Apply module scope to file validation checks

docs/consumers/check.md

@@ -43,22 +43,24 @@ ignores symlink blobs and worktree changes, and reports unformatted paths as
 after tests, selected vet, and package compilation, before `AdditionalChecks`.
 
 Set `Validation.ModuleDistribution.WorkspaceFiles` to reject committed
-`go.work` and `go.work.sum` blobs, including nested and symlink entries. It
-examines the captured candidate even when `GOWORK=off`, ignores uncommitted
-files, and does not change Go test workspace selection or vendor behavior. The
-zero value disables the check; failures use `workspace-files`.
+`go.work` and `go.work.sum` files in the selected module inputs, including
+nested and symlink entries. It examines the captured candidate even when
+`GOWORK=off`, ignores uncommitted files, and does not change Go test workspace
+selection; vendored contents remain in scope. The zero value disables the check;
+failures use `workspace-files`.
 Set `Validation.ModuleDistribution.LocalReplacements` independently to parse
-committed `go.mod` declarations throughout the candidate, including nested and
-vendor modules. It reports filesystem `replace` directives with their source
-path, line, and target as `local-replacements`; versioned replacements are
+the selected module's committed `go.mod` declarations. Vendored contents remain
+in scope, while independently released nested modules are excluded. It reports
+filesystem `replace` directives with their source path, line, and target as
+`local-replacements`; versioned replacements are
 permitted. Committed module symlinks are resolved within the candidate. Parse
 and inspection errors retain their causes, and the rule applies even when
 `GOWORK=off`. Its zero value disables the check.
 Set `Validation.FileSize` to check each committed blob against a byte limit.
 Nil disables the check; an empty object enables the default of 1,000,000
 decimal bytes. `LimitBytes` is strict greater-than, accepts zero, and rejects
-negative values. `Exclusions` contains literal repository-relative files or
-directories; excluded directories include descendants. Symlink blobs are
+negative values. `Exclusions` contains literal files or directories relative to
+the selected module; excluded directories include descendants. Symlink blobs are
 measured by link-text bytes, and gitlinks are omitted. The check applies to the
 captured candidate and reports one oversized file with its measurement as
 `file-size`; it does not measure historical or aggregate size.

docs/consumers/publish.md

@@ -62,9 +62,10 @@ are ignored, and Go workspace selection and vendor behavior are unchanged. Its
 zero value disables the check. Findings use `workspace-files` and stop
 publication before product checks or tag creation.
 Set `Validation.ModuleDistribution.LocalReplacements` independently to parse
-committed `go.mod` declarations across the candidate, including nested and
-vendor modules. Filesystem `replace` directives are reported with their source
-path, line, and target as `local-replacements`; versioned replacements are
+selected module's committed `go.mod` declarations. Vendored contents remain in
+scope, while independently released nested modules are excluded. Filesystem
+`replace` directives are reported with their source path, line, and target as
+`local-replacements`; versioned replacements are
 permitted. Committed module symlinks are resolved within the candidate, and
 parse or inspection errors retain their causes. This check is independent of
 `GOWORK`; its zero value disables it, and a failure stops publication before
@@ -72,9 +73,9 @@ product checks or tag creation.
 Set `Validation.FileSize` to check each committed blob against a byte limit.
 Nil disables the check; an empty object enables the default of 1,000,000
 decimal bytes. `LimitBytes` uses strict greater-than, accepts zero, and rejects
-negative values. `Exclusions` contains literal repository-relative files or
-directories, including committed descendants of excluded directories. Symlink
-blob size is its link text; gitlinks are omitted. This check measures only the
+negative values. `Exclusions` contains literal files or directories relative to
+the selected module, including committed descendants of excluded directories.
+Symlink blob size is its link text; gitlinks are omitted. This check measures only the
 captured candidate and reports one oversized file with its measurement as
 `file-size`; it stops publication before product checks or tag creation.