Complete bounded glob imports

docs/roadmap/implementation.md

@@ -878,7 +878,7 @@ Completion evidence (2026-09-06):
   tests cover nested/list-order traversal, composition conflicts, version placement,
   directives, optional/required paths, explicit roots, cycles, diamonds, symlinks,
   hard links, parse/decode attribution, file types, context rules, and reduced limit
-  boundaries. The [current path-import contract](../config.md#explicit-path-imports)
+  boundaries. The [current path-import contract](../config.md#explicit-imports)
   owns implemented behavior; glob expansion remains pending. Verified `go test ./...`,
   `go test -race ./...`, `go vet ./...`, `go build ./...`, `go mod tidy -diff`, and
   `git diff --check` with Go 1.26.7 on linux/amd64.
@@ -917,7 +917,36 @@ Acceptance:
 
 ## Stage 12 — Complete glob imports and filesystem option handling
 
-Status: pending.
+Status: complete.
+
+Completion evidence (2026-09-06):
+
+- Removed the temporary glob gate and added prevalidated Go `path.Match` semantics
+  for `*`, `?`, character classes, and escapes, with recursive unescaped `**`, URLs,
+  absolute paths, empty segments, and malformed classes rejected before any walk.
+- Added a pattern-directed walker that resolves literal segments directly and reads
+  wildcard directories through positive bounded `File.ReadDir` batches. It charges
+  every examined entry, including nonmatches, canonicalizes and contains traversed
+  directories and final targets, sorts slash-relative matches, and bounds final
+  candidates against remaining source capacity before traversal.
+- Reused the path-import DFS for every sorted match, preserving declaration ordering,
+  nested depth-first imports, canonical alias/repetition handling, hard-link path
+  identity, source IDs, composition, version placement, and all existing byte/node/
+  source/depth budgets. Optional glob declarations suppress only zero matches, never
+  invalid syntax, walk/permission failures, matched directories, or symlink escapes.
+- Completed filesystem option validation independently of import/profile selection:
+  file inputs reject `BaseDir` and may select a containing root; byte/readers require
+  existing absolute base/root pairs whenever context is supplied; `NoSource` rejects
+  context while the reserved `default` profile remains inactive.
+- Tests cover lexical and multi-declaration ordering, deterministic repeated loads,
+  overlapping matches, directories, hard links, contained absolute and escaping
+  symlink directories, required/optional no-match behavior, invalid patterns in empty
+  directories, escaped metacharacters, character classes, visible permission errors,
+  explicit `conf.d` imports without discovery, nonmatching-entry exhaustion, candidate
+  bounds, and filesystem combinations. The
+  [current import contract](../config.md#explicit-imports) owns the completed behavior.
+  Verified `go test ./...`, `go test -race ./...`, `go vet ./...`, `go build ./...`,
+  `go mod tidy -diff`, and `git diff --check` with Go 1.26.7 on linux/amd64.
 
 Read: feature import syntax and source-context API.