Prepare source release validation

docs/roadmap/release-readiness.md

@@ -2,24 +2,36 @@
 
 ## Status and ownership
 
-ConfigKit is not release-ready. This document tracks outstanding release
-prerequisites under the [temporary bootstrap exception](../policy/release.md#temporary-bootstrap-deferral).
-It is not the library implementation plan and does not assign implementation
-stages. The maintainer preparing the first release owns closure.
+ConfigKit's implementation is prepared for release-candidate validation, but no
+release candidate has been selected or publication authorized. The maintainer
+preparing the first release owns the remaining gates under the
+[temporary bootstrap exception](../policy/release.md#temporary-bootstrap-deferral).
+This evidence record remains until candidate preparation retires completed roadmap
+material in favor of the operational [release procedure](../release.md) and normal
+release notes.
 
-## Outstanding prerequisites
+## Preparation evidence
 
-| Gap | Evidence required to close |
+| Preparation item | Status and evidence |
 | --- | --- |
-| No Go module or declared support matrix | Established module path, supported Go versions and platform targets documented in the release procedure |
-| No release runbook | `docs/release.md` exists with the prerequisites, commands, publication guards, and verification required by release policy |
-| No complete release checker | A documented command exists and exercises every applicable automated candidate gate; manual gates and inapplicable checks are explicit |
-| No consumer verification procedure | Runbook verifies retrieval of the exact released module version and a representative consumer build without local replacement directives |
-| No verified secret/precedence/explanation contracts | Current contracts and passing bootstrap skip/partial-failure, secret isolation, CLI precedence, and safe historical-value regressions; representative consumer examples |
-| No validated release candidate | Version-matched release note, current contracts/examples, and complete checks against the exact committed candidate |
+| Module and support matrix | Closed: the runbook records module `gitea.maximumdirect.net/eric/ConfigKit`, minimum Go 1.25 with a patched 1.25 plus newer supported toolchain, and Linux/macOS on amd64/arm64. |
+| Maintainer release procedure | Closed: `docs/release.md` owns access prerequisites, candidate recording, complete validation, exact remote/commit/tag guards, source-only publication, consumer retrieval, and correction. |
+| Automated source checker | Closed for current-source preparation: `scripts/release-check.sh` passed on 2026-09-06 with Go 1.25.5 and Go 1.26.7 on linux/amd64. It performs disposable-copy module hygiene, cached/offline tests, race, vet, native and four-target cross-builds, formatting/whitespace, examples, import isolation, and local-link gates. The exact candidate must rerun it. |
+| Consumer verification procedure | Closed as procedure: the runbook retrieves an exact published version into a clean temporary module with no local replacement and tests/builds it. Actual retrieval remains a post-publication gate. |
+| Secret/precedence/explanation evidence | Closed locally: current contracts and deterministic tests cover bootstrap skip/partial failure, credential isolation, defaults/base/profile/CLI precedence, historical redaction, and maintained consumer startup examples. |
+| Parser dependency reassessment | Closed for preparation: on 2026-09-06, `go list -m -versions go.yaml.in/yaml/v4` and `go list -m -json go.yaml.in/yaml/v4@latest` both showed `v4.0.0-rc.6` as the newest available release. The explicit pin is retained; a candidate compatibility review must reassess and record it again. |
 
-No release can proceed while these prerequisites remain open. Close items only
-on evidence from actual files and checks, not proposed commands. Record closure
-evidence here while this roadmap remains active. Once all gaps are closed,
-remove the bootstrap exception and retire this document in favor of the
-operational runbook and normal release records.
+## Outstanding release gates
+
+| Gate | Owner and closure evidence |
+| --- | --- |
+| Exact candidate and release note | Maintainer selects an unused stable version, writes `docs/releases/<version>.md`, commits all release changes, runs the checker against that exact clean commit, pushes it to `origin/main`, and records the commit. |
+| Native platform execution | Maintainer records applicable checker, race, symlink, and permission-fixture results on native Linux and macOS. Current local evidence is Linux/amd64 only; cross-builds do not close macOS execution. |
+| Compatibility, migration, and content review | Maintainer records public API/configuration/diagnostic review, downstream migration impact, release-note approval, and inspection for credentials, private data, generated output, unintended files, and unrelated changes. |
+| Roadmap retirement | Maintainer removes obsolete completed files under `docs/roadmap/`, repairs inbound links, and reruns the checker as part of the candidate. This record and the implementation plan intentionally remain while no candidate exists. |
+| Remote publication guards | Maintainer fetches authoritative `origin/main` and tags immediately before publication and proves branch, clean worktree/index, candidate commit, remote commit, release note, approvals, and unused version all agree. |
+| Tag and retrieval verification | After authorization, maintainer pushes only the exact immutable source tag, verifies its peeled remote commit, and retrieves/tests/builds the exact version in a clean consumer module without `replace`. |
+
+No tag, push, downstream migration, release note, or release publication was
+performed during implementation. A green local checker does not close the exact
+candidate, native macOS, remote, or post-publication gates.