Add explicit path import traversal

docs/roadmap/implementation.md

@@ -850,7 +850,38 @@ Acceptance:
 
 ## Stage 11 — Implement explicit file-import traversal
 
-Status: pending.
+Status: complete.
+
+Completion evidence (2026-09-06):
+
+- Added strict recursive `_configkit.imports` parsing with exactly one `path` or
+  recognized `glob`, optional booleans, unknown-shape rejection, root-only placement,
+  and detached directive removal. Glob declarations return the deliberate temporary
+  `import.unsupported` gate for the next owning work.
+- Implemented declaration-order depth-first path traversal with canonical symlink
+  identity, relative containment checks, and canonical root-relative access through a
+  ConfigKit-owned `os.Root`. File inputs infer their canonical base/root; labeled
+  byte and reader inputs require explicit absolute base/root context and never infer
+  paths from URI-like labels.
+- Kept active and visited indexes separate, reporting complete cycle import sites and
+  both diamond/alias inclusion routes. Canonical aliases repeat, while hard links at
+  distinct paths remain separate sources. Required missing paths, directories,
+  unreadable targets, escapes, and canonicalization failures remain errors; optional
+  suppresses only nonexistence.
+- Assigned deterministic source IDs while reading each accepted source once, enforced
+  per-source and aggregate bytes, aggregate input nodes, source count, and active-edge
+  depth, and retained import-site/source records on failures. Imported fragments are
+  rejected when they claim the application version path or a non-mapping ancestor,
+  before strict composition.
+- Wired composed input and multi-location origins through `Load`, version checking,
+  strict decoding, resolution, validation, and base metadata. Temporary-directory
+  tests cover nested/list-order traversal, composition conflicts, version placement,
+  directives, optional/required paths, explicit roots, cycles, diamonds, symlinks,
+  hard links, parse/decode attribution, file types, context rules, and reduced limit
+  boundaries. The [current path-import contract](../config.md#explicit-path-imports)
+  owns implemented behavior; glob expansion remains pending. Verified `go test ./...`,
+  `go test -race ./...`, `go vet ./...`, `go build ./...`, `go mod tidy -diff`, and
+  `git diff --check` with Go 1.26.7 on linux/amd64.
 
 Read: feature [import graph](initial.md#explicit-imports-and-source-identity).