Reject nonregular configuration files before opening them

docs/roadmap/remediation.md

@@ -50,6 +50,11 @@ references must remain prohibited inside dynamic values.
 
 ## 2. P1 — Reject nonregular source files before a blocking open
 
+Status: complete. Selected files, rooted imports and profiles now inspect canonical
+targets before opening and retain post-open checks. Deadline-controlled FIFO
+subprocess tests cover all three paths. Full tests pass with the issue-8 TMPDIR
+workaround; vet, build and whitespace checks pass.
+
 Evidence: [source.go](../../source.go), `readSource`, calls `os.Open` before
 checking regular-file status. [imports.go](../../imports.go), `readImport`, and
 [profile.go](../../profile.go), `readProfileFile`, likewise open before checking.