scribe assemble refuses a symlink at an allow-list directory and inside it but not at its ancestors (.abcd, .abcd/work, .abcd/work/issues): os.Root follows an in-root link, so a committed issues -> docs/shadow link carries shipped-tree content into the scribe context under ledger paths

scribe assemble refuses a symlink at an allow-list directory and inside it but not at its ancestors (.abcd, .abcd/work, .abcd/work/issues): os.Root follows an in-root link, so a committed issues -> docs/shadow link carries shipped-tree content into the scribe context under ledger paths

Grounds

• pursued: a committed symlink at .abcd/work or .abcd/work/issues refuses the assembly and the ingest before any ledger content is read; a shadowed shipped file reaching the context under a ledger path would show it wrong