Document and verify the remediation sprint

docs/internal/imports.md

@@ -33,6 +33,15 @@ sandbox guarantee. `source_context.go` derives passive resource contexts from
 resolved sources for later caller-owned reads; those records do not retain live
 acquisition handles.
 
+Host and native link bindings share one iterative link-frame evaluator. It
+tracks active links for cycle detection and reuses successfully completed link
+targets while resolving the remaining path components; each binding retains its
+own namespace and target-containment rules. Directory reads distinguish an
+initial-open failure from failures after opening: only an initial missing
+directory can be treated as optional, while enumeration and close failures
+remain selection errors, including errors from the standard `fs.ReadDir`
+fallback.
+
 Acquisition remains authored: declarations are visited in source order and each
 selected candidate set in namespace-path lexical order. This preserves source
 records, IDs, source-local version checks, and callback ordering. The acquired

docs/internal/overview.md

@@ -27,7 +27,8 @@ Implemented component owners:
   identity and owns schema
   inspection, lifecycle coordination, callback auditing,
   provenance/history, passive source-context retention, secret resolution and
-  bootstrap, safe inspection rendering, and effective-value comparison over
+  bootstrap, operation-local secret failure-location attribution, safe
+  inspection rendering, and effective-value comparison over
   frozen inspection snapshots. It never imports the root package.
 - Root `Source`, `Filesystem`, `Input`, `Underlay`, `Path`, `Secret`, records,
   lifecycle callbacks, results, and bootstrap reports are root-defined wrappers

docs/roadmap/implementation.md

@@ -1149,3 +1149,15 @@ Stage 33 verifies all 29 entries. C03 and F07 remain deferred, not missing from
 this table. No user/product question remains open; the implementation choices
 necessary for this scope are selected above. Helper names/file splits not fixed
 by an existing declaration can follow local idiom without changing those choices.
+
+Status: **complete** (final acceptance for all 29 selected findings). The final
+integration also formatted the identity-restoration test identified by the
+repository check. Prior final implementation commits: `f132cd6` and `b4af900`.
+Validation passed:
+`env GOTOOLCHAIN=local GOPROXY=off GOTELEMETRY=off ./scripts/check.sh`,
+`env GOTOOLCHAIN=local GOPROXY=off GOTELEMETRY=off go test -race ./...`,
+`env GOTOOLCHAIN=local GOPROXY=off GOTELEMETRY=off go test ./... -shuffle=on -count=3`,
+`env GOTOOLCHAIN=local GOPROXY=off GOTELEMETRY=off go test ./internal/engine -run '^$' -fuzz '^FuzzCompositionAndOverlay$' -fuzztime=30s -parallel=2`,
+`env GOTOOLCHAIN=local GOPROXY=off GOTELEMETRY=off go test ./examples/consumers -count=1`,
+`env GOTOOLCHAIN=local GOPROXY=off GOTELEMETRY=off go test . -run 'TestLocalDocumentationLinks|TestDependencyImportBoundary|TestPublicFacadeBoundary' -count=1`,
+and `git diff --check`. No platform skip or release action was required.

internal/engine/inheritance_identified_test.go

@@ -59,11 +59,11 @@ func TestPreserveInheritanceIdentityIndexesCompoundFields(t *testing.T) {
 		}
 	}
 	for _, want := range []struct {
-		key       string
-		text      string
-		keyLine   int
-		keyColumn int
-		valueLine int
+		key         string
+		text        string
+		keyLine     int
+		keyColumn   int
+		valueLine   int
 		valueColumn int
 	}{
 		{key: "id", text: "child-id", keyLine: 3, keyColumn: 3, valueLine: 3, valueColumn: 7},