Resolve candidate file destinations

docs/internal/overview.md

@@ -64,7 +64,9 @@ in `internal/candidate`. Its validation bridge calls `internal/validation` for
 the default offline Go suite, then runs product-specific checks once. The
 candidate package owns post-validation builds and local-state rechecks;
 publication owns endpoint guards, tag creation, push, and recovery around that
-same candidate validation path.
+same candidate validation path. `internal/validation.CandidateTree` reads
+committed blobs lazily and resolves local destinations from committed entries;
+it does not consult neighboring files or traverse submodule checkouts.
 
 ## Capability owners and behavioral evidence
 

docs/roadmap/implementation.md

@@ -1,6 +1,6 @@
 # Validation model implementation plan
 
-Status: In progress; the shared executor, internal diagnostics, and committed-file reader are complete.
+Status: In progress; the shared executor, diagnostics, committed-file reader, and destination resolver are complete.
 
 This plan implements the enabling work in [model.md](model.md), guided by
 [ADR 0003](../adr/0003-declarative-validation.md). It is written for a Luna
@@ -254,6 +254,11 @@ checkout. Confirm inspection leaves repository contents unchanged.
 
 ## Stage 4: Add candidate destination-resolution primitives
 
+**Completion:** Complete. The candidate tree resolves committed relative paths
+and symlinks, preserving directory identities and classifying missing,
+outside-checkout, submodule, and cycle observations without reading the live
+filesystem.
+
 **Outcome:** Future Markdown validation can resolve committed local destinations
 and classify checkout boundaries without filesystem traversal.