Complete single-source semantic validation

docs/roadmap/implementation.md

@@ -2,7 +2,7 @@
 
 ## Status and ownership
 
-Status: implementation in progress; Stages 1–8 are complete and later stages are
+Status: implementation in progress; Stages 1–9 are complete and later stages are
 pending.
 
 Audience: a `gpt-5.6-terra` coding agent implementing one stage per prompt, in
@@ -744,7 +744,37 @@ Acceptance:
 
 ## Stage 9 — Add semantic validation and finish the single-source lifecycle
 
-Status: pending.
+Status: complete.
+
+Completion evidence (2026-09-06):
+
+- Reused `Validation` for post-resolution application reports in
+  [`validation.go`](../../validation.go), with `validate.error`,
+  `validate.warning`, and `validate.invalid_path` classifications. Omitted declared
+  fields and missing string-map/dynamic keys remain valid report paths; unknown
+  struct fields and malformed primary or related paths fail safely.
+- Attached exact or nearest input locations to primary and related reports, retained
+  independent errors and warnings, continued through warnings, and returned no
+  configuration on any semantic error. Version, decode, and resolution failures stop
+  before later hooks.
+- Added before/after typed projection around the validator. Any net scalar,
+  container, or nested mutable-state change, and any newly unprojectable value,
+  returns `validate.mutation` without publishing the mutated object. Callback
+  contexts close after invocation and callback panics remain programming failures.
+- Removed the semantic-validator options gate, finalized metadata only after
+  successful resolution/validation, and retained defensive configuration snapshot,
+  metadata, diagnostic, and source ownership. The
+  [current semantic-validation contract](../config.md#semantic-validation) owns the
+  completed single-source lifecycle and application/runtime-state boundary.
+- Added compiling executable examples in [`example_test.go`](../../example_test.go)
+  for minimal loading, defaults-only operation, related-path validation, actionable
+  schema-version guidance, and resolution followed by validation. Focused tests cover
+  multiple reports, missing/dynamic paths, related/nearest locations, invalid paths,
+  validator mutation, hook ordering and stop points, warnings, and final value/
+  explicitness/origin/history agreement. Verified `go test ./...`,
+  `go test -race ./...`, `go vet ./...`, `go build ./...`, `go mod tidy -diff`, and
+  `git diff --check` with Go 1.26.7 on linux/amd64. No deviations were required;
+  imports and profiles remain deliberately unavailable.
 
 Read: feature [diagnostic callbacks](initial.md#resolution-and-validation-callbacks)
 and [schema reports](initial.md#schema-checking-and-secret-classification).

docs/roadmap/initial.md

@@ -582,10 +582,10 @@ independently captured resolved results are implemented. The
 [current ownership contract](../config.md#typed-projection-and-ownership) owns those
 mechanics.
 
-Application semantic validation runs after successful resolution and collects
-independent errors in a standard diagnostic form. Validators are read-only and
-own domain requirements; checking live S3 buckets or starting runtime clients
-is outside this lifecycle. Do not run later hooks on an invalid typed value.
+Application semantic validation is implemented. The
+[current semantic-validation contract](../config.md#semantic-validation) owns
+schema-aware reporting, nearest locations, warning/error behavior, mutation audit,
+callback lifetime, and application/runtime responsibility boundaries.
 
 ## Provenance, diagnostics, and redaction
 
@@ -795,9 +795,10 @@ behavior. Layered callback history and safe historical values remain target beha
 
 ### Resolution and validation callbacks
 
-The resolution declarations and behavior below are implemented; the
-[current recorded-resolution contract](../config.md#recorded-application-resolution)
-is authoritative. Semantic validation behavior in this section remains target work.
+The resolution and semantic-validation declarations and behavior below are
+implemented. The [current recorded-resolution contract](../config.md#recorded-application-resolution)
+and [semantic-validation contract](../config.md#semantic-validation) are
+authoritative.
 
 ```go
 func (r *Resolution) IsExplicit(path Path) bool