Share bounded regular file read mechanics

docs/internal/overview.md

@@ -6,7 +6,8 @@ module and package documentation boundary. Its implemented public primitives are
 - immutable semantic `Path` construction and strict JSON Pointer parsing;
 - detached provenance and diagnostic record types with empty `Metadata` queries;
 - canonical, control-safe diagnostic rendering and structured `LoadError` access;
-- opaque file, byte, reader, and no-input source construction and bounded reads;
+- opaque file, byte, reader, and no-input source construction in `source.go`,
+  with shared regular-file checks and bounded read mechanics in `source_file.go`;
 - a parser-independent ordered tree in `internal/document`;
 - the sole upstream YAML integration in `internal/yaml`, which translates validated
   input into that owned tree and exposes no parser types outside its boundary;

docs/roadmap/remediation.md

@@ -120,7 +120,14 @@ small cross-entry regression only if a source path lacks equivalent coverage.
 
 ## Stage 3 — Share bounded regular-file read mechanics
 
-Status: pending.
+Status: complete.
+
+Completion: `source_file.go` owns regular-file preflight/open/recheck/close and
+bounded reads, with private failure kinds and stat/open-only optional-missing
+classification. Callers retain containment, metadata, budgets, accounting, and
+limit diagnostics. Existing filesystem, FIFO, budget, and reader tests pass;
+a private regression covers nondeterministic filesystem failure phases. Full
+offline baseline and race suites passed with Go 1.26.7 on Linux/amd64.
 
 Evidence: `readSource`, `importTraversal.readImport`, and `readProfileFile` repeat
 preflight stat, open, post-open stat, regular-file checks, size checks, and bounded