Development record

lint.LoadConfig reads the docs-lint/record-lint config with a raw os.ReadFile — no O_NOFOLLOW, no regular-file check, no size cap — while its .abcd/*.json siblings guard.Load, rules.Load and positioning.LoadConfig all guard the read as a trust boundary. The read is hook-reachable (ahoy.Detect via hook session-start/end) and cross-repo-clonable, so a committed .abcd/docs-lint.json symlink to a FIFO wedges abcd docs lint / lint / ahoy / hook / cite refresh and the record-lint CI leg, a /dev/zero target OOMs the CLI, and an out-of-repo symlink target runs the entire ruleset from a file the repository does not own (gate substitution).