resolver before inspecting the final entry. Native
+handling and the final entry's `follow` policy are unchanged. Added a public
+regression for directory roots below an absolute contained link with both
+`follow` settings, including canonical source identity. Confirmed that the test
+fails before the fix and passes afterward. Focused facade and engine directory,
+glob, symlink, and cycle tests passed, as did `./scripts/check.sh`,
+`go test -race -count=1 ./...`, and `git diff --check`. The original public
+reproduction now succeeds for all selectors.
+
 ## 2. [ ] P2 — Describe scheduled provenance and history order consistently
 
 Owner: [configuration contract](../config.md), especially layered metadata