diff --git a/docs/roadmap/implementation.md b/docs/roadmap/implementation.md
index fddb7b7..ee82b93 100644
--- a/docs/roadmap/implementation.md
+++ b/docs/roadmap/implementation.md
@@ -218,7 +218,17 @@ or unrelated source changes. No new legal-approval or network release gate.
 
 ## Stage 4: Simplify candidate validation and its behavioral tests
 
-Status: Pending.
+Status: Complete (2026-09-28).
+
+Verification: The checker retains version/title, module hygiene, formatting,
+whitespace, one race-enabled full suite, vet, and the asset builder while
+removing duplicate test/build invocations. Go module metadata distinguishes
+filesystem from versioned replacements; workspace and vendor presence are
+inert under GOWORK=off and readonly module selection. Focused release-check
+tests cover selected command counts, failure propagation, note handling,
+replacement behavior, builder targets/version, and destination protections.
+`go test ./internal/releasecheck`, shell syntax checks, `go test
+./internal/doccheck`, and `git diff --check` passed. No publication ran.
 
 Read scripts/check-release-candidate.sh, scripts/build-release-assets.sh,
 scripts/release-lib.sh, and internal/releasecheck/assets_test.go. Read testing,
diff --git a/internal/releasecheck/assets_test.go b/internal/releasecheck/assets_test.go
index c5e6534..716d3d7 100644
--- a/internal/releasecheck/assets_test.go
+++ b/internal/releasecheck/assets_test.go
@@ -108,6 +108,8 @@ func TestAssetBuilderBuildsNamedAssetsAndChecksEmbeddedVersion(t *testing.T) {
 	command.Env = append(os.Environ(),
 		"PATH="+binDir+string(os.PathListSeparator)+os.Getenv("PATH"),
 		"GOWORK=/caller/controlled/go.work",
+		"GOFLAGS=-tags=releasecheck",
+		"NARRATIO_RELEASE_EXPECT_GOFLAGS=-tags=releasecheck",
 		"NARRATIO_RELEASE_ASSET_GO_LOG="+goLog,
 	)
 	output, err := command.CombinedOutput()
@@ -144,10 +146,20 @@ func TestAssetBuilderBuildsNamedAssetsAndChecksEmbeddedVersion(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
+	builds := 0
 	for _, line := range strings.Split(strings.TrimSpace(string(goCommands)), "\n") {
 		if !strings.HasPrefix(line, "off ") {
 			t.Fatalf("asset builder Go command did not receive GOWORK=off: %q", line)
 		}
+		if strings.Contains(line, " build ") {
+			builds++
+			if !strings.Contains(line, " build -mod=readonly ") {
+				t.Fatalf("asset builder did not select readonly modules: %q", line)
+			}
+		}
+	}
+	if builds != 3 {
+		t.Fatalf("asset builder ran %d builds, want three: %q", builds, goCommands)
 	}
 }
 
@@ -156,10 +168,16 @@ func TestCandidateCheckerRejectsMalformedVersionAndReleaseNotes(t *testing.T) {
 	if output, err := fixture.run("v1.2"); err == nil || !strings.Contains(output, "invalid stable version") {
 		t.Fatalf("malformed version error = %v\n%s", err, output)
 	}
+	if err := os.Remove(fixture.notePath); err != nil {
+		t.Fatal(err)
+	}
+	if output, err := fixture.run("v1.2.3"); err == nil || !strings.Contains(output, "release note must be nonempty") {
+		t.Fatalf("missing note error = %v\n%s", err, output)
+	}
 
 	for _, note := range []string{
-		"# Narratio v1.2.3\n\n## Summary\n\n## Compatibility\n\n## Upgrade\n",
-		"# Narratio v1.2.4\n\n## Summary\n\n## Compatibility\n\n## Upgrade\n\n## Changes\n",
+		"",
+		"# Narratio v1.2.4\n\nA release.\n",
 	} {
 		fixture := newCandidateFixture(t)
 		if err := os.WriteFile(fixture.notePath, []byte(note), 0o644); err != nil {
@@ -186,33 +204,10 @@ func TestCandidateCheckerRejectsRepositoryHygieneViolations(t *testing.T) {
 			},
 		},
 		{
-			name: "tracked workspace", want: "tracked workspace file is not allowed",
+			name: "filesystem replacement", want: "filesystem module replacements are not allowed",
 			prepare: func(t *testing.T, fixture *candidateFixture) {
-				path := filepath.Join(fixture.root, "go.work")
-				if err := os.WriteFile(path, []byte("go 1.26.0\n"), 0o644); err != nil {
-					t.Fatal(err)
-				}
-				fixture.git("add", "go.work")
-			},
-		},
-		{
-			name: "vendor directory", want: "vendor directory is not allowed",
-			prepare: func(t *testing.T, fixture *candidateFixture) {
-				if err := os.Mkdir(filepath.Join(fixture.root, "vendor"), 0o755); err != nil {
-					t.Fatal(err)
-				}
-			},
-		},
-		{
-			name: "replace directive", want: "replace directives are not allowed",
-			prepare: func(t *testing.T, fixture *candidateFixture) {
-				data, err := os.ReadFile(filepath.Join(fixture.root, "go.mod"))
-				if err != nil {
-					t.Fatal(err)
-				}
-				if err := os.WriteFile(filepath.Join(fixture.root, "go.mod"), append(data, []byte("replace example.invalid/module => ./module\n")...), 0o644); err != nil {
-					t.Fatal(err)
-				}
+				appendFixtureModuleReplacement(t, fixture, "replace example.invalid/module => ./module\n")
+				fixture.extraEnv = append(fixture.extraEnv, "NARRATIO_RELEASE_LOCAL_REPLACEMENT=example.invalid/module")
 			},
 		},
 	} {
@@ -228,14 +223,15 @@ func TestCandidateCheckerRejectsRepositoryHygieneViolations(t *testing.T) {
 
 func TestCandidateCheckerPropagatesOwnedValidationFailure(t *testing.T) {
 	fixture := newCandidateFixture(t)
-	fixture.extraEnv = append(fixture.extraEnv, "NARRATIO_RELEASE_FAIL_GO=test -race -count=1 ./...")
-	if output, err := fixture.run("v1.2.3"); err == nil || !strings.Contains(output, "failed: go test -race -count=1 ./...") {
+	fixture.extraEnv = append(fixture.extraEnv, "NARRATIO_RELEASE_FAIL_GO=test -mod=readonly -race -count=1 ./...")
+	if output, err := fixture.run("v1.2.3"); err == nil || !strings.Contains(output, "failed: go test -mod=readonly -race -count=1 ./...") {
 		t.Fatalf("validation failure = %v\n%s", err, output)
 	}
 }
 
-func TestCandidateCheckerUsesGoWorkOffForOwnedCommands(t *testing.T) {
+func TestCandidateCheckerSelectsOwnedValidationOnce(t *testing.T) {
 	fixture := newCandidateFixture(t)
+	fixture.extraEnv = append(fixture.extraEnv, "GOFLAGS=-tags=releasecheck", "NARRATIO_RELEASE_EXPECT_GOFLAGS=-tags=releasecheck")
 	if output, err := fixture.run("v1.2.3"); err != nil {
 		t.Fatalf("candidate checker error = %v\n%s", err, output)
 	}
@@ -244,7 +240,7 @@ func TestCandidateCheckerUsesGoWorkOffForOwnedCommands(t *testing.T) {
 		t.Fatal(err)
 	}
 	lines := strings.FieldsFunc(strings.TrimSpace(string(data)), func(r rune) bool { return r == '\n' })
-	if len(lines) < 9 {
+	if len(lines) != 6 {
 		t.Fatalf("owned command log = %q", data)
 	}
 	for _, line := range lines {
@@ -252,23 +248,55 @@ func TestCandidateCheckerUsesGoWorkOffForOwnedCommands(t *testing.T) {
 			t.Fatalf("owned command did not receive GOWORK=off: %q", line)
 		}
 	}
-	for _, want := range []string{
+	want := []string{
+		"off list -m -mod=readonly -f {{if .Replace}}{{if not .Replace.Version}}{{.Path}}{{end}}{{end}} all",
 		"off mod tidy -diff",
-		"off test -count=1 ./...",
-		"off test -race -count=1 ./...",
-		"off vet ./...",
-		"off build ./...",
-		"off test -count=1 ./internal/doccheck",
-		"off test -count=1 ./internal/config -run ^TestExamplesLoadAndValidate$",
 		"off gofmt -l",
+		"off test -mod=readonly -race -count=1 ./...",
+		"off vet -mod=readonly ./...",
 		"off build-release-assets v1.2.3",
-	} {
-		if !containsLogLine(lines, want) {
-			t.Fatalf("owned command log = %q, missing %q", data, want)
+	}
+	for index, prefix := range want {
+		if !strings.HasPrefix(lines[index], prefix) {
+			t.Fatalf("owned command %d = %q, want prefix %q", index, lines[index], prefix)
 		}
 	}
 }
 
+func TestCandidateCheckerAllowsInertModuleInputs(t *testing.T) {
+	fixture := newCandidateFixture(t)
+	if err := os.Mkdir(filepath.Join(fixture.root, "vendor"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	writeFixtureFile(t, filepath.Join(fixture.root, "go.work"), "go 1.26.0\n", 0o644)
+	writeFixtureFile(t, filepath.Join(fixture.root, "go.work.sum"), "checksum\n", 0o644)
+	writeFixtureFile(t, filepath.Join(fixture.root, "vendor", "modules.txt"), "# module metadata\n", 0o644)
+	fixture.git("add", ".")
+	if output, err := fixture.run("v1.2.3"); err != nil {
+		t.Fatalf("candidate checker rejected inert workspace/vendor files: %v\n%s", err, output)
+	}
+}
+
+func TestCandidateCheckerAllowsVersionedReplacement(t *testing.T) {
+	fixture := newCandidateFixture(t)
+	appendFixtureModuleReplacement(t, fixture, "replace example.invalid/module v1.0.0 => example.invalid/fork v1.0.1\n")
+	if output, err := fixture.run("v1.2.3"); err != nil {
+		t.Fatalf("candidate checker rejected versioned replacement metadata: %v\n%s", err, output)
+	}
+}
+
+func appendFixtureModuleReplacement(t *testing.T, fixture *candidateFixture, replacement string) {
+	t.Helper()
+	path := filepath.Join(fixture.root, "go.mod")
+	data, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(path, append(data, []byte(replacement)...), 0o644); err != nil {
+		t.Fatal(err)
+	}
+}
+
 func releaseCheckRepoRoot(t *testing.T) string {
 	t.Helper()
 	_, file, _, ok := runtime.Caller(0)
@@ -286,6 +314,9 @@ set -eu
 if [ -n "${NARRATIO_RELEASE_ASSET_GO_LOG:-}" ]; then
   printf '%s %s\n' "${GOWORK:-}" "$*" >> "$NARRATIO_RELEASE_ASSET_GO_LOG"
 fi
+if [ -n "${NARRATIO_RELEASE_EXPECT_GOFLAGS:-}" ] && [ "${GOFLAGS:-}" != "$NARRATIO_RELEASE_EXPECT_GOFLAGS" ]; then
+  exit 1
+fi
 
 if [ "$1" = env ]; then
   case $2 in
@@ -364,7 +395,7 @@ printf '%s build-release-assets %s\n' "${GOWORK:-}" "$1" >> "$NARRATIO_RELEASE_C
 	writeFixtureFile(t, filepath.Join(root, "go.mod"), "module gitea.maximumdirect.net/eric/narratio\n\ngo 1.26.0\n", 0o644)
 	writeFixtureFile(t, filepath.Join(root, "main.go"), "package narratio\n", 0o644)
 	notePath := filepath.Join(root, "docs", "releases", "v1.2.3.md")
-	writeFixtureFile(t, notePath, "# Narratio v1.2.3\n\n## Summary\n\n## Compatibility\n\n## Upgrade\n\n## Changes\n", 0o644)
+	writeFixtureFile(t, notePath, "# Narratio v1.2.3\n\nA concise release note.\n", 0o644)
 
 	fixture := &candidateFixture{root: root, notePath: notePath, binDir: t.TempDir(), logPath: filepath.Join(t.TempDir(), "commands.log")}
 	writeFixtureFile(t, filepath.Join(fixture.binDir, "go"), fixtureGoShim, 0o755)
@@ -414,18 +445,18 @@ func writeFixtureFile(t *testing.T, path, contents string, mode os.FileMode) {
 	}
 }
 
-func containsLogLine(lines []string, want string) bool {
-	for _, line := range lines {
-		if strings.HasPrefix(line, want) {
-			return true
-		}
-	}
-	return false
-}
-
 const fixtureGoShim = `#!/bin/sh
 set -eu
 printf '%s %s\n' "${GOWORK:-}" "$*" >> "$NARRATIO_RELEASE_CHECK_LOG"
+if [ -n "${NARRATIO_RELEASE_EXPECT_GOFLAGS:-}" ] && [ "${GOFLAGS:-}" != "$NARRATIO_RELEASE_EXPECT_GOFLAGS" ]; then
+  exit 1
+fi
+if [ "$1" = list ]; then
+  if [ -n "${NARRATIO_RELEASE_LOCAL_REPLACEMENT:-}" ]; then
+    printf '%s\n' "$NARRATIO_RELEASE_LOCAL_REPLACEMENT"
+  fi
+  exit 0
+fi
 if [ "${NARRATIO_RELEASE_FAIL_GO:-}" = "$*" ]; then
   exit 1
 fi
diff --git a/scripts/build-release-assets.sh b/scripts/build-release-assets.sh
index 0d29a17..1991165 100755
--- a/scripts/build-release-assets.sh
+++ b/scripts/build-release-assets.sh
@@ -73,7 +73,7 @@ for target in linux/amd64 linux/arm64 darwin/arm64; do
 	target_os=${target%%/*}
 	target_arch=${target#*/}
 	asset_path="$output_dir/narratio-$release_version-$target_os-$target_arch"
-	CGO_ENABLED=0 GOOS="$target_os" GOARCH="$target_arch" go build -trimpath -ldflags "$build_flags" -o "$asset_path" ./cmd/narratio
+	CGO_ENABLED=0 GOOS="$target_os" GOARCH="$target_arch" go build -mod=readonly -trimpath -ldflags "$build_flags" -o "$asset_path" ./cmd/narratio
 	if [ "$target_os" = "$host_os" ] && [ "$target_arch" = "$host_arch" ]; then
 		host_asset=$asset_path
 	fi
@@ -81,7 +81,7 @@ done
 
 if [ -z "$host_asset" ]; then
 	temporary_smoke_binary="$output_dir/.narratio-release-version-smoke"
-	CGO_ENABLED=0 go build -trimpath -ldflags "$build_flags" -o "$temporary_smoke_binary" ./cmd/narratio
+	CGO_ENABLED=0 go build -mod=readonly -trimpath -ldflags "$build_flags" -o "$temporary_smoke_binary" ./cmd/narratio
 	host_asset=$temporary_smoke_binary
 fi
 
diff --git a/scripts/check-release-candidate.sh b/scripts/check-release-candidate.sh
index 42eae90..d6dc4ba 100755
--- a/scripts/check-release-candidate.sh
+++ b/scripts/check-release-candidate.sh
@@ -29,25 +29,14 @@ note_heading=$(sed -n '1p' "$release_note")
 if [ "$note_heading" != "# Narratio $release_version" ]; then
 	narratio_release_fail "$tool_name" "release note must begin with # Narratio $release_version"
 fi
-for required_heading in '## Summary' '## Compatibility' '## Upgrade' '## Changes'; do
-	if ! grep -Fqx "$required_heading" "$release_note"; then
-		narratio_release_fail "$tool_name" "release note is missing required heading: $required_heading"
-	fi
-done
-
 if ! grep -Eq '^module[[:space:]]+gitea\.maximumdirect\.net/eric/narratio[[:space:]]*$' go.mod; then
 	narratio_release_fail "$tool_name" 'go.mod must declare module gitea.maximumdirect.net/eric/narratio'
 fi
-for workspace_file in go.work go.work.sum; do
-	if git ls-files --error-unmatch "$workspace_file" >/dev/null 2>&1; then
-		narratio_release_fail "$tool_name" "tracked workspace file is not allowed: $workspace_file"
-	fi
-done
-if [ -d vendor ]; then
-	narratio_release_fail "$tool_name" 'vendor directory is not allowed'
+if ! local_replacements=$(GOWORK=off go list -m -mod=readonly -f '{{if .Replace}}{{if not .Replace.Version}}{{.Path}}{{end}}{{end}}' all); then
+	narratio_release_fail "$tool_name" 'failed: go list -m replacement metadata'
 fi
-if grep -Eq '^[[:space:]]*replace[[:space:]]' go.mod; then
-	narratio_release_fail "$tool_name" 'go.mod replace directives are not allowed'
+if [ -n "$local_replacements" ]; then
+	narratio_release_fail "$tool_name" "filesystem module replacements are not allowed: $local_replacements"
 fi
 
 narratio_release_go() {
@@ -68,12 +57,8 @@ if ! git diff --cached --check; then
 	narratio_release_fail "$tool_name" 'cached whitespace check failed'
 fi
 
-narratio_release_go test -count=1 ./...
-narratio_release_go test -race -count=1 ./...
-narratio_release_go vet ./...
-narratio_release_go build ./...
-narratio_release_go test -count=1 ./internal/doccheck
-narratio_release_go test -count=1 ./internal/config -run '^TestExamplesLoadAndValidate$'
+narratio_release_go test -mod=readonly -race -count=1 ./...
+narratio_release_go vet -mod=readonly ./...
 
 temporary_assets_dir=$(mktemp -d "${TMPDIR:-/tmp}/narratio-release-candidate.XXXXXX") || narratio_release_fail "$tool_name" 'cannot create temporary asset directory'
 case $temporary_assets_dir in