access follows a symlink, so a published dangling raw-link still looked absent. lstat and readlink inspect the link itself.