Development record

The brief at .abcd/development/brief/05-internals/03-configuration.md:615 says: Every file in the user scope whose contents abcd acts on — rules.json, trusted-roots, local-transcript-roots, path-entry, cache-attestation, release-mark, config.json, oracle-routing.json, statusline.json, load-limits, credentials.json and credential-homes.json — is refused behind a symlinked ~/.abcd.noindex. The shipped surface differs: The list omits ~/.abcd.noindex/memory.json, which abcd acts on (memory notes recalled into every prompt) and reads through rules.ReadUserLayerFile, the rules layers' trust checks (internal/core/memnote/layers.go). (v0.14.2 release crosscheck, undocumented-surface, raised by opus in a34.)