Function scan_dir 

fn scan_dir(
    working_dir: &Path,
    scan: &InstructionDirScan,
    out: &mut Vec<String>,
) -> ScanOutcome

Collect qualifying files under one declared scan directory.

Bounded during traversal, not after it. Collecting everything and then truncating leaves the advertised ceiling doing nothing about the cost it exists to bound: a repository-controlled directory with a very large number of matches still gets fully walked, allocated and sorted first (Codex, PR #3156). The walk now stops as soon as it has one file more than the cap, which is exactly enough to know the limit was hit.

Entries are sorted at each level before descending, so stopping early still yields the same set every time. Without that, an early stop would return whatever the filesystem happened to hand back first.

Symlinks are skipped outright: file_type() does not follow the link, unlike metadata(), which resolves the target and reports is_symlink() == false for every symlink — so an earlier guard written against metadata() never fired at all. A scanned directory is repository-controlled, and nothing about “follow this link” can be verified from here; the declared literal paths are still read through links, which is an ordinary layout.

Returns true when the cap was reached.