Add bounded sources and strict YAML parsing

docs/roadmap/initial.md

@@ -423,31 +423,10 @@ configuration is never returned as a successful, usable result.
 
 ## YAML and scalar policy
 
-The supported model is mappings with string keys, sequences, scalars, and null,
-with YAML comments and block/flow syntax. Require exactly one document with a
-mapping root. Reject empty input, additional documents (including empty ones),
-duplicate mapping keys, explicit tags, anchors, aliases, and merge keys (`<<`).
-Mapping keys must resolve to strings under this scalar policy; quote keys
-that would otherwise be booleans, numbers, or null. Compare decoded string keys
-without case folding or Unicode normalization. A quoted `"<<"` is also reserved and rejected.
-
-Use a deliberately limited scalar vocabulary independent of parser defaults:
-
-- Quoted and block scalars are strings.
-- Plain `true` and `false` are booleans; plain `null`, `~`, and an empty value
-  are null. Other case variants of these reserved literals are rejected when used as
-  plain values.
-- Numbers use JSON decimal syntax: optional minus, integer part with no leading
-  zero except zero itself, optional fraction, and optional decimal exponent.
-- Reject YAML numeric extensions such as hexadecimal, octal, digit separators,
-  leading plus, and non-finite values. Reject legacy boolean words such as
-  `yes`, `no`, `on`, and `off` unless quoted (case-insensitively).
-- Date/time-looking plain text remains a string, never an implicit timestamp.
-  Other ordinary plain text is a string.
-
-Unsupported scalar forms must produce a policy error rather than inherit a
-parser conversion. Preserve numeric lexical information until decoding so
-large integers are not rounded through an intermediate floating-point value.
+Source ownership, the supported YAML subset, scalar grammar, fixed input limits,
+and safe failure behavior are implemented. The [current configuration input
+contract](../config.md) now owns those definitions. Typed scalar conversion into
+application values remains target work in [typed decoding](#typed-decoding).
 
 ## Paths and presence
 
@@ -770,11 +749,6 @@ type FilesystemContext struct {
     BaseDir string
     Root    string
 }
-
-func File(path string) Source
-func Bytes(label string, data []byte) Source
-func Reader(label string, input io.Reader) Source
-func NoSource() Source
 ```
 
 `Load` accepts zero or one options value; multiple values are an options error,
@@ -792,11 +766,11 @@ result. Callbacks must not retain these contexts or configuration pointers; shar
 closures must be safe for concurrent calls if the application loads concurrently.
 ConfigKit does not synchronize application-owned captured state.
 
-`Source` is opaque with the constructors above, not an arbitrary provider
-interface. `Bytes` snapshots its input; `Reader` is consumed during the load and
-is not closed by ConfigKit. A reader source is single-use. File sources are read
-on each load. Constructor argument errors surface as load diagnostics. Applications must use
-non-secret source labels because labels appear in diagnostics and source reports.
+`Source` and its constructors are implemented; [`source.go`](../../source.go) and
+the [configuration input contract](../config.md#sources) own their current behavior.
+The loading and filesystem-option behavior below remains target work.
+Applications must use non-secret source labels because labels appear in diagnostics
+and source reports.
 Filesystem context follows the [source rules](#explicit-imports-and-source-identity):
 a file's own directory supplies its base, and an explicit context can set its
 root. Supplying `BaseDir` for a file is an options error; bytes/readers require