Record successful remote vanity verification

docs/roadmap/migration.md

@@ -1,7 +1,7 @@
 # Vanity Module Path Migration
 
-Status: repository implementation complete and locally verified. Exact-revision
-remote consumer verification awaits availability of the migrated commit.
+Status: repository implementation and exact-revision remote consumer verification
+complete.
 Planning baseline: `21c9bc0ad0315c4ac96268b487a52376558a18d7`.
 
 This roadmap defines the target and work needed to adopt
@@ -237,9 +237,32 @@ inspection reported the new main-module identity and no old ConfigKit imports
 in the assembled test dependency graph. The module-selected ReleaseKit built
 outside the checkout and reported v0.4.2. Module tidiness produced no diff.
 
-No push or release was performed. A fresh remote consumer has not yet installed
-the migrated revision, because that revision has not been published to the remote.
-The earlier infrastructure checks remain preliminary evidence only. Once the
-commit is available through an authorized push, the one-time exact-revision
-consumer check described above can verify retrieval and public-API compilation
-without a local replacement; it remains separate from release completion.
+### Remote Consumer Verification
+
+With subsequent user authorization, migration commit
+`587f407a32dec1e00d2aa17d2790c293d994721d` was pushed to authoritative `main`
+through the retained Forge SSH endpoint. No release tag was created or published.
+
+Two disposable consumer modules outside the repository retrieved that exact
+revision through `go.maximumdirect.net/configkit`, using separate fresh module
+caches and Go 1.26.10:
+
+- Direct retrieval with `GOPROXY=direct` passed.
+- Retrieval with `GOPROXY=https://proxy.golang.org,direct` passed. This verifies
+  the standard proxy/fallback configuration, not a proxy-only availability claim.
+
+Checksum verification was enabled, `GOWORK=off` disabled workspace overrides, and
+neither consumer had a `replace` directive. Go selected
+`v0.10.3-0.20261101141937-587f407a32de`; the downloaded origin metadata identified
+the exact migration commit in the Forge HTTPS repository. Both consumers received
+the same module and module-file checksums.
+
+After retrieval, each consumer passed `GOPROXY=off go test -mod=readonly -v ./...`.
+The smoke test compiled and exercised the public API: explicit false/zero input
+over typed defaults, effective provenance with `LayerMain`, source lookup by an
+origin's source ID, and effective YAML rendering. Module inspection confirmed
+that ConfigKit came from the corresponding fresh download cache, not the checkout.
+
+This completes the one-time remote migration verification. The Go-generated
+pseudo-version identifies an untagged commit; it is not an additional release.
+No CI waiting or release gate was introduced.