Count import depth only for selected sources

docs/roadmap/remediation.md

@@ -1,6 +1,6 @@
 # Import Discovery and Scheduling Review Findings
 
-Status: in progress; issues 1–5 complete, one finding remains.
+Status: complete; all six findings addressed in separate validated commits.
 
 Reviewed implementation: `aa93aed..15943e2`, ending at
 `15943e233ca3cd1286c03c0e7085871db344cd4b`, against the accepted
@@ -177,7 +177,7 @@ suffixes after overflow and retain valid huge integers and `-0`. The two invalid
 cases failed before the fix. Existing depth/specification coverage and the full
 everyday check passed; the accepted integer range was not narrowed.
 
-## 6. [ ] P2 — Apply the active import-depth limit to actual inclusion edges
+## 6. [x] P2 — Apply the active import-depth limit to actual inclusion edges
 
 Owner: [walkDeclarations](../../internal/engine/imports.go), around lines 403–405.
 
@@ -199,6 +199,13 @@ and selection resource budgets even when no source is selected. At the boundary,
 empty lists and optional zero selections must succeed, while a real next source
 must still fail. Keep the existing numeric resource limit unchanged.
 
+Completed: the depth bound is checked for an existing selected target at source
+inclusion, rather than for every declaration. A test-controlled one-edge budget
+covers empty/required-empty lists, absent path/directory/glob selections, actual
+next sources, and invalid declarations. The original 64-edge public examples
+now succeed with empty optional contributions; a real next edge still fails.
+The full everyday and race checks passed without changing the resource limit.
+
 ## Review validation
 
 Passed on the reviewed revision with Go `go1.26.9 linux/amd64`:
@@ -214,3 +221,22 @@ fixtures outside the repository. The native wildcard-alias and ordinary item-
 version regressions were also compared with an archived `aa93aed` checkout
 outside the repository. No code, dependencies, release procedure, consumer
 repository, or accepted ADR decision text was changed during the review.
+
+## Remediation validation
+
+All six findings have completion evidence above. Final validation passed with
+Go `go1.26.9 linux/amd64`, local toolchain selection, offline dependencies, and
+build caches outside the repository:
+
+- `./scripts/check.sh` (formatting, whitespace, full tests, vet, and build).
+- `go test -race ./...`.
+- Local documentation-link checks and `git diff --check`.
+
+The original external public-API reproductions were rerun against the completed
+fixes. Native path/directory/glob aliases now retain the same helper origin and
+resource context; ordinary item versions load; nested native roots and finite
+symlink reuse load; invalid depth suffixes fail; and empty contributions do not
+consume active inclusion depth. Focused regressions also retain actual version
+ownership, real cycle/escape errors, invalid-declaration handling, and the depth
+budget for real sources. No dependencies, public controls, release gates, or
+downstream repositories were changed.