Reject nonregular configuration files before opening them

docs/config.md

@@ -490,7 +490,9 @@ source may supply `FilesystemContext.Root` to widen that root but may not supply
 `BaseDir`. Whenever byte and reader sources supply filesystem context, they must
 provide both `BaseDir` and `Root` as absolute existing directories; their diagnostic
 labels, including URI-looking labels, never imply filesystem paths. The base and
-selected file must be inside the canonical root. ConfigKit canonicalizes symlinks,
+selected file must be inside the canonical root. Nonregular targets are rejected before opening to avoid blocking on FIFOs;
+post-open regular-file checks remain in place under the stable-input assumption.
+ConfigKit canonicalizes symlinks,
 checks containment with relative paths, and opens the canonical root-relative target
 through a library-owned root handle. Contained relative or absolute symlink targets
 are accepted; escapes are rejected. Canonical paths define identity, so hard links at

docs/roadmap/remediation.md

@@ -50,6 +50,11 @@ references must remain prohibited inside dynamic values.
 
 ## 2. P1 — Reject nonregular source files before a blocking open
 
+Status: complete. Selected files, rooted imports and profiles now inspect canonical
+targets before opening and retain post-open checks. Deadline-controlled FIFO
+subprocess tests cover all three paths. Full tests pass with the issue-8 TMPDIR
+workaround; vet, build and whitespace checks pass.
+
 Evidence: [source.go](../../source.go), `readSource`, calls `os.Open` before
 checking regular-file status. [imports.go](../../imports.go), `readImport`, and
 [profile.go](../../profile.go), `readProfileFile`, likewise open before checking.