Preserve message resource origins and profile credential lookup names

docs/roadmap/remediation.md

@@ -13,7 +13,8 @@ resources/templates, and builds execution-owned indexes. Catalog preflight and
 legacy profile resolution are removed. Operator inspection delegates to the
 retained ConfigKit result separately from ordinary execution.
 
-Two findings require remediation. This review changes no implementation code.
+Both findings have been addressed. The original review evidence is retained
+below; the resolution section records the changes and regression coverage.
 
 ## 1. P2 — Message Normalization Loses Content-File Resource Origins
 
@@ -106,3 +107,20 @@ Required outcome:
 The passing suite does not cover the two failing cases above. No provider
 requests were made. Beyond these findings, the reviewed implementation did not
 show another actionable ownership-boundary violation or strengthened guarantee.
+
+## Resolution
+
+1. Message role/cache-control normalization now occurs on execution-owned copies
+   during materialization. ConfigKit's captured message sequence and its origins
+   remain intact. The imported/inherited content regression now includes role
+   and cache-control normalization and asserts the unchanged field's source in
+   inspection metadata. This also removes duplicate cache-control normalization.
+2. Removed the profile environment-name regular expression check, leaving backend
+   validation unchanged. A public engine/HTTP-transport regression covers a
+   non-shell environment name, unset/empty/whitespace values, explicit clearing,
+   trimming, and direct-key precedence. The implementation plan now states this
+   distinction explicitly.
+
+Both regressions failed against the reviewed implementation before the fixes.
+After remediation, the full ordinary and race-enabled suites, affected packages
+on Go 1.25.5, `go vet ./...`, and documentation/whitespace checks passed.