Complete audit remediation and verification

docs/roadmap/correctness.md

@@ -3,7 +3,8 @@
 ## Status and scope
 
 Audit completed against source commit `31f5327` on 2026-11-01. The three findings
-below remain open. This audit changes documentation only.
+below are resolved as recorded in their completion markers. The audit itself
+changed documentation only.
 
 The review covered candidate capture and rechecks, module/tag derivation,
 committed-file validation and reference traversal, builds and runtime version
@@ -13,8 +14,8 @@ examined ordinary paths, empty selections, error and cancellation paths, and
 boundary interactions against the current code, GoDoc, consumer guides,
 accepted decisions, and existing tests.
 
-The earlier [interface audit](interfaces.md) remains applicable. In particular,
-its build-source cancellation defect remains open; this document records
+The earlier [interface audit](interfaces.md) also recorded a build-source
+cancellation defect; this document records
 additional functional findings rather than duplicating that issue or its
 contract-clarity findings. No production code or repository tests were changed.
 
@@ -40,13 +41,16 @@ behavioral corrections within those boundaries.
 
 ### 1. Candidate checking can approve a tag that Git cannot create
 
-**Priority:** medium. **Status:** open.
+**Priority:** medium. **Status:** complete.
+
+**Completion evidence:** `b91a0d1`: public invalid-derived-tag regressions and
+Git/candidate package tests pass.
 
 **Relevant code:** `Derive` in
 [internal/releaseidentity/identity.go](../../internal/releaseidentity/identity.go),
 and `Capture`, `Recheck`, and `hasLocalTag` in
 [internal/candidate/check.go](../../internal/candidate/check.go). Compare the
-existing `checkTagRef` boundary in
+existing Git ref-validation boundary in
 [internal/git/remote.go](../../internal/git/remote.go).
 
 **Circumstances:** a selected nested module has a physical directory name that
@@ -85,7 +89,10 @@ restrictions or changing standalone local-build behavior.
 
 ### 2. Ambient Go flags can redirect dependency preparation to another module file
 
-**Priority:** medium. **Status:** open.
+**Priority:** medium. **Status:** complete.
+
+**Completion evidence:** `05f1b47`, `abbab3c`: local-proxy inherited and
+persistent flag regressions verify selected graphs and build identity.
 
 **Relevant code:** public `PrepareBuildDependencies` in
 [preparation.go](../../preparation.go), its preparation bridge, and
@@ -140,7 +147,10 @@ caller settings.
 
 ### 3. Incomplete tag reconciliation is reported as a known publication conflict
 
-**Priority:** medium. **Status:** open.
+**Priority:** medium. **Status:** complete.
+
+**Completion evidence:** `0632aa5`: both Git query paths and public/CLI
+lost-acknowledgment recovery regressions pass.
 
 **Relevant code:** `mergeRef` in
 [internal/git/remote.go](../../internal/git/remote.go), `Endpoint.QueryTag` in
@@ -208,10 +218,8 @@ The audit also reviewed committed-file input boundaries, local-reference and
 symlink traversal, validation ordering, build result/receipt binding, version
 injection, and additive delivery with read-only preflight and write recovery.
 No additional functional finding was substantiated in those paths beyond the
-issues already recorded in [the interface audit](interfaces.md). Passing tests
-provide regression evidence for existing cases; they do not resolve the three
-newly demonstrated cases above.
+issues already recorded in [the interface audit](interfaces.md). The tests
+available at audit time did not cover the three demonstrated cases above.
 
-Prioritize accurate publication recovery and preparation of the selected module,
-then close the candidate tag-validation gap. These are corrections to existing
-behavior; they do not require new public interfaces or a broader release model.
+The agreed remediation corrected these behaviors without new public interfaces
+or a broader release model.