Share semantic document traversal helpers

docs/internal/overview.md

@@ -8,7 +8,8 @@ module and package documentation boundary. Its implemented public primitives are
 - canonical, control-safe diagnostic rendering and structured `LoadError` access;
 - opaque file, byte, reader, and no-input source construction in `source.go`,
   with shared regular-file checks and bounded read mechanics in `source_file.go`;
-- a parser-independent ordered tree in `internal/document`;
+- a parser-independent ordered tree in `internal/document`, with root-private
+  semantic lookup, indexing, and value traversal in `document_walk.go`;
 - the sole upstream YAML integration in `internal/yaml`, which translates validated
   input into that owned tree and exposes no parser types outside its boundary;
   `parse.go` owns shared translation into detached, ordered public diagnostics;

docs/roadmap/remediation.md

@@ -163,7 +163,14 @@ reliably induce an important filesystem failure. Run race tests for this unit.
 
 ## Stage 4 — Establish shared document traversal ownership
 
-Status: pending.
+Status: complete.
+
+Completion: `document_walk.go` owns nil-safe preorder value walking, borrowed
+indexing, and semantic lookup. Metadata shapes and projected sensitivity use the
+walker with defensive path copies. Specialized origins and budget traversals
+remain explicit. Full offline tests (including historical path shapes, metadata
+detachment, and dynamic secrets), vet, build, and whitespace checks passed with
+Go 1.26.7 on Linux/amd64.
 
 Evidence: `indexDocument`, `walkDocumentPaths`, and `projectedSensitivity` repeat
 semantic tree traversal in [load_metadata.go](../../load_metadata.go),