Add bounded sources and strict YAML parsing

docs/roadmap/implementation.md

@@ -2,7 +2,7 @@
 
 ## Status and ownership
 
-Status: implementation in progress; Stages 1–2 are complete and later stages are
+Status: implementation in progress; Stages 1–3 are complete and later stages are
 pending.
 
 Audience: a `gpt-5.6-terra` coding agent implementing one stage per prompt, in
@@ -383,7 +383,30 @@ Acceptance:
 
 ## Stage 3 — Extract source reading and enforce YAML policy
 
-Status: pending.
+Status: complete.
+
+Completion evidence (2026-09-06):
+
+- Added opaque source constructors and bounded file/byte/reader acquisition in
+  [`source.go`](../../source.go), including byte snapshots, regular-file checks,
+  deterministic I/O codes, caller-owned reader lifetime, and one atomic claim
+  shared by source copies. `NoSource` creates no source record.
+- Pinned `go.yaml.in/yaml/v4 v4.0.0-rc.6` solely behind `internal/yaml` and added
+  the parser-independent ordered tree in `internal/document`. The adapter uses the
+  streaming loader, checks for a second document explicitly, applies a calibrated
+  private parser depth plugin, enforces owned depth/node limits, preserves numeric
+  spelling and locations, and returns only value-free internal issues.
+- Generalized the strict-source/document cases recorded in the [extraction
+  inventory](../internal/extraction.md), created the [current configuration input
+  contract](../config.md), and added an AST import-boundary regression. No typed
+  decoder, composition, filesystem graph, or public `Load` was introduced.
+- Tests cover real file failures and reopening, byte ownership, fragmented/error
+  readers, exact/overflow byte limits, concurrent copied-source claims, all YAML
+  policy categories, trailing/empty documents, duplicate locations, lexical wide
+  numbers, block/flow depth calibration, node limits, safe parser errors, and
+  adapter isolation. Verified `go test ./...`, `go vet ./...`, `go build ./...`,
+  `go mod tidy -diff`, and `git diff --check` with Go 1.26.7 on linux/amd64. No
+  deviations were required; typed binding and decoding remain later work.
 
 Read: feature [YAML policy](initial.md#yaml-and-scalar-policy),
 [source constructors](initial.md#entry-point-and-reusable-application-definition).