Provide passive per-source resource contexts

docs/config.md

@@ -148,6 +148,33 @@ have index zero. Explicit empty groups and `NoSource` consume no source ID.
 Byte, source, node, and glob-entry budgets are shared across the load, while
 the existing per-source and import-depth bounds still apply.
 
+### Source resource contexts
+
+`Result.SourceContext(id)` and callback-scoped `Resolution.SourceContext(id)`
+return a passive `ResourceContext` for a source with filesystem context, or
+false for unknown and contextless IDs. The result query is nil-safe; the
+resolution query follows the callback's lifetime guard. Queries perform no
+filesystem access. Obtain IDs from exact origin locations rather than guessing
+one context for a composite origin or an application-derived value.
+
+`ResourceContext.FS` is rooted at the source's configured root, and `BaseDir`
+is its slash-relative directory inside that root. This includes imported
+sources, selected overlays, host files even without enabled imports, native
+files, and byte, reader, or mapping inputs with an explicit context. CLI and
+contextless synthetic inputs have no resource context. To open a relative
+resource, join `BaseDir` with the application resource name using slash-path
+operations and open that path through `FS`.
+
+Native contexts borrow the caller's filesystem within the configured root.
+Host contexts retain a canonical root path, not an open root handle; each
+resource `Open` checks containment and opens a fresh handle that the returned
+file's `Close` releases. Applications own and close the files they open.
+Resources are application data, not configuration input, and do not consume
+configuration byte or node budgets. The loaded configuration and metadata stay
+usable if source files later change or disappear. Later resource operations
+observe the backing filesystem then and may fail if files move, disappear, or
+a caller-owned filesystem closes. This is not a snapshot or universal sandbox.
+
 ### Application schema versions
 
 `VersionRule` declares a semantic path and non-nil checker. Before defaults or typed

docs/roadmap/implementation.md

@@ -425,6 +425,18 @@ configuration, metadata, and safe rendering agree. Run the everyday checker and
 
 ## Stage 8: Add handle-free source-context queries
 
+**Completed 2026-09-29.** Results and active resolution callbacks now expose
+passive per-source `ResourceContext` records. Native views borrow caller-owned
+filesystems under their configured roots; host views retain only canonical root
+paths and open/close fresh roots with each resource file. Main, imported,
+selected-overlay, and explicitly contextual synthetic sources have their own
+base directories; contextless and CLI sources do not. Public tests verify
+origin-based resource access, no I/O on queries, later mutation/deletion,
+borrowed-filesystem closure, and callback guards. Tracking tests cover resource
+Open failure cleanup, returned file/directory ownership, and loading-handle
+closure across success and representative failures. The everyday checker and
+full race suite passed.
+
 1. Retain context descriptors keyed by acquired source ID, including imported
    sources, in private inspection and live resolution state. Keep descriptors
    separate from serializable metadata and preserve callback guards.