Rename the candidate file validator to forbidden files

docs/config.md

@@ -141,9 +141,9 @@ symlink size is the committed link text. Gitlinks have no measured size. Only
 the captured candidate is checked, one offending file is reported at a time,
 and historical or aggregate repository size is not measured.
 
-`validation.untracked_files` is an optional list of literal repository-relative
+`validation.forbidden_files` is an optional list of literal repository-relative
 file paths that must be absent from the captured commit. It runs after the Go
-checks and before other file checks, using the `untracked-files` identity and
+checks and before other file checks, using the `forbidden-files` identity and
 reporting selected committed paths. Omission, `null`, or `[]` disables it.
 Paths use slash separators and ordinary relative normalization and must stay
 within the repository. They are checked against the whole captured repository,
@@ -166,7 +166,7 @@ the absence of both credential sources, returns status 2. Omission of
 Credential loading runs only for `deliver` and `ci-deliver`. `check`, `publish`,
 and `build` do not read the token file or require a token. The CLI passes the
 resolved value explicitly to the library operation. Selecting a token file and
-selecting the optional untracked-file validator are independent settings.
+selecting the optional forbidden-file validator are independent settings.
 
 `expected_push_url`, when nonempty, is compared exactly with Git's resolved
 effective push URL during `publish`, before candidate validation. It applies

docs/consumers/check.md

@@ -98,9 +98,9 @@ The `Candidate` supplies both `RepositoryDir` and `ModuleDir`, plus the declared
 module-local product checks. ReleaseKit calls `AdditionalChecks` once after
 shared validation when supplied.
 
-For local token files, set `Validation.UntrackedFiles` to the repository-relative
+For local token files, set `Validation.ForbiddenFiles` to the repository-relative
 paths that should stay out of the committed candidate, such as
-`[]string{".releasekit/gitea-token"}`. Failures use `untracked-files` and carry the
+`[]string{".releasekit/gitea-token"}`. Failures use `forbidden-files` and carry the
 selected committed paths in `ValidationError.Findings`. This selection is
 independent of module and shared-file inputs; see [GoDoc](../../check.go) for
 the API contract and the [configuration reference](../config.md) for CLI use.

docs/consumers/delivery.md

@@ -90,7 +90,7 @@ as `.releasekit/gitea-token` and configure:
 {
   "product": "Example",
   "validation": {
-    "untracked_files": [".releasekit/gitea-token"]
+    "forbidden_files": [".releasekit/gitea-token"]
   },
   "delivery": {
     "base_url": "https://gitea.example",

docs/internal/validation.md

@@ -59,9 +59,9 @@ workspace-file check using the same candidate inventory. Resolved module bodies
 are parsed once per blob object ID; only owned filesystem-replacement targets
 and line numbers remain cached. Each declaration path receives findings from
 that summary in its own path context.
-The optional untracked-file check uses the captured tree's full path lookup
+The optional forbidden-file check uses the captured tree's full path lookup
 before the other file checks. It normalizes the explicitly selected
-repository-relative names and reports matching entries through `untracked-files`
+repository-relative names and reports matching entries through `forbidden-files`
 without loading their blobs. Candidate-tree cleanup covers this failure path.
 The optional file-size check applies normalized literal file/directory
 exclusions with path-boundary matching, then requests local Git sizes for the

docs/release.md

@@ -18,7 +18,7 @@ For local hosted-page delivery, save a Gitea personal access token in
 `.releasekit/gitea-token` with owner-only file permissions. The file contains
 only the token. ReleaseKit's profile selects this file as a fallback to
 `RELEASEKIT_GITEA_TOKEN`; `.releasekit/` is already ignored. Its optional
-`validation.untracked_files` selection checks that this path is absent from the
+`validation.forbidden_files` selection checks that this path is absent from the
 committed candidate. Source publication requires no delivery token. The
 [configuration reference](config.md) owns credential selection and validator
 semantics.