Prepare source release validation

docs/internal/extraction.md

@@ -28,8 +28,8 @@ the owning implementation work extracts a symbol or case.
 - Use sanitized local fixtures only. Audio, transcripts, credentials, private
   configuration, and whole application package trees are application-only.
 - Record the exact copied/generalized symbols and tests in the owning section when
-  extraction occurs. An entry below assigns evidence; it does not claim extraction
-  or behavior is implemented.
+  extraction occurs. Assignment prose records the original work boundary; dated
+  implementation records state what was actually generalized.
 
 ## Narratio evidence
 
@@ -86,8 +86,8 @@ collection, conflict construction, and recursive mapping join in `compose.go` ad
 the assigned production symbols. `TestComposeDocumentsJoinsDisjointMappingsAndTracksClaims`,
 `TestComposeDocumentsRejectsEveryPresentNonMappingOverlap`, and
 `TestComposeDocumentsReportsAllClaimantsAtExactLocations` adapt the assigned cases.
-The planned empty-mapping difference is covered separately: empty mappings retain
-container provenance but contribute no child claims. No unplanned semantic deviation
+The intentional empty-mapping difference is covered separately: empty mappings retain
+container provenance but contribute no child claims. No other semantic deviation
 from the extracted additive composer was required.
 
 ### Imports
@@ -122,9 +122,9 @@ declaration-order, disjoint composition, keyed-entry, all-source conflict, unsaf
 target, alias, imported parse/schema, and relative-resolution cases. ConfigKit adds
 recursive bounded DFS, `os.OpenRoot` confinement, canonical symlink identity,
 cycle/diamond route locations, optional-path semantics, aggregate budgets, and
-fragment version-placement enforcement. The planned glob syntax is parsed but
-remains explicitly unavailable for its next owning work; hard links intentionally
-replace Narratio's same-file rejection with path identity.
+fragment version-placement enforcement. That checkpoint parsed glob syntax behind an
+explicit unsupported gate that the subsequent glob implementation removed; hard
+links intentionally replace Narratio's same-file rejection with path identity.
 
 Glob-import implementation record (2026-09-06): ConfigKit retains the extracted
 declaration order, import failures, composition, and identity cases while adding the
@@ -133,7 +133,7 @@ new `expandImportGlob`, `readGlobMatches`, and pattern-validation mechanisms in
 directories, hard links, contained and escaping symlinks, unmatched declarations,
 malformed and recursive patterns, escaped metacharacters, character classes,
 permission failures, explicit `conf.d` use, and entry/candidate budgets. This work
-has no Narratio production equivalent; it uses the planned standard-library
+has no Narratio production equivalent; it uses the selected standard-library
 `path.Match` and bounded `File.ReadDir` adaptation rather than its flat loader.
 
 ### Profiles and overlay
@@ -199,8 +199,8 @@ inspection cases across one default/import/profile/resolution workflow. ConfigKi
 adds chronological descendant history for parent and whole-sequence operations,
 composite empty-mapping origins, canonical resolution reasons/dependencies, private
 snapshot agreement, defensive nested copies, and concurrent load isolation. Value
-rendering, redaction, explanation, commands, generated attribution, diffs, and
-digests remain assigned to their later owning work.
+That checkpoint deliberately left rendering, redaction, explanation, commands,
+generated attribution, diffs, and digests outside its scope.
 
 Effective-rendering implementation record (2026-09-06): ConfigKit adapts Narratio's
 deterministic effective-output and side-effect-free inspection cases in
@@ -212,7 +212,8 @@ resolved values, text-scalar snapshot reuse, application YAML-hook isolation,
 non-disclosure through failures and record formatting, caller mutation, and writer
 failures. Unlike Narratio's marshal/reparse path, ConfigKit renders only its owned
 frozen tree and substitutes redaction before the upstream dumper boundary. Historical
-value explanation and secret references remain assigned to later work.
+value explanation and secret references were implemented at their later owning
+boundaries and are exercised by the consumer startup example below.
 
 ### Defaults, presence, and domain resolution
 

docs/internal/overview.md

@@ -20,17 +20,17 @@ module and package documentation boundary. Its implemented public primitives are
 - a per-operation private reflection descriptor graph in `schema.go` for supported
   types, YAML field binding, inlining, secret tags, recursion, and semantic paths;
 - descriptor-driven canonical projection, detached typed cloning, cycle/limit
-  enforcement, and structural comparison in `projection.go`; and
+  enforcement, and structural comparison in `projection.go`;
 - strict schema-driven decoding over detached defaults in `decode.go`, including
   mapping/sequence semantics, null and numeric policy, safe codec errors, presence,
-  baseline/final trees, and initial default/input origins; and
+  baseline/final trees, and initial default/input origins;
 - public lifecycle coordination in `load.go`, bounded canonical import DFS in
   `imports.go`, pattern-directed glob expansion in `glob.go`, version-report contexts
   in `validation.go`, and detached layered metadata/history assembly in
-  `load_metadata.go`; and
+  `load_metadata.go`;
 - recorded application defaulting and normalization in `resolution.go`, including
   explicitness queries, helper verification, structural mutation audit, coalesced
-  intent, private before/after snapshots, and resolution metadata integration; and
+  intent, private before/after snapshots, and resolution metadata integration;
 - post-resolution schema-aware report collection and validator mutation detection in
   `validation.go`, completing the public callback lifecycle after composed input;
 - opaque typed environment references and per-load name resolution in
@@ -38,13 +38,15 @@ module and package documentation boundary. Its implemented public primitives are
   validator-state auditing;
 - explicit bounded startup environment bootstrap and safe partial reporting in
   `secrets.go`;
-- fixed-point tag/predicate/dependency sensitivity classification in `secret.go`; and
+- fixed-point tag/predicate/dependency sensitivity classification in `secret.go`;
 - frozen-snapshot redaction and canonical effective output in `render.go`;
 - bounded immutable input applications, safe historical replay, detached explanation
   records, and deterministic human rendering in `explain.go`, with the
-  only upstream dumper integration isolated in `internal/yaml/write.go`; and
+  only upstream dumper integration isolated in `internal/yaml/write.go`;
 - a separate maintained `examples/consumers` package with four sanitized consumer
-  shapes, fixtures, domain validators, and runtime-boundary functions.
+  shapes, fixtures, domain validators, and runtime-boundary functions; and
+- a fail-fast source-candidate checker in `scripts/release-check.sh`, with local
+  documentation-link and public import-boundary gates owned by root-package tests.
 
 The [configuration contract](../config.md) owns implemented input, schema, decoding,
 loading lifecycle, path imports, composition, profile/CLI overlay, version checking,
@@ -54,15 +56,13 @@ explanation, and ownership behavior.
 The [consumer adoption guide](../consumers/README.md) owns current application-fit
 and migration guidance.
 
-The source-extraction inventory records the application foundations assigned to
-future implementation work:
+The source-extraction inventory records the application foundations used by the
+implementation:
 
 - [Extraction inventory](extraction.md)
 
-This document will inventory additional components and link to their current
-contracts and focused internal documentation as they are introduced.
-
 The [architecture policy](../policy/architecture.md) owns binding boundaries and
-invariants. The [initial target design](../roadmap/initial.md) describes planned
-behavior; it is not an inventory of implemented features. See the
-[development guide](../development.md) for contributor orientation and validation.
+invariants. The [initial target record](../roadmap/initial.md) links current feature
+owners and preserves deferred scope; it is not an implementation inventory. See the
+[development guide](../development.md) for contributor orientation and validation
+and the [release procedure](../release.md) for source-candidate gates.