Complete bounded glob imports

docs/roadmap/implementation.md

@@ -878,7 +878,7 @@ Completion evidence (2026-09-06):
   tests cover nested/list-order traversal, composition conflicts, version placement,
   directives, optional/required paths, explicit roots, cycles, diamonds, symlinks,
   hard links, parse/decode attribution, file types, context rules, and reduced limit
-  boundaries. The [current path-import contract](../config.md#explicit-path-imports)
+  boundaries. The [current path-import contract](../config.md#explicit-imports)
   owns implemented behavior; glob expansion remains pending. Verified `go test ./...`,
   `go test -race ./...`, `go vet ./...`, `go build ./...`, `go mod tidy -diff`, and
   `git diff --check` with Go 1.26.7 on linux/amd64.
@@ -917,7 +917,36 @@ Acceptance:
 
 ## Stage 12 — Complete glob imports and filesystem option handling
 
-Status: pending.
+Status: complete.
+
+Completion evidence (2026-09-06):
+
+- Removed the temporary glob gate and added prevalidated Go `path.Match` semantics
+  for `*`, `?`, character classes, and escapes, with recursive unescaped `**`, URLs,
+  absolute paths, empty segments, and malformed classes rejected before any walk.
+- Added a pattern-directed walker that resolves literal segments directly and reads
+  wildcard directories through positive bounded `File.ReadDir` batches. It charges
+  every examined entry, including nonmatches, canonicalizes and contains traversed
+  directories and final targets, sorts slash-relative matches, and bounds final
+  candidates against remaining source capacity before traversal.
+- Reused the path-import DFS for every sorted match, preserving declaration ordering,
+  nested depth-first imports, canonical alias/repetition handling, hard-link path
+  identity, source IDs, composition, version placement, and all existing byte/node/
+  source/depth budgets. Optional glob declarations suppress only zero matches, never
+  invalid syntax, walk/permission failures, matched directories, or symlink escapes.
+- Completed filesystem option validation independently of import/profile selection:
+  file inputs reject `BaseDir` and may select a containing root; byte/readers require
+  existing absolute base/root pairs whenever context is supplied; `NoSource` rejects
+  context while the reserved `default` profile remains inactive.
+- Tests cover lexical and multi-declaration ordering, deterministic repeated loads,
+  overlapping matches, directories, hard links, contained absolute and escaping
+  symlink directories, required/optional no-match behavior, invalid patterns in empty
+  directories, escaped metacharacters, character classes, visible permission errors,
+  explicit `conf.d` imports without discovery, nonmatching-entry exhaustion, candidate
+  bounds, and filesystem combinations. The
+  [current import contract](../config.md#explicit-imports) owns the completed behavior.
+  Verified `go test ./...`, `go test -race ./...`, `go vet ./...`, `go build ./...`,
+  `go mod tidy -diff`, and `git diff --check` with Go 1.26.7 on linux/amd64.
 
 Read: feature import syntax and source-context API.
 

docs/roadmap/initial.md

@@ -475,30 +475,9 @@ the surviving sequence, not an attempted correspondence with previous indices.
 
 ## Explicit imports and source identity
 
-Explicit path-import traversal, source identity, containment, budgets, recursive
-directives, and the temporary glob gate are implemented and owned by the
-[current configuration contract](../config.md#explicit-path-imports). Bounded glob
-expansion remains target behavior. Illustrative future fragment:
-
-```yaml
-_configkit:
-  imports:
-    - glob: fragments/outputs/*.yml
-      optional: true
-```
-
-- Expand declarations in list order, sorting each glob's matches
-  lexicographically by slash-separated relative path, with no locale sorting.
-  Use the slash-based [Go `path.Match` grammar](https://pkg.go.dev/path#Match)
-  (`*`, `?`, character classes, and backslash escapes), with recursive `**`
-  syntax forbidden. Backslashes escape pattern characters, not directory separators.
-- A required unmatched glob is an error. Optional suppresses only zero matches.
-  Invalid patterns, permission
-  failures, directories, and invalid matched documents remain errors.
-- Glob traversal counts examined directory entries, including nonmatches, against
-  its separate work budget; only accepted matches contribute to sorted source order.
-  Expansion remains pattern-directed and must preserve the current path-import
-  identity, containment, repetition, and depth-first traversal rules.
+Explicit path and glob imports, recursive traversal, source identity, containment,
+filesystem context, and budgets are implemented and now owned by the
+[current configuration contract](../config.md#explicit-imports).
 
 ## Profiles