Refactor to put all document validity checks into lint()
Once !15 (merged) has been merged, we have a
lint function that checks the parsed document for duplicate names for embedded files. But only that. Any other checks should be moved into lint.
Also, lint should maybe not be an optional thing to call, but the constructors should call it? Or maybe not. If it's unavoidable we can't have a "I know it's broken, but process it anyway" mode.