Prepare release notes for ConfigKit 1.1.0

.gitignore

@@ -28,6 +28,9 @@ go.work.sum
 # Local codebase-memory tooling artifacts
 /.codebase-memory/
 
+# Local release credentials and tooling
+/.releasekit/
+
 # ---> Linux
 *~
 

COPYRIGHT

@@ -18,8 +18,3 @@ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 GNU Lesser General Public License for more details.
 
 Third-party code and assets are subject to their respective license terms.
-
-Policy documents adapted from Standard Repository Policies, the root AGENTS.md
-orientation, and the Policy Reading Guide in docs/development.md remain licensed
-under CC-BY-SA-4.0. See docs/oss/attribution.md for the affected material,
-upstream credit, and license links.

README.md

@@ -1,56 +1,18 @@
 # ConfigKit
 
-An opinionated Go library for applications that use YAML configuration files.
+ConfigKit loads YAML into your application's Go configuration type, combines the
+inputs you choose, and lets you inspect where the final values came from. You
+supply the types, defaults, and application rules; ConfigKit handles loading,
+combination, strict decoding, and inspection.
 
 Linux is release-validated; macOS support is best-effort. See the
-[platform support policy](docs/policy/release.md#platform-support) for details.
+[platform support policy](docs/policy/release.md#platform-support).
 
-ConfigKit's simple `Load` accepts one strict YAML source (or explicit
-defaults-only input). `LoadLayered` additionally combines explicit lower-priority
-source groups with an independently selected main input. Sources can be host
-files, native `fs.FS` files, labeled bytes or readers, or snapshotted mappings.
-Enabled explicit imports compose strictly within their group; precedence
-between groups combines mappings recursively. Both entry points return a complete,
-validated configuration with detached metadata and safe diagnostics.
-Applications may perform audited defaulting and normalization through a resolver,
-then report domain errors and warnings through read-only semantic validation. Secret
-tags and a path predicate drive deterministic redacted effective YAML. Typed secret
-references resolve environment names before validation, and explicit
-secrets-directory bootstrap is available as a separate startup operation. Explicit
-CLI override records apply after inheritance and typed decoding, before application
-resolution. Value explanation is available through
-detached structured records and deterministic redacted output. Built-in
-`extends` relationships let a mapping inherit from a named sibling during the
-same load, retaining explicit presence and source/derivation history. The root
-`Diff` API compares frozen effective values from two successful same-type loads;
-the [configuration contract](docs/config.md#effective-configuration-diffs) and
-[consumer guide](docs/consumers/README.md#effective-configuration-diffs) describe
-its safe changed-region records and maintained workflows.
-
-Sources can also be explicitly placed as sequence items. Configuration
-declarations and application registrations can give selected sequences scalar
-identities and choose how they combine across precedence and inheritance.
-Strict peers combine distinct records, while higher-priority collections can
-replace, append, or upsert whole records. See the
-[sequence contract](docs/config.md#strict-document-composition),
-[maintained catalog examples](docs/consumers/README.md#identified-prompt-sequences),
-and [ADR 0017](docs/adr/0017-collection-sequence-policy.md).
-
-Imports are also explicit: a source may name files, search declared directories,
-or select files with path globs. Applications can set load-wide import defaults
-while keeping declaration-specific exceptions. Files are acquired in authored
-declaration order; dependency-ready composition uses a shared stable scheduler.
-ConfigKit does not search conventional application paths implicitly. See the
-[import contract](docs/config.md#explicit-imports), [consumer examples](docs/consumers/README.md),
-and [ADR 0015](docs/adr/0015-shared-dependency-ready-ordering.md) and
-[ADR 0016](docs/adr/0016-independent-import-controls.md).
-
-Main-file discovery is explicit too: applications choose and order `Search`
-descriptions and pass `SearchConfig` to the existing load APIs. See the
-[discovery contract](docs/config.md#configuration-discovery), [consumer guide](docs/consumers/README.md#explicit-main-file-discovery),
-and [ADR 0019](docs/adr/0019-explicit-configuration-discovery.md).
+## Load a configuration file
 
 ```go
+import "go.maximumdirect.net/configkit"
+
 type Config struct {
     Enabled bool `yaml:"enabled"`
     Workers int  `yaml:"workers"`
@@ -65,48 +27,57 @@ func ReadConfig(path string) (Config, error) {
 }
 ```
 
+Existing consumers should follow the
+[module-path migration guidance](docs/consumers/README.md#vanity-module-path-migration).
+
+## Add the features you need
+
+Start with one file. Optional features use the same loading and inspection model:
+
+- [Choose inputs](docs/consumers/README.md#choosing-a-loading-entry-point): read
+  files, an application-owned `fs.FS`, bytes, a reader, or a Go mapping. Use
+  explicit search descriptions when the application should look in several places.
+- [Supply lower-priority settings](docs/consumers/README.md#native-filesystem-and-layered-input):
+  use `LoadLayered` for bundled defaults that application configuration can override.
+- [Combine configuration](docs/config.md#explicit-imports): add declared imports,
+  select one overlay, or pass values explicitly set by your CLI parser.
+- [Reuse settings](docs/config.md#sibling-inheritance): let one named entry inherit
+  from a sibling. [Identified lists](docs/config.md#strict-document-composition)
+  also support record inheritance and replace, append, or upsert operations.
+- [Apply application rules](docs/config.md#recorded-application-resolution): derive
+  or normalize values in a resolver, then check the final configuration in a validator.
+- [Handle credentials](docs/config.md#typed-secret-references): use environment-name
+  references and choose which configuration fields to hide in inspection output.
+- [Inspect a load](docs/config.md#layered-metadata): examine sources, presence,
+  history, safe YAML output, or [changes between two loads](docs/config.md#effective-configuration-diffs).
+
+The [consumer guide](docs/consumers/README.md) walks through these tasks and links
+to maintained examples. The [configuration reference](docs/config.md) defines the
+exact YAML, combination, and lifecycle rules.
+
 ## Design philosophy
 
-ConfigKit favors one coherent, predictable configuration model over flexibility
-for reproducing each consumer's conventions. Its goal is to let applications
-load once, inspect where final values came from, and distinguish explicit values
-from omissions with minimal configuration bookkeeping. Applications retain their
-domain rules and execution responsibilities.
+ConfigKit favors consistent, predictable rules across applications. A load returns
+the final configuration and metadata that distinguish supplied values such as
+`false` and `0` from omissions. Applications keep their domain rules and runtime
+initialization.
 
-Loading is synchronous and complete on return. Applications normally load once
-near startup and then use the final configuration and metadata; ConfigKit stays
-inactive until explicitly called again. Applications may initiate additional
-loads as needed. See the [loading lifecycle](docs/config.md#completion-and-resource-lifetime)
-for completion and ownership details.
+Within one layer, independent contributions combine strictly: conflicting
+values are errors. Across layers, higher-priority settings can replace
+lower-priority settings, while mappings combine by key. Identified lists have
+their declared combination rules. See the [worked combination
+examples](docs/config.md#strict-document-composition) for the details and
+exceptions.
 
-Within a configuration tier, independent contributions compose strictly: shared
-mappings combine, while overlapping non-mapping definitions are errors. Between
-precedence tiers, mappings combine recursively, retaining omitted lower-priority
-children; other values replace lower-priority values. The main document and its
-imports form one strictly composed tier. Explicit underlay groups sit below it
-and above typed defaults; a selected overlay applies before inheritance, while
-explicit CLI overrides apply after decoding and before application resolution.
-The [configuration contract](docs/config.md#strict-document-composition) owns
-the detailed combination rules and input-specific constraints. Declared or
-registered collections combine distinct identified records within strict tiers
-and use their selected operation at precedence boundaries; other sequences keep
-their strict-conflict and whole-value-replacement behavior.
+Loading finishes before the call returns. ConfigKit then stays inactive until you
+call it again; inspection uses the saved result. See
+[completion and resource lifetime](docs/config.md#completion-and-resource-lifetime).
 
-The [architecture goals](docs/policy/architecture.md#success-criteria) explain
-these priorities and how genuine new needs can justify extending the shared
-model. The [future feature list](docs/roadmap/future.md) preserves candidates for
-consideration in future releases.
-
-The [configuration contract](docs/config.md) describes implemented behavior,
-including [input destinations](docs/config.md#input-destinations). The
-[consumer adoption guide](docs/consumers/README.md) provides maintained simple,
-layered, mounted-collection, and identified-prompt examples alongside the
-migration shapes. Input placement decisions are recorded in
-[ADR 0011](docs/adr/0011-input-destinations.md) and sequence placement and
-composition in [ADR 0014](docs/adr/0014-sequence-placement-and-composition.md).
-See the [development guide](docs/development.md) for repository orientation and
-the [release procedure](docs/release.md) for maintainer-only candidate and
-publication steps.
+The [architecture goals](docs/policy/architecture.md#success-criteria) and
+[ADRs](docs/adr) explain design decisions, including shared import and inheritance
+ordering. [Future work](docs/roadmap/future.md) lists possible extensions.
+Contributors can start with the [development guide](docs/development.md);
+release maintainers use the [release procedure](docs/release.md).
 
 ConfigKit code is licensed under the [LGPL v3.0 or later](COPYRIGHT).
 

conversion.go

@@ -1,6 +1,6 @@
 package configkit
 
-import "gitea.maximumdirect.net/eric/ConfigKit/internal/engine"
+import "go.maximumdirect.net/configkit/internal/engine"
 
 func fromEngineLocation(value engine.Location) Location {
 	return Location{SourceID: value.SourceID, Line: value.Line, Column: value.Column}
@@ -46,21 +46,21 @@ func fromEngineSourceInfo(value engine.SourceInfo) SourceInfo {
 	return SourceInfo{
 		ID: value.ID, Label: value.Label, Path: value.Path, Destination: fromEnginePath(value.Destination),
 		PlacementMode:         PlacementMode(engine.SourceInfoPlacementModeForFacade(value)),
-		DestinationUnresolved: engine.SourceInfoDestinationUnresolvedForFacade(value),
+		DestinationIsFallback: engine.SourceInfoDestinationUnresolvedForFacade(value),
 		Layer:                 Layer(value.Layer), Kind: SourceKind(value.Kind), UnderlayIndex: value.UnderlayIndex,
-		ImportedFrom: fromEngineLocationPointer(value.ImportedFrom), VersionCheck: fromEngineSourceVersionCheck(value.VersionCheck),
-		ImportSelections: fromEngineImportSelections(engine.SourceInfoImportSelectionsForFacade(value)),
+		ImportedFrom: fromEngineLocationPointer(value.ImportedFrom), VersionEvidence: fromEngineSourceVersionEvidence(value.VersionCheck),
+		EmptyImportSelections: fromEngineEmptyImportSelections(engine.SourceInfoImportSelectionsForFacade(value)),
 	}
 }
-func fromEngineImportSelections(values []engine.ImportSelectionForFacade) []ImportSelection {
+func fromEngineEmptyImportSelections(values []engine.ImportSelectionForFacade) []EmptyImportSelection {
 	if values == nil {
 		return nil
 	}
-	result := make([]ImportSelection, len(values))
+	result := make([]EmptyImportSelection, len(values))
 	for index, value := range values {
-		result[index] = ImportSelection{
+		result[index] = EmptyImportSelection{
 			Path: fromEnginePath(value.Path), Location: fromEngineLocation(value.Location),
-			Selector: ImportSelector(value.Selector), Outcome: ImportSelectionOutcome(value.Outcome),
+			Selector: ImportSelector(value.Selector),
 		}
 	}
 	return result
@@ -82,18 +82,18 @@ func toEngineOverrides(values []Override) []engine.Override {
 func toEngineImportDefaults(value ImportDefaults) engine.ImportDefaults {
 	return engine.ImportDefaults{
 		Required:  value.Required,
-		Follow:    value.Follow,
-		Hidden:    value.Hidden,
+		Follow:    value.FollowSymlinks,
+		Hidden:    value.IncludeHidden,
 		Recursive: value.Recursive,
 		Pattern:   value.Pattern,
 	}
 }
 
-func fromEngineSourceVersionCheck(value *engine.SourceVersionCheck) *SourceVersionCheck {
+func fromEngineSourceVersionEvidence(value *engine.SourceVersionCheck) *SourceVersionEvidence {
 	if value == nil {
 		return nil
 	}
-	return &SourceVersionCheck{
+	return &SourceVersionEvidence{
 		Path:     fromEnginePath(value.Path),
 		Version:  Version{Present: value.Version.Present, Null: value.Version.Null, Text: value.Version.Text},
 		Location: fromEngineLocationPointer(value.Location), Redacted: value.Redacted,

diagnostic.go

@@ -3,7 +3,7 @@ package configkit
 import (
 	"io"
 
-	"gitea.maximumdirect.net/eric/ConfigKit/internal/engine"
+	"go.maximumdirect.net/configkit/internal/engine"
 )
 
 // LoadError reports safe structured diagnostics for a failed configuration load.
@@ -50,6 +50,21 @@ func (e *LoadError) Sources() []SourceInfo {
 	return result
 }
 
+// Source returns a detached record from the sanitized source evidence retained
+// before loading failed, including placement evidence available at that point.
+// IDs are local to the failed load. It does not acquire sources or access the
+// filesystem. Empty or unknown IDs return false.
+func (e *LoadError) Source(id string) (SourceInfo, bool) {
+	if e == nil || e.value == nil {
+		return SourceInfo{}, false
+	}
+	value, ok := e.value.Source(id)
+	if !ok {
+		return SourceInfo{}, false
+	}
+	return fromEngineSourceInfo(value), true
+}
+
 // WriteDiagnostics writes diagnostics in canonical order. It escapes terminal
 // control characters and propagates writer errors, including short writes.
 func WriteDiagnostics(output io.Writer, diagnostics []Diagnostic) error {

diff.go

@@ -1,15 +1,14 @@
 package configkit
 
-import "gitea.maximumdirect.net/eric/ConfigKit/internal/engine"
+import "go.maximumdirect.net/configkit/internal/engine"
 
-// Difference describes one canonical changed region between two successful
-// loads. Left is the earlier value and Right is the later value. Each snapshot
-// is detached; Present distinguishes absence from an explicit null, and
-// Redacted reports whether combined sensitivity affected that side. Mappings
-// are compared recursively, while sequences are reported as atomic values.
-// Records are ordered by canonical JSON pointer. HiddenChanged indicates that
-// a value concealed by combined sensitivity changed, without revealing which
-// concealed member changed.
+// Difference describes one changed value or subtree between two successful loads.
+// Left is the earlier value and Right is the later value. Snapshots are copies;
+// Present distinguishes absence from explicit null. Redacted reports hiding
+// based on sensitivity from either load. Mappings compare by key; a changed
+// sequence is reported as a whole value. Records are ordered by canonical JSON
+// pointer. HiddenChanged reports an actual hidden change, without identifying
+// the hidden member. Redaction alone does not set it.
 type Difference struct {
 	Path          Path
 	Left          ValueSnapshot
@@ -17,8 +16,9 @@ type Difference struct {
 	HiddenChanged bool
 }
 
-// Diff compares the frozen effective values of two successful loads of the
-// same configuration type. It does not reread sources, environment variables,
+// Diff compares the saved final values of two successful loads of the same
+// configuration type, independently of later changes to Result.Config.
+// It does not reread sources, environment variables,
 // or rerun defaults or resolvers. Equal values produce no records even when
 // their sources, defaults, or resolution histories differ. Credential contents
 // are not compared: typed secret references compare by reference name only.

discovery.go

@@ -1,6 +1,6 @@
 package configkit
 
-import "gitea.maximumdirect.net/eric/ConfigKit/internal/engine"
+import "go.maximumdirect.net/configkit/internal/engine"
 
 // Search is an immutable ordered description of possible host-file inputs.
 // It is consumed only when passed to SearchConfig and used by a load.
@@ -52,8 +52,8 @@ func SearchDirectory(directory string, supplied ...DirectorySearchOptions) Searc
 	return Search{value: engine.SearchDirectory(directory, options...)}
 }
 
-// Paths describes literal host-file candidates in the supplied order.
-func Paths(paths ...string) Search { return Search{value: engine.Paths(paths...)} }
+// SearchPaths describes literal host-file candidates in the supplied order.
+func SearchPaths(paths ...string) Search { return Search{value: engine.Paths(paths...)} }
 
 // Searches concatenates descriptions in order and snapshots their entries.
 func Searches(searches ...Search) Search {

doc.go

@@ -1,9 +1,17 @@
-// Package configkit provides deterministic, application-owned configuration
-// loading for Go programs.
+// Package configkit loads YAML into an application's Go configuration type and
+// lets the application inspect where the final values came from.
 //
-// Load supports file, byte, reader, and explicit no-input sources with strict YAML,
-// typed defaults, imports, overlays, CLI overrides, schema-version checks, detached
-// metadata, recorded application resolution, typed secret references, safe effective
-// rendering, read-only semantic validation, and structured load errors. The
-// configuration contract is documented in docs/config.md.
+// Start with Load and a File, Bytes, Reader, Mapping, or Filesystem.File source.
+// Use NoSource for deliberately absent input or SearchConfig for an explicitly
+// chosen search. Applications supply types, defaults, version rules, and callbacks
+// for deriving and validating values. LoadLayered adds lower-priority input groups.
+//
+// A successful load returns the final configuration and saved inspection state.
+// Metadata tracks supplied values, including false and zero; explanations retain
+// safe earlier values. WriteEffective and Diff use the saved state even if the
+// application later changes Result.Config. Secret references resolve credentials
+// during loading, while inspection follows the configured hiding rules.
+//
+// The consumer guide is in docs/consumers/README.md. The exact YAML, combination,
+// lifecycle, and ownership rules are documented in docs/config.md.
 package configkit

docs/adr/0011-input-destinations.md

@@ -10,6 +10,9 @@ request, and review records are preserved at `e4270c9` under `docs/roadmap/` in
 Git history; the original input-destination implementation plan remains at
 `315f464:docs/roadmap/implementation.md`.
 
+[ADR 0020](0020-document-root-controls.md) amends the scope of the control-name
+reservation. The other placement decisions in this record remain in force.
+
 ## Date
 
 2026-10-14

docs/adr/0020-document-root-controls.md

@@ -0,0 +1,61 @@
+# ADR 0020: Scope Configuration Controls to Document Roots
+
+## Status
+
+Accepted.
+
+## Date
+
+2026-11-01
+
+## Context
+
+ConfigKit interprets configuration controls during source acquisition, before
+placing and composing source payloads. Reserving the control name throughout
+application data restricts paths unrelated to source-document controls. The
+source-local position of a control and the effective application path of a
+value are different coordinates, even when their path text is identical.
+
+## Decision
+
+Use `config` as the single control mapping name at the root of each acquired
+source document. Interpret each source's controls before placing its payload,
+using the existing context-specific grammar and import opt-in. A source retains
+its own document root regardless of its eventual destination, including when
+mounted below another value or as a sequence record.
+
+Below a source root, `config` is ordinary application data, including in
+sequence records and selected overlays. Control-looking children in such data
+do not activate controls. Application-root `config` data produced by placement,
+defaults, CLI assignment, or resolution is also ordinary data. Placement and
+later lifecycle operations do not create another source-document parsing pass.
+
+The former spellings `configkit` and `_configkit` are ordinary application keys
+at any depth, subject to normal schema and structural rules; they are not
+control aliases. Source-version checks protect actual source-local controls,
+not an application path merely because its spelling matches. Existing `extends`
+inheritance semantics and restrictions remain in force.
+
+## Alternatives Considered
+
+- **Reserve the control name throughout application data.** This conflates
+  source-document syntax with application paths and prevents ordinary fields
+  unrelated to control interpretation.
+- **Recognize controls again after placement or later operations.** This makes
+  application data acquire control semantics according to its destination and
+  introduces a second interpretation pass.
+- **Support multiple or configurable control spellings.** This makes control
+  interpretation ambiguous and expands the configuration contract.
+
+## Consequences
+
+Control evidence uses source-local coordinates while assembled values use
+application coordinates. Existing source identities and contexts distinguish
+these uses without a new inspection-record format. Consumers must migrate
+genuine old control blocks and account for source-root application fields
+named `config`; ordinary nested and assembled root fields remain available.
+
+The completed feature roadmap and implementation plan are preserved in Git
+history at `c63f4ff` under `docs/roadmap/`, for example
+`git show c63f4ff:docs/roadmap/implementation.md`.
+The [configuration contract](../config.md) owns implemented behavior.

docs/adr/0021-sequence-resolution-correspondence.md

@@ -0,0 +1,65 @@
+# ADR 0021: Match Registered Records During Resolution Inspection
+
+## Status
+
+Accepted.
+
+## Date
+
+2026-11-02
+
+## Context
+
+Application resolution can change fields within sequences. Treating every
+sequence change as atomic prevents a field record from covering an individual
+edit. Registered collection identities also provide a way to relate a final
+record to its entry value when positions change, so inspection can retain the
+correct source evidence without confusing it with a prior index occupant.
+
+## Decision
+
+Compare equal-length ordinary lists recursively by position during resolution
+auditing. A length change requires coverage of the list or an ancestor. For a
+collection with an applicable application identity registration, match entry and
+final records only when both endpoints have valid, unique identities. A change
+in identity order or membership requires list or ancestor coverage, while
+surviving records retain their matched entry evidence. When matching is not
+available, audit a changed list as a whole without introducing an early identity
+failure. Final registration validation remains at its existing boundary.
+
+Match only the resolution-entry and final snapshots, within the same registered
+destination. Identity changes are removals and additions, not inferred renames.
+Records and helpers address final positions; entry queries remain fixed to entry
+coordinates, and helpers do not follow later moves automatically. A surviving
+record takes precedence at a reused position; collection inspection retains
+removed records' evidence, and absent historical positions remain inspectable.
+New records do not inherit a previous occupant's history or explicitness.
+
+Preserve recorded operations, source coordinates, sensitivity, and safe detached
+inspection. Resolution comparison is separate from public effective diff, which
+continues to present sequence changes atomically.
+
+This extends resolution inspection under [ADR 0003](0003-preserve-presence-and-resolution-history.md)
+while preserving the diff decision in [ADR 0010](0010-effective-configuration-diff.md),
+source combination and identity rules in [ADR 0017](0017-collection-sequence-policy.md),
+and lifecycle ordering in [ADR 0018](0018-cli-after-structural-resolution.md).
+
+## Alternatives Considered
+
+- **Keep all sequence changes atomic during resolution.** This forces whole-list
+  records for independent field edits and does not identify a moved record's
+  earlier evidence.
+- **Infer identities for every list.** Similar values or conventional field
+  names do not establish an application identity and could attach unrelated
+  history to a final record.
+- **Reconstruct every intermediate callback mutation.** This requires a new
+  mutation history and implies an ordering that endpoint snapshots cannot prove.
+
+## Consequences
+
+Resolution auditing and inspection must share entry-to-final correspondence,
+including explicit unmatched records, while preserving historical coordinates
+and conservative sensitivity masking. Source assembly and public path types do
+not change. The completed implementation plan is preserved in Git history at
+`7e53863:docs/roadmap/implementation.md`; the
+[configuration contract](../config.md) owns implemented behavior.

docs/consumers/README.md

@@ -1,21 +1,45 @@
 # Consumer Adoption Guide
 
-ConfigKit removes parser setup, strict decoding, presence bookkeeping, import and
-selected-overlay traversal, precedence, provenance, secret lookup, and safe inspection from
-applications. Consumers still own their configuration structs, defaults, semantic
-validation, schema-version policy, CLI parsing, runtime matching and conversion,
-resource checks, remote acquisition, and service initialization.
+ConfigKit loads configuration into your application's Go types. You provide
+those types, defaults, and application rules. ConfigKit reads and combines the
+selected inputs, checks their types, and returns values with source information.
+Your application still owns CLI parsing, resource reads, remote acquisition, and
+runtime initialization.
+
+Import `"go.maximumdirect.net/configkit"`; the package name is `configkit`.
+
+Document controls now use root `config` in every source. Rename genuine old
+`configkit` or `_configkit` control blocks and update stored declaration paths
+from `/configkit/...` to `/config/...`. Old blocks become ordinary data and a
+permissive schema can accept them without executing imports. Move, rename, or
+separately mount application fields previously authored as source-root `config`.
+Nested and assembled root `config` values remain ordinary application data; the
+[mounted-root example](../../examples/consumers/config_controls_test.go) shows
+the boundary. See the [configuration contract](../config.md#declaration-and-selection-rules)
+for the complete rules.
+Start with one file, then choose the tasks your application needs:
+
+| Task | Start here |
+| --- | --- |
+| Load one file | [Happy path](#happy-path) and the [README example](../../README.md#load-a-configuration-file) |
+| Supply fixed defaults and check application rules | [Defaults and application rules](#defaults-and-application-rules) |
+| Add bundled defaults beneath application settings | [Native filesystem and layered input](#native-filesystem-and-layered-input) |
+| Select files or an overlay | [Discovery](#explicit-main-file-discovery), [import defaults](#import-defaults-and-selection-inspection), and the [overlay reference](../config.md#selected-overlays) |
+| Reuse settings or combine record lists | [Inheritance](#named-sibling-inheritance) and [identified sequences](#identified-prompt-sequences) |
+| Handle credentials | [Typed-secret reference](../config.md#typed-secret-references) and the [startup example](../../examples/consumers/consumers_test.go) |
+| Inspect sources, earlier values, or changes | [Inspect a completed load](#inspect-a-completed-load) and [diffs](#effective-configuration-diffs) |
+| Upgrade an existing consumer | [Migration guidance](#intentional-migration-changes) |
 
 ## Choosing a loading entry point
 
 - Use [`Load`](../../lifecycle.go) with one source for an ordinary configuration.
-  [`SearchConfig`](../../discovery.go) is also a source, so its explicit
-  discovery result can be passed to `Load` or used as the main input to
-  [`LoadLayered`](../../layered.go).
-- Use `LoadLayered` when inputs must be composed in underlay groups before the
-  main source. Each [`Input`](../../layered.go) owns its source, filesystem,
-  destination, and import choice. The overlay filesystem context is selected
-  independently in [`LayeredOptions`](../../layered.go).
+  [`SearchConfig`](../../discovery.go) is also a source; pass it to `Load` or use
+  it as the main input to [`LoadLayered`](../../layered.go).
+- Use `LoadLayered` when several inputs should supply lower-priority defaults
+  beneath the main source. Each underlay group combines its inputs strictly.
+  Each [`Input`](../../layered.go) owns its source, filesystem, destination, and
+  import choice. The overlay filesystem context is selected independently in
+  [`LayeredOptions`](../../layered.go).
 - Load-wide rules belong to [`Options`](../../lifecycle.go) or
   [`LayeredOptions`](../../layered.go): the application definition (including
   version policy), import defaults, and explicit overrides. These do not turn
@@ -30,68 +54,68 @@ file and layered cases. For import-focused adoption, see the
 discovery composed with sequences, see the
 [sequence catalog](../../examples/consumers/sequence_catalog.go).
 
-The maintained [`examples/consumers`](../../examples/consumers) package demonstrates
-sanitized shapes using only ConfigKit and the Go standard library:
-
-| Shape | Demonstrated fit | Application code deliberately retained |
-| --- | --- | --- |
-| Narratio-like | Fresh defaults, explicit partial imports, artifact maps, recorded inherited defaults, normalization, and source ownership | Artifact meaning and the separate `model_profile` domain field |
-| Notarius-like | Canonical object bindings, a string-backed schema version accepting string or integer YAML, strict dynamic options, and `int64` dynamic integers | Catalog selection, allowed option keys, range-checked conversion to runtime `int` |
-| WeatherReporter-like | Defaults-only loading, report maps, canonical module objects, typed option unions, explicit CLI records, and typed secret startup | Report/module compatibility, rejection of explicitly empty domain lists, CLI parsing, and startup ordering |
-| Seriatim-like | Independent strict ordered speaker and autocorrect rule files | First-match and ordered replacement algorithms; no central application configuration file |
-| Bundled file | Simple native `fs.FS` source through ordinary `Load` | Selection and lifetime of the application-owned embedded filesystem |
-| Layered catalog | Embedded defaults with an import, a mapping underlay, an independent host main file, explicit false/zero input, and source-relative resource access | Domain validation and opening/interpreting the template resource |
-| Mounted collections | Entry-declared relative destinations, nested metadata/prompt/profile imports, local inheritance, and a version-only higher-tier override | Collection IDs, profile meaning, and opening/interpreting prompt resources |
-| Named presets | One-load sibling inheritance, explicit false, nested destination resolution, and source/derivation inspection | Choosing and executing a preset |
-| Effective configuration diff | Same-type frozen effective comparisons for two selected files or base-versus-overlay impact | Source/options selection and consumer-owned safe presentation |
-| Shared source-version checks | One `Definition.Version` policy for accepted declarations across participating source documents, with optional or required declarations and sanitized evidence | Choosing which declarations the application accepts; final assembled schema and domain validation |
-| Sequence catalogs | Declared collection operations, record inheritance, typed CLI and resolution, inspection, exact and wildcard application registrations | Catalog meaning and final domain validation |
-
-The YAML under [`testdata`](../../examples/consumers/testdata) is loaded by the
-executable examples and ordinary tests. It contains no private application data,
-credentials, network calls, or dependency on a sibling checkout.
-
-The Notarius-shaped fixtures deliberately load both `version: 4` and
-`version: "4"` into the same string-backed application field. Its version checker
-still owns the supported identifier; fractional numeric input and unsupported
-integer identifiers remain negative examples.
-
 ## Happy path
 
-An application defines ordinary types and passes one explicit source. Optional
-features appear only when the application needs them:
+Define the Go configuration type, choose one source, and call `Load`. Handle a
+load error before starting the application with `result.Config`. The
+[README example](../../README.md#load-a-configuration-file) shows this complete
+minimal loading function. An explicitly missing file is an error; use `NoSource`
+when you deliberately want defaults without a main document.
+
+### Defaults and application rules
+
+Using the README's `Config` type, an application can add reusable rules:
 
 ```go
-result, err := configkit.Load[Config](configkit.File(path), configkit.Options[Config]{
-    Definition: rules,
-    Imports:    useDeclaredImports,
-    Overlay:    selectedConfigOverlay,
-    Overrides:  explicitlySetFlags,
-})
-if err != nil {
-    return err
+definition := configkit.Definition[Config]{
+    Defaults: func() Config { return Config{Enabled: true, Workers: 2} },
+    Validate: func(value *Config, validation *configkit.Validation) {
+        if value.Workers < 0 {
+            validation.Error(configkit.Keys("workers"), "must be nonnegative")
+        }
+    },
 }
-return start(result.Config)
 ```
 
-Simple consumers use neither imports nor selected overlays. A complex consumer can opt into
-both without redefining their syntax. ConfigKit overlays are configuration overlays;
-they do not select or replace an application's LLM, model, pipeline, report, or
-execution profile concepts.
+Pass this definition in `Options[Config]{Definition: definition}` when calling
+`Load`. Supplied `enabled: false` or `workers: 0` replaces those defaults.
+Use `Resolve` when a value must be derived or normalized before validation, and
+record that change with the provided helpers. The
+[callback reference](../config.md#recorded-application-resolution) compares the
+helpers; [executable examples](../../example_test.go) show full definitions.
+
+### Inspect a completed load
+
+Keep the result when you need to explain configuration. Use
+`result.Metadata().Lookup(configkit.Keys("workers"))` to inspect whether input
+supplied the value and which source or application step supplied it. Follow an
+origin's source ID with `result.Source(id)` when you need its source record.
+
+Use `Explain` for earlier values, `WriteExplanation` for a readable explanation,
+and `WriteEffective` for safe YAML describing the final saved state. These
+operations describe the completed load even if your application later changes
+`result.Config`. The [inspection reference](../config.md#layered-metadata)
+explains returned values, copies, and hidden information.
+
+Add imports, a selected overlay, or explicitly set CLI values through options
+only when needed. An overlay changes configuration; choosing an LLM, report, or
+execution profile remains application logic.
 
 ## Explicit main-file discovery
 
 Applications choose the search conventions and their precedence, then pass the
-resulting `SearchConfig` source to the same `Load` or `LoadLayered` entry point.
-For example, the maintained sequence catalog puts a caller-selected file before
-a custom directory fallback while keeping its underlay and overlay choices
-independent. See [`sequence_catalog.go`](../../examples/consumers/sequence_catalog.go)
-and its [behavior tests](../../examples/consumers/sequence_catalog_test.go), plus
-the [working-directory executable example](../../examples/consumers/discovery_test.go).
-Together, the root-owned [discovery API](../../discovery.go) and [configuration
-discovery contract](../config.md#configuration-discovery) define ordered
-concatenation, directory-first Cartesian expansion, optional exhaustion, and
-selected-file behavior. [ADR 0019](../adr/0019-explicit-configuration-discovery.md)
+resulting `SearchConfig` source to the same `Load` or `LoadLayered` entry
+point. For example, the maintained sequence catalog puts a caller-selected
+file before a custom directory fallback while keeping its underlay and overlay
+choices independent. See
+[`sequence_catalog.go`](../../examples/consumers/sequence_catalog.go) and its
+[behavior tests](../../examples/consumers/sequence_catalog_test.go), plus the
+[working-directory executable
+example](../../examples/consumers/discovery_test.go). Together, the [discovery
+API](../../discovery.go) and [configuration discovery
+contract](../config.md#configuration-discovery) explain the order of attempted
+files, what happens when no file is found, and why a selected-file failure
+stops the search. [ADR 0019](../adr/0019-explicit-configuration-discovery.md)
 records why discovery is explicitly selected.
 
 ## Import defaults and selection inspection
@@ -99,15 +123,20 @@ records why discovery is explicitly selected.
 `Options.ImportDefaults` and `LayeredOptions.ImportDefaults` apply one
 load-wide policy to enabled main, underlay, and transitive imports. Each field
 is resolved independently: a declaration's explicit value wins, then the
-application default, then the library default. `Required`, `Follow`, `Hidden`,
-and `Recursive` use nil pointers for unspecified values. `Pattern` applies to
+application default, then the library default. `Required`, `FollowSymlinks`,
+`IncludeHidden`, and `Recursive` use nil pointers for unspecified values.
+`Pattern` applies to
 directory searches: nil leaves filenames unrestricted, while a non-nil empty
 slice selects no files. A declaration's own `pattern` replaces the application
 default. The defaults do not enable imports or change selected-overlay behavior.
+The Go fields `FollowSymlinks` and `IncludeHidden` correspond to the unchanged
+YAML keys `follow` and `hidden`.
 
 `Result.Sources`, `LoadError.Sources`, and `Resolution.Source` expose each
-declaring source's `ImportSelections`. These records identify the source-local
-declaration path, its authored location and selector, and the `none` outcome;
+declaring source's `EmptyImportSelections`. `Result.Source(id)` and
+`LoadError.Source(id)` retrieve one retained record directly when its load-local
+ID is known. These records identify the source-local declaration path, its
+authored location and selector;
 they do not include candidate names or a guessed reason for absence. Returned
 records are detached snapshots. The [configuration contract](../config.md#explicit-imports)
 owns selector applicability and exact absence semantics.
@@ -117,7 +146,7 @@ owns selector applicability and exact absence semantics.
 [`LoadVersionedService`](../../examples/consumers/source_version.go) demonstrates
 if-present and required modes with one `Definition.Version` rule across a mounted
 main input and an underlay. The example reads only sanitized
-`SourceInfo.VersionCheck` fields; its executable test is in
+`SourceInfo.VersionEvidence` fields; its executable test is in
 [`layered_test.go`](../../examples/consumers/layered_test.go). The
 [configuration contract](../config.md#shared-source-version-checks) defines
 participation, source-local lookup and diagnostics, non-main header consumption,
@@ -135,13 +164,14 @@ priority values remain present. Its resolver records a derived endpoint URL afte
 overlay application, and its nested typed secret reference is classified before
 the resulting records are presented.
 
-The maintained [behavior tests and executable examples](../../examples/consumers/diff_test.go)
-use temporary files and disposable secret values. Presenters should use
-`ValueSnapshot.Present` for absence, record membership for change, and
-`HiddenChanged` for a withheld change indicator. Do not parse the redaction marker
-or add separately rendered full contexts that lack combined sensitivity. The
-[configuration contract](../config.md#effective-configuration-diffs) owns shared
-equality, granularity, and disclosure semantics.
+The maintained [behavior tests and executable
+examples](../../examples/consumers/diff_test.go) use temporary files and
+disposable secret values. Presenters should use `ValueSnapshot.Present` for
+absence, record membership for change, and `HiddenChanged` for a withheld
+change indicator. Do not parse the redaction marker or add separately rendered
+full contexts that lack combined sensitivity. The [configuration
+contract](../config.md#effective-configuration-diffs) owns shared equality,
+granularity, and disclosure semantics.
 
 ## Named sibling inheritance
 
@@ -264,14 +294,13 @@ conversion API.
 ## Source-aware application path policy
 
 [`LoadNotariusPaths`](../../examples/consumers/consumers.go) is the maintained
-path-bearing example. Its application resolver uses `Resolution.InputInfo` and
+path-bearing example. Its application resolver uses `Resolution.EntryInfo` and
 `Resolution.Source` before normalizing: relative CLI input uses an explicitly
 supplied invocation directory, retained defaults use the canonical main source,
 and a file-authored scalar uses its one declaring source. Absolute paths remain
-unchanged. Its executable test covers the matching effective YAML and explanation
-history, source-file ownership, and a symlink opened through an alias; canonical
-target-file directories, rather than the alias directory or process working
-directory, are the selected bases.
+unchanged. Its executable test checks the resulting YAML and explanation
+history. When the configuration filename is a symlink, this example uses the
+actual target file's directory as the base for file-authored paths.
 
 The selected example policy leaves a relative value unchanged and emits a warning
 when a CLI base is absent or file provenance is missing or composite. That is an
@@ -279,9 +308,77 @@ application choice, not a ConfigKit fallback: consumers can instead reject it or
 choose another explicit base. The example intentionally performs neither target
 existence checks nor confinement checks.
 
+### Normalizing paths inside a list
+
+Suppose `/srv/catalog/resources.yml` supplies this configuration, and the
+application interprets file-authored relative paths against their declaring
+file's directory:
+
+```yaml
+resources:
+  - name: reports
+    path: ./reports
+  - name: invoices
+    path: ./invoices
+```
+
+Apply the same source-aware policy as `LoadNotariusPaths` to each `path` field
+while the list remains in its entry order:
+
+1. Build the field's semantic path, such as
+   `configkit.Keys("resources").Index(0).Key("path")`.
+2. Query `Resolution.EntryInfo` at that path and use `Resolution.Source` to
+   identify its declaring file. Choose the base under the application's policy;
+   defaults, CLI values, and missing or composite provenance need their own
+   handling, as in the maintained example above.
+3. Resolve the relative value against that base and use `Normalize` to assign
+   and record the individual field. For a mutation already performed by the
+   application, use `RecordNormalization` instead.
+4. Continue without reordering the list. Later resource access uses the resolved
+   value rather than trying to recover a base directory from its effective origin.
+
+For these file-authored values, the resulting configuration is:
+
+```yaml
+resources:
+  - name: reports
+    path: /srv/catalog/reports
+  - name: invoices
+    path: /srv/catalog/invoices
+```
+
+Each changed `path` has a resolution origin, while its history retains the
+earlier relative value and source evidence. Unchanged fields such as `name`
+retain their source origins. Field-level recording avoids attributing the whole
+list to the path-normalization operation; it does not preserve a file origin on
+the normalized fields themselves.
+
+If the application also restructures the list during resolution, a whole-list
+record covers the structural change. For a collection registered with `name`
+as its identity, history follows each surviving record through a reorder, but
+descendants can acquire synthetic resolution origins without source locations.
+Historical source evidence and effective origins answer different questions;
+identity-aware history does not automatically select a resource base for a
+derived value. Resolve source-relative values before moving records, and account
+for final positions when recording helper targets. `EntryInfo` continues to use
+entry positions even after a move.
+
+See [resolution recording](../config.md#resolution-recording-and-failure-rules)
+for helper and coverage behavior, and
+[origins and historical paths](../config.md#presence-origins-and-historical-paths)
+for the distinction between resolution origins and retained source evidence.
+
 ## Intentional migration changes
 
-The examples preserve domain meaning while adopting one configuration convention:
+When upgrading, start with the changes relevant to your dependency and inputs:
+
+1. Update the module requirement and Go imports together as described below.
+2. Replace old public names using the old/new table.
+3. Update any layer or diagnostic-code strings stored or compared by your code.
+4. Review YAML and startup changes that apply to your application, then rebuild
+   and run its configuration tests.
+
+The maintained examples illustrate these configuration changes:
 
 - Explicit empty strings, lists, zeroes, false values, and nulls remain intentional.
   ConfigKit accepts an empty list structurally; WeatherReporter-shaped validation
@@ -301,10 +398,70 @@ The examples preserve domain meaning while adopting one configuration convention
   parsers translate only explicitly set configuration flags into `Override` records.
   Separate invocation state remains outside configuration.
 - Credential fields migrate to environment-name `Secret` references. Applications
-  explicitly call `LoadSecretsDir` before `Load` when they choose file bootstrap;
+  explicitly call `LoadSecretsIntoEnvironment` before `Load` when they choose
+  file bootstrap;
   blocked empty variables remain blocked, and ordinary `Load` never changes the
   process environment.
 
+### Vanity module path migration
+
+ConfigKit's module identifier changed from
+`gitea.maximumdirect.net/eric/ConfigKit` to `go.maximumdirect.net/configkit` before
+v1.0.0. Update the dependency requirement in your application's `go.mod` and its
+Go imports together, selecting a revision or release that declares the new module
+path. The package name remains `configkit`; the configuration model and public
+symbol names are unchanged by this identity migration.
+
+Go treats the old and new import paths as different packages, with different
+named types. For example, if another library returns a ConfigKit `Path` or
+`Secret` using the old import, your application cannot use it as the new
+package's type just by changing a module requirement. Coordinate migration
+with dependencies that pass ConfigKit values to or from your application. The
+maintained examples use the new path, but other repositories must manage their
+own migrations.
+
+Historical tags keep their original module declarations and contents. Older
+releases such as v0.10.2 still use the old path and cannot be installed under the
+vanity identifier simply because discovery can find their repository. A matching
+migrated revision is needed; no old-path compatibility module is supplied here.
+
+### Pre-v1 public API cleanup
+
+The pre-v1 API cleanup replaces these names outright; it does not retain
+compatibility aliases:
+
+| Previous API | Current API |
+| --- | --- |
+| `Resolution.InputInfo(path)` | `Resolution.EntryInfo(path)` |
+| `Definition.Secret` | `Definition.Sensitive` |
+| `SourceVersionModeDefault` | `SourceVersionModeMainOnly` |
+| `SourceVersionCheck` | `SourceVersionEvidence` |
+| `SourceInfo.VersionCheck` | `SourceInfo.VersionEvidence` |
+| `ImportSelection` | `EmptyImportSelection` |
+| `SourceInfo.ImportSelections` | `SourceInfo.EmptyImportSelections` |
+| `SourceInfo.DestinationUnresolved` | `SourceInfo.DestinationIsFallback` |
+| `ImportDefaults.Follow` / `.Hidden` | `FollowSymlinks` / `IncludeHidden` |
+| `Paths(paths...)` | `SearchPaths(paths...)` |
+| `LoadSecretsDir(directory)` | `LoadSecretsIntoEnvironment(directory)` |
+| `LayerBase` | `LayerMain` |
+| `CodeExplainLimitExceeded` | `CodeHistoryLimitExceeded` |
+| `CodeResolveInvalidKind` / `CodeOptionsUnavailable` | Removed; no replacement |
+| `ImportSelection.Outcome`, `ImportSelectionOutcome`, `ImportSelectionNone` | Removed; empty-selection records no longer carry an outcome |
+| `Resolution.Record(path, ChangeDerivedDefault, reason, deps...)` | `Resolution.RecordDerivedDefault(path, reason, deps...)` |
+| `Resolution.Record(path, ChangeNormalization, reason, deps...)` | `Resolution.RecordNormalization(path, reason, deps...)` |
+| Enumerating `Result.Sources()` / `LoadError.Sources()` to find one ID | `Result.Source(id)` / `LoadError.Source(id)` |
+| Provenance string `"base"` | `"main"` |
+| History diagnostic string `"explain.limit_exceeded"` | `"history.limit_exceeded"` |
+
+The YAML import keys `follow` and `hidden`, the `configkit:"secret"` tag, and
+typed `Secret` references are unchanged. If your application compares or
+stores layer names or diagnostic codes as strings, update those strings
+alongside Go references. This repository guidance does not claim that
+downstream applications have migrated and does not select a release version
+for this breaking pre-v1 change. `ChangeKind` and its inspection constants
+remain; use `Default` and `Normalize` when the helper should both assign and
+record a value.
+
 ### Selected-overlay migration
 
 To adopt the current selected-overlay API, rename `Options.Profile`,
@@ -315,10 +472,40 @@ The [configuration contract](../config.md#selected-overlays) is the canonical
 behavioral reference. Application-owned profile concepts, such as `model_profile`,
 are unchanged, and any CLI flag rename remains the application's decision.
 
-These examples are migration evidence, not completed changes to Narratio, Notarius,
-WeatherReporter, or Seriatim. Updating those repositories, their deployed YAML, CLI
-wiring, runtime catalogs, and operational documentation remains separate downstream
-work.
+### Background on the examples
+
+These examples demonstrate migration shapes. They do not claim that Narratio,
+Notarius, WeatherReporter, or Seriatim has been migrated. Updating those
+repositories, their deployed YAML, CLI wiring, runtime catalogs, and
+operational documentation remains separate downstream work.
+
+## Example background
+
+The maintained [`examples/consumers`](../../examples/consumers) package demonstrates
+sanitized shapes using only ConfigKit and the Go standard library:
+
+| Shape | Demonstrated fit | Application code deliberately retained |
+| --- | --- | --- |
+| Artifact defaults and normalization (Narratio-like) | Fresh defaults, explicit partial imports, artifact maps, recorded inherited defaults, normalization, and source ownership | Artifact meaning and the separate `model_profile` domain field |
+| Versions and dynamic options (Notarius-like) | Canonical object bindings, a string-backed schema version accepting string or integer YAML, strict dynamic options, and `int64` dynamic integers | Catalog selection, allowed option keys, range-checked conversion to runtime `int` |
+| Module validation and credential startup (WeatherReporter-like) | Defaults-only loading, report maps, canonical module objects, typed option unions, explicit CLI records, and typed secret startup | Report/module compatibility, rejection of explicitly empty domain lists, CLI parsing, and startup ordering |
+| Independent ordered rule files (Seriatim-like) | Independent strict ordered speaker and autocorrect rule files | First-match and ordered replacement algorithms; no central application configuration file |
+| Bundled file | Simple native `fs.FS` source through ordinary `Load` | Selection and lifetime of the application-owned embedded filesystem |
+| Layered catalog | Embedded defaults with an import, a mapping underlay, an independent host main file, explicit false/zero input, and source-relative resource access | Domain validation and opening/interpreting the template resource |
+| Mounted collections | Entry-declared relative destinations, nested metadata/prompt/profile imports, local inheritance, and a version-only higher-tier override | Collection IDs, profile meaning, and opening/interpreting prompt resources |
+| Named presets | One-load sibling inheritance, explicit false, nested destination resolution, and source/derivation inspection | Choosing and executing a preset |
+| Effective configuration diff | Same-type frozen effective comparisons for two selected files or base-versus-overlay impact | Source/options selection and consumer-owned safe presentation |
+| Shared source-version checks | One `Definition.Version` policy for accepted declarations across participating source documents, with optional or required declarations and sanitized evidence | Choosing which declarations the application accepts; final assembled schema and domain validation |
+| Sequence catalogs | Declared collection operations, record inheritance, typed CLI and resolution, inspection, exact and wildcard application registrations | Catalog meaning and final domain validation |
+
+The YAML under [`testdata`](../../examples/consumers/testdata) is loaded by the
+executable examples and ordinary tests. It contains no private application data,
+credentials, network calls, or dependency on a sibling checkout.
+
+The Notarius-shaped fixtures deliberately load both `version: 4` and
+`version: "4"` into the same string-backed application field. Its version checker
+still owns the supported identifier; fractional numeric input and unsupported
+integer identifiers remain negative examples.
 
 ## Maintained API examples
 
@@ -330,7 +517,7 @@ focused behavioral owner:
 | `Load`, `NoSource`, validation, versions, resolution, `SecretEnv`, overrides, and explanation | Executable examples in [`example_test.go`](../../example_test.go) |
 | Source/import/selected-overlay pipeline rules and artifact defaults | Narratio-shaped executable example and fixture |
 | Canonical module objects and dynamic option handling | WeatherReporter- and Notarius-shaped examples and migration tests |
-| `LoadSecretsDir`, bootstrap reporting, typed lookup, CLI explanation | `Example_weatherStartup` |
+| `LoadSecretsIntoEnvironment`, bootstrap reporting, typed lookup, CLI explanation | `Example_weatherStartup` |
 | Native filesystem, grouped underlays, programmatic mapping, retained resource context | `Example_nativeFilesystem`, `Example_layeredCatalog`, and their focused consumer tests |
 | Literal input destinations, root-default compatibility, and mounted peer collections | `Example_inputDestination`, `LoadCollectionBundle`, and `destinations_test.go` |
 | Named sibling inheritance, presence, and derivation | `Example_inheritedPresets` and `TestPresetCatalogOneLoadAndDerivation` |

docs/development.md

@@ -43,7 +43,7 @@ public behavior.
 | Shared source-version checks | [Configuration contract](config.md#shared-source-version-checks), [ADR 0013](adr/0013-shared-source-version-checks.md), and the version/source-version tests below |
 | Documentation changes | The owning document |
 | Licensing, dependencies, attribution, or release-document changes | [Project grant](../COPYRIGHT) and [attribution](oss/attribution.md); release changes also follow the release procedure |
-| Architecture decisions or future work | [Future features](roadmap/future.md), [remediation roadmap](roadmap/roadmap.md), and relevant ADRs listed below |
+| Architecture decisions or future work | [Future features](roadmap/future.md) and relevant ADRs listed below |
 | Code and test changes | The owning contract and tests from the map below |
 | Examples or copyable assets | The owning implemented contract and [consumer adoption guide](consumers/README.md) |
 | Release preparation | [Release procedure](release.md) |
@@ -64,6 +64,8 @@ Accepted decisions:
 - [Define identity and merge rules for each collection](adr/0017-collection-sequence-policy.md)
 - [Apply CLI overrides after inheritance and decoding](adr/0018-cli-after-structural-resolution.md)
 - [Keep main-file discovery explicit and composable](adr/0019-explicit-configuration-discovery.md)
+- [Scope configuration controls to document roots](adr/0020-document-root-controls.md)
+- [Match registered records during resolution inspection](adr/0021-sequence-resolution-correspondence.md)
 
 For cross-cutting changes, follow every applicable row. Completed implementation
 and remediation plans are preserved in Git history at `cb5b435`; use current
@@ -91,6 +93,19 @@ and current facade ownership belongs to the [component overview](internal/overvi
 
 ## Baseline validation
 
+The completed field-level sequence resolution roadmap, implementation plan, and
+resolved audit findings are preserved in Git history at `7e53863` under
+`docs/roadmap/`. For example:
+
+```sh
+git show 7e53863:docs/roadmap/implementation.md
+git show 7e53863:docs/roadmap/remediation.md
+```
+
+The [configuration contract](config.md#recorded-application-resolution) owns
+current resolution behavior, and [ADR 0021](adr/0021-sequence-resolution-correspondence.md)
+records the correspondence decision.
+
 The completed filesystem-source and underlay roadmap, original feature request,
 implementation plan, and resolved remediation record are preserved in Git history
 at `b604aa1` under `docs/roadmap/`. Current behavior belongs to the
@@ -113,7 +128,7 @@ git show 8e91a2b:docs/roadmap/startup-benchmark.md
 ```
 
 Remaining optimization candidates belong to
-[future performance experiments](roadmap/future.md#5-performance-experiments).
+[future performance experiments](roadmap/future.md#3-performance-experiments).
 
 The completed effective-configuration diff roadmap, implementation plan, and
 resolved review findings are preserved in Git history at `1c2610c` under
@@ -199,8 +214,25 @@ git show 34cbc0d:docs/roadmap/remediation.md
 ```
 
 Potential enhancements are tracked in [future features](roadmap/future.md).
-The completed audit remediation's scope is recorded in the
-[remediation roadmap](roadmap/roadmap.md). The consolidated audit, including
+The completed audit-remediation, internal-boundary simplification, shared-history,
+and public API cleanup roadmaps, reviews, and resolved findings are preserved at
+`68400ff` under `docs/roadmap/`. For example:
+
+```sh
+git show 68400ff:docs/roadmap/api.md
+git show 68400ff:docs/roadmap/remediation.md
+```
+
+Their earlier completed implementation plans are preserved at
+`bb5540b:docs/roadmap/implementation.md` (audit remediation),
+`f6d54a0:docs/roadmap/implementation.md` (internal-boundary simplification), and
+`07e4ae5:docs/roadmap/implementation.md` (shared history). The plan at
+`68400ff:docs/roadmap/implementation.md` records the public API cleanup.
+Current behavior and migration information belong to the
+[configuration contract](config.md), public declaration comments, and
+[consumer guide](consumers/README.md#pre-v1-public-api-cleanup).
+
+The consolidated audit, including
 findings, evidence, and settled scope decisions, is preserved at
 `453da68:docs/roadmap/audit.md`; the original nine reports are preserved at
 `ecd5d5d` under `docs/roadmap/`. Retrieve the consolidated record with:
@@ -232,15 +264,19 @@ dependency downloads. Acquire dependencies and any selected toolchain beforehand
 Format reported Go files with `gofmt -w <files>`.
 
 The default suite includes executable examples, maintained consumer fixtures,
-local documentation-link checks, and the dependency import-boundary check.
+and the dependency/public boundary checks.
 It must stay deterministic and runnable without network access or credentials.
 Still inspect new/untracked content and review paths, examples, ownership, and
 current-versus-planned claims; automated checks do not replace content review.
 
 Use focused checks while iterating, with validation proportionate to the change
-under the testing policy. Documentation-only work normally needs the local-link
-check below and whitespace review; behavior-bearing examples and commands also
-need execution. Use `go test -race ./...` for ownership or concurrency changes.
+under the testing policy. Documentation-only work normally needs review of
+affected links and whitespace; behavior-bearing examples and commands also
+need execution. Automated Markdown link checking runs against the committed
+candidate through ReleaseKit, not during ordinary Go tests or the everyday
+checker. See the [release procedure](release.md#4-publish-the-committed-candidate)
+for the selected checks and optional diagnostic command. Use
+`go test -race ./...` for ownership or concurrency changes.
 The [release procedure](release.md#4-publish-the-committed-candidate) performs
 its selected validation through one `publish` invocation. The everyday checker
 remains a development gate and is not a separate release prerequisite. CI never
@@ -256,28 +292,28 @@ code changes. Use the component overview to find the corresponding implementatio
 | --- | --- | --- |
 | YAML syntax, diagnostics, parser limits | [Adapter tests](../internal/yaml/parse_test.go), [source translation](../internal/engine/parse_test.go) | `go test ./internal/yaml` and `go test ./internal/engine -run '^TestParseSource'` |
 | File/reader access, imports, globs, containment | [Import internals](internal/imports.md), [source acquisition](../internal/engine/source_test.go), [FIFO](../internal/engine/source_fifo_test.go), [import traversal](../internal/engine/imports_test.go), [import evidence](../internal/engine/import_evidence_test.go), [relative destinations](../internal/engine/destination_import_test.go), [globs](../internal/engine/glob_test.go) | `go test ./internal/engine -run 'Source\|Import\|Glob\|Filesystem\|Nonregular\|RegularFile'` |
-| Explicit main-file discovery and absent-input loading | [Candidate selection](../internal/engine/discovery_test.go), [load integration](../internal/engine/discovery_load_test.go), [public facade](../facade_discovery_test.go), and maintained [catalog](../examples/consumers/sequence_catalog_test.go) and [preset](../examples/consumers/discovery_test.go) examples | `go test ./internal/engine -run 'Discovery|Search'`, `go test . -run 'Search'`, and `go test ./examples/consumers -run 'WorkingDirectoryPreset|SequenceCatalog'` |
-| Import defaults, empty-selection evidence, and dependency-ready ordering | [Defaults and facade evidence](../facade_import_defaults_test.go), [engine import evidence](../internal/engine/import_evidence_test.go), [scheduler](../internal/engine/dependency_order_test.go), [scheduling integrations](../internal/engine/imports_test.go) | `go test ./internal/engine -run 'Import|ScheduleDependencies|Inheritance'`, `go test . -run 'ImportDefaults|FacadeImport'`, and `go test ./examples/consumers` |
+| Explicit main-file discovery and absent-input loading | [Candidate selection](../internal/engine/discovery_test.go), [load integration](../internal/engine/discovery_load_test.go), [public facade](../facade_discovery_test.go), and maintained [catalog](../examples/consumers/sequence_catalog_test.go) and [preset](../examples/consumers/discovery_test.go) examples | `go test ./internal/engine -run 'Discovery\|Search'`, `go test . -run 'Search'`, and `go test ./examples/consumers -run 'WorkingDirectoryPreset\|SequenceCatalog'` |
+| Import defaults, empty-selection evidence, and dependency-ready ordering | [Defaults and facade evidence](../facade_import_defaults_test.go), [engine import evidence](../internal/engine/import_evidence_test.go), [scheduler](../internal/engine/dependency_order_test.go), [scheduling integrations](../internal/engine/imports_test.go) | `go test ./internal/engine -run 'Import\|ScheduleDependencies\|Inheritance'`, `go test . -run 'ImportDefaults\|FacadeImport'`, and `go test ./examples/consumers` |
 | Native filesystem and mapping sources | [Native acquisition](../internal/engine/native_filesystem_test.go), [filesystem facade](../facade_filesystem_test.go), [mapping facade](../facade_mapping_test.go) | `go test ./internal/engine -run 'NativeFilesystem'` and `go test . -run 'TestFacade'` |
 | Composition, selected overlays, CLI precedence | [Composition](../internal/engine/compose_test.go), [overlay](../internal/engine/overlay_test.go), [selected overlays](../internal/engine/selected_overlay_test.go), [overrides](../internal/engine/override_test.go) | `go test ./internal/engine -run 'Compose\|Overlay\|Override'` |
 | Sequence identity, declarations, and operations | [Identity](../internal/engine/sequence_identity_test.go), [registrations](../internal/engine/sequence_registration_test.go), [declarations](../internal/engine/sequence_declaration_test.go), [combination](../internal/engine/sequence_combine_test.go), [final facade validation](../facade_final_sequence_identity_test.go), and [consumer catalog](../examples/consumers/sequence_catalog_test.go) | `go test ./internal/engine -run 'Sequence\|Collection'`, `go test . -run 'SequenceIdentity\|SequenceRegistration'`, and `go test ./examples/consumers` |
 | Sibling inheritance, provenance, history, sensitivity | [Implementation flow](internal/overview.md#implementation-flow), [expansion](../internal/engine/inheritance_test.go), [destination scopes](../internal/engine/inheritance_walk_test.go), [origins](../internal/engine/inheritance_origin_test.go), [history](../internal/engine/inheritance_history_test.go), [secrets](../internal/engine/inheritance_secret_test.go), [public loading](../facade_inheritance_test.go) | `go test ./internal/engine -run 'Inheritance\|Inherited'` and `go test . -run '^TestFacadeInheritance\|^TestFacadeInheritedSecrets'` |
 | Layered loading and source equivalence | [Grouped lifecycle](../internal/engine/load_request_test.go), [layered facade](../facade_layered_test.go), [equivalence](../facade_equivalence_test.go) | `go test ./internal/engine -run '^TestGrouped'`, `go test . -run '^TestFacadeLayered'`, and `go test . -run '^TestEquivalentSourceForms'` |
-| Input and relative-import destinations, mounted sources, and source ownership | [Destination engine tests](../internal/engine/destination_test.go), [tier tests](../internal/engine/destination_tiers_test.go), [import traversal and version tests](../internal/engine/destination_import_test.go), [accounting tests](../internal/engine/destination_accounting_test.go), [lifecycle inspection tests](../internal/engine/destination_import_lifecycle_test.go), [public source/error tests](../facade_destination_test.go), [resource contexts](../facade_resource_context_test.go), and [consumer examples](../examples/consumers/destinations_test.go) | `go test ./internal/engine -run 'Destination|Import|Glob|Mounted'`, `go test . -run 'Destination|Import|SourceContext|FacadeMounted'`, and `go test ./examples/consumers` |
+| Input and relative-import destinations, mounted sources, and source ownership | [Destination engine tests](../internal/engine/destination_test.go), [tier tests](../internal/engine/destination_tiers_test.go), [import traversal and version tests](../internal/engine/destination_import_test.go), [accounting tests](../internal/engine/destination_accounting_test.go), [lifecycle inspection tests](../internal/engine/destination_import_lifecycle_test.go), [public source/error tests](../facade_destination_test.go), [resource contexts](../facade_resource_context_test.go), and [consumer examples](../examples/consumers/destinations_test.go) | `go test ./internal/engine -run 'Destination\|Import\|Glob\|Mounted'`, `go test . -run 'Destination\|Import\|SourceContext\|FacadeMounted'`, and `go test ./examples/consumers` |
 | Shared source-version modes and evidence | [Engine source-version tests](../internal/engine/source_version_test.go), [public facade tests](../facade_source_version_mode_test.go), and [consumer example tests](../examples/consumers/layered_test.go) | `go test ./internal/engine -run 'SourceVersion'`, `go test . -run 'SourceVersion'`, and `go test ./examples/consumers` |
 | Schema, defaults, projection, cloning | [Implementation flow](internal/overview.md#implementation-flow), [schema](../internal/engine/schema_test.go), [decoding](../internal/engine/decode_test.go), [projection and typed cloning](../internal/engine/projection_test.go) | `go test ./internal/engine -run 'Schema\|Decode\|Projection\|Clone\|Inline\|CompareDocument'` |
 | Lifecycle, resolution, validation, callback ownership | [Loading](../internal/engine/load_test.go), [resolution](../internal/engine/resolution_test.go), [validation](../internal/engine/validation_test.go), [ownership](../internal/engine/callback_ownership_test.go), [independence](../internal/engine/independence_test.go) | `go test ./internal/engine -run 'Load\|Resolution\|Validation\|Validator\|Hook\|Callback\|Parallel'` |
+| Resolution sequence matching and inspection | [Correspondence](../internal/engine/resolution_correspondence_test.go), [auditing and history](../internal/engine/resolution_compare_test.go), [public integration](../facade_resolution_sequences_test.go) | `go test ./internal/engine -run 'Resolution\|History\|Explain\|Sensitivity'` and `go test . -run 'Resolution\|SequenceIdentity\|Diff'` |
 | Paths, metadata, provenance | [Paths](../internal/engine/path_test.go), [metadata](../internal/engine/metadata_test.go), [provenance](../internal/engine/provenance_test.go) | `go test ./internal/engine -run 'Path\|Metadata\|Provenance\|Queries'` |
 | Passive resource contexts | [Engine contexts](../internal/engine/resource_context_test.go), [public contexts](../facade_resource_context_test.go) | `go test ./internal/engine -run 'Resource'` and `go test . -run 'SourceContext'` |
 | Secrets, bootstrap, redaction, explanation | [References](../internal/engine/secret_reference_test.go), [bootstrap](../internal/engine/secrets_test.go), [rendering](../internal/engine/render_test.go), [explanation](../internal/engine/explain_test.go) | `go test ./internal/engine -run 'Secret\|Bootstrap\|Effective\|Explain\|Explanation\|History\|Sensitivity'` |
-| Effective configuration diff | [Engine comparison and masking tests](../internal/engine/diff_test.go), [engine operation tests](../internal/engine/diff_operation_test.go), [root facade tests](../facade_diff_test.go), and [consumer examples](../examples/consumers/diff_test.go) | `go test ./internal/engine -run 'Diff|Explain|History|Secret|Independent'`, `go test . -run 'Diff|FacadeInspection|PublicFacadeBoundary|DependencyImportBoundary'`, `go test ./examples/consumers`, and `go test . -run '^ExampleDiff$'` |
+| Effective configuration diff | [Engine comparison and masking tests](../internal/engine/diff_test.go), [engine operation tests](../internal/engine/diff_operation_test.go), [root facade tests](../facade_diff_test.go), and [consumer examples](../examples/consumers/diff_test.go) | `go test ./internal/engine -run 'Diff\|Explain\|History\|Secret\|Independent'`, `go test . -run 'Diff\|FacadeInspection\|PublicFacadeBoundary\|DependencyImportBoundary'`, `go test ./examples/consumers`, and `go test . -run '^ExampleDiff$'` |
 | Consumer examples and migration fixtures | [Consumer tests](../examples/consumers/consumers_test.go), [native, layered, and ordinary relative-import examples](../examples/consumers/layered_test.go), [mounted collection examples](../examples/consumers/destinations_test.go), [API examples](../example_test.go) | `go test ./examples/consumers` and `go test . -run '^Example'` |
 | Assembly and layered scaling evidence | [Assembly benchmarks](../internal/engine/assembly_bench_test.go), [layered benchmarks](../internal/engine/underlay_bench_test.go) | `go test ./internal/engine -run '^$' -bench '^BenchmarkUnderlay' -benchmem`; repeat with `^BenchmarkCompose` and `^BenchmarkOverlay` |
 | Identified-sequence scaling evidence | [Mixed-upsert benchmark](../internal/engine/sequence_combine_bench_test.go) | `go test ./internal/engine -run '^$' -bench '^BenchmarkSequenceMixedUpsert$' -benchmem` |
 | Inheritance scaling evidence | [Expansion benchmarks](../internal/engine/inheritance_bench_test.go) | `go test ./internal/engine -run '^$' -bench '^BenchmarkInheritance' -benchmem` |
-| Documentation links and dependency isolation | [Link checks](../documentation_test.go), [import boundary](../import_boundary_test.go), [public boundary](../public_boundary_test.go) | `go test . -run 'TestLocalDocumentationLinks\|TestDependencyImportBoundary\|TestPublicFacadeBoundary'` |
+| Dependency and public API isolation | [Import boundary](../import_boundary_test.go), [public boundary](../public_boundary_test.go) | `go test . -run 'TestDependencyImportBoundary\|TestPublicFacadeBoundary'` |
 | Development check behavior | [Development checker test](../development_check_test.go) | `go test . -run '^TestDevelopmentCheckHandlesFilenamesAndStopsOnFailure$'` |
-| Release profile wiring | [Release profile test](../releasekit_profile_test.go) | `go test . -run '^TestReleaseKitProfile$'` |
 
 ## Fuzz validation
 

docs/internal/overview.md

@@ -50,7 +50,7 @@ Implemented component owners:
 - Engine mechanism tests own source, composition, inheritance, decoding,
   callback, provenance,
   source-context, secret, history, rendering, and bootstrap behavior. Root tests
-  own public API compatibility, facade integration, documentation links, and
+  own public API compatibility, facade integration, and
   dependency/public boundary checks. Consumer examples remain under
   `examples/consumers`.
 
@@ -110,7 +110,9 @@ source, filesystem, destination, and import settings.
 
 [`acquisition.go`](../../internal/engine/acquisition.go) defines acquisition
 policy, load-wide accounting, and tier-scoped repetition/namespace state. Each
-input is acquired under that policy; grouped requests retain acquired underlay
+input is acquired under that policy. Source-root controls are extracted from
+each acquired tree before placement; assembled application data is not parsed
+again for controls. Grouped requests retain acquired underlay
 scopes until their tier is composed in
 [`load_request.go`](../../internal/engine/load_request.go). Completed tiers then
 share one assembly handoff that applies collection declarations and projects
@@ -151,6 +153,30 @@ descriptor caching and type policy, and
 inline field assembly. [`decode.go`](../../internal/engine/decode.go) consumes
 those descriptors for typed decoding.
 
+History and inspection use one private evidence owner. The
+[`history_model.go`](../../internal/engine/history_model.go) builder receives
+baseline, source-composition, inheritance, typed-checkpoint, and CLI evidence
+in [`preparePostDecodeOverrideContext`](../../internal/engine/override_context.go),
+before application resolution begins. The callback retains its separate fixed
+entry view; it does not read a builder that continues to change. After successful
+resolution auditing, [`resolveLoadInput`](../../internal/engine/load_result.go)
+adds the original resolution records and their net replay groups. At the existing
+resolution boundary, [`resolution_correspondence.go`](../../internal/engine/resolution_correspondence.go)
+matches eligible registered records and the shared history retains their paired
+coordinates for selection and safe replay. At the existing
+pre-secret admission boundary, [`prepareInspectionHistory`](../../internal/engine/load_result.go)
+freezes that builder and counts the retained document roots before secret lookup
+and validation.
+
+The frozen model is shared by `Metadata` and `Inspection`. Its shape-aware
+selection in [`history_select.go`](../../internal/engine/history_select.go)
+drives metadata history, explanation, and historical-path membership; the model
+also supplies historical diagnostic locations and sensitivity/dependency
+evidence. `Inspection` replays selected payloads to produce detached, safely
+rendered values, while metadata queries return detached attribution records.
+History and explanation behavior is covered by focused `history_*_test.go`
+tests alongside metadata, secret, inheritance, and facade integration tests.
+
 Behavioral ownership follows the same handoffs: imports and grouped lifetimes are
 covered by `imports_test.go`, `load_request_test.go`, and focused source,
 discovery, and destination tests; inheritance by the inheritance test files;
@@ -158,3 +184,9 @@ reflection behavior by `schema_test.go`, `projection_test.go`, and
 `decode_test.go`. The [development test map](../development.md#task-to-test-map)
 links focused commands. [`clone.go`](../../internal/engine/clone.go) owns typed
 copying, using the shared descriptors and per-operation traversal helpers.
+
+Each schema operation builds its private reflection descriptor graph with
+operation-local caching; there is no global mutable descriptor cache. Decoding,
+projection, and cloning reuse these descriptors so field bindings agree. The
+public reference describes the resulting type, output, and ownership behavior;
+this descriptor storage is an implementation detail.

docs/policy/architecture.md

@@ -207,7 +207,9 @@ records this ordering.
 CLI overrides are the highest-priority input to application resolution. Supplied
 sequences replace whole sequences, and mappings combine recursively. Inheritance
 and typed defaulting do not run again after CLI application. CLI paths and values
-must not introduce structural directives; earlier source, inheritance, and
+must not introduce inheritance controls; source-document controls are interpreted
+only at acquisition, before placement, and later application `config` data is
+not reinterpreted. Earlier source, inheritance, and
 decoding failures remain errors even if a CLI assignment would replace the value.
 Semantic validation assesses the final configuration after overrides and resolution.
 
@@ -374,6 +376,11 @@ it does not cover every intermediate callback state or later caller mutations.
 YAML-only declarations carry no such final guarantee through defaults, CLI
 assignments, or application resolution.
 
+For resolution auditing and inspection, eligible registered collections match
+entry and final records by identity within each destination. Structural changes
+still require container coverage, and this correspondence does not change source
+composition or move final validation earlier. Public diff remains sequence-atomic.
+
 Preserve source attribution, presence, history, sensitivity, and resource context
 as records survive, move, or are replaced. Identity diagnostics use paths and
 available origin information without exposing identity values. The guarantee

docs/policy/oss.md

@@ -11,8 +11,9 @@
 ConfigKit's selected grant is LGPL-3.0-or-later, recorded in
 [COPYRIGHT](../../COPYRIGHT), with the complete LGPLv3 and incorporated GPLv3
 texts in [LICENSE](../../LICENSE). The [release procedure](../release.md)
-owns source-only Go module publication through Gitea. No separate hosted release
-object or license asset is required for this channel.
+owns source-only Go module publication and, beginning with v1.0.0, local delivery
+of a Gitea release page using the complete committed release note. That page
+retains the note's licensing footer; separate license assets are not required.
 
 ## Purpose And Scope
 

docs/policy/release.md

@@ -23,9 +23,10 @@ policy and link to it rather than introduce additional release requirements.
 
 ConfigKit publishes a source-only Go module. Its declared deliverables are the
 immutable annotated source tag and version-matched checked-in release note.
-Standalone binaries, container images, hosted release objects, and separate
-registry publication are not required. Additional channels require a deliberate
-update to the policy and procedure.
+Beginning with v1.0.0, maintainers also deliver a Gitea release page containing
+that complete note after source publication. Standalone binaries, container
+images, and separate registry publication are not required. Further channels
+require a deliberate update to the policy and procedure.
 
 The Go API, documented YAML and resolution semantics, and structured diagnostic
 contracts participate in compatibility review. A signature-preserving change
@@ -80,9 +81,13 @@ the tagged source. The procedure must identify those deliverables and the
 responsibility of their automation. Published deliverables must be traceable
 to that source and identify the same version.
 
-ConfigKit currently declares no additional deliverables. Confirmed publication
-of the intended source tag is the completion point. CI, macOS validation,
-hosted delivery, and consumer retrieval are outside the release gates.
+ConfigKit's hosted release page is delivered locally through ReleaseKit after
+confirmed source publication, using the tagged note and preserving its licensing
+footer. Hosted delivery has a separately reported outcome and may be retried
+against the same immutable tag without republishing it. Confirmed publication
+of the intended source tag remains the source-release completion point. CI,
+macOS validation, hosted-service availability, delivery credentials, and consumer
+retrieval are outside the source-publication gates.
 
 ## Versioning And Compatibility
 
@@ -176,8 +181,8 @@ ConfigKit uses the complete checked-in note as the annotated tag message.
 Include the release footer defined by the [OSS policy](oss.md#discoverability)
 in each new release document. The release procedure defines the concrete URLs
 and publication mechanics. Prepare these links with the release note; they do
-not add a network check or approval gate. If a hosted download page is used in
-a future channel, preserve the footer there.
+not add a network check or approval gate. ConfigKit's hosted release page reuses
+the complete committed note and its footer.
 
 Handle version selection, release-note content, and retirement of completed
 roadmaps during preparation. Preserve planned and deferred work and repair
@@ -208,8 +213,8 @@ test or CI run required before it.
 
 The selected profile runs the complete deterministic, offline default suite
 once with the race detector and test-time vet disabled. The suite already
-includes examples, consumer fixtures, documentation links, and package
-boundaries. One full vet pass adds static checks beyond the test-time subset.
+includes examples, consumer fixtures, and package boundaries. One full vet
+pass adds static checks beyond the test-time subset.
 CGO-disabled Linux amd64 and arm64 package compilation covers supported
 configurations distinct from native race compilation. macOS and newer-toolchain
 checks are optional.
@@ -221,6 +226,22 @@ expanded platform matrices solely because they are possible. Retain such
 checks when their distinct protection justifies their cost. A one-time migration
 check must not silently become a permanent release requirement.
 
+ConfigKit selects ReleaseKit's targeted forbidden-file check to keep the local
+delivery token path out of the committed candidate. The profile owns the path;
+the check does not inspect file contents or Git history. Hosted credential
+preflight belongs to delivery and adds no source-publication gate.
+
+ConfigKit delegates committed Markdown link validation to ReleaseKit rather
+than maintaining a documentation-link test in the Go suite. Links outside the
+checkout remain out of scope. This moves automated link feedback to candidate
+validation; ordinary development review still covers edited links.
+
+ConfigKit also selects ReleaseKit's local-replacement check for committed module
+declarations. Filesystem replacements can make local validation succeed with
+dependencies unavailable to consumers of the published module. Versioned module
+replacements remain permitted. This check does not validate remote dependency
+availability or require consumer retrieval.
+
 ReleaseKit runs its selected Go commands with readonly module mode and
 `GOPROXY=off`; acquire dependencies and build the tool before candidate
 validation. Formatting and whitespace remain ordinary development checks in

docs/release.md

@@ -1,16 +1,25 @@
 # ConfigKit Release Procedure
 
 This is the maintainer runbook for ConfigKit's [release policy](policy/release.md).
-ConfigKit publishes a source-only Go module. The immutable annotated tag and
-matching checked-in release note are the deliverables; there is no binary,
-container image, generated package, or separate registry publication.
+A release publishes the Go source under a new Git tag, with a matching release
+note committed in the repository. The tag is annotated: it includes the release
+note text and points to the released commit. Published tags and contents are
+immutable. There is no binary, container image, generated package, or separate
+registry publication. Beginning with v1.0.0, maintainers also deliver a Gitea
+release page containing the complete checked-in note after source publication.
+Source publication and hosted delivery have separate outcomes.
+
+A **candidate** is the committed revision you intend to release. The
+**authoritative remote** is the repository where ConfigKit publishes releases;
+its exact push URL is listed below. The **consumer minimum** is the oldest Go
+version supported for applications using ConfigKit.
 
 ## Release identity and support
 
-- Module: `gitea.maximumdirect.net/eric/ConfigKit`
+- Module: `go.maximumdirect.net/configkit`
 - Primary branch: `main`
 - Authoritative remote: `origin`
-- Authoritative push URL: `https://gitea.maximumdirect.net/eric/ConfigKit.git`
+- Authoritative push URL: `ssh://git@forge.maximumdirect.net:22222/base-layer/configkit.git`
 - Tags: stable Semantic Versions such as `v0.5.0`; no prereleases
 - Minimum Go version: the first stable patch of the selected Go series, or a
   higher patch when required by a dependency or specific correctness fix, as
@@ -20,10 +29,16 @@ container image, generated package, or separate registry publication.
 - Best-effort targets: macOS amd64 and arm64, under the
   [platform support policy](policy/release.md#platform-support)
 
-Release validation runs one offline race-enabled Go suite, one full vet pass,
-and CGO-disabled package compilation for both Linux targets. macOS and CI are
+Release validation runs the offline Go test suite once with the race detector,
+then a full vet pass and package compilation for both Linux targets with cgo
+disabled (`CGO_ENABLED=0`), followed by the selected committed-file checks
+described in [publication](#4-publish-the-committed-candidate). macOS and CI are
 not release gates; do not wait for or poll CI.
 
+The vanity module path is the name applications put in Go imports. Source/tag
+browser links and public Go retrieval use the Forge HTTPS repository
+independently of SSH publication.
+
 ## 1. Select Go and prepare the tool
 
 Use a clean checkout with Git, Bash 3.2 or newer, and a native compiler for race
@@ -33,10 +48,10 @@ For a patch release, retain the series recorded in `go.mod` and leave its consum
 minimum unchanged. Follow the
 [toolchain selection policy](policy/release.md#configkit-toolchain-selection).
 
-Put the selected series' latest locally available compatible patch first on
-`PATH`, ensuring it meets `go.mod`'s minimum. The same `go` executable must build
-ReleaseKit and run its child validation commands. Set local toolchain selection
-and verify it:
+Choose the latest compatible patch installed locally in that Go series. Put
+its `go` executable first on `PATH` and ensure it meets the minimum in
+`go.mod`. The same `go` executable must build ReleaseKit and run its child
+validation commands. Set local toolchain selection and verify it:
 
 ```sh
 export GOTOOLCHAIN=local
@@ -61,8 +76,17 @@ use that required version instead and document the reason. When the series is
 unchanged, leave the minimum unchanged unless a minor or major release
 deliberately changes it under the
 [consumer minimum policy](policy/release.md#consumer-minimum-and-release-toolchain).
-For example, validating with Go 1.26.8 leaves `go 1.26.0` unchanged. There is no
-separate requirement to validate with Go 1.26.0.
+For example:
+
+| Release situation | Go used for validation | Consumer minimum |
+| --- | --- | --- |
+| Patch release in the 1.26 series | Latest compatible patch installed locally, such as 1.26.8 | Keep the existing `go.mod` minimum unchanged. |
+| Minor/major release staying in 1.26 | Latest compatible patch installed locally | Normally retain the minimum; any deliberate change follows the linked policy. |
+| Minor/major release adopting a newer installed stable series | Latest compatible patch installed locally in that series | Normally declare that series' initial stable patch, or the higher patch required by a dependency or identified fix. |
+
+Using Go 1.26.8 for validation can therefore leave `go 1.26.0` unchanged. Users
+need the declared minimum, while maintainers validate with their selected patch.
+There is no separate requirement to validate with Go 1.26.0.
 
 Prepare dependencies whether or not the minimum changes:
 
@@ -70,28 +94,35 @@ Prepare dependencies whether or not the minimum changes:
 go mod download
 ```
 
-Build the tool selected by `go.mod` into temporary storage outside the checkout.
-Ensure `$TMPDIR` names a system temporary location, not the repository. These
-commands never install another ReleaseKit version:
+Run the module-selected ReleaseKit tool from the repository root. Go builds
+and caches the executable; no temporary executable or launcher is needed.
+These commands use the version recorded in `go.mod`:
 
 ```sh
-releasekit_tmp=$(mktemp -d "${TMPDIR:-/tmp}/configkit-releasekit.XXXXXX")
-releasekit_bin="$releasekit_tmp/releasekit"
-go build -o "$releasekit_bin" gitea.maximumdirect.net/eric/ReleaseKit/cmd/releasekit
-go list -m gitea.maximumdirect.net/eric/ReleaseKit
-"$releasekit_bin" version
+go list -m go.maximumdirect.net/releasekit
+go tool releasekit version
 ```
 
-The module-selected executable is ReleaseKit v0.4.2. Use the built executable
-for publication to preserve its exit status and publication-state diagnostics.
-`go run` maps a nonzero child exit status to 1. ReleaseKit's child Go commands
+This repository selects ReleaseKit v0.8.0. `go tool releasekit` preserves the
+tool's exit status and publication report; `go run` maps a nonzero child exit
+status to 1. ReleaseKit's child Go commands
 use the `go` found on `PATH` with `GOTOOLCHAIN=local`; keep the selected
 executable first on `PATH` through the publication command.
 
+For hosted delivery, save the Gitea API token in the ignored local file
+`.releasekit/gitea-token` with owner-only permissions. The profile uses it when
+`RELEASEKIT_GITEA_TOKEN` is unset or blank; a nonblank environment value takes
+precedence. The file path resolves from the repository root, and ReleaseKit
+trims surrounding whitespace from its contents. Keep credentials out of release
+notes, diagnostic labels, command arguments, and commits. The selected
+`forbidden_files` check also rejects a committed token at that exact path;
+it does not scan other files or history. Source publication uses Git
+authentication and does not read or require this token.
+
 Verify access to the authoritative remote without displaying credentials:
 
 ```sh
-git ls-remote https://gitea.maximumdirect.net/eric/ConfigKit.git HEAD refs/heads/main
+git ls-remote ssh://git@forge.maximumdirect.net:22222/base-layer/configkit.git HEAD refs/heads/main
 ```
 
 Publication requires explicit authorization. Local implementation commits do
@@ -99,10 +130,10 @@ not authorize a push or release.
 
 ## 2. Prepare and commit the candidate
 
-Choose an unused stable version locally and on the authoritative remote. Compare
-the candidate with the previous tag and review exported Go signatures and
-ownership, YAML and resolution semantics, diagnostic contracts, minimum Go
-version, and platform support. Review maintained consumer examples and the
+Choose a stable version that has not been used locally or on the publication
+remote. Compare the candidate with the previous tag. Review public Go APIs and
+value ownership, YAML and resolution rules, diagnostic contracts, the minimum
+Go version, and platform support. Review maintained consumer examples and the
 migration guidance. Explain any consumer-minimum increase and required consumer
 action under the
 [consumer minimum policy](policy/release.md#consumer-minimum-and-release-toolchain).
@@ -111,7 +142,7 @@ Create `docs/releases/<version>.md`. Its first line must be exactly
 `# ConfigKit <version>`, and it must end with the license and attribution footer:
 
 ```markdown
-[COPYRIGHT](https://gitea.maximumdirect.net/eric/ConfigKit/src/tag/VERSION/COPYRIGHT) | [LICENSE](https://gitea.maximumdirect.net/eric/ConfigKit/src/tag/VERSION/LICENSE) | [ATTRIBUTION](https://gitea.maximumdirect.net/eric/ConfigKit/src/tag/VERSION/docs/oss/attribution.md)
+[COPYRIGHT](https://forge.maximumdirect.net/base-layer/configkit/src/tag/VERSION/COPYRIGHT) | [LICENSE](https://forge.maximumdirect.net/base-layer/configkit/src/tag/VERSION/LICENSE) | [ATTRIBUTION](https://forge.maximumdirect.net/base-layer/configkit/src/tag/VERSION/docs/oss/attribution.md)
 ```
 
 Replace `VERSION` with the full tag and confirm the three target files exist in
@@ -127,7 +158,7 @@ Push only that committed candidate to the literal authoritative URL. This does
 not follow local tags:
 
 ```sh
-git push --no-follow-tags https://gitea.maximumdirect.net/eric/ConfigKit.git HEAD:refs/heads/main
+git push --no-follow-tags ssh://git@forge.maximumdirect.net:22222/base-layer/configkit.git HEAD:refs/heads/main
 ```
 
 ReleaseKit requires authoritative `main` to equal this candidate before it
@@ -139,82 +170,184 @@ candidate to `main`, and invoke validation again.
 
 ## 4. Publish the committed candidate
 
-With the authorized candidate already on authoritative `main`, invoke the
-module-selected native executable exactly once:
+Once publication is authorized and the candidate is on the publication remote's
+`main`, run the module-selected ReleaseKit tool once to validate and publish it:
 
 ```sh
-"$releasekit_bin" publish vMAJOR.MINOR.PATCH
+go tool releasekit publish vMAJOR.MINOR.PATCH
 ```
 
 Replace the placeholder with the selected version. ReleaseKit checks the
-effective push URL against `expected_push_url`, verifies the candidate on
+push URL Git will actually use, after URL rewrites, against `expected_push_url`.
+It verifies the candidate on
 `main`, and checks the release-note H1 for the product and version. It then
 runs the selected race-enabled standard suite once with test-time vet disabled,
 one full vet pass, and CGO-disabled package compilation for Linux amd64 and
-arm64. It publishes only the annotated tag for that candidate. Confirmed
+arm64. It also checks the committed candidate for the forbidden token path,
+filesystem replacements in module declarations, and local Markdown destinations
+and supported heading fragments. Markdown links outside the checkout are
+reported as out of scope without failing validation. These file checks inspect
+the committed candidate, not uncommitted or ignored working-tree content.
+
+It publishes only the annotated tag for that candidate. Confirmed
 publication of the intended tag completes the release. The tag points to the
 captured commit and uses the complete checked-in note as its annotation message.
-The optional `check`
-command is available for diagnosis but is not a separate required pass:
+Use the optional `check` command for diagnosis when useful. It validates without
+publishing and is not required before `publish`, which performs its own checks:
 
 ```sh
-"$releasekit_bin" check vMAJOR.MINOR.PATCH
+go tool releasekit check vMAJOR.MINOR.PATCH
 ```
 
-Status 0 confirms publication, status 1 reports a known publication failure or
-conflict, status 2 reports usage, profile, or version errors, and status 3 means
-the push outcome remains unknown. Preserve both the native exit status and its
-diagnostics.
+For `publish`, interpret the program's exit status as follows:
+
+| Status | Meaning | Next action |
+| --- | --- | --- |
+| `0` | Publication succeeded. | The source release is complete. Continue with hosted delivery. |
+| `1` | A known publication failure or conflict was reported. | Read the report and correct the stated problem. Preserve any published tag. |
+| `2` | The command, profile, or version is invalid. | Correct the command or configuration before trying again. |
+| `3` | The tag push outcome is still unknown. | Follow the recovery procedure below before retrying or declaring success. |
+
+Keep both the program's exit status and its diagnostic report. Using `go run`
+would lose the distinction between its nonzero exit statuses.
 
 The command does not push or repair `main`, wait for CI, or publish binaries or
 a hosted release page. A successful intended-tag publication does not require
 remote read-back or consumer retrieval; those checks remain optional.
 
-## 5. Recover from a failed or uncertain tag push
+## 5. Deliver the hosted release page
 
-The executable reports the publication state, phase, version, candidate commit,
-tag-object ID, effective endpoint, and error on standard error. It performs one
-bounded authoritative reconciliation after a failed tag push. Exit status 3
-means the tag outcome remains unknown; do not blindly retry or move a tag.
-
-For an uncertain result, use the exact endpoint, candidate commit, version, and
-tag-object ID from the report. Copy the captured endpoint into the variable
-below using normal shell quoting. Check that Git still resolves it to itself,
-then query the authoritative refs once:
+After source publication succeeds, run local hosted delivery from the repository
+root. Keep the worktree clean and `HEAD` at the published tag's commit. Use the
+module-selected tool as in step 1. For the first release using this workflow:
+
+```sh
+go tool releasekit deliver v1.0.0
+```
+
+For subsequent releases, substitute the selected version. The profile selects
+Gitea at `https://forge.maximumdirect.net`, owner `base-layer`, repository
+`configkit`. With no build targets, delivery creates or accepts a stable,
+non-draft release page containing the complete committed note, including its
+licensing footer. It creates no binary assets, receipts, or checksum manifest.
+An existing page with matching content is accepted; conflicting content is not
+overwritten.
+
+Delivery automatically performs an authenticated, read-only repository preflight
+before hosted writes. A separate preflight before source publication is not a
+release gate. Delivery does not rerun candidate validation, publish a tag, or
+wait for CI. Hosted-service availability and delivery credentials do not gate
+source publication. Report source-publication success and hosted-delivery status
+separately.
+
+| Delivery status | Meaning and next action |
+| --- | --- |
+| `0` | Delivery is complete; report the hosted release URL. |
+| `1` | Preflight was unavailable, or delivery failed, conflicted, or made partial progress. Read the reported state and correct the cause; investigate conflicts before retrying. |
+| `2` | Usage, profile, credential loading, or preflight configuration/access failed. Correct the reported problem before retrying delivery. |
+| `3` | A hosted write has an unresolved outcome. Inspect the hosted release and resolve that state before retrying. |
+
+A delivery problem leaves the successfully published source tag intact. Retry
+delivery with the same immutable version after correcting the cause and
+resolving any uncertain write. For a later retry, use a clean checkout of the
+original tag, fetching that tag if needed. Use that checkout's module-selected
+CLI, prepare its dependencies and tool as in step 1 without changing the tagged
+module files, and make the token available there. For example, with the tag
+available locally:
+
+```sh
+release_version=v1.0.0
+git switch --detach "$release_version"
+```
+
+After preparing the tool in that tagged checkout:
+
+```sh
+go tool releasekit deliver "$release_version"
+```
+
+Do not rerun `publish`, move a tag, or replace a hosted page to repair delivery.
+If published source or content needs correction, prepare a new appropriate
+version through the normal release procedure.
+
+## 6. Recover from a failed or uncertain tag push
+
+ReleaseKit attempts to save publication evidence before pushing a tag and
+reports the absolute record path, or a recording warning, separately from the
+publication outcome. A recording failure does not undo a successful publication
+or change its exit status. Confirmed publication still completes the source
+release; hosted delivery remains a separate operation.
+
+Records default to a private store under the repository's Git common directory,
+shared by linked worktrees. `publish --record-dir DIR` can select another
+location; relative paths resolve from the source repository root. Records can
+contain exact endpoints, including credentials. Keep them private and remove
+them when their recovery value expires. There is no new tracked storage,
+credential-preflight gate, or required recording-success check.
+
+After a failed push, ReleaseKit makes one bounded observation of the original
+publication endpoint. If the outcome remains unknown, use the explicitly saved
+record rather than rerunning publication. Copy the recovery command printed by
+ReleaseKit, or use the module-selected tool:
+
+```sh
+publication_record='/absolute/path/from/the/publication/report.json'
+go tool releasekit reconcile --record "$publication_record"
+```
+
+If the path was lost, discover local attempts without contacting a remote:
+
+```sh
+go tool releasekit publication-attempts
+```
+
+Select the record for the intended attempt from its reported version, candidate,
+and tag evidence; discovery does not automatically choose the latest attempt.
+For an alternate store, supply `publication-attempts --record-dir DIR`.
+Both commands support optional `--json` output. Treat saved records as private
+regardless of the CLI's credential-redacted diagnostic output.
+
+Reconciliation observes the captured endpoint and exact tag object using current
+supported Git transport settings. It does not load the current profile, require
+the original `HEAD`, rerun candidate validation, change tags, or contact Gitea
+hosted delivery. It needs no clean candidate checkout. Use ReleaseKit v0.8.0 or
+another CLI supporting the saved record format, including format 2 where exact
+non-UTF-8 endpoint/path bytes were retained.
+
+| Reconciliation status | Meaning and next action |
+| --- | --- |
+| `0` | The intended tag object is published. The source release is complete; continue with hosted delivery from its clean tagged checkout. |
+| `1` | The tag is currently absent or conflicting. Read the reported state. Investigate conflicts; absence alone does not prove that the version was never published. |
+| `2` | The record cannot be read/decoded, or the invocation is invalid. Correct the path, access, CLI compatibility, or command. |
+| `3` | Observation remains unresolved, including insufficient evidence or cancellation. Correct the transport or other reported cause before another explicit observation; do not blindly republish. |
+
+These are recovery actions after failure, not read-back requirements after a
+successful push. A failed observation leaves the result unresolved. Do not poll
+CI or move a tag to settle uncertainty.
+
+When no usable record exists (for example, storage failed or an older CLI made
+the attempt), use the captured endpoint and exact tag-object ID from the original
+report for a manual authoritative observation. Checking only the peeled commit
+would not establish that the intended annotated tag object arrived. Do not
+substitute current profile or local tag state for missing original evidence.
+
+Only after establishing that a retained local tag was never published or used
+by another release channel may it be removed before retrying publication:
 
 ```sh
-authoritative='COPY_CAPTURED_ENDPOINT'
 release_version='vMAJOR.MINOR.PATCH'
-test "$(git ls-remote --get-url -- "$authoritative")" = "$authoritative" &&
-  git ls-remote --refs -- "$authoritative" refs/heads/main "refs/tags/$release_version"
-```
-
-A failed URL-equality check or remote query leaves the outcome unresolved.
-Correct transport configuration before continuing; a rewritten destination
-cannot establish absence at the captured endpoint.
-
-Compare the `main` object ID with the reported candidate commit and the tag
-object ID with the reported tag-object ID. `--refs` returns the annotated tag
-object itself, not merely its peeled commit. If the tag object matches, the
-release is published. If the query fails, the result is conflicting, or the
-endpoint or candidate differs, stop and resolve the state before retrying. If
-the endpoint is reachable, the tag is confirmed absent, and `main` still equals
-the reported candidate, remove a retained local tag only after confirming it
-was not published or used by another channel; then rerun `publish`, which
-revalidates the candidate:
-
-```sh
 git tag -d "$release_version"
-"$releasekit_bin" publish "$release_version"
+go tool releasekit publish "$release_version"
 ```
 
+Replace the placeholder with the original attempt's version.
+The next `publish` revalidates the candidate and publication guards. A conflicting
+published tag must never be moved or reused. A defect in published source
+requires a corrected commit, a new appropriate version, and a matching note.
 A validation failure after the candidate reached `main` leaves an untagged
-candidate there. Correct it with a new commit rather than rewriting or rolling
-back `main`. A conflicting published tag must never be moved or reused. A
-defect in published source requires a corrected commit, a new semantically
-appropriate version, and a matching release note.
+candidate there; correct it in a new commit rather than rewriting `main`.
 
-## 6. Optional consumer verification
+## 7. Optional consumer verification
 
 When useful or requested, read back the remote tag or retrieve the exact
 version into a new module without a local `replace` directive. These checks are
@@ -228,8 +361,8 @@ consumer_dir=$(mktemp -d)
 (
   cd "$consumer_dir"
   go mod init example.invalid/configkit-release-check
-  GOPRIVATE=gitea.maximumdirect.net GOPROXY=direct go get "gitea.maximumdirect.net/eric/ConfigKit@$release_version"
-  go list -m -f '{{.Path}} {{.Version}}' gitea.maximumdirect.net/eric/ConfigKit
+  GOWORK=off GOPROXY=direct go get "go.maximumdirect.net/configkit@$release_version"
+  GOWORK=off go list -m -f '{{.Path}} {{.Version}}' go.maximumdirect.net/configkit
 )
 ```
 

docs/releases/v0.6.0.md

@@ -30,7 +30,7 @@ adopts ReleaseKit for source publication, and raises the consumer Go minimum to
   successful-tag-push completion point remain unchanged; CI is not a gate.
 - Adopt release policy 1.6, distinguishing the consumer Go minimum from the
   validation toolchain. Retire completed planning and measurement records into
-  Git history while preserving [performance candidates](../roadmap/future.md#5-performance-experiments).
+  Git history while preserving [performance candidates](../roadmap/future.md#3-performance-experiments).
 
 ## Compatibility and upgrade
 

docs/releases/v1.0.0.md

@@ -0,0 +1,144 @@
+# ConfigKit v1.0.0
+
+ConfigKit's first stable release completes the public API cleanup, moves the Go
+module to `go.maximumdirect.net/configkit`, and scopes configuration controls to
+the root of each source document. It also corrects presence, history, and
+sensitivity reporting and adds direct source lookup for successful and failed
+loads.
+
+This release includes intentional breaking changes from v0.10.2. The public Go
+API, documented configuration and resolution semantics, and structured diagnostic
+contracts now follow the [stable-release compatibility policy](../policy/release.md#versioning-and-compatibility).
+That policy includes the existing allowance for minor releases to raise the Go
+consumer minimum.
+
+## Upgrade from v0.10.2
+
+### Module path
+
+Update the dependency requirement and Go imports from
+`gitea.maximumdirect.net/eric/ConfigKit` to `go.maximumdirect.net/configkit`,
+selecting v1.0.0. The package name remains `configkit`.
+
+Go treats the two import paths as different packages with different named types.
+Coordinate the change with dependencies that exchange ConfigKit values with your
+application. Earlier tags retain their original module declarations; no old-path
+compatibility module is provided. See the
+[module migration guide](../consumers/README.md#vanity-module-path-migration).
+
+### Source-document controls
+
+Rename genuine source-root `configkit` control blocks to `config` in main files,
+imported fragments, underlays, selected overlays, and programmatic mapping inputs.
+The recognized controls remain `imports` and `sequences`, subject to their
+existing context-specific rules and import opt-in.
+
+The control name is reserved only at the root of each acquired document. ConfigKit
+extracts controls before placing that document's payload. Nested `config` keys,
+including those in sequence records, are ordinary application data. Application-root
+`config` data produced by placement, defaults, CLI overrides, or resolution is
+also ordinary data and is not interpreted again as controls.
+
+Review source-root application fields already named `config`: move, rename, or
+separately mount that data. The former names `configkit` and `_configkit` are now
+ordinary application keys at every depth, with no control aliases. A permissive
+schema can therefore accept an unmigrated control block as data without executing
+its imports. Stored source-local declaration paths change from `/configkit/...`
+to `/config/...`.
+
+Source-version checks distinguish actual source-local controls from application
+paths with the same spelling. Existing inheritance rules remain in place. See
+[imports and control scope](../config.md#declaration-and-selection-rules) and
+[the directive migration guidance](../config.md#earlier-directive-spelling).
+
+### Public Go API
+
+The following names replace their pre-v1 counterparts outright, without
+compatibility aliases:
+
+| Previous API | v1.0.0 API |
+| --- | --- |
+| `Resolution.InputInfo(path)` | `Resolution.EntryInfo(path)` |
+| `Definition.Secret` | `Definition.Sensitive` |
+| `SourceVersionModeDefault` | `SourceVersionModeMainOnly` |
+| `SourceVersionCheck` | `SourceVersionEvidence` |
+| `SourceInfo.VersionCheck` | `SourceInfo.VersionEvidence` |
+| `ImportSelection` | `EmptyImportSelection` |
+| `SourceInfo.ImportSelections` | `SourceInfo.EmptyImportSelections` |
+| `SourceInfo.DestinationUnresolved` | `SourceInfo.DestinationIsFallback` |
+| `ImportDefaults.Follow` / `.Hidden` | `FollowSymlinks` / `IncludeHidden` |
+| `Paths(paths...)` | `SearchPaths(paths...)` |
+| `LoadSecretsDir(directory)` | `LoadSecretsIntoEnvironment(directory)` |
+| `LayerBase` | `LayerMain` |
+| `CodeExplainLimitExceeded` | `CodeHistoryLimitExceeded` |
+| `Resolution.Record(path, ChangeDerivedDefault, reason, deps...)` | `Resolution.RecordDerivedDefault(path, reason, deps...)` |
+| `Resolution.Record(path, ChangeNormalization, reason, deps...)` | `Resolution.RecordNormalization(path, reason, deps...)` |
+
+The recording methods describe mutations the application has already performed;
+they do not assign values. `Default` and `Normalize` remain the helpers that both
+assign and record. `EntryInfo` names the fixed resolution-entry metadata view,
+including defaults and CLI assignments. Version evidence records what was
+observed, not proof of checker execution or acceptance.
+
+The redundant `ImportSelection.Outcome`, `ImportSelectionOutcome`, and
+`ImportSelectionNone` are removed. Empty-selection records retain their selector,
+path, and location. The obsolete diagnostic constants `CodeResolveInvalidKind`
+and `CodeOptionsUnavailable` are also removed without replacements.
+
+Update stored or compared strings as well as Go symbols:
+
+- The main provenance layer changes from `"base"` to `"main"`.
+- The retained-history limit diagnostic changes from
+  `"explain.limit_exceeded"` to `"history.limit_exceeded"`.
+
+The YAML import options `follow` and `hidden`, the `configkit:"secret"` Go tag,
+and typed `Secret` references retain their existing spelling and behavior. See
+the [API migration guide](../consumers/README.md#pre-v1-public-api-cleanup) for
+the consolidated mapping and usage guidance. Rebuild and run your application's
+configuration tests after migrating its imports, API calls, and source controls.
+
+## Source inspection
+
+`Result.Source(id)` and `LoadError.Source(id)` return a detached `SourceInfo`
+record and a found flag for an already acquired source. They complement
+`Sources()` and the existing callback-scoped `Resolution.Source(id)`. Empty or
+unknown IDs return false. Lookup does not reopen inputs or resolve credentials;
+failed loads retain the same partial, conservatively redacted evidence as their
+source inventory. See [results and failures](../config.md#results-and-failures).
+
+## Correctness and internal improvements
+
+- Resolution presence queries distinguish numeric mapping keys from sequence
+  indexes using the configuration's entry shape. A later shape change no longer
+  transfers input explicitness to a different semantic path.
+- Metadata history and value explanations now use one shared internal history
+  model. This corrects attribution across shape changes, preserves container
+  origins, and avoids duplicate intermediate source-history records.
+- Final dynamically typed secret fields retain their sensitivity classification
+  in inspection output. Parsed dependency paths are deduplicated without losing
+  distinctions needed for sensitivity propagation.
+- Composition-conflict diagnostics preserve claimant order through structured
+  reporting and rendering, consistent with scoped assembly order.
+- History selection and explanation use indexes and reuse prepared selections
+  and sensitivity dependencies to reduce repeated traversal. Retained-history
+  accounting follows the shared model, and secret resolution and validation share
+  traversal machinery.
+
+These changes preserve the documented loading and inspection rules apart from
+the explicit migrations above. No end-to-end performance improvement is claimed.
+The [configuration contract](../config.md) and public Go declaration comments
+remain the behavior references.
+
+## Requirements and release delivery
+
+The consumer minimum rises from Go 1.26.0 to Go 1.27.0. Consumers must upgrade
+their Go toolchain before adopting this release. The YAML dependency is unchanged.
+Linux amd64 and arm64 remain the release-validated targets; macOS support remains
+best-effort under the [platform support policy](../policy/release.md#platform-support).
+
+Release tooling moves to `go.maximumdirect.net/releasekit` v0.6.0. Beginning with
+this release, the source tag and checked-in note are accompanied by a Gitea release
+page containing the complete note and licensing footer. Source publication and
+hosted delivery remain separate outcomes under the [release procedure](../release.md).
+
+[COPYRIGHT](https://forge.maximumdirect.net/base-layer/configkit/src/tag/v1.0.0/COPYRIGHT) | [LICENSE](https://forge.maximumdirect.net/base-layer/configkit/src/tag/v1.0.0/LICENSE) | [ATTRIBUTION](https://forge.maximumdirect.net/base-layer/configkit/src/tag/v1.0.0/docs/oss/attribution.md)

docs/releases/v1.1.0.md

@@ -0,0 +1,79 @@
+# ConfigKit v1.1.0
+
+ConfigKit now accepts field-level resolution records inside lists and follows
+registered records across position changes when reporting their provenance and
+history. This release also standardizes more release validation on ReleaseKit.
+
+## Field-level resolution in lists
+
+Applications can normalize or derive a field inside a list and record that
+field directly. For example, changing `/resources/0/path` can be covered by
+`RecordNormalization` at that path, without recording the entire `/resources`
+list when no other changes require coverage.
+
+For ordinary lists of equal length, resolution auditing compares corresponding
+positions recursively. Positions are addresses; ConfigKit does not infer an
+element's identity from similar values. A length change still requires a record
+for the list or an ancestor.
+
+For collections registered through `Definition.SequenceIdentities`, ConfigKit
+matches records between the resolution-entry and final snapshots when both
+endpoints have valid, unique identities. Field edits can be recorded individually.
+Changes to identity order or membership still require list or ancestor coverage;
+changing an identity is treated as removal and addition. When matching is
+unavailable, a changed registered collection is audited as a whole. Existing
+final identity validation remains in place, allowing resolution to repair entry
+values.
+
+See [recorded application resolution](../config.md#recorded-application-resolution)
+for the complete rules.
+
+## Matched history and inspection
+
+For eligible registered collections, inspection at a surviving record's final
+position follows its own entry evidence, including earlier values, input
+explicitness, and source attribution. A record no longer inherits the evidence
+of a different record that previously occupied its final position. Original
+source coordinates remain intact, while reported operation paths follow the
+matched final record.
+
+Collection inspection retains removed records' evidence. Removed fields of
+surviving moved records remain available through metadata history and
+explanation, including deep inherited fields. Sensitivity propagation protects
+matched and removed evidence and recorded dependencies; detached before/after
+snapshots remain conservatively masked.
+
+Correspondence lookup, sensitivity propagation, and resolution-change ordering
+reuse indexes, a work queue, and prepared pointer strings to avoid repeated
+prefix construction, full-map passes, and formatting during sorting. No
+end-to-end performance improvement is claimed.
+
+## Compatibility
+
+This is a backward-compatible extension of resolution auditing and inspection.
+Existing callbacks that record a whole list remain supported. Records and helper
+targets for surviving values refer to final positions; helpers do not follow
+later moves automatically. `Resolution.EntryInfo` and `Resolution.IsExplicit`
+retain their fixed entry-snapshot meaning.
+
+Public effective-configuration diffs continue to report list changes atomically.
+Source composition, collection merge operations, configuration syntax, and public
+path addressing are unchanged. No new public Go symbols are required.
+
+The consumer minimum remains Go 1.27.0, and the YAML dependency is unchanged.
+Linux amd64 and arm64 remain release-validated; macOS remains best-effort.
+
+## Release tooling
+
+ReleaseKit advances from v0.6.0 to v0.8.0. The runbook uses the module-selected
+`go tool releasekit` command and documents saved publication attempts and
+reconciliation after failed or uncertain tag pushes.
+
+ReleaseKit now checks committed Markdown links and rejects filesystem dependency
+replacements during candidate validation. The custom documentation-link Go test
+is removed, so automated link feedback occurs during candidate validation rather
+than ordinary Go tests. Source publication and hosted Gitea delivery remain
+separate outcomes; CI remains outside release gates. See the
+[release procedure](../release.md).
+
+[COPYRIGHT](https://forge.maximumdirect.net/base-layer/configkit/src/tag/v1.1.0/COPYRIGHT) | [LICENSE](https://forge.maximumdirect.net/base-layer/configkit/src/tag/v1.1.0/LICENSE) | [ATTRIBUTION](https://forge.maximumdirect.net/base-layer/configkit/src/tag/v1.1.0/docs/oss/attribution.md)

docs/roadmap/future.md

@@ -6,15 +6,7 @@ plans, or release commitments. Adopting a candidate requires an explicit design
 decision and a separate plan. Significant architectural exclusions and their rationale belong
 in ADRs; this document does not maintain a list of rejected proposals.
 
-## 1. Separate glob entry preparation from traversal
-
-Implemented in the [internal-boundary roadmap](internal-boundaries.md#glob-entry-preparation) (C03).
-
-## 2. Simplify redundant facade-to-engine transport
-
-Implemented in the [internal-boundary roadmap](internal-boundaries.md#facade-to-engine-transport) (F07).
-
-## 3. Recursive body merging for identified records
+## 1. Recursive body merging for identified records
 
 Status: deferred. The implemented
 [collection policy](../config.md#strict-document-composition) uses `upsert` to
@@ -28,7 +20,7 @@ presence and ordering, and how provenance, history, sensitivity, and resource
 context follow partially retained records. Any change requires a new decision and
 implementation plan; this entry does not alter current upsert behavior.
 
-## 4. Required version declarations for selected sources
+## 2. Required version declarations for selected sources
 
 Status: deferred. PromptKit requested a way to require version declarations on
 a selected subset of source files while permitting other fragments to omit them.
@@ -64,7 +56,7 @@ compatible version or replace final configuration validation.
   behavior for absent optional inputs and preserve source-local diagnostics,
   inspection evidence, and existing sensitivity handling.
 
-## 5. Performance experiments
+## 3. Performance experiments
 
 Status: deferred pending evidence. The completed performance audit identified
 four internal optimization candidates for separate investigation:
@@ -91,3 +83,22 @@ evidence are preserved in Git history at `8e91a2b` under `docs/roadmap/`.
   across loads without introducing aliasing?
 - What cache lifetime and concurrency design would make schema reuse worthwhile
   without excessive retained memory?
+
+## 4. Public path comparison
+
+Status: deferred pending a concrete consumer need. This preserves A2 from the
+completed API review at `68400ff:docs/roadmap/review.md`.
+
+`Path.String()` is a JSON Pointer spelling, not a complete semantic identity:
+an explicit numeric mapping key and a sequence index can share it. The public
+type is opaque and currently non-comparable.
+
+If consumers need comparison, consider a small exact-representation operation
+rather than exposing mutable segments or introducing a pattern language. A
+proposal must distinguish exact segment representation, including parsed versus
+explicit segments and invalid state, from resolution against a document. Pointer
+string equality must not be presented as semantic equality.
+
+Keeping `Path` solely as an opaque query/building value remains an alternative.
+No current contract changes or implementation commitment follow from this entry;
+a comparison operation can be added compatibly later.

docs/roadmap/implementation.md

@@ -1,296 +0,0 @@
-# Import Discovery And Facade Simplification Implementation Plan
-
-Status: complete.
-Baseline: `bb5540b62e382106d59678e2edb7655acfd5c960`.
-Audience: a Luna coding agent implementing the stages sequentially.
-
-## Scope And Execution
-
-Implement **C03** and **F07** from the
-[internal-boundary roadmap](internal-boundaries.md). That document owns the target
-state and preservation requirements; this plan owns concrete private choices,
-steps, validation, and progress. The preceding 29-finding remediation sprint is
-complete. Its implementation record remains at
-`bb5540b:docs/roadmap/implementation.md`; this plan does not reopen it.
-
-Read `AGENTS.md`, [agent policy](../policy/agents.md), the [development
-guide](../development.md), and applicable architecture, testing, and documentation
-policies. Use graph-first discovery and verify actual callers before deleting
-helpers. Preserve unrelated work.
-
-This is one end-to-end sprint. Intermediate stages may fail to compile, especially
-the coordinated engine/facade cutover in Stages 2–3. Do not create adapters,
-aliases, duplicate paths, or extra abstractions solely to make intermediate
-stages green. Run focused checks once their affected surface is buildable; record
-pending checks and finish them before final acceptance. Commit focused nonempty
-units under repository policy and record stage status, actual validation, and
-known commit identifiers here. Completion requires the integrated result, not
-just checked-off stages.
-
-### Boundaries
-
-- Preserve public root-owned declarations and signatures, YAML syntax, loading
-  semantics, ordinary/layered differences, callback order, diagnostics, source
-  identity, inspection, confidentiality, and ownership.
-- Preserve glob literal-versus-discovered rules and directory/glob differences.
-  Keep completed-link reuse, directory failure phases, containment, and existing
-  accounting. This is not a discovery algorithm or permission-policy change.
-- Keep `resolvedImportPolicy`, registration compilation, normalized request
-  responsibilities, and conversions with real ownership or domain meaning.
-  Simplification is limited to defaults transport and placement construction.
-- Add no dependencies, caller controls, caches, limits, background work, release
-  gates, or performance promises. Do not publish a release, update consumers, or
-  revise accepted ADR decisions.
-
-### Selected Ownership Model
-
-Use the existing engine `ImportDefaults` name and its exported `Required`,
-`Follow`, `Hidden`, `Recursive`, and `Pattern` fields as the sole engine
-input-defaults type. Root `ImportDefaults` stays separately defined. Root
-conversion maps the fields without cloning them; the public loading wrappers
-immediately enter engine preflight. `loadSettings` takes the per-load snapshot
-before acquisition or callbacks, as it already does. The normalized request and
-acquisition policy then borrow that load-owned read-only value.
-
-Declaration resolution reads the owned defaults and retains its existing copies
-of selected pattern/exclusion slices and destinations in `resolvedImportPolicy`.
-This separates presence-aware load input from independently owned effective
-declaration policy. No public copy-count or thread-safety guarantee follows.
-
-For placement, expose the engine's existing enum as `PlacementMode uint8` with
-`PlacementModeMapping` and `PlacementModeSequenceItem`, and expose placement
-fields on engine input/options records for direct construction. These remain
-internal-package implementation surfaces. Root types stay root-owned; direct
-casts preserve unknown values for existing preflight validation.
-
-### Validation Conventions
-
-Run from the repository root with an installed compatible Go toolchain and
-dependencies already available. Use `GOTOOLCHAIN=local`, `GOPROXY=off`, and
-`GOTELEMETRY=off`. Keep disposable artifacts outside the repository and do not
-change dependencies for tooling. Focused expressions identify behavior owners;
-include a newly named regression explicitly if needed. Reuse unchanged successful
-checks. No timing, allocation, exact syscall, or helper-shape assertions are
-acceptance criteria.
-
-## Stage 1 — Extract Patterned Glob Entry Preparation
-
-Finding: **C03**. Owners: `internal/engine/glob.go`, existing glob selection,
-link, and directory failure tests. Status: **complete**. Validation passed:
-`env GOTOOLCHAIN=local GOPROXY=off GOTELEMETRY=off go test ./internal/engine -run 'Glob|Directory|Link|Filesystem|Resource'` and `git diff --check`.
-
-1. Add `prepareGlobEntry` beside the selector. Take the filesystem access,
-   base path, parent `selectedImportCandidate`, `fs.DirEntry`, pattern segment,
-   `last` flag, and `resolvedImportPolicy`. Return a candidate, a boolean meaning
-   selected versus ordinary skip, and a nullable `*Diagnostic`. Use the parent's
-   existing `site`, which is propagated from the selector's root candidate.
-   No candidate-set, accounting, or traversal-state mutation belongs here.
-2. Move only the patterned branch's per-entry body into this helper. Preserve
-   its order: `path.Match`; match/hidden filtering; lexical/access path creation
-   and containment; `importEntryTarget` and existing diagnostic translation;
-   follow filtering; intermediate-directory eligibility; host/native physical
-   path selection and canonicalization fallback; candidate label/site creation.
-   Return existing safe codes, paths, and sites. Do not turn inspection errors
-   into skips or skip validation merely because exclusion will later match.
-3. Replace that inline body with the helper call and candidate insertion.
-   Leave pattern validation, `explicitGlobCandidate`, directory enumeration,
-   per-segment union/sorting, final-file validation, exclusions, requiredness,
-   and source-admission timing in the selector.
-4. Keep directory entry preparation separate. Reuse existing filesystem/link
-   primitives; do not introduce a generic entry strategy or unify differing
-   missing-target, literal-link, filtering, or recursion rules. Remove imports
-   only when genuinely unused after extraction.
-
-Acceptance: the selector now expresses traversal without embedding preparation
-details. Reuse `glob_selection_test.go`, `glob_test.go`, filesystem-link tests,
-and the preceding sprint's directory-phase regressions. They must still cover
-literal hidden/link components versus wildcard filtering, aliases and native
-spelling, escaping/cyclic links, matched-directory errors before exclusion,
-selection order, and bounded accounting. Add a behavioral case only for a gap
-identified during extraction, not a unit test asserting the new helper exists.
-
-Focused check:
-`go test ./internal/engine -run 'Glob|Directory|Link|Filesystem|Resource'`.
-
-## Stage 2 — Consolidate The Engine Defaults Representation
-
-Finding: **F07**, engine representation. Owners: `internal/engine/import_spec.go`,
-`load.go`, `layered.go`, `load_request.go`, `acquisition.go`, `options.go`, and
-their callers/fixtures. Status: **complete**. Validation passed:
-`env GOTOOLCHAIN=local GOPROXY=off GOTELEMETRY=off go test ./internal/engine -run 'Import|Glob|Directory|SourceVersion'` and `git diff --check`. Root facade callers remain pending Stage 3.
-
-1. Retain engine `ImportDefaults` with its existing five exported fields.
-   Remove private `importDefaults`, without a compatibility alias. Update
-   engine option/request/acquisition fields, helper signatures, readers, and
-   fixture literals to use the canonical type and exported default-field names.
-   Private containing fields such as `loadRequest.importDefaults` can keep their
-   names. Do not rename the distinct fields of `importDeclarationSpec` or
-   `resolvedImportPolicy` just because they have similar meanings.
-2. Expose `ImportDefaults ImportDefaults` on engine `Options[T]` and
-   `LayeredOptions[T]`. Remove `OptionsWithImportDefaults`,
-   `LayeredOptionsWithImportDefaults`, and `privateImportDefaults`. Stage 3 changes
-   root callers; a temporary compile failure is preferable to an interim bridge.
-3. Adapt `snapshotImportDefaults` to the canonical type, retaining nil boolean
-   pointers and nil versus non-nil empty pattern. Keep `cloneBool` and
-   `cloneStrings` where they still have real consumers. Keep current snapshot
-   call sites until Stage 3 establishes their final ownership placement.
-4. Keep effective declaration policy resolution and validation semantics intact:
-   explicit false beats defaults, each control resolves independently, and
-   selector-specific applicability and depth checks stay unchanged. Do not
-   combine defaults with resolved policy or registration compilation.
-
-Acceptance: one engine input-defaults type reaches every production path and
-fixture; no equivalent private record or alias remains. Inspect ordinary,
-layered, transitive-import, directory/glob, and test-helper call sites. The root
-cutover and removal of redundant snapshots are explicitly pending until Stage 3.
-
-Run the import/default focused tests after Stage 3 if the root cutover prevents
-building the package here; do not report that deferred check as passed.
-
-## Stage 3 — Simplify Facade Defaults Construction And Snapshot Ownership
-
-Finding: **F07**, defaults handoff. Owners: root `conversion.go`, `lifecycle.go`,
-`layered.go`; engine defaults/preflight/coordinator owners; `facade_import_defaults_test.go`
-and `internal/engine/import_spec_test.go`. Status: **complete**. Validation passed:
-`env GOTOOLCHAIN=local GOPROXY=off GOTELEMETRY=off go test ./internal/engine -run 'Import|Glob|Directory|SourceVersion'`, `env GOTOOLCHAIN=local GOPROXY=off GOTELEMETRY=off go test . -run 'ImportDefaults|FacadeImport|SourceVersion'`, `env GOTOOLCHAIN=local GOPROXY=off GOTELEMETRY=off go test ./...`, `env GOTOOLCHAIN=local GOPROXY=off GOTELEMETRY=off go test -race ./...`, and `git diff --check`.
-
-1. Set engine `ImportDefaults` fields directly in root `toEngineOptions` and
-   `toEngineLayeredOptions`. Retain `toEngineImportDefaults` as the explicit
-   root-to-engine type mapping, but map its booleans/pattern without copies.
-   Remove root `cloneImportDefaultBool` and `cloneImportDefaultStrings` after
-   confirming no other caller. Keep public root types and declaration contracts.
-2. Keep `snapshotImportDefaults` in `loadSettings` as the load-entry ownership
-   operation for both APIs. Remove repeated snapshots in engine `LoadLayered`
-   request construction, `executeLoadRequest` acquisition-policy construction,
-   and `resolveImportPolicy`. Carry the owned defaults read-only thereafter.
-   Review all callers of those helpers, including test setup; direct declaration
-   resolution can read its input because it returns its own concrete policy.
-3. Keep per-policy copies of the selected pattern, exclusions, and destination.
-   Do not borrow caller-owned storage beyond preflight, mutate the shared owned
-   defaults, or remove copying from unrelated option/record paths. Each new load
-   snapshots its own current inputs; add no reuse cache or ownership flag.
-4. Replace the private conversion-snapshot fragment in
-   `TestImportDefaultsPreserveEmptyPatternAndRequiredness`, which converts options,
-   mutates inputs, and calls engine `Load`. It should no longer demand a snapshot
-   from a private conversion helper. Keep that test's public nil/empty,
-   requiredness, and inspection-evidence checks.
-5. Protect the public snapshot contract with a compact ordinary/layered table:
-   use a main document with a version and imports, enable
-   `SourceVersionModeIfPresent`, and use a configuration type with version and
-   imported-value fields. In the main version-check callback, mutate the caller's
-   recursive default from true to false and its existing pattern element from
-   `*.cfg` to `*.skip`. This callback runs after preflight but before imported
-   discovery. Verify the original recursive/pattern selection still supplies a
-   value from a nested imported file. Use existing fixture helpers and no
-   concurrent mutation. A subsequent load with those changed defaults must omit
-   that imported contribution rather than reuse the prior snapshot. Keep fixtures
-   reusable or create fresh readers for each load.
-6. Reuse or extend the small snapshot/policy tests for all four optional booleans,
-   explicit false, pattern mutation, nil, and non-nil empty pattern. Preserve
-   existing invalid-pattern-before-read/hook tests and declaration override,
-   transitive, underlay, and selected-overlay coverage. Do not assert exact copy
-   counts, pointer identities, or the private conversion boundary as public policy.
-
-Acceptance: the engine/facade cutover builds; public defaults remain detached
-before acquisition/callbacks, reused loads remain independent, and only genuine
-ownership copies remain. Confirm the absence of full defaults snapshots at the
-three removed downstream sites by source review, not production instrumentation.
-
-Focused checks:
-`go test ./internal/engine -run 'Import|Glob|Directory|SourceVersion'` and
-`go test . -run 'ImportDefaults|FacadeImport|SourceVersion'`.
-
-## Stage 4 — Construct Placement Directly Across The Facade
-
-Finding: **F07**, placement handoff. Owners: engine `destination.go`, `load.go`,
-`layered.go`, normalized input and placement consumers; root `lifecycle.go`,
-`layered.go`, and placement fixtures. Status: **complete**. Validation passed:
-`env GOTOOLCHAIN=local GOPROXY=off GOTELEMETRY=off go test ./internal/engine -run 'Destination|Placement|Item|SourceVersion'`, `env GOTOOLCHAIN=local GOPROXY=off GOTELEMETRY=off go test . -run 'Placement|Destination|SourceInfo|SourceVersion|PublicFacadeBoundary|DependencyImportBoundary'`, `env GOTOOLCHAIN=local GOPROXY=off GOTELEMETRY=off go test ./...`, and `git diff --check`.
-
-1. Rename the existing engine enum and its constants to `PlacementMode`,
-   `PlacementModeMapping`, and `PlacementModeSequenceItem`, preserving underlying
-   `uint8` values and zero semantics. Use the same type throughout engine
-   placement parsing, normalization, acquisition, source evidence, and version
-   projection. Do not add a second raw-mode record or type alias.
-2. Expose engine `Options[T].Destination` and `.PlacementMode`, and
-   `Input.PlacementMode`. Normalized `loadInput` and other private owner fields
-   can retain their names. Populate the normalized input from those fields.
-   Remove `OptionsWithPlacement` and `InputWithPlacement` and migrate all callers,
-   including the direct engine construction in root `records_test.go`.
-3. In root `toEngineOptions` and `toEngineInput`, set destination using the existing
-   `toEnginePath` conversion and placement using
-   `engine.PlacementMode(options.PlacementMode)` or its input equivalent.
-   Preserve invalid enum values for `normalizeInput` to diagnose before reads.
-   Do not add validation/defaulting to the facade or a new setter/cast function.
-4. Preserve normalization of literal/parsed destination keys, root-item rejection,
-   wrapper accounting, mounted/item source coordinates, and version projection.
-   Root `Path` is immutable and `toEnginePath` carries its private engine value;
-   keep normalization and actual mutable ownership copies. Do not redesign path
-   conversion or add redundant clones solely to replace the deleted decorator.
-5. Leave source-result transport such as `SourceInfoPlacementModeForFacade`,
-   source-version conversion, sequence registration preparation, and opaque
-   records alone. They are not input setters targeted by this step. Adapt tests
-   mechanically to new engine construction without weakening public assertions.
-
-Acceptance: both public loading APIs retain zero/mapping and sequence-item
-placement, errors before input consumption, final values, source metadata, and
-history. Reuse the public placement tests plus destination/accounting,
-item-import, mounted-version, and invalid-option cases. Root signatures still
-contain no engine types, and engine exports remain below the internal boundary.
-
-Focused checks:
-`go test ./internal/engine -run 'Destination|Placement|Item|SourceVersion'` and
-`go test . -run 'Placement|Destination|SourceInfo|SourceVersion|PublicFacadeBoundary|DependencyImportBoundary'`.
-
-## Stage 5 — Integrate, Document, And Verify The Result
-
-Findings: final acceptance for **C03, F07**. Status: **complete**. Validation
-passed on Linux/amd64 (Go 1.26.10):
-`env GOTOOLCHAIN=local GOPROXY=off GOTELEMETRY=off ./scripts/check.sh`,
-`env GOTOOLCHAIN=local GOPROXY=off GOTELEMETRY=off go test -race ./...`, and
-`git diff --check`. Existing integration coverage was reviewed; no additional
-case was needed.
-
-1. Review both paths together: defaults resolving wildcard discovery in ordinary,
-   layered, and transitive imports; placement carrying the resulting sources
-   through composition and inspection; and failures stopping before later hooks.
-   Existing integration tests own these interactions. Add only a concrete missing
-   case rather than a second copy of the complete matrix or a new fixture framework.
-2. Inspect the resulting handoffs. Confirm the glob selector no longer embeds
-   per-entry preparation, the engine has one defaults input type, direct fields
-   replaced the four input decorators, and the load snapshot is not repeated at
-   each private representation. Keep domain-specific policy/registration and
-   root conversion boundaries, necessary ownership copies, and existing budgets.
-3. Update `docs/internal/imports.md` for the selector/preparation split and
-   `docs/internal/overview.md` for defaults conversion, preflight snapshot ownership,
-   and direct placement construction. Keep algorithms private and avoid public
-   performance or copy-count guarantees. No ADR/policy change is needed.
-4. Replace C03/F07 detail in the first two `docs/roadmap/future.md` entries with
-   short pointers to `internal-boundaries.md`. Retain their heading anchors for
-   existing audit links; leave other future candidates unchanged. Correct old
-   roadmap references that would otherwise mistake this replacement plan for
-   the previous sprint's completed record: use
-   `bb5540b:docs/roadmap/implementation.md` for that historical plan. Do not reopen
-   the prior audit or retire unrelated planning records in this sprint.
-5. Format changed Go files, finish deferred checks, run the final checks below,
-   and inspect the complete diff for API, dependency, semantics, or scope changes.
-   Record actual results and platform limitations here. Commit focused nonempty
-   units and hand off a clean workspace; do not create empty validation commits.
-
-Final validation, following the existing development guide:
-
-```sh
-env GOTOOLCHAIN=local GOPROXY=off GOTELEMETRY=off ./scripts/check.sh
-env GOTOOLCHAIN=local GOPROXY=off GOTELEMETRY=off go test -race ./...
-git diff --check
-```
-
-The everyday check includes consumers, documentation links, and public/dependency
-boundary tests. Confirm those existing tests ran rather than adding redundant
-final invocations. Report filesystem/platform skips accurately; express macOS
-validation, CI completion, release publication, extended fuzz campaigns, and
-benchmarks are not additional acceptance requirements.
-
-No product or architectural question remains open. The concrete choices above
-complete the plan without changing the roadmap's public contracts; private
-formatting and file organization can follow local idiom.

docs/roadmap/interface-remediation.md

@@ -1,346 +0,0 @@
-# Interface Contract Remediation Roadmap
-
-Status: target settled, including shared history ownership; implementation has
-not begun.
-Planning baseline: `1f64673` (v0.10.2 implementation plus documentation changes).
-
-This roadmap covers the four findings in the [interface audit](interfaces.md).
-The audit owns reproductions, evidence, and finding numbers. This document owns
-the combined target, required changes, and general dependency order. A subsequent
-implementation plan should own concrete stages, private implementation choices,
-validation commands, and progress.
-
-## Purpose And Scope
-
-Restore agreement between ConfigKit's presence, metadata, history, and diagnostic
-interfaces under their existing contracts. The first three findings concern
-semantic paths that share a JSON Pointer spelling; the fourth concerns a
-composition claimant order that is lost during diagnostic canonicalization.
-
-Build one shared internal history model from which metadata history and
-explanation are derived. It will own the historical evidence and semantic
-attribution used by both views, replacing their independent reconstruction of
-that attribution. This is the selected resolution of OD-1.
-
-The [Path declarations](../../path.go), [metadata contract](../config.md#layered-metadata),
-[resolution contract](../config.md#recorded-application-resolution), and
-[strict-composition contract](../config.md#strict-document-composition) remain
-authoritative. This work changes the implementation of those contracts without
-selecting a new public API, path syntax, precedence rule, or configuration
-restriction. The existing root-owned facade and engine responsibilities remain.
-
-## Current Baseline And Targeted End State
-
-An explicit mapping-key path and an explicit sequence-index path can both render
-as `/shape/0`. `ParsePath` deliberately leaves numeric tokens contextual, whereas
-`Keys` and `Index` preserve the caller's explicit choice. The engine already has
-shape-aware effective/historical path indexes and a frozen resolution-entry view,
-but some queries and metadata updates still use pointer spelling alone.
-
-History currently reconstructs definition and previous-origin records, while
-explanation replays source contributions, inheritance, decoding checkpoints, CLI
-assignments, and grouped resolution snapshots. Neither public representation
-contains everything needed by the other. The target is shared underlying evidence
-with distinct projections for each interface, preserving their existing behavior.
-
-| Finding | Current discrepancy | Target |
-| --- | --- | --- |
-| 1: resolution presence | `IsExplicit` and `Default` consult string-keyed presence after schema validation, which cannot determine actual shape beneath dynamic values. | Presence decisions use the matching semantic path in the fixed resolution-entry state. |
-| 2: effective explicitness | Resolution retains old field information when pointer spelling survives a container-shape change. | Input explicitness carries forward for the same semantic path; a newly introduced key or index does not inherit another path's explicitness. |
-| 3: history attribution | A historical-shape check admits the query, then `History` returns the entire textual-pointer bucket; explanation selects evidence separately. | Both interfaces derive attribution from one shared history model, selecting exact definitions, previous origins, and applicable ancestor operations by semantic path. |
-| 4: claimant order | Composition constructs related locations in assembly order, then canonicalization sorts them by location. | Structured and rendered composition conflicts preserve the selected claimant order. |
-
-For example, if input contains `shape: {'0': old}` and recorded application
-resolution changes `shape` to a sequence, the old key remains an input path in
-the callback's entry view. The new index is effective in final metadata but was
-not explicitly supplied by that input. Its history must not present the old key's
-definition as its own. This distinction concerns container shape, not identity
-tracking for records that move within a sequence.
-
-## Required Changes
-
-### 1. Use Entry-State Shape For Resolution Presence
-
-In [resolution.go](../../internal/engine/resolution.go), align `IsExplicit` and
-the explicitness decision in `Default` with the frozen, shape-aware entry metadata
-already used by `InputInfo` in
-[load_metadata.go](../../internal/engine/load_metadata.go).
-
-Reuse the existing semantic-path matching machinery. A shared private lookup can
-avoid divergent presence decisions without requiring every public query to have
-identical error behavior. In particular:
-
-- Preserve `IsExplicit`'s schema-path validation and its existing diagnostics.
-  `InputInfo` remains a query that returns false for missing or mismatched paths
-  without those diagnostics.
-- Preserve `Default`'s helper-target validation, assignment, recording, and final
-  helper-value checks. Correct its presence gate; do not bypass the other checks.
-- Use entry-state shape even after application code changes the working value.
-  Explicit false, zero, empty, and null retain their existing presence meaning.
-- Keep callback lifetime and detached metadata behavior intact.
-
-A shape mismatch beneath a schema-valid dynamic path must not become explicit
-merely because its pointer spelling matches an input path. Contextually parsed
-numeric tokens continue to resolve against the entry state's actual containers.
-
-### 2. Preserve Explicitness By Semantic Path During Resolution
-
-Update resolution metadata application and field refresh in
-[load_metadata.go](../../internal/engine/load_metadata.go) to compare the relevant
-entry and final shapes before reusing presence information.
-
-The comparison must account for container kinds along the full path. A mapping
-key becoming a sequence index at an ancestor can change a descendant's semantic
-path even when its last segment and full pointer spelling stay unchanged.
-
-Keep explicitness for matching surviving paths, including descendants covered by
-an ancestor normalization record. New semantic paths introduced by resolution
-remain non-explicit, and retain the applicable recorded resolution origin.
-Removed paths leave effective metadata while remaining available to historical
-queries under the existing contract. Do not clear every descendant's presence
-just because its parent was normalized.
-
-Use the existing before/after projection and entry metadata where possible.
-This work does not require tracking every transient mutation inside a callback;
-the existing net-change and coalesced-record model continues to apply.
-
-### 3. Build A Shared Internal History Model
-
-#### Evidence And Ownership
-
-Give historical evidence one private owner in the engine. Composition,
-inheritance, decoding, CLI assignment, and resolution continue to perform their
-existing work and supply evidence to that owner. The model does not drive a
-second configuration load or repeat application callbacks.
-
-Organize the evidence into ordered groups with the phase boundaries required by
-the existing inspection contracts:
-
-| Evidence group | Information to preserve |
-| --- | --- |
-| Default baseline | Canonical typed application defaults or Go-zero values and their default attribution. |
-| Source contributions | Underlay, main-tier, and selected-overlay contributions in their existing order; exact definitions, composite origins, displaced definitions, raw policy-validated values, and sequence-position projections. |
-| Inheritance | Parent transfers, child contributions including equal-valued replacements, controlling directives and their consumption, identity-field preservation, and contribution origins/dependencies. |
-| Typed checkpoints | Pre-CLI and post-CLI typed projections and attribution needed to reconcile retained defaults and raw contributions with decoded values. |
-| CLI contributions | Explicit assignments, including equal-valued assignments, raw supplied representation, source attribution, and affected paths. |
-| Resolution | Original recorded operations, reasons, dependencies, and before/after evidence, with the grouping needed to explain overlapping records as net subtree changes. |
-
-The logical order remains baseline, source contributions, inheritance, pre-CLI
-decoding reconciliation, CLI contributions, post-CLI typed reconciliation, then
-recorded resolution. The two typed checkpoints belong on their respective sides
-of the CLI contribution phase.
-
-The groups describe logical inspection chronology, not a transcript of every
-physical mutation. Retain the existing net-change and coalescing rules for
-resolution. Preserve superseded raw input that need not decode into the final
-application type; typed checkpoints do not replace that evidence.
-
-Use a small set of ordinary private structures and existing document/path
-mechanisms. Exact types, indexes, and storage layout belong in the implementation
-plan. Complete evidence means enough for the existing history, explanation, and
-internal attribution consumers; it does not add persistence, a public event API,
-or recording of transient application effects.
-
-#### Shared Selection And Attribution
-
-Retain concrete semantic-path evidence when it is available. A query over the
-model must distinguish exact definitions from operations affecting an ancestor
-or descendant, determine the relevant previous origins, and apply sequence
-contribution coordinates at their assigned positions.
-
-The affected semantic path and the operation's reported path are distinct facts.
-For example, a replacement at `/shape` can remove a mapping key and introduce a
-sequence index with the same pointer spelling. Preserve enough before/after shape
-evidence to answer each explicit query correctly. Merely filtering `Change.Path`
-after concrete segment kinds have been discarded is insufficient.
-
-Make this selection and attribution common to both projections, including
-inheritance integration and `Previous` reconstruction. A false definition must
-not survive as a previous origin after it has been excluded from the query's
-history. Preserve genuine ancestor replacement/removal effects and chronology.
-A path that never existed does not acquire history solely because an ancestor
-changed.
-
-Keep the contextual meaning of parsed numeric tokens across historical states
-and the one-entry-per-canonical-pointer enumeration of `HistoricalPaths`.
-Indexes and compact derived records may remain, but their attribution must come
-from the shared evidence. Metadata queries should not require full configuration
-replay or YAML rendering to obtain definition and origin records.
-
-#### Distinct Public Projections
-
-`Metadata.History` produces detached definition, inheritance, and resolution
-records from the model. `Explain` reconstructs and safely renders values from
-the same evidence, retaining its existing decoding and grouping behavior. Neither
-public API should be implemented by translating the other's public result.
-
-Preserve these intentional differences:
-
-| Case | Metadata history | Explanation |
-| --- | --- | --- |
-| Several strict contributions to a mapping | Composite definition/origin information. | Each contribution's effect on the mapping. |
-| Raw input differs from canonical typed values | Definition and attribution records. | The applicable decoding reconciliation transition. |
-| Overlapping resolution records | Specific recorded attribution under the existing coverage rules. | One net subtree event with combined reasons and dependencies. |
-| Equal-valued input or inheritance operations | Explicit definition and operation attribution remains visible. | Relevant operations remain visible even when before and after values are equal. |
-
-Agreement means consistent semantic identity and attribution, not identical
-record lists. Retain original resolution records as evidence from which net
-replay groups are derived; a grouped explanation alone loses information needed
-by metadata.
-
-#### Replace Existing Attribution Machinery
-
-The common model must replace independent historical attribution, rather than
-become another representation alongside it. The implementation plan should map
-the following owners to their replacements:
-
-| Current owner | Required change |
-| --- | --- |
-| History-building portions of `metadataFromDecoded`, `applyOverlayMetadata`, and `appendPostDecodeCLIHistory` in [load_metadata.go](../../internal/engine/load_metadata.go) and [override_context.go](../../internal/engine/override_context.go) | Produce or project shared evidence instead of independently reconstructing pointer-keyed histories. Retain effective-field construction where it is still needed. |
-| Previous-origin reconstruction and inheritance insertion in [inheritance_history.go](../../internal/engine/inheritance_history.go) | Use common semantic selection and attribution while preserving the existing inheritance projection rules. |
-| Relevance and chronology orchestration in [explain.go](../../internal/engine/explain.go) | Consume the shared model; retain useful value reconstruction and redaction helpers. |
-| Separate published inheritance evidence for metadata and explanation in [load_result.go](../../internal/engine/load_result.go) | Consolidate under the frozen history owner where independent copies are unnecessary; keep required output detachment. |
-| Original and coalesced resolution evidence in [history.go](../../internal/engine/history.go) | Own original records in the model and derive the replay grouping without losing specific attribution or maintaining a second independently interpreted history. |
-
-Existing source, sequence-combination, and inheritance evidence producers may
-remain useful. Their algorithms need not be rewritten merely to contribute to
-the model. Likewise, final effective fields, the frozen resolution-entry view,
-source records, and final configuration snapshots retain their responsibilities.
-Findings 1 and 2 still require explicit presence corrections.
-
-#### Other Consumers, Lifetime, And Resource Accounting
-
-Move historical dependency reads in
-[secret classification](../../internal/engine/secret.go) and historical location
-fallbacks in [override_context.go](../../internal/engine/override_context.go) to
-the shared evidence. Do not retain the old history machinery solely for those
-readers. Preserve existing sensitivity propagation and historical classification;
-correcting attribution does not authorize narrowing redaction for paths that
-share a pointer spelling.
-
-Evidence must be available at the lifecycle stages where these internal readers
-need it, including diagnostic attribution before publication. Keep the callback's
-entry metadata fixed while later resolution evidence is added. Finalize the
-model for published queries without introducing lazy mutation of shared state.
-Private frozen evidence may be shared by the two views while their returned
-records remain detached under the existing ownership contract.
-
-Reuse retained trees and existing lookup machinery where practical. Review
-retained-history accounting against the resulting ownership graph, including
-typed checkpoints and inheritance/resolution evidence. The model does not require
-a full document copy per event, a new quota, or a new concurrency guarantee.
-Reduced duplication is a design benefit to evaluate, not a promised memory or
-speed improvement.
-
-### 4. Preserve Composition Claimant Order Through Diagnostics
-
-Keep the order produced by `compositionConflictDiagnostic` in
-[compose.go](../../internal/engine/compose.go) through accumulation, `LoadError`,
-facade conversion, and `WriteDiagnostics` in
-[diagnostic.go](../../internal/engine/diagnostic.go).
-
-Prefer a narrow internal canonicalization rule based on the diagnostic semantics
-already carried across these boundaries. Identify the composition diagnostic
-producers governed by the claimant-order contract rather than changing all
-related-location lists. Preserve canonical ordering of diagnostic records and
-the existing sorting of related locations for other diagnostics.
-
-The root renderer converts public diagnostic records back to engine records and
-canonicalizes them again. An engine-only marker discarded by facade conversion
-would therefore be insufficient. No public ordering option is needed for this
-correction. Keep primary selection, conflict detection, acquisition order, and
-dependency-ready scheduling unchanged.
-
-## General Implementation Order
-
-1. Prepare the concrete shared-evidence design and focused regression cases.
-   Map existing producers and consumers to the new owner, distinguish common
-   attribution from presentation rules, and identify the old paths to remove.
-   Select representations and indexes that preserve existing query and lifetime
-   needs without adding public contracts.
-2. Repair entry-state presence queries and `Default` (finding 1). This is a local
-   correction that can proceed independently of the larger history work.
-3. Repair final explicitness preservation (finding 2), retaining the shape evidence
-   needed by metadata updates. Coordinate this work with history construction so
-   the two fixes do not introduce competing definitions of path identity.
-4. Build the shared model and migrate metadata history, explanation, sensitivity
-   dependencies, and diagnostic-location readers. Preserve phase evidence and
-   derive both public projections through common semantic attribution. Remove
-   the superseded reconstruction paths and reconcile retained-history accounting.
-   Verify finding 3 and its interaction with final presence metadata; repairing
-   pointer buckets alone does not complete the selected architecture.
-5. Complete composition diagnostic ordering (finding 4) as an independent change;
-   it may proceed alongside the path work. Check rendering as well as the
-   structured error before considering it complete.
-6. Review the integrated result, run applicable development checks, and update
-   affected implementation documentation and finding status.
-
-These are high-level dependencies, not a requirement to combine unrelated fixes
-in one commit. The implementation plan should select concrete edits and test
-commands while keeping the four findings individually traceable.
-
-## Validation And Completion
-
-Follow the [testing policy](../policy/testing.md) and use the
-[development guide](../development.md#baseline-validation) for checks. Extend
-existing test owners rather than recreating full internal matrices at the facade.
-The focused cases should cover:
-
-- Both mapping-key/index mismatch directions beneath dynamic values, including
-  explicit paths and contextual parsed pointers. Check callback presence and
-  `Default` behavior, including the fixed entry view after working-value changes.
-- Both container-shape transitions during recorded resolution, a descendant
-  affected by an ancestor shape change, and a same-shape normalization control.
-  Check explicitness and recorded origins through final metadata and explanation.
-- Shape-changing CLI and resolution history, checking exact definitions,
-  `Previous`, and genuine ancestor replacement/removal. Include contextual
-  enumeration/query coverage and preserve existing inheritance and overlay cases;
-  add another case only where those integrations expose an unprotected risk.
-- Shared-model projections across composite mapping origins, typed decoding and
-  default reconciliation, equal-valued writes, inheritance controls/transfers,
-  mapped sequence replacements and removed descendants, and overlapping
-  resolution records. Reuse existing cases where they protect those semantics;
-  check the intentional differences between the public projections as well as
-  agreement on attribution.
-- Historical sensitivity/dependency propagation, diagnostic source-location
-  fallback, detached returned records, and complete retained-history accounting
-  under the new ownership graph. Use small controlled budget cases and existing
-  disclosure fixtures rather than memory or timing thresholds.
-- A composition conflict whose acquisition and assembly orders differ, using the
-  audit fixture. Check both published diagnostics and rendered related-location
-  order, while retaining coverage for ordinary diagnostic canonicalization.
-
-Retain existing checks for invalid schema paths, callback lifetime, detached
-records, safe historical rendering, and default/null presence semantics. Test
-observable behavior rather than a particular private index or number of copies.
-No benchmark campaign, broader audit, or new release gate is part of this roadmap.
-
-Completion requires all four findings to have implementation and regression
-evidence, appropriate development checks, and both history interfaces deriving
-semantic attribution from the shared model. Review the final producer/consumer
-map to confirm superseded independent reconstruction has been removed and
-internal attribution readers have migrated. Passing the four defect regressions
-while retaining the old parallel attribution machinery is not completion.
-
-The audit's previous passing suite is not validation of these future changes.
-Scope here does not promise identical output from different inspection interfaces
-or a universal guarantee about unrelated path-processing code.
-
-## Decision Status
-
-OD-1 is settled: build one shared internal history model with distinct metadata
-and explanation projections. The design investigation found that both views
-require evidence the other's public representation does not preserve. Shared
-ownership can replace independent attribution and redundant retained evidence,
-while keeping the current lifecycle and public contracts.
-
-The narrower repair of stored history events would leave the separate replay
-attribution owner in place. Promoting current explanation output to authoritative
-history would lose composite-definition and specific resolution information.
-The selected common underlying model addresses both concerns. This accepts a
-larger internal refactor than a local shape-filtering fix.
-
-No significant open decision remains at roadmap level. Private representation,
-indexing, and helper choices belong in the implementation plan. This roadmap
-records future implementation ownership; it does not revise accepted ADRs or
-declare the model implemented.

docs/roadmap/interfaces.md

@@ -1,202 +0,0 @@
-# API and Interface Contract Audit
-
-Reviewed baseline: `01b08e76a3fecc22c4414437bfeaa07b4b7a85aa`.
-
-Status: four open findings. This is an audit record, not an implementation plan.
-No production code or repository tests were changed.
-
-The [interface remediation roadmap](interface-remediation.md) describes the
-settled target, required changes, and dependencies, including a shared internal
-history model for metadata history and explanation. Implementation remains pending.
-This audit retains the findings and reproduction evidence.
-
-## Scope and evidence
-
-Reviewed the root-owned public facade and its conversions, engine loading and
-callback boundaries, source/discovery and filesystem ownership, schema and typed
-value handling, metadata/history, safe rendering and comparison, secrets, and
-the document/YAML boundary against declaration comments, the
-[configuration contract](../config.md), and applicable architectural decisions.
-The root delegates to the synchronous engine lifecycle; parser-independent
-documents support source assembly and inheritance, and completed results retain
-detached configuration and frozen inspection state.
-
-The findings below were reproduced through the public API with a disposable Go
-program outside the repository, using labeled byte sources and `fstest.MapFS`.
-The full existing suite passed with Go 1.26.10 on Linux:
-
-```sh
-GOTOOLCHAIN=local GOTELEMETRY=off GOPROXY=off go test ./... -count=1
-```
-
-The existing tests cover many ownership, lifetime, error, and zero-value cases,
-but do not detect these cross-interface discrepancies. No benchmarks, external
-service calls, or new test files were needed. The recommendations restore
-existing contracts rather than introduce new API restrictions or guarantees.
-
-## 1. Resolution presence queries confuse explicit keys with sequence indexes
-
-Priority: P2. Status: open.
-
-Relevant code:
-
-- [`Resolution.IsExplicit`](../../internal/engine/resolution.go), lines 75–82.
-- `Resolution.InputInfo` and `resolutionInput.lookup` in
-  [resolution.go](../../internal/engine/resolution.go) and
-  [load_metadata.go](../../internal/engine/load_metadata.go).
-- `resolveSchemaPath` in [schema.go](../../internal/engine/schema.go).
-
-The public [path contract](../../path.go) distinguishes explicit mapping keys
-from sequence indexes. The [resolution contract](../config.md#recorded-application-resolution)
-defines surviving-input presence and a fixed entry-state metadata view;
-[metadata queries](../config.md#layered-metadata) preserve container shapes.
-
-`IsExplicit` validates against the schema but then looks up presence using only
-`path.String()`. In dynamic `any` state, schema validation cannot establish the
-actual container shape. Consequently these distinct queries collide:
-
-```go
-key := configkit.Keys("shape", "0")
-index := configkit.Keys("shape").Index(0)
-```
-
-Load `map[string]any` from `shape: [input]` with a resolver that queries both
-paths, without changing the configuration. Observed results:
-
-| Query | `Resolution.IsExplicit` | `Resolution.InputInfo` found | Final `Metadata.IsExplicit` |
-| --- | --- | --- | --- |
-| Explicit mapping key | true | false | false |
-| Explicit sequence index | true | true | true |
-
-The mapping-key path never existed and should not be reported as explicit.
-Applications branching on presence receive inconsistent answers depending on
-which public query they use, even during an otherwise unchanged load.
-
-Potential remediation: use the retained entry-state semantic shape when checking
-resolution presence, consistently with `InputInfo` and `Metadata.IsExplicit`.
-Review the same string-only presence lookup in `Default` while preserving its
-existing assignment and callback-lifetime rules. Add focused public coverage for
-both mapping-to-index and index-to-mapping mismatches under dynamic values,
-including contextually parsed pointers. This does not require changing the
-documented treatment of invalid schema paths.
-
-## 2. Resolution can transfer explicitness to a different semantic path
-
-Priority: P2. Status: open.
-
-Relevant code: `applyResolutionMetadata`, `applyResolutionFieldOrigins`, and
-`refreshResolutionFields` in
-[load_metadata.go](../../internal/engine/load_metadata.go), especially lines
-371–387; final shape checking in
-[`Metadata.effectiveField`](../../internal/engine/metadata.go).
-
-The [metadata contract](../config.md#layered-metadata) distinguishes key/index
-shapes and keeps derived values for absent input non-explicit. Recorded
-resolution changes origins without creating input explicitness.
-
-Reproduction:
-
-1. Load `map[string]any` from `shape: {'0': old}`.
-2. In resolution, replace `configuration["shape"]` with `[]any{"new"}` and
-   record normalization at `Keys("shape")`.
-3. Query final metadata using the two paths from finding 1.
-
-The old explicit mapping-key path correctly stops being effective, but the newly
-created sequence index reports `Explicit: true`. That sequence index was never
-supplied by input. `refreshResolutionFields` reuses the old `FieldInfo` whenever
-its textual pointer survives; it updates null state without checking whether
-the old and new containers give that pointer different semantic shapes. Final
-lookup validates only the new shape, so it cannot recover the lost distinction.
-
-This can mislead consumers inspecting whether a final value was explicitly
-configured rather than introduced by application resolution. The converse
-sequence-to-numeric-key transition has the same underlying collision.
-
-Potential remediation: retain entry/effective shape evidence across resolution
-and carry input explicitness forward only for the matching semantic path.
-Preserve existing explicitness for same-shape paths and the recorded resolution
-origin; do not clear every descendant's presence merely because an ancestor was
-normalized. Cover both shape transitions and agreement among `Lookup`,
-`IsExplicit`, and explanation. Fixing finding 1's callback query alone does not
-repair this publication path.
-
-## 3. Metadata history mixes numeric-key and sequence-index definitions
-
-Priority: P2. Status: open.
-
-Relevant code:
-
-- [`Metadata.History`](../../internal/engine/metadata.go), lines 56–65.
-- `metadataFromDecoded`, `applyOverlayMetadata`, and history event construction
-  in [load_metadata.go](../../internal/engine/load_metadata.go).
-- Shape-aware replay in [`Inspection.Explain`](../../internal/engine/explain.go).
-
-The [metadata contract](../config.md#layered-metadata) promises semantic
-key/index distinctions for historical as well as effective queries. The
-historical-path index retains both shapes, but `History` uses that index only to
-check that the query was ever known. It then retrieves the entire history bucket
-by textual pointer, without selecting the query's shape.
-
-Reproduction: load `shape: {'0': old}` into `map[string]any`, then apply a CLI
-override at `Keys("shape")` with `[]any{"new"}`. Both explicit shapes were
-observed and share `/shape/0`.
-
-`History(Keys("shape").Index(0))` incorrectly includes the original base
-definition of the mapping key, and identifies that base origin as the previous
-origin of the CLI operation. The old input defined a key, not an index. In the
-same successful result, `Explain` for the explicit index correctly shows only
-its CLI introduction. `History` for the key and index returns identical records
-despite their different lifetimes.
-
-Consequences include false source attribution and disagreement between the two
-public history interfaces when consumers inspect removed or introduced paths.
-
-Potential remediation: retain enough container-shape evidence with stored
-history events, or select relevant events from existing shape-aware replay
-evidence. Filter exact definitions and previous origins by the queried semantic
-shape while retaining genuine ancestor replacement/removal events. Filtering
-only on the current `Change.Path` is insufficient where construction already
-replaced concrete segment kinds with parsed tokens. Preserve the intentional
-one-pointer-per-entry `HistoricalPaths` enumeration and contextual behavior of
-`ParsePath`; neither public contract needs redesign. Cover both direction changes
-and compare metadata history with explanation.
-
-## 4. Diagnostic canonicalization breaks composition claimant ordering
-
-Priority: P3. Status: open.
-
-Relevant code: `compositionConflictDiagnostic` in
-[compose.go](../../internal/engine/compose.go) and `canonicalDiagnostics` in
-[diagnostic.go](../../internal/engine/diagnostic.go), particularly lines 88–92.
-The latter runs both while constructing `LoadError` and in `WriteDiagnostics`.
-
-The [strict-composition contract](../config.md#strict-document-composition)
-specifies the first claim in scoped assembly order as primary and every remaining
-claim in the same order as related locations.
-
-A native-filesystem fixture demonstrates the discrepancy:
-
-```text
-main.yml imports a.yml, b.yml, c.yml
-a.yml imports z.yml
-b.yml, c.yml, and z.yml each define x
-```
-
-Acquisition assigns main=source-1, a=source-2, z=source-3, b=source-4,
-c=source-5. Dependency-ready assembly considers the three conflicting claims
-in b, c, z order. The composer correctly chooses b as primary and constructs
-related locations c, z. Generic canonicalization sorts those related locations
-by acquisition ID, publishing z, c instead. The reproduced public diagnostic
-has primary source-4 and related source-3, source-5.
-
-All claimants remain present and the conflict still fails loading, so this is
-lower impact than the presence/history defects. It nevertheless violates the
-documented reporting order and gives consumers two different ordering rules
-within one conflict report.
-
-Potential remediation: preserve the selected semantic ordering for composition
-claimant lists through accumulation and rendering, while retaining canonical
-ordering of diagnostic records and the established sorting of related locations
-for diagnostics without a semantic-order contract. Add one public failure-path
-case whose acquisition and claimant orders differ and verify both structured
-diagnostics and rendered output. No scheduler or precedence change is needed.

docs/roadmap/internal-boundaries.md

@@ -1,186 +0,0 @@
-# Import Discovery And Facade Boundary Simplification
-
-Status: target defined; execution is tracked in the [implementation plan](implementation.md).
-Baseline: `80cf23e7102fca2c5d7c7621e75f930a1ef1ecad`.
-
-This roadmap brings together the two refactors deferred until after the audit
-remediation sprint: glob entry preparation (**C03**) and facade-to-engine
-transport simplification (**F07**). Their original motivation is retained in the
-[glob](future.md#1-separate-glob-entry-preparation-from-traversal) and
-[transport](future.md#2-simplify-redundant-facade-to-engine-transport) future-work
-entries and the [consolidated audit](https://gitea.maximumdirect.net/eric/ConfigKit/src/commit/453da684d7c7d3843a5f505f5c468b4c889dc6e2/docs/roadmap/audit.md).
-
-The goal is clearer responsibility and ownership with fewer redundant internal
-representations. Both changes preserve the public API and configuration model.
-They are independent work areas within one maintenance effort, not a new loading
-workflow. The [implementation plan](implementation.md) owns concrete edits,
-stages, validation commands, and execution progress.
-
-## Baseline And Targeted End State
-
-The preceding sprint repaired directory-failure classification and shared link
-dependency evaluation, clarified acquisition handoffs, and removed unused
-placement bridges. Those changes provide the baseline; this work does not repeat
-or redesign them.
-
-| Area | Current baseline | Target |
-| --- | --- | --- |
-| Glob discovery | `selectGlobImportCandidates` interleaves traversal and set operations with substantial per-entry preparation. | The selector coordinates discovery; a cohesive private operation prepares a wildcard-discovered entry. |
-| Facade transport | Import defaults pass through root conversion, an exported engine transport record, an equivalent private engine record, and repeated snapshots. Placement construction also uses setter-style bridges. | Root-owned public records convert explicitly to one engine defaults representation, with straightforward engine option/input construction and identifiable ownership copies. |
-
-The [architecture policy](../policy/architecture.md), [configuration
-contract](../config.md), and public declarations remain authoritative. [ADR
-0006](../adr/0006-public-facade.md) continues to govern the facade boundary. These
-refactors do not require a new architectural decision or changes to its accepted
-decision. The [component overview](../internal/overview.md) and [import
-internals](../internal/imports.md) own implemented structure.
-
-## Glob Entry Preparation
-
-### Target Responsibility Split
-
-In [glob.go](../../internal/engine/glob.go), the selector continues to own pattern
-validation, component advancement, literal-segment handling, directory
-enumeration and its accounting, candidate union and sorting, final target
-validation, exclusions, and requiredness.
-
-A private glob-specific preparation operation owns the patterned branch's work
-for one directory entry: matching and hidden-entry filtering, lexical/access path
-construction, containment checks, target inspection and discovered-link policy,
-intermediate-directory eligibility, host/native access-path selection, labels,
-and candidate construction. Its result distinguishes a selected candidate, an
-ordinary skip, and a diagnostic. It receives the facts needed for that entry
-rather than mutating the selector's candidate set or surrounding traversal state.
-
-Use the existing filesystem access and link-resolution helpers. Directory
-selection already has `prepareImportDirectoryEntry`; it remains a separate owner
-because its recursion, matching, absence handling, and traversal state differ.
-Share a smaller operation only where it actually expresses the same semantics
-and reduces duplication. No common visitor or discovery strategy is needed for
-this extraction.
-
-### Behavior To Preserve
-
-Preserve the current distinctions and processing order documented by
-[explicit imports](../config.md#explicit-imports) and exercised by the selection
-tests:
-
-- Literal components remain explicit selections; discovery filters apply at
-  their existing wildcard boundaries. Moving matching or hidden filtering after
-  filesystem inspection would change which errors are observable.
-- Keep lexical candidate identity separate from resolved access identity.
-  Native source identity and relative imports retain namespace spelling; host
-  access retains its existing canonicalization and containment behavior.
-- Keep discovered-link follow rules, intermediate-directory eligibility,
-  missing-target handling, and structured diagnostic sites/classifications.
-  Do not make glob and directory rules identical as a side effect of extraction.
-- Preserve deterministic candidate and error order, union/deduplication,
-  directory-entry accounting, and the existing point of source admission.
-  Final selected-file validation remains before exclusions where it is today;
-  exclusions do not hide discovery or resource errors.
-- Retain the preceding sprint's distinction between missing-on-open directories
-  and failures after opening, along with operation-local completed-link reuse.
-
-The intended benefit is that a maintainer can understand traversal separately
-from entry eligibility and identity preparation. This is a readability change;
-it does not select a different search algorithm or claim a speedup.
-
-## Facade-To-Engine Transport
-
-### Target Representations
-
-The root keeps its public `ImportDefaults`, `PlacementMode`, `Options`, `Input`,
-and `LayeredOptions` types. Explicit conversions remain appropriate at this
-boundary; consumers must not acquire engine type identity, fields, or methods.
-
-Inside the engine, consolidate the equivalent `ImportDefaults` transport and
-private `importDefaults` records into one presence-aware input-defaults
-representation. Carry that representation through the ordinary and layered
-options, normalized request, and acquisition policy instead of translating the
-same five fields between equivalent engine records.
-
-Keep `resolvedImportPolicy` distinct: it represents concrete per-declaration
-choices, including selector-specific rules, rather than another copy of optional
-load-wide input. Likewise, registration compilation and the normalized loading
-request have real responsibilities and are not replacement targets.
-
-Make placement and defaults straightforward to construct on the existing engine
-option/input records. Remove decorator-style bridges made unnecessary by that
-construction surface. Exporting fields or types within `internal/engine` where
-needed by the root converter does not make them part of ConfigKit's supported
-public API. Keep explicit enum conversion and preserve unknown values until the
-existing option validation can report them; conversion must not silently choose
-a default or move validation into facade setters.
-
-### Ownership And Copying
-
-Make the actual mutable ownership boundaries identifiable. Public load calls
-continue to snapshot pointed-to default booleans and the pattern slice before
-source acquisition, as specified by the [public
-declaration](../../lifecycle.go). Preserve omitted, explicit false, nil pattern,
-and non-nil empty pattern as distinct inputs where they are distinct today.
-
-Review the entire handoff, not just the duplicate type definitions: root
-conversion in [conversion.go](../../conversion.go), ordinary construction in
-[lifecycle.go](../../lifecycle.go), layered construction in
-[layered.go](../../layered.go), engine options and normalization, acquisition
-policy construction, and declaration resolution in
-[import_spec.go](../../internal/engine/import_spec.go).
-
-Remove snapshots that merely recopy already-owned read-only defaults as they
-cross those private representations. Keep copies needed when establishing
-independent mutable ownership, including any independently owned resolved
-policy. The target is explainable ownership and less redundant work, not an exact
-copy count or removal of copying throughout the library. Shared defaults within
-one load can be read-only by implementation discipline; this creates no new
-caller immutability or concurrency requirement.
-
-Preserve ordinary and layered option preflight before source reads and application
-hooks, independent declaration overrides, transitive/underlay propagation,
-selected-overlay behavior, destination normalization, and invalid-enum
-diagnostics. Keep callback, source, path, secret, and returned-record conversions
-whose ownership or domain meaning is not redundant transport.
-
-The intended benefit is fewer concepts, field mappings, and construction paths
-to maintain. Reduced copying is useful but does not establish an end-to-end
-performance guarantee.
-
-## Documentation Ownership
-
-Internal documentation describes the resulting discovery and transport
-boundaries once implemented. Public declarations continue to own the existing
-snapshot and type contracts; this effort selects no new public behavior.
-The corresponding C03/F07 future-work entries serve as navigation to this
-roadmap rather than parallel target or progress inventories. Unrelated future
-candidates remain separate. The implementation plan owns the documentation
-updates and retirement of replaced private representations and helpers.
-
-## Validation And Completion
-
-Follow the [testing policy](../policy/testing.md) and [development
-guide](../development.md#baseline-validation). Reuse the existing glob selection,
-directory/link failure, import-default, placement, public facade, and dependency
-boundary coverage. Add a focused behavioral case only where a concrete
-extraction or ownership risk lacks protection.
-
-For discovery, verify literal versus wildcard filters, host/native identity,
-contained and escaping links, optional absence versus read/close failures,
-ordering, exclusions, regular-file checks, and existing resource accounting. For
-transport, verify nil/empty and explicit-false distinctions, mutation of caller
-default storage after the load snapshot through a supported callback, invalid
-options before input consumption, both loading APIs, and transitive/underlay
-defaults. Existing conversion-focused tests may change with private construction;
-preserve the useful ownership behavior rather than fossilizing a helper's shape.
-
-Completion requires an easier-to-follow selector, one engine input-defaults
-representation, fewer redundant mapping/construction sites, justified remaining
-copies, and preserved public behavior under the relevant checks. Review source
-and ownership flow as well as passing tests; moving complexity into a helper or
-renaming a duplicate record alone is insufficient.
-
-No benchmark campaign, complexity score, allocation threshold, exact filesystem
-call trace, new resource limit, or additional release gate is required. This work
-adds no dependencies, caches, background activity, or new consumer controls, and
-does not reopen other audit findings or deferred performance experiments. Routine
-helper signatures, names, and file placement belong to the implementation plan;
-no significant product or architectural decision remains open for this scope.

docs/roadmap/roadmap.md

@@ -1,276 +0,0 @@
-# Audit Remediation Roadmap
-
-Status: target accepted; completed execution is recorded in the historical plan
-at `bb5540b:docs/roadmap/implementation.md`.
-Prepared: 2026-10-25. Planning baseline: `e1e94ee`.
-
-This roadmap describes the target state and related work for the 29 entries
-selected in the [consolidated audit review](https://gitea.maximumdirect.net/eric/ConfigKit/src/commit/453da684d7c7d3843a5f505f5c468b4c889dc6e2/docs/roadmap/audit.md#settled-scope-decisions).
-It is intended for maintainers reviewing the remediation's scope and architecture.
-
-## Document Ownership
-
-- [Archived audit](https://gitea.maximumdirect.net/eric/ConfigKit/src/commit/453da684d7c7d3843a5f505f5c468b4c889dc6e2/docs/roadmap/audit.md) records finding IDs, original evidence, detailed remedies and
-  acceptance cases, and the settled scope decisions. Its evidence has not been
-  independently reproduced by writing this roadmap.
-- This document owns the combined target state, work areas, and design intent.
-  Finding IDs below provide traceability without repeating the full audit inventory.
-- The historical implementation plan at
-  `bb5540b:docs/roadmap/implementation.md` records concrete stages, private
-  implementation choices, edits, validation commands, and completion evidence.
-
-The [configuration contract](../config.md), public Go declarations, and
-[architecture policy](../policy/architecture.md) remain the owners of behavior
-and guarantees. Update their applicable implementation documentation when work
-lands; this planning document does not redefine their contracts.
-
-## Current Baseline And Targeted End State
-
-The existing loading model remains the foundation. Public loading APIs delegate
-to the shared engine lifecycle; acquisition retains source scopes for composition,
-then precedence, inheritance, decoding, CLI overrides, application resolution,
-secret lookup, and validation produce a detached result with inspection metadata.
-The [component overview](../internal/overview.md) describes the current owners.
-
-The audits identify failures at particular traversal, lifetime, error, and
-accounting boundaries, alongside redundant representations and repeated work.
-The target is to repair those boundaries and simplify their implementation while
-preserving ConfigKit's public API and configuration model.
-
-| Current gap | Targeted outcome |
-| --- | --- |
-| Recursive descriptors can fail to terminate, failed dynamic builds can leave partial state, and slice aliases can be mistaken for cycles. | Traversal terminates for the reported cases, failed construction leaves reusable state valid, and supported acyclic values remain accepted. |
-| Callback and owned-root cleanup can be skipped during panic unwinding; directory errors lose their failure phase. | Cleanup follows the lifetime of each owned resource, and selected-directory failures retain the information needed for correct error handling. |
-| Finite symlink dependencies can be expanded repeatedly. | Completed dependencies are reused within a resolution while active cycles remain detectable. |
-| Projection reservations and published history can escape existing accounting. | Existing budgets govern the relevant allocations and complete retained document graph. |
-| Collection-policy work repeatedly scans or copies unrelated state. | Policy preparation, application, and retained evidence have clear ownership, with work localized to affected policy. |
-| Acquisition has redundant paths and difficult handoffs; several private representations have no production consumer. | Production paths and their tests share the active protocol, with cohesive handoffs and unused representations removed. |
-| Some lookups repeat full scans, and some tests assert incidental representation or miss meaningful mutations. | Local indexing avoids the identified repeated work, and tests protect observable contracts at useful boundaries. |
-
-This is a bounded remediation effort, not a redesign of configuration semantics.
-Correcting erroneous acceptance, rejection, cleanup, or diagnostics in the
-reported cases restores existing contracts. It does not select new loading APIs,
-configuration options, limits, background work, or persistent caches.
-
-## Selected Work
-
-The following areas account for all 29 selected entries. Detailed examples and
-acceptance cases remain with their linked audit group.
-
-### 1. Safe Typed-Value Traversal And Descriptor Reuse
-
-Selected entries: **A01, A02, A03, A04, A05** in
-[schema and typed values](https://gitea.maximumdirect.net/eric/ConfigKit/src/commit/453da684d7c7d3843a5f505f5c468b4c889dc6e2/docs/roadmap/audit.md#a-schema-and-typed-values).
-
-Make pointer-only descriptor traversal terminate in decoding and path resolution,
-while preserving supported null values and ordinary recursive structures. Make
-dynamic descriptor construction transactional: a failed build must not leave
-partial descriptors available to subsequent operations. Staging successful
-additions or rolling back the complete failed addition set are implementation
-choices; both must handle recursive references and preserve prior valid entries.
-
-Correct active-path cycle detection to distinguish finite slice views sharing
-storage from actual cycles. Keep detachment and nil/empty behavior intact across
-the callers that share this traversal machinery.
-
-Enforce existing projection budgets before large container reservations. Include
-map-key materialization and overflow-safe lower-bound checks in the review; a
-check after the reservation does not address the reported failure. This work
-does not introduce a general heap limit or reject large containers independently
-of existing budgets.
-
-Dynamic-type eligibility reuse depends on safe descriptor construction and retains
-completed successful checks within the value operation. Keep failure diagnostics
-specific to their current path and distinguish completed results from traversal visits.
-This removes repeated descriptor-graph walks without a cross-load cache.
-
-### 2. Callback, Filesystem, And Dependency Lifetimes
-
-Selected entries: **B01, B02** in [callback lifetime](https://gitea.maximumdirect.net/eric/ConfigKit/src/commit/453da684d7c7d3843a5f505f5c468b4c889dc6e2/docs/roadmap/audit.md#b-callback-and-filesystem-lifetime)
-and **C01, C02** in [filesystem traversal](https://gitea.maximumdirect.net/eric/ConfigKit/src/commit/453da684d7c7d3843a5f505f5c468b4c889dc6e2/docs/roadmap/audit.md#c-import-selection-and-link-resolution).
-
-Tie callback-context deactivation to the callback invocation with deferred cleanup
-so it runs on normal return and panic unwinding. Independently give the owned
-import root a deferred cleanup fallback. Preserve normal close-error handling,
-caller ownership, and propagation of the original callback panic. Fixing either
-state lifetime or handle lifetime does not fix the other.
-
-Preserve the phase of a directory failure. A genuinely absent directory before
-successful opening remains subject to existing permissiveness rules; a later
-read or close failure must not be treated as absence. Apply this distinction to
-both supported directory-reading paths. Strengthen the shared filesystem tests
-to check each handle's closure and structured, non-disclosing diagnostics,
-including partial reads and failures masked by another successful directory.
-Do not change regular-file close-error policy as a side effect.
-
-Avoid repeatedly expanding completed finite symlink dependencies in both host
-and native filesystem resolution. Use operation-local memoization of completed
-targets, or an equivalent dependency evaluation, with keys that respect the
-resolution namespace. Keep active-path cycle detection separate from completed
-work. Preserve containment, supported finite reuse, and existing host-path
-semantics. The fix must work for directory and glob selection without a new
-arbitrary traversal cap or changed symlink defaults.
-
-### 3. Retained History And Combination Evidence
-
-Selected entries: **D01, D02, D03, D04** in
-[history and retained state](https://gitea.maximumdirect.net/eric/ConfigKit/src/commit/453da684d7c7d3843a5f505f5c468b4c889dc6e2/docs/roadmap/audit.md#d-retained-history-and-unused-evidence).
-
-Remove the unconsumed override-result pre-CLI copy and the unqueried published
-structural-input copy. Preserve the separate pre-CLI state used by active replay
-and the structural input still used before publication for metadata and secret
-classification. Remove unused combination-evidence members and the work needed
-solely to produce them, retaining projections, mappings, origins, and snapshots
-that have active consumers.
-
-With retained roots clarified, enforce the existing history allowance against
-the complete graph published through inspection, including replay and inheritance
-state and publication-created copies. Count shared nodes once by pointer identity;
-distinct retained copies still consume the allowance. Account for required copies
-before creating them where practical. Removing an unused tree alone does not
-resolve the accounting omissions.
-
-Keep required before/after evidence and existing inspection behavior. Validate
-the complete publication path with small controlled allowances, including the
-interaction of CLI, resolution replay, and inheritance, rather than relying only
-on tests of an isolated counting helper.
-
-### 4. Collection-Policy Preparation And Application
-
-Selected entries: **E01, E02, E03** in
-[collection policy and projection](https://gitea.maximumdirect.net/eric/ConfigKit/src/commit/453da684d7c7d3843a5f505f5c468b4c889dc6e2/docs/roadmap/audit.md#e-collection-processing-and-efficiency).
-
-Distinguish the existing policy state used for lookup, changes introduced by an
-incoming tier, and evidence retained by the assembly. Prepare incoming claims and
-declarations against read-only lower state, then apply the owned changes at the
-appropriate combination boundary. Avoid copying every unrelated policy for
-small tiers and scanning all policies for each independent replacement.
-
-Use a semantic-path index, localized updates, or equivalent bounded lookup to
-find affected policy. Preserve retirement timing, policy established by the
-incoming contribution, pending declarations, persistent explicit modes, and
-nested record ownership. Copying remains appropriate wherever mutable ownership
-requires it. Removing only one duplicate clone or shortening a function does not
-address the identified growth patterns.
-
-Clarify preparation, evidence application, and finalization responsibilities.
-Share straightforward history-descriptor translation where useful; evaluate
-shared record-selection logic while keeping overlay and inheritance origin and
-mode lifetimes distinct. Retain the common sequence-combination owner. This work
-does not call for a generic merging framework.
-
-### 5. Active Acquisition Handoffs And Private Cleanup
-
-Selected entries: **F01, F02, F03, F04, F05, F06** in
-[acquisition, cleanup, and test quality](https://gitea.maximumdirect.net/eric/ConfigKit/src/commit/453da684d7c7d3843a5f505f5c468b4c889dc6e2/docs/roadmap/audit.md#f-remaining-maintenance-and-test-improvements).
-
-Remove the test-only eager acquisition mode so acquisition retains scopes through
-the active production protocol. Tests that need composition should invoke the
-actual composition boundary explicitly. Retire the parallel test-only import
-parser and route relevant fixtures through the active directive parser or the
-appropriate declaration boundary, retaining malformed-input coverage.
-
-Clarify active acquisition and coordinator handoffs around cohesive tasks:
-parsed-input directive/version handling, standalone placement, and repeated tier
-application/projection. Use explicit inputs and results consistent with existing
-state owners. Extracting helpers that continue to share surrounding mutable state
-does not establish a clearer handoff. Preserve ordinary/layered differences,
-overlay and diff behavior, source identity, callback timing, diagnostics, and
-accounting scopes.
-
-Remove the disconnected root record-clone family, uncalled engine helpers, and
-unread private transport/result members identified in the audit. Reconfirm
-references on the implementation baseline, including function values and relevant
-build configurations. Preserve live conversion paths and validation side effects;
-the audit's absence of field reads is not a general rule for deleting state.
-Replace meaningful ownership coverage through the public boundary before removing
-tests that only exercise disconnected helpers.
-
-### 6. Local Lookup Improvements
-
-Selected entries: **E04, E05** in
-[collection policy and projection](https://gitea.maximumdirect.net/eric/ConfigKit/src/commit/453da684d7c7d3843a5f505f5c468b4c889dc6e2/docs/roadmap/audit.md#e-collection-processing-and-efficiency)
-and **F08** in [secret-failure lookup](https://gitea.maximumdirect.net/eric/ConfigKit/src/commit/453da684d7c7d3843a5f505f5c468b4c889dc6e2/docs/roadmap/audit.md#f08-index-secret-failure-location-queries-lazily).
-
-Reuse a local document lookup or equivalent traversal for tier-history projection
-instead of rescanning wide mappings for each sequence. Preserve authored
-coordinates, sparse projections, and evidence ownership.
-
-Restore compound identity fields using indexed mapping positions and membership
-checks rather than rescanning child and merged mappings for every field. Preserve
-child-authored values and locations, mapping order, and detached nodes.
-
-Build secret-failure location lookup state lazily when failures need it. Preserve
-all diagnostics, nearest-location fallbacks, and confidentiality; successful
-loads should not incur an unnecessary index merely to support failure reporting.
-These changes address specific repeated work and do not promise a measured
-startup improvement.
-
-### 7. Tests That Protect The Intended Behavior
-
-Selected entries: **F09, F10, F11, F12** in
-[acquisition, cleanup, and test quality](https://gitea.maximumdirect.net/eric/ConfigKit/src/commit/453da684d7c7d3843a5f505f5c468b4c889dc6e2/docs/roadmap/audit.md#f-remaining-maintenance-and-test-improvements),
-in addition to the regression coverage attached to each reported defect.
-
-Cover historical-path enumeration through the public API, including removed
-paths, queryability, ordering, and detached returned slices. Use those assertions
-to replace private representation checks where they address the same risk.
-
-Strengthen fuzz detachment checks by mutating existing descendants or in-length
-elements, so spare capacity cannot hide aliases. Replace exact filesystem stat
-call sequences with observable candidate ordering and meaningful failure
-selection, retaining relevant assertions such as not opening excluded inputs.
-
-Consolidate facade scaffolding around public construction, loading, errors,
-ownership, and lifecycle behavior. Preserve distinct integration risks and
-reader-byte snapshot coverage. Existing coverage percentages or a desired test
-count are not acceptance criteria for this work.
-
-## Implementation Plan
-
-The historical implementation plan at `bb5540b:docs/roadmap/implementation.md`
-defines the sequential, Luna-scoped stages and their dependencies, including
-coordinated changes to descriptor state, history ownership/accounting, collection
-policy, acquisition, and replacement public coverage. It also records validation
-commands and the complete finding-to-stage map. The audit remains the owner of
-original evidence and detailed acceptance cases.
-
-## Validation And Completion
-
-Validation follows the audit's detailed acceptance cases and the
-[testing policy](../policy/testing.md). For fatal or hanging regressions, use bounded
-subprocesses; for budget cases, use small controlled limits. For symlink expansion
-and repeated lookup work, prefer bounded operation evidence and algorithm review
-over timing thresholds. Use real filesystem fixtures where filesystem semantics
-matter and narrow fault injection for read/close failures. State platform limits.
-
-Applicable development checks come from the [development guide](../development.md),
-including appropriate race coverage for changed ownership and lifetime boundaries.
-The historical implementation plan owns their execution. Existing audit results
-are baseline evidence, not validation of the eventual changes. No performance
-benchmark campaign is required by this roadmap, and no new benchmark results are
-claimed.
-
-Completion means all 29 selected findings have implementation and acceptance
-evidence, the affected public behavior remains consistent with its contracts,
-and canonical internal documentation describes the resulting owners. The
-historical implementation plan records execution status without duplicate
-progress inventories. Retire completed planning records under the normal
-documentation lifecycle.
-
-## Scope Boundaries And Decision Status
-
-All three audit scope questions are settled. No significant architectural or
-product decision remains open for this roadmap. The historical implementation
-plan records private design choices and sequencing, subject to the acceptance
-cases above.
-If that work exposes a need to change a public contract, bring the specific
-decision back for review rather than treating it as an implicit part of remediation.
-
-The glob preparation refactor (C03) and wider facade transport simplification
-(F07) have since been selected in the
-[internal-boundary roadmap](internal-boundaries.md). Other deferred features,
-clone-traversal redesign, and broader performance experiments remain outside
-this effort. Keep
-existing ownership boundaries and loading APIs; no ADR or architecture-policy
-change is proposed by this roadmap.

documentation_test.go

@@ -1,151 +0,0 @@
-package configkit
-
-import (
-	"bufio"
-	"fmt"
-	"net/url"
-	"os"
-	"path/filepath"
-	"regexp"
-	"strings"
-	"testing"
-	"unicode"
-)
-
-var markdownLinkPattern = regexp.MustCompile(`(?m)(?:^|[[:space:]])\[[^\]]*\]\(([^)[:space:]]+)`)
-
-func TestLocalDocumentationLinks(t *testing.T) {
-	repository, err := filepath.Abs(".")
-	if err != nil {
-		t.Fatal(err)
-	}
-	var failures []string
-	err = filepath.WalkDir(repository, func(path string, entry os.DirEntry, walkErr error) error {
-		if walkErr != nil {
-			return walkErr
-		}
-		if entry.IsDir() {
-			if entry.Name() == ".git" {
-				return filepath.SkipDir
-			}
-			return nil
-		}
-		if filepath.Ext(path) != ".md" {
-			return nil
-		}
-		content, readErr := os.ReadFile(path)
-		if readErr != nil {
-			return readErr
-		}
-		for _, match := range markdownLinkPattern.FindAllStringSubmatch(string(content), -1) {
-			target := strings.Trim(match[1], "<>")
-			if strings.Contains(target, "://") || strings.HasPrefix(target, "mailto:") {
-				continue
-			}
-			filePart, fragment, _ := strings.Cut(target, "#")
-			decoded, decodeErr := url.PathUnescape(filePart)
-			if decodeErr != nil {
-				failures = append(failures, fmt.Sprintf("%s: invalid escaped link %q", relativePath(repository, path), target))
-				continue
-			}
-			linked := path
-			if decoded != "" {
-				linked = filepath.Clean(filepath.Join(filepath.Dir(path), filepath.FromSlash(decoded)))
-			}
-			_, statErr := os.Stat(linked)
-			outside := linked != repository && !strings.HasPrefix(linked, repository+string(filepath.Separator))
-			if os.IsNotExist(statErr) && outside && optionalSiblingSource(repository, linked) {
-				continue // Recorded sibling-source links are optional in isolated clones.
-			}
-			if statErr != nil {
-				failures = append(failures, fmt.Sprintf("%s: missing local link %q", relativePath(repository, path), target))
-				continue
-			}
-			if fragment != "" && filepath.Ext(linked) == ".md" && !markdownHasFragment(linked, fragment) {
-				failures = append(failures, fmt.Sprintf("%s: missing fragment in %q", relativePath(repository, path), target))
-			}
-		}
-		return nil
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(failures) != 0 {
-		t.Fatalf("documentation link failures:\n%s", strings.Join(failures, "\n"))
-	}
-}
-
-func optionalSiblingSource(repository, linked string) bool {
-	relative, err := filepath.Rel(filepath.Dir(repository), linked)
-	if err != nil || relative == "." || filepath.IsAbs(relative) {
-		return false
-	}
-	parts := strings.Split(filepath.ToSlash(relative), "/")
-	if len(parts) == 0 {
-		return false
-	}
-	switch strings.ToLower(parts[0]) {
-	case "narratio", "notarius", "weatherreporter", "seriatim":
-		return true
-	default:
-		return false
-	}
-}
-
-func markdownHasFragment(path, wanted string) bool {
-	file, err := os.Open(path)
-	if err != nil {
-		return false
-	}
-	defer file.Close()
-	wanted, err = url.PathUnescape(wanted)
-	if err != nil {
-		return false
-	}
-	seen := make(map[string]int)
-	scanner := bufio.NewScanner(file)
-	for scanner.Scan() {
-		line := strings.TrimSpace(scanner.Text())
-		if !strings.HasPrefix(line, "#") {
-			continue
-		}
-		heading := strings.TrimSpace(strings.TrimLeft(line, "#"))
-		base := markdownFragment(heading)
-		count := seen[base]
-		seen[base]++
-		fragment := base
-		if count > 0 {
-			fragment = fmt.Sprintf("%s-%d", base, count)
-		}
-		if fragment == wanted {
-			return true
-		}
-	}
-	return false
-}
-
-func markdownFragment(heading string) string {
-	var result strings.Builder
-	previousSpace := false
-	for _, character := range strings.ToLower(heading) {
-		switch {
-		case unicode.IsLetter(character), unicode.IsDigit(character), character == '_', character == '-':
-			result.WriteRune(character)
-			previousSpace = false
-		case unicode.IsSpace(character):
-			if result.Len() > 0 && !previousSpace {
-				result.WriteByte('-')
-				previousSpace = true
-			}
-		}
-	}
-	return strings.TrimRight(result.String(), "-")
-}
-
-func relativePath(root, path string) string {
-	relative, err := filepath.Rel(root, path)
-	if err != nil {
-		return path
-	}
-	return filepath.ToSlash(relative)
-}

example_test.go

@@ -6,7 +6,7 @@ import (
 	"os"
 	"strings"
 
-	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+	configkit "go.maximumdirect.net/configkit"
 )
 
 func ExampleLoad() {
@@ -26,7 +26,7 @@ func ExampleLoad_sequenceDeclaration() {
 	type Config struct {
 		Items []Item `yaml:"items"`
 	}
-	result, err := configkit.Load[Config](configkit.Bytes("catalog.yml", []byte(`configkit:
+	result, err := configkit.Load[Config](configkit.Bytes("catalog.yml", []byte(`config:
   sequences:
     - destination: [items]
       key: id
@@ -186,7 +186,8 @@ func ExampleOverride() {
 		},
 		Overrides: overrides,
 	})
-	fmt.Println(result.Config.Workers, result.Sources()[0].Label, err)
+	source, _ := result.Source("source-1")
+	fmt.Println(result.Config.Workers, source.Label, err)
 	// Output: 0 --workers <nil>
 }
 

examples/consumers/config_controls_test.go

@@ -0,0 +1,26 @@
+package consumers
+
+import (
+	"fmt"
+	"testing/fstest"
+
+	configkit "go.maximumdirect.net/configkit"
+)
+
+func Example_documentRootConfig() {
+	type app struct {
+		Config struct {
+			Timeout string `yaml:"timeout"`
+		} `yaml:"config"`
+	}
+	files := configkit.NewFilesystem("bundle", fstest.MapFS{
+		"main.yml":     {Data: []byte("config: {imports: [{path: settings.yml, destination: [config]}]}\n")},
+		"settings.yml": {Data: []byte("timeout: 10s\n")},
+	})
+	result, err := configkit.Load[app](files.File("main.yml"), configkit.Options[app]{Imports: true})
+	if err != nil {
+		panic(err)
+	}
+	fmt.Println(result.Config.Config.Timeout)
+	// Output: 10s
+}

examples/consumers/consumers.go

@@ -9,7 +9,7 @@ import (
 	"strings"
 	"time"
 
-	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+	configkit "go.maximumdirect.net/configkit"
 )
 
 // Artifact is a Narratio-shaped generated output declaration.
@@ -167,7 +167,7 @@ func LoadNotariusPaths(path, invocationDir string, overrides ...configkit.Overri
 				resolveNotariusReference(configuration, resolution, invocationDir)
 				return nil
 			},
-			Secret: func(path configkit.Path) bool { return path.String() == "/sensitive" },
+			Sensitive: func(path configkit.Path) bool { return path.String() == "/sensitive" },
 		},
 	})
 }
@@ -177,7 +177,7 @@ func resolveNotariusReference(configuration *NotariusPathConfig, resolution *con
 	if configuration.Reference == "" || filepath.IsAbs(configuration.Reference) {
 		return
 	}
-	info, found := resolution.InputInfo(path)
+	info, found := resolution.EntryInfo(path)
 	if !found {
 		resolution.Warning(path, "relative reference has no entry provenance")
 		return

examples/consumers/consumers_test.go

@@ -11,8 +11,8 @@ import (
 	"strings"
 	"testing"
 
-	configkit "gitea.maximumdirect.net/eric/ConfigKit"
-	"gitea.maximumdirect.net/eric/ConfigKit/examples/consumers"
+	configkit "go.maximumdirect.net/configkit"
+	"go.maximumdirect.net/configkit/examples/consumers"
 )
 
 func Example_narratio() {
@@ -82,7 +82,7 @@ func Example_weatherStartup() {
 	defer os.RemoveAll(directory)
 	_ = os.WriteFile(filepath.Join(directory, blockedName), []byte("unused-example-value\n"), 0o600)
 	_ = os.WriteFile(filepath.Join(directory, tokenName), []byte("disposable-example-credential\n"), 0o600)
-	report, bootstrapErr := configkit.LoadSecretsDir(directory)
+	report, bootstrapErr := configkit.LoadSecretsIntoEnvironment(directory)
 	var reportOutput bytes.Buffer
 	_, reportWriteErr := report.WriteTo(&reportOutput)
 

examples/consumers/destinations.go

@@ -6,7 +6,7 @@ import (
 	"io/fs"
 	"path"
 
-	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+	configkit "go.maximumdirect.net/configkit"
 )
 
 // CollectionBundleConfig is a representative application-owned collection
@@ -86,7 +86,7 @@ func resolveCollectionResources(configuration *CollectionBundleConfig, resolutio
 				continue
 			}
 			contentPath := configkit.Keys("collections", collectionID, "prompts", promptID, "content_file")
-			info, found := resolution.InputInfo(contentPath)
+			info, found := resolution.EntryInfo(contentPath)
 			if !found || len(info.Origin.Locations) != 1 {
 				return fmt.Errorf("prompt resource has no single declaring source")
 			}
@@ -104,9 +104,9 @@ func resolveCollectionResources(configuration *CollectionBundleConfig, resolutio
 			}
 			prompt.ResourceText = string(data)
 			collection.Prompts[promptID] = prompt
-			resolution.Record(
+			resolution.RecordNormalization(
 				configkit.Keys("collections", collectionID, "prompts", promptID, "resource_text"),
-				configkit.ChangeNormalization, "read source-relative prompt content", contentPath,
+				"read source-relative prompt content", contentPath,
 			)
 		}
 		configuration.Collections[collectionID] = collection

examples/consumers/destinations_test.go

@@ -5,8 +5,8 @@ import (
 	"fmt"
 	"testing"
 
-	configkit "gitea.maximumdirect.net/eric/ConfigKit"
-	"gitea.maximumdirect.net/eric/ConfigKit/examples/consumers"
+	configkit "go.maximumdirect.net/configkit"
+	"go.maximumdirect.net/configkit/examples/consumers"
 )
 
 func Example_inputDestination() {
@@ -60,7 +60,7 @@ func TestCollectionBundleAssemblesMountedPeersAndResources(t *testing.T) {
 	}
 
 	versionInfo, ok := result.Metadata().Lookup(configkit.Keys("version"))
-	if !ok || !versionInfo.Explicit || versionInfo.Origin.Layer != configkit.LayerBase || len(versionInfo.Origin.Locations) != 1 {
+	if !ok || !versionInfo.Explicit || versionInfo.Origin.Layer != configkit.LayerMain || len(versionInfo.Origin.Locations) != 1 {
 		t.Fatalf("main-owned version metadata = %#v, %v", versionInfo, ok)
 	}
 	collectionVersionPath := configkit.Keys("collections", "weatherreporter", "version")

examples/consumers/diff.go

@@ -5,7 +5,7 @@ import (
 	"strconv"
 	"strings"
 
-	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+	configkit "go.maximumdirect.net/configkit"
 )
 
 // FileComparisonConfig is a small application-owned shape for comparing
@@ -101,8 +101,8 @@ func resolveRollout(configuration *RolloutConfig, resolution *configkit.Resoluti
 	url := fmt.Sprintf("https://%s:%d", endpoint.Host, endpoint.Port)
 	if endpoint.URL != url {
 		endpoint.URL = url
-		resolution.Record(configkit.Keys("service", "endpoint", "url"),
-			configkit.ChangeNormalization, "derived endpoint URL",
+		resolution.RecordNormalization(configkit.Keys("service", "endpoint", "url"),
+			"derived endpoint URL",
 			configkit.Keys("service", "endpoint", "host"),
 			configkit.Keys("service", "endpoint", "port"))
 	}

examples/consumers/diff_test.go

@@ -7,8 +7,8 @@ import (
 	"strings"
 	"testing"
 
-	configkit "gitea.maximumdirect.net/eric/ConfigKit"
-	"gitea.maximumdirect.net/eric/ConfigKit/examples/consumers"
+	configkit "go.maximumdirect.net/configkit"
+	"go.maximumdirect.net/configkit/examples/consumers"
 )
 
 func ExampleCompareFiles() {

examples/consumers/discovery_test.go

@@ -5,7 +5,7 @@ import (
 	"os"
 	"path/filepath"
 
-	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+	configkit "go.maximumdirect.net/configkit"
 )
 
 type workingDirectoryPresetConfig struct {
@@ -40,6 +40,7 @@ func Example_workingDirectoryPreset() {
 		fmt.Println(err)
 		return
 	}
-	fmt.Println(result.Config.Name, filepath.Base(result.Sources()[0].Path))
+	source, _ := result.Source("source-1")
+	fmt.Println(result.Config.Name, filepath.Base(source.Path))
 	// Output: example service.yml
 }

examples/consumers/inheritance.go

@@ -1,6 +1,6 @@
 package consumers
 
-import configkit "gitea.maximumdirect.net/eric/ConfigKit"
+import configkit "go.maximumdirect.net/configkit"
 
 // PresetCatalog is ordinary application data; no inheritance fields or
 // registration hooks are required in the typed configuration.

examples/consumers/inheritance_test.go

@@ -3,8 +3,8 @@ package consumers_test
 import (
 	"testing"
 
-	configkit "gitea.maximumdirect.net/eric/ConfigKit"
-	"gitea.maximumdirect.net/eric/ConfigKit/examples/consumers"
+	configkit "go.maximumdirect.net/configkit"
+	"go.maximumdirect.net/configkit/examples/consumers"
 )
 
 func TestPresetCatalogOneLoadAndDerivation(t *testing.T) {

examples/consumers/layered.go

@@ -6,7 +6,7 @@ import (
 	"io/fs"
 	"path"
 
-	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+	configkit "go.maximumdirect.net/configkit"
 )
 
 //go:embed testdata/native-source testdata/layered-bundle testdata/collection-bundle testdata/ordinary-imports testdata/source-version

examples/consumers/layered_test.go

@@ -6,8 +6,8 @@ import (
 	"strings"
 	"testing"
 
-	configkit "gitea.maximumdirect.net/eric/ConfigKit"
-	"gitea.maximumdirect.net/eric/ConfigKit/examples/consumers"
+	configkit "go.maximumdirect.net/configkit"
+	"go.maximumdirect.net/configkit/examples/consumers"
 )
 
 func Example_nativeFilesystem() {
@@ -26,7 +26,7 @@ func Example_rootRelativeImports() {
 		fmt.Println(err)
 		return
 	}
-	source := result.Sources()[2]
+	source, _ := result.Source("source-3")
 	fmt.Println(result.Config.Name, result.Config.Version, result.Config.Prompts["brief"].Summary, source.Destination.String(), err)
 	// Output: Root import example 1.0 A root-loaded prompt. /prompts <nil>
 }
@@ -68,7 +68,7 @@ func Example_sourceVersionAdoption() {
 	}
 	checks, redacted := 0, true
 	for _, source := range result.Sources() {
-		if check := source.VersionCheck; check != nil {
+		if check := source.VersionEvidence; check != nil {
 			checks++
 			redacted = redacted && check.Redacted && check.Version.Text == ""
 		}
@@ -95,7 +95,7 @@ func TestVersionedServiceModesAndMountedProtection(t *testing.T) {
 			t.Fatalf("versioned service sources = %#v", sources)
 		}
 		for _, source := range sources {
-			check := source.VersionCheck
+			check := source.VersionEvidence
 			if check == nil || check.Path.String() != "/version" || !check.Version.Present ||
 				!check.Redacted || check.Version.Text != "" {
 				t.Fatalf("safe source version evidence = %#v", sources)
@@ -119,7 +119,7 @@ func TestCatalogRetainsPresenceAndSourceContext(t *testing.T) {
 	}
 	for _, key := range []string{"enabled", "workers"} {
 		info, found := result.Metadata().Lookup(configkit.Keys(key))
-		if !found || !info.Explicit || info.Origin.Layer != configkit.LayerBase {
+		if !found || !info.Explicit || info.Origin.Layer != configkit.LayerMain {
 			t.Fatalf("%s presence = %#v, %v", key, info, found)
 		}
 	}

examples/consumers/prompt_catalog.go

@@ -3,7 +3,7 @@ package consumers
 import (
 	"strings"
 
-	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+	configkit "go.maximumdirect.net/configkit"
 )
 
 // PromptCatalogConfig is an application-owned prompt collection shape.

examples/consumers/prompt_catalog_test.go

@@ -8,8 +8,8 @@ import (
 	"path/filepath"
 	"testing"
 
-	configkit "gitea.maximumdirect.net/eric/ConfigKit"
-	"gitea.maximumdirect.net/eric/ConfigKit/examples/consumers"
+	configkit "go.maximumdirect.net/configkit"
+	"go.maximumdirect.net/configkit/examples/consumers"
 )
 
 func Example_identifiedPromptCatalog() {
@@ -24,8 +24,8 @@ func Example_identifiedPromptCatalog() {
 	}
 	emptySearches := 0
 	for _, source := range result.Sources() {
-		for _, selection := range source.ImportSelections {
-			if selection.Selector == configkit.ImportSelectorDirectory && selection.Outcome == configkit.ImportSelectionNone {
+		for _, selection := range source.EmptyImportSelections {
+			if selection.Selector == configkit.ImportSelectorDirectory {
 				emptySearches++
 			}
 		}

examples/consumers/sequence_catalog.go

@@ -9,7 +9,7 @@ import (
 	"path/filepath"
 	"strings"
 
-	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+	configkit "go.maximumdirect.net/configkit"
 )
 
 // SequenceCatalogConfig is a source-backed prompt catalog with an application
@@ -43,7 +43,7 @@ func LoadSequenceCatalog(mainPath, overlayName, runLabel string) (*configkit.Res
 	filesystem := configkit.NewFilesystem("sequence catalog", os.DirFS(root))
 	filesystemContext := &configkit.FilesystemContext{BaseDir: ".", Root: ".", FS: &filesystem}
 	mainSearch := configkit.SearchConfig("", configkit.Searches(
-		configkit.Paths(absoluteMain),
+		configkit.SearchPaths(absoluteMain),
 		configkit.SearchDirectory(filepath.Join(root, "fallback"), configkit.DirectorySearchOptions{
 			Filenames: []configkit.FilenameGroup{configkit.CustomFilenames(filepath.Base(absoluteMain))},
 		}),
@@ -54,7 +54,7 @@ func LoadSequenceCatalog(mainPath, overlayName, runLabel string) (*configkit.Res
 		},
 		Resolve: func(configuration *SequenceCatalogConfig, resolution *configkit.Resolution) error {
 			configuration.ResolvedLabel = "for:" + configuration.RunLabel
-			resolution.Record(configkit.Keys("resolved_label"), configkit.ChangeNormalization,
+			resolution.RecordNormalization(configkit.Keys("resolved_label"),
 				"derive the resolved label from the selected run label", configkit.Keys("run_label"))
 			return nil
 		},

examples/consumers/sequence_catalog_test.go

@@ -8,8 +8,8 @@ import (
 	"strings"
 	"testing"
 
-	configkit "gitea.maximumdirect.net/eric/ConfigKit"
-	"gitea.maximumdirect.net/eric/ConfigKit/examples/consumers"
+	configkit "go.maximumdirect.net/configkit"
+	"go.maximumdirect.net/configkit/examples/consumers"
 )
 
 func Example_sequenceCatalog() {
@@ -171,7 +171,7 @@ collections:
 
 func Example_yamlDeclaredIdentityOnly() {
 	result, err := configkit.Load(configkit.Bytes("YAML identity only", []byte(`
-configkit:
+config:
   sequences:
     - destination: [prompts]
       key: id
@@ -193,7 +193,7 @@ prompts:
 
 func TestYAMLDeclaredIdentityDoesNotRegisterFinalTypedConstraint(t *testing.T) {
 	result, err := configkit.Load(configkit.Bytes("YAML identity only", []byte(`
-configkit:
+config:
   sequences:
     - destination: [prompts]
       key: id

examples/consumers/source_version.go

@@ -4,7 +4,7 @@ import (
 	"errors"
 	"io/fs"
 
-	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+	configkit "go.maximumdirect.net/configkit"
 )
 
 // VersionedServiceConfig demonstrates a mounted main input whose source-local
@@ -47,7 +47,7 @@ func LoadVersionedService(mode configkit.SourceVersionMode, overrides ...configk
 				return nil
 			},
 		},
-		Secret: func(path configkit.Path) bool {
+		Sensitive: func(path configkit.Path) bool {
 			return path.String() == "/service/version"
 		},
 	}

examples/consumers/testdata/collection-bundle/collections/weather/collection.yml

@@ -1,4 +1,4 @@
-configkit:
+config:
   imports:
     - path: metadata.yml
       destination: []

examples/consumers/testdata/collection-bundle/collections/weather/metadata.yml

@@ -1,4 +1,4 @@
-configkit:
+config:
   imports:
     - path: version.yml
 description: Imported collection metadata.

examples/consumers/testdata/collection-bundle/collections/weather/profiles/index.yml

@@ -1,4 +1,4 @@
-configkit:
+config:
   imports:
     - path: compact.yml
     - path: weather.yml

examples/consumers/testdata/collection-bundle/collections/weather/prompts/index.yml

@@ -1,4 +1,4 @@
-configkit:
+config:
   imports:
     - path: brief.yml
     - path: custom.yml

examples/consumers/testdata/layered-bundle/defaults/config.yml

@@ -1,4 +1,4 @@
-configkit:
+config:
   imports:
     - path: ../shared.yml
 enabled: true

examples/consumers/testdata/narratio/pipeline.yml

@@ -1,4 +1,4 @@
-configkit:
+config:
   imports:
     - path: artifacts.yml
 poll_interval: 1m

examples/consumers/testdata/notarius-paths/main.yml

@@ -1,4 +1,4 @@
-configkit:
+config:
   imports:
     - path: declarations/path.yml
 sensitive: PATH_REFERENCE_SECRET_CANARY

examples/consumers/testdata/ordinary-imports/config.yml

@@ -1,4 +1,4 @@
-configkit:
+config:
   imports:
     - path: metadata.yml
     - path: prompts/brief.yml

examples/consumers/testdata/prompt-catalog/config.yml

@@ -1,4 +1,4 @@
-configkit:
+config:
   sequences:
     - destination: [prompts]
       key: id

examples/consumers/testdata/prompt-catalog/invalid.yml

@@ -1,4 +1,4 @@
-configkit:
+config:
   sequences:
     - destination: [prompts]
       key: id

examples/consumers/testdata/prompt-catalog/prompts/curated.yml

@@ -1,4 +1,4 @@
-configkit:
+config:
   imports:
     - path: helpers/curated-id.yml
 name: Curated summary

examples/consumers/testdata/prompt-catalog/simple.yml

@@ -1,4 +1,4 @@
-configkit:
+config:
   imports:
     - path: prompts/required.yml
       required: true

examples/consumers/testdata/sequence-catalog/config.yml

@@ -1,5 +1,5 @@
 run_label: source-default
-configkit:
+config:
   imports:
     - dir: fragments
       pattern: '*.yml'

examples/consumers/testdata/sequence-catalog/overlays/append.yml

@@ -1,4 +1,4 @@
-configkit:
+config:
   sequences:
     - destination: [prompts]
       key: id

examples/consumers/testdata/sequence-catalog/overlays/replace.yml

@@ -1,4 +1,4 @@
-configkit:
+config:
   sequences:
     - destination: [prompts]
       key: id

examples/consumers/testdata/sequence-catalog/overlays/upsert.yml

@@ -1,4 +1,4 @@
-configkit:
+config:
   sequences:
     - destination: [prompts]
       key: id

examples/consumers/testdata/sequence-catalog/underlay.yml

@@ -1,4 +1,4 @@
-configkit:
+config:
   sequences:
     - destination: [prompts]
       key: id

facade_candidate_test.go

@@ -11,7 +11,7 @@ import (
 	"strings"
 	"testing"
 
-	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+	configkit "go.maximumdirect.net/configkit"
 )
 
 var (
@@ -23,7 +23,7 @@ var (
 
 func TestFacadeValuesRemainRootOwned(t *testing.T) {
 	t.Parallel()
-	const packagePath = "gitea.maximumdirect.net/eric/ConfigKit"
+	const packagePath = "go.maximumdirect.net/configkit"
 	for _, candidate := range []reflect.Type{
 		reflect.TypeFor[configkit.Path](), reflect.TypeFor[configkit.Source](),
 		reflect.TypeFor[configkit.Secret](), reflect.TypeFor[configkit.Diagnostic](),
@@ -140,7 +140,7 @@ func TestFacadeSecretsBootstrapUsesFacadeRecords(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	report, err := configkit.LoadSecretsDir(directory)
+	report, err := configkit.LoadSecretsIntoEnvironment(directory)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -164,7 +164,7 @@ func TestFacadeSecretsBootstrapUsesFacadeRecords(t *testing.T) {
 		t.Fatalf("report rendering = %q, %v", rendered.String(), err)
 	}
 
-	failedReport, err := configkit.LoadSecretsDir("")
+	failedReport, err := configkit.LoadSecretsIntoEnvironment("")
 	var secretsError *configkit.SecretsError
 	if failedReport == nil || !errors.As(err, &secretsError) || len(secretsError.Diagnostics()) != 1 || secretsError.Diagnostics()[0].Code != configkit.CodeSecretsInvalidPath {
 		t.Fatalf("bootstrap failure = %#v / %#v", failedReport, err)
@@ -203,7 +203,7 @@ func TestFacadeLoadBridgesLifecycleCallbacks(t *testing.T) {
 			if !resolution.IsExplicit(configkit.Keys("input")) {
 				resolution.Error(configkit.Keys("input"), "input is required")
 			}
-			input, ok := resolution.InputInfo(configkit.Keys("input"))
+			input, ok := resolution.EntryInfo(configkit.Keys("input"))
 			if !ok || !input.Explicit {
 				resolution.Error(configkit.Keys("input"), "missing input provenance")
 			}
@@ -245,6 +245,8 @@ func TestFacadeLoadBridgesLifecycleCallbacks(t *testing.T) {
 	}
 	for _, context := range []func(){
 		func() { retainedResolution.IsExplicit(configkit.Keys("input")) },
+		func() { retainedResolution.RecordDerivedDefault(configkit.Keys("input"), "too late") },
+		func() { retainedResolution.RecordNormalization(configkit.Keys("input"), "too late") },
 		func() { retainedValidation.Warning(configkit.Keys("input"), "too late") },
 	} {
 		func() {

facade_compatibility_test.go

@@ -7,7 +7,7 @@ import (
 	"io"
 	"testing"
 
-	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+	configkit "go.maximumdirect.net/configkit"
 )
 
 var (

facade_config_directives_test.go

@@ -0,0 +1,108 @@
+package configkit_test
+
+import (
+	"strings"
+	"testing"
+	"testing/fstest"
+
+	configkit "go.maximumdirect.net/configkit"
+)
+
+func TestDocumentRootControlsAndNestedApplicationConfig(t *testing.T) {
+	type settings struct {
+		Imports string `yaml:"imports"`
+	}
+	type app struct {
+		Service struct {
+			Config settings `yaml:"config"`
+		} `yaml:"service"`
+	}
+	result, err := configkit.Load[app](configkit.Bytes("main", []byte("config: {sequences: []}\nservice: {config: {imports: ordinary}}\n")))
+	if err != nil || result.Config.Service.Config.Imports != "ordinary" {
+		t.Fatalf("result = %#v, error = %v", result, err)
+	}
+}
+
+func TestMountedConfigDataKeepsControlEvidenceAndHiding(t *testing.T) {
+	type settings struct {
+		Imports string `yaml:"imports"`
+		Token   string `yaml:"token" configkit:"secret"`
+	}
+	type app struct {
+		Config settings `yaml:"config"`
+	}
+	fs := configkit.NewFilesystem("bundle", fstest.MapFS{
+		"main.yml": {Data: []byte("config: {imports: [{path: missing.yml}, {path: data.yml, destination: [config]}]}\n")},
+		"data.yml": {Data: []byte("imports: ordinary\ntoken: disposable-canary\n")},
+	})
+	result, err := configkit.Load[app](fs.File("main.yml"), configkit.Options[app]{Imports: true})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if result.Config.Config.Imports != "ordinary" {
+		t.Fatalf("config = %#v", result.Config)
+	}
+	sources := result.Sources()
+	if len(sources) != 2 || len(sources[0].EmptyImportSelections) != 1 || sources[0].EmptyImportSelections[0].Path.String() != "/config/imports/0" {
+		t.Fatalf("sources = %#v", sources)
+	}
+	if _, ok := result.Metadata().Lookup(configkit.Keys("config", "imports")); !ok {
+		t.Fatal("missing application value")
+	}
+	if _, ok := result.Explain(configkit.Keys("config", "imports")); !ok {
+		t.Fatal("missing explanation")
+	}
+	var output strings.Builder
+	if err := result.WriteEffective(&output); err != nil || strings.Contains(output.String(), "disposable-canary") || !strings.Contains(output.String(), "ordinary") {
+		t.Fatalf("effective output = %q, %v", output.String(), err)
+	}
+}
+
+func TestOldControlSpellingsAreOrdinaryData(t *testing.T) {
+	body := "configkit: {imports: [{path: nonexistent.yml}]}\n_configkit: ordinary\n"
+	result, err := configkit.Load[map[string]any](configkit.Bytes("old", []byte(body)))
+	if err != nil || result.Config["configkit"] == nil || result.Config["_configkit"] != "ordinary" {
+		t.Fatalf("result = %#v, error = %v", result, err)
+	}
+	if _, err := configkit.Load[struct{}](configkit.Bytes("strict", []byte(body))); err == nil {
+		t.Fatal("strict schema accepted unknown data")
+	}
+}
+
+func TestDefaultsOverridesAndResolutionAtConfigRoot(t *testing.T) {
+	type settings struct {
+		Enabled bool `yaml:"enabled"`
+		Count   int  `yaml:"count"`
+	}
+	type app struct {
+		Config settings `yaml:"config"`
+	}
+	entryExplicit := false
+	entryCountExplicit := false
+	result, err := configkit.Load[app](configkit.NoSource(), configkit.Options[app]{
+		Definition: configkit.Definition[app]{
+			Defaults: func() app { return app{Config: settings{Enabled: true, Count: 2}} },
+			Resolve: func(value *app, r *configkit.Resolution) error {
+				info, ok := r.EntryInfo(configkit.Keys("config", "enabled"))
+				entryExplicit = ok && info.Explicit && info.Origin.Layer == configkit.LayerCLI
+				entryCountExplicit = r.IsExplicit(configkit.Keys("config", "count"))
+				value.Config.Count = 7
+				r.RecordNormalization(configkit.Keys("config", "count"), "normalize count")
+				return nil
+			},
+		},
+		Overrides: []configkit.Override{{Path: configkit.Keys("config", "enabled"), Value: false, Flag: "--enabled"}},
+	})
+	if err != nil || result == nil || !entryExplicit || entryCountExplicit || result.Config.Config.Enabled || result.Config.Config.Count != 7 {
+		t.Fatalf("result = %#v, entry explicit = %t, error = %v", result, entryExplicit, err)
+	}
+	if info, ok := result.Metadata().Lookup(configkit.Keys("config", "enabled")); !ok || !info.Explicit || info.Origin.Layer != configkit.LayerCLI {
+		t.Fatalf("final enabled info = %#v, %t", info, ok)
+	}
+	if info, ok := result.Metadata().Lookup(configkit.Keys("config", "count")); !ok || info.Origin.Layer != configkit.LayerResolution {
+		t.Fatalf("final count info = %#v, %t", info, ok)
+	}
+	if _, ok := result.Explain(configkit.Keys("config", "count")); !ok {
+		t.Fatal("missing resolution explanation")
+	}
+}

facade_container_origin_test.go

@@ -0,0 +1,41 @@
+package configkit_test
+
+import (
+	"testing"
+	"testing/fstest"
+
+	configkit "go.maximumdirect.net/configkit"
+)
+
+func TestOverlayExplanationUsesQueryScopedOrigin(t *testing.T) {
+	t.Parallel()
+	filesystem := configkit.NewFilesystem("origin", fstest.MapFS{
+		"main.yml":         {Data: []byte("a: base\ngroup: {x: X, y: Y}\n")},
+		"overlays/dev.yml": {Data: []byte("a: overlay\ngroup: {x: O}\n")},
+	})
+	result, err := configkit.Load[map[string]any](filesystem.File("main.yml"), configkit.Options[map[string]any]{Overlay: "dev"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, test := range []struct {
+		path         configkit.Path
+		line, column int
+	}{
+		{configkit.Keys(), 1, 1},
+		{configkit.Keys("group"), 2, 8},
+		{configkit.Keys("group", "x"), 2, 12},
+	} {
+		explanation, found := result.Explain(test.path)
+		if !found || len(explanation.History) == 0 {
+			t.Fatalf("missing explanation for %s", test.path)
+		}
+		origin := explanation.History[len(explanation.History)-1].Origin
+		if origin.Layer != configkit.LayerOverlay || len(origin.Locations) != 1 {
+			t.Fatalf("overlay origin for %s = %#v", test.path, origin)
+		}
+		location := origin.Locations[0]
+		if location.SourceID != "source-2" || location.Line != test.line || location.Column != test.column {
+			t.Fatalf("overlay location for %s = %#v; want line %d column %d", test.path, location, test.line, test.column)
+		}
+	}
+}

facade_context_test.go

@@ -3,7 +3,7 @@ package configkit_test
 import (
 	"testing"
 
-	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+	configkit "go.maximumdirect.net/configkit"
 )
 
 func TestFacadeInactiveContextsPreserveClosedFailure(t *testing.T) {
@@ -24,10 +24,11 @@ func TestFacadeInactiveContextsPreserveClosedFailure(t *testing.T) {
 				call func()
 			}{
 				{"IsExplicit", func() { state.resolution.IsExplicit(path) }},
-				{"InputInfo", func() { state.resolution.InputInfo(path) }},
+				{"EntryInfo", func() { state.resolution.EntryInfo(path) }},
 				{"Source", func() { state.resolution.Source("source") }},
 				{"SourceContext", func() { state.resolution.SourceContext("source") }},
-				{"Record", func() { state.resolution.Record(path, configkit.ChangeNormalization, "reason") }},
+				{"RecordDerivedDefault", func() { state.resolution.RecordDerivedDefault(path, "reason") }},
+				{"RecordNormalization", func() { state.resolution.RecordNormalization(path, "reason") }},
 				{"Resolution.Error", func() { state.resolution.Error(path, "message") }},
 				{"Resolution.Warning", func() { state.resolution.Warning(path, "message") }},
 				{"Default", func() { configkit.Default(state.resolution, path, &target, 1, "reason") }},

facade_destination_test.go

@@ -14,7 +14,7 @@ import (
 	"testing"
 	"testing/fstest"
 
-	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+	configkit "go.maximumdirect.net/configkit"
 )
 
 func TestFacadeInputDestinationsAcrossSourceKinds(t *testing.T) {
@@ -109,7 +109,7 @@ func TestFacadeDestinationRootEmptyMappingNoSourceAndInvalidPaths(t *testing.T)
 		wantReads   int
 	}{
 		{name: "index segment", source: configkit.Reader("unread", reader), destination: configkit.Keys("catalog").Index(0)},
-		{name: "reserved configkit key", source: configkit.NoSource(), destination: configkit.Keys("configkit")},
+		{name: "reserved extends key", source: configkit.NoSource(), destination: configkit.Keys("extends")},
 		{name: "reserved extends key", source: configkit.NoSource(), destination: configkit.Keys("catalog", "extends")},
 	} {
 		t.Run(test.name, func(t *testing.T) {
@@ -129,7 +129,7 @@ func TestFacadeImportedSourcesRetainInputDestination(t *testing.T) {
 	directory := t.TempDir()
 	mainPath := filepath.Join(directory, "main.yml")
 	fragmentPath := filepath.Join(directory, "fragment.yml")
-	if err := os.WriteFile(mainPath, []byte("configkit: {imports: [{path: fragment.yml}]}\nmain: present\n"), 0o600); err != nil {
+	if err := os.WriteFile(mainPath, []byte("config: {imports: [{path: fragment.yml}]}\nmain: present\n"), 0o600); err != nil {
 		t.Fatal(err)
 	}
 	if err := os.WriteFile(fragmentPath, []byte("imported: present\n"), 0o600); err != nil {
@@ -169,7 +169,7 @@ func TestFacadeRelativeImportDestinationsForRootAndMountedLoads(t *testing.T) {
 		return filename
 	}
 
-	mainPath := write("main.yml", `configkit:
+	mainPath := write("main.yml", `config:
   imports:
     - path: metadata.yml
       destination: [metadata]
@@ -184,7 +184,7 @@ root: main
 	write("metadata.yml", "name: imported\n")
 	write("prompts/a.yml", "a: {name: alpha}\n")
 	write("prompts/b.yml", "b: {name: beta}\n")
-	write("entries/main.yml", `configkit:
+	write("entries/main.yml", `config:
   imports:
     - path: nested/details.yml
       destination: [details]
@@ -352,7 +352,7 @@ func TestFacadeMountedMainAndUnderlayInspectionResourcesAndDiff(t *testing.T) {
 				Resolve: func(configuration *map[string]any, resolution *configkit.Resolution) error {
 					callbacks.resolve++
 					resourcePath := configkit.Keys("catalog", "entries", "item", "resource")
-					input, ok := resolution.InputInfo(resourcePath)
+					input, ok := resolution.EntryInfo(resourcePath)
 					if !ok || len(input.Origin.Locations) != 1 {
 						return fmt.Errorf("mounted resource input has no single source origin")
 					}
@@ -370,11 +370,11 @@ func TestFacadeMountedMainAndUnderlayInspectionResourcesAndDiff(t *testing.T) {
 					}
 					entry := facadeDestinationMap(t, facadeDestinationMap(t, facadeDestinationMap(t, *configuration, "catalog"), "entries"), "item")
 					entry["resource_text"] = string(data)
-					resolution.Record(configkit.Keys("catalog", "entries", "item", "resource_text"), configkit.ChangeNormalization, "read source-relative summary", resourcePath)
+					resolution.RecordNormalization(configkit.Keys("catalog", "entries", "item", "resource_text"), "read source-relative summary", resourcePath)
 					return nil
 				},
-				Validate: func(*map[string]any, *configkit.Validation) { callbacks.validate++ },
-				Secret:   func(candidate configkit.Path) bool { return candidate.String() == tokenPath.String() },
+				Validate:  func(*map[string]any, *configkit.Validation) { callbacks.validate++ },
+				Sensitive: func(candidate configkit.Path) bool { return candidate.String() == tokenPath.String() },
 			},
 		})
 		if err != nil {
@@ -405,7 +405,7 @@ func TestFacadeMountedMainAndUnderlayInspectionResourcesAndDiff(t *testing.T) {
 		if err != nil || string(data) != "source-relative summary" {
 			t.Fatalf("completed relative resource = %q, %v", data, err)
 		}
-		if info, ok := result.Metadata().Lookup(titlePath); !ok || info.Origin.Layer != configkit.LayerBase {
+		if info, ok := result.Metadata().Lookup(titlePath); !ok || info.Origin.Layer != configkit.LayerMain {
 			t.Fatalf("mounted title metadata = %#v, %v", info, ok)
 		}
 		if history := result.Metadata().History(titlePath); len(history) < 2 {
@@ -505,7 +505,7 @@ func TestFacadeRelativeImportFailuresRetainSourceRecordsAndCoordinates(t *testin
 	}
 
 	t.Run("imported parse failure retains effective source destination", func(t *testing.T) {
-		mainPath := write("parse/main.yml", "configkit:\n  imports:\n    - path: child.yml\n      destination: [tenant]\n")
+		mainPath := write("parse/main.yml", "config:\n  imports:\n    - path: child.yml\n      destination: [tenant]\n")
 		childPath := write("parse/child.yml", "count: [unterminated\n")
 		_, err := configkit.LoadLayered[map[string]any](configkit.Input{
 			Source: configkit.File(mainPath), Imports: true, Destination: configkit.Keys("mount"),
@@ -525,8 +525,8 @@ func TestFacadeRelativeImportFailuresRetainSourceRecordsAndCoordinates(t *testin
 	})
 
 	t.Run("directive failure stays source local", func(t *testing.T) {
-		mainPath := write("directive/main.yml", "configkit:\n  imports:\n    - path: parent.yml\n      destination: [tenant]\n")
-		parentPath := write("directive/parent.yml", "configkit:\n  imports:\n    - path: details.yml\n      destination: [3]\n")
+		mainPath := write("directive/main.yml", "config:\n  imports:\n    - path: parent.yml\n      destination: [tenant]\n")
+		parentPath := write("directive/parent.yml", "config:\n  imports:\n    - path: details.yml\n      destination: [3]\n")
 		_, err := configkit.LoadLayered[map[string]any](configkit.Input{
 			Source: configkit.File(mainPath), Imports: true, Destination: configkit.Keys("mount"),
 		})
@@ -535,7 +535,7 @@ func TestFacadeRelativeImportFailuresRetainSourceRecordsAndCoordinates(t *testin
 			t.Fatalf("load error = %T %v", err, err)
 		}
 		diagnostics := loadError.Diagnostics()
-		wantPath := configkit.Keys("configkit", "imports").Index(0).Key("destination").Index(0)
+		wantPath := configkit.Keys("config", "imports").Index(0).Key("destination").Index(0)
 		if len(diagnostics) != 1 || diagnostics[0].Code != configkit.CodeImportInvalid || !reflect.DeepEqual(diagnostics[0].Path, wantPath) || diagnostics[0].Primary == nil || diagnostics[0].Primary.SourceID != "source-2" {
 			t.Fatalf("import directive diagnostic = %#v", diagnostics)
 		}
@@ -546,7 +546,7 @@ func TestFacadeRelativeImportFailuresRetainSourceRecordsAndCoordinates(t *testin
 	})
 
 	t.Run("composition failure reports effective path and all sources", func(t *testing.T) {
-		mainPath := write("compose/main.yml", "configkit:\n  imports:\n    - path: left.yml\n      destination: [tenant]\n    - path: right.yml\n      destination: [tenant]\n")
+		mainPath := write("compose/main.yml", "config:\n  imports:\n    - path: left.yml\n      destination: [tenant]\n    - path: right.yml\n      destination: [tenant]\n")
 		write("compose/left.yml", "value: same\n")
 		write("compose/right.yml", "value: same\n")
 		_, err := configkit.LoadLayered[map[string]any](configkit.Input{
@@ -567,7 +567,7 @@ func TestFacadeRelativeImportFailuresRetainSourceRecordsAndCoordinates(t *testin
 	})
 
 	t.Run("version failure reports effective path and imported source", func(t *testing.T) {
-		mainPath := write("version/main.yml", "configkit:\n  imports:\n    - path: child.yml\n      destination: [tenant]\n")
+		mainPath := write("version/main.yml", "config:\n  imports:\n    - path: child.yml\n      destination: [tenant]\n")
 		childPath := write("version/child.yml", "version: forbidden\n")
 		_, err := configkit.LoadLayered[map[string]any](configkit.Input{
 			Source: configkit.File(mainPath), Imports: true, Destination: configkit.Keys("mount"),
@@ -599,7 +599,7 @@ func TestFacadeRelativeImportFailuresRetainSourceRecordsAndCoordinates(t *testin
 				} `yaml:"tenant"`
 			} `yaml:"mount"`
 		}
-		mainPath := write("typed/main.yml", "configkit:\n  imports:\n    - path: child.yml\n      destination: [tenant]\n")
+		mainPath := write("typed/main.yml", "config:\n  imports:\n    - path: child.yml\n      destination: [tenant]\n")
 		childPath := write("typed/child.yml", "count: invalid\n")
 		_, err := configkit.LoadLayered[configuration](configkit.Input{
 			Source: configkit.File(mainPath), Imports: true, Destination: configkit.Keys("mount"),

facade_diagnostic_order_test.go

@@ -0,0 +1,95 @@
+package configkit_test
+
+import (
+	"bytes"
+	"errors"
+	"strings"
+	"testing"
+	"testing/fstest"
+
+	configkit "go.maximumdirect.net/configkit"
+)
+
+func TestFacadeCompositionConflictKeepsClaimantOrder(t *testing.T) {
+	filesystem := configkit.NewFilesystem("bundle", fstest.MapFS{
+		"a.yml": &fstest.MapFile{Data: []byte(`config:
+  imports:
+    - path: z.yml
+`)},
+		"b.yml": &fstest.MapFile{Data: []byte("x: b\n")},
+		"c.yml": &fstest.MapFile{Data: []byte("x: c\n")},
+		"z.yml": &fstest.MapFile{Data: []byte("x: z\n")},
+	})
+	main := configkit.Mapping("main", map[string]any{
+		"config": map[string]any{"imports": []any{
+			map[string]any{"path": "a.yml"},
+			map[string]any{"path": "b.yml"},
+			map[string]any{"path": "c.yml"},
+		}},
+	})
+	_, err := configkit.Load[map[string]any](main, configkit.Options[map[string]any]{
+		Imports: true,
+		Filesystem: &configkit.FilesystemContext{
+			FS: &filesystem, Root: ".", BaseDir: ".",
+		},
+	})
+	var loadError *configkit.LoadError
+	if !errors.As(err, &loadError) {
+		t.Fatalf("Load error = %v, want composition LoadError", err)
+	}
+	diagnostics := loadError.Diagnostics()
+	if len(diagnostics) != 1 {
+		t.Fatalf("diagnostics = %#v, want one composition conflict", diagnostics)
+	}
+	diagnostic := diagnostics[0]
+	if diagnostic.Code != configkit.CodeComposeConflict || diagnostic.Path.String() != "/x" || diagnostic.Primary == nil {
+		t.Fatalf("composition diagnostic = %#v", diagnostic)
+	}
+
+	pathsByID := make(map[string]string)
+	var acquisitionOrder []string
+	for _, source := range loadError.Sources() {
+		pathsByID[source.ID] = source.Path
+		for _, name := range []string{"z.yml", "b.yml", "c.yml"} {
+			if source.Path == name || strings.HasSuffix(source.Path, "/"+name) {
+				acquisitionOrder = append(acquisitionOrder, strings.TrimSuffix(name, ".yml"))
+				break
+			}
+		}
+	}
+	if strings.Join(acquisitionOrder, ",") != "z,b,c" {
+		t.Fatalf("claimant acquisition order = %v, want z,b,c", acquisitionOrder)
+	}
+	claimant := func(location configkit.Location) string {
+		for _, name := range []string{"b.yml", "c.yml", "z.yml"} {
+			if pathsByID[location.SourceID] == name || strings.HasSuffix(pathsByID[location.SourceID], "/"+name) {
+				return strings.TrimSuffix(name, ".yml")
+			}
+		}
+		return ""
+	}
+	if got := claimant(*diagnostic.Primary); got != "b" {
+		t.Fatalf("primary claimant = %q, want b (sources: %#v)", got, pathsByID)
+	}
+	if len(diagnostic.Related) != 2 || claimant(diagnostic.Related[0]) != "c" || claimant(diagnostic.Related[1]) != "z" {
+		t.Fatalf("related claimants = %#v, want c then z", diagnostic.Related)
+	}
+
+	var output bytes.Buffer
+	if err := configkit.WriteDiagnostics(&output, diagnostics); err != nil {
+		t.Fatal(err)
+	}
+	positions := []int{
+		strings.Index(output.String(), diagnostic.Primary.SourceID),
+		strings.Index(output.String(), diagnostic.Related[0].SourceID),
+		strings.Index(output.String(), diagnostic.Related[1].SourceID),
+	}
+	if positions[0] < 0 || positions[1] <= positions[0] || positions[2] <= positions[1] {
+		t.Fatalf("rendered claimant order = %v in %q", positions, output.String())
+	}
+
+	diagnostics[0].Related[0].SourceID = "mutated"
+	if got := claimant(loadError.Diagnostics()[0].Related[0]); got != "c" {
+		t.Fatalf("LoadError.Diagnostics retained caller mutation; first claimant = %q", got)
+	}
+}

facade_diff_test.go

@@ -7,7 +7,7 @@ import (
 	"strings"
 	"testing"
 
-	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+	configkit "go.maximumdirect.net/configkit"
 )
 
 type facadeDiffConfig struct {
@@ -29,10 +29,10 @@ func TestFacadeDiffKeepsPublicSequenceChangesWithHistoricalDescendants(t *testin
 		t.Helper()
 		result, err := configkit.Load(configkit.Bytes("historical-sequence.yml", []byte("items: [{secret: disposable-canary}, "+public+"]\n")),
 			configkit.Options[configuration]{Definition: configkit.Definition[configuration]{
-				Secret: func(path configkit.Path) bool { return path.String() == "/items/0/secret" },
+				Sensitive: func(path configkit.Path) bool { return path.String() == "/items/0/secret" },
 				Resolve: func(current *configuration, resolution *configkit.Resolution) error {
 					current.Items[0] = "public scalar"
-					resolution.Record(configkit.Keys("items"), configkit.ChangeNormalization, "normalize first item")
+					resolution.RecordNormalization(configkit.Keys("items"), "normalize first item")
 					return nil
 				},
 			}})
@@ -71,10 +71,10 @@ func TestFacadeDiffKeepsPublicScalarAcrossHistoricalAbsence(t *testing.T) {
 		Dynamic map[string]any `yaml:"dynamic"`
 	}
 	options := configkit.Options[configuration]{Definition: configkit.Definition[configuration]{
-		Secret: func(path configkit.Path) bool { return path.String() == "/dynamic/entry/token" },
+		Sensitive: func(path configkit.Path) bool { return path.String() == "/dynamic/entry/token" },
 		Resolve: func(current *configuration, resolution *configkit.Resolution) error {
 			delete(current.Dynamic, "entry")
-			resolution.Record(configkit.Keys("dynamic", "entry"), configkit.ChangeNormalization, "remove entry")
+			resolution.RecordNormalization(configkit.Keys("dynamic", "entry"), "remove entry")
 			return nil
 		},
 	}}
@@ -221,7 +221,7 @@ func TestFacadeDiffIgnoresSourceAndResolutionHistory(t *testing.T) {
 	resolve := func(value string) configkit.Options[config] {
 		return configkit.Options[config]{Definition: configkit.Definition[config]{Resolve: func(current *config, resolution *configkit.Resolution) error {
 			current.Count = len(value) + 8
-			resolution.Record(configkit.Keys("count"), configkit.ChangeNormalization, "set effective count")
+			resolution.RecordNormalization(configkit.Keys("count"), "set effective count")
 			return nil
 		}}}
 	}
@@ -281,7 +281,7 @@ func TestFacadeDiffUsesFrozenFilesAndRunsCallbacksOnlyDuringLoad(t *testing.T) {
 
 func TestFacadeDiffCombinesSecretSensitivityAndLoadErrors(t *testing.T) {
 	t.Setenv("FACADE_DIFF_SECRET", "credential-one")
-	secretOptions := configkit.Options[facadeDiffSecretConfig]{Definition: configkit.Definition[facadeDiffSecretConfig]{Secret: func(path configkit.Path) bool {
+	secretOptions := configkit.Options[facadeDiffSecretConfig]{Definition: configkit.Definition[facadeDiffSecretConfig]{Sensitive: func(path configkit.Path) bool {
 		return path.String() == "/secret"
 	}}}
 	left, err := configkit.Load[facadeDiffSecretConfig](configkit.Bytes("left.yml", []byte("secret: FACADE_DIFF_SECRET\n")), secretOptions)

facade_discovery_test.go

@@ -93,14 +93,14 @@ func TestFacadeSearchOrderingRequirednessAndSnapshots(t *testing.T) {
 	names := []string{"config.yml"}
 	groups := []FilenameGroup{CustomFilenames(names...)}
 	directoryOptions := []DirectorySearchOptions{{Filenames: groups}}
-	search := Searches(Paths(paths...), SearchDirectory(root, directoryOptions...), Paths(laterPath))
+	search := Searches(SearchPaths(paths...), SearchDirectory(root, directoryOptions...), SearchPaths(laterPath))
 	source := SearchConfig("", search, SearchOptions{Required: true})
 
 	paths[0] = laterPath
 	names[0] = "later.yml"
 	groups[0] = CustomFilenames("later.yml")
 	directoryOptions[0].Filenames[0] = CustomFilenames("later.yml")
-	search = Paths(laterPath)
+	search = SearchPaths(laterPath)
 
 	result, err := Load[facadeDiscoveryConfig](source)
 	if err != nil || result.Config.Value != "selected" {
@@ -110,7 +110,7 @@ func TestFacadeSearchOrderingRequirednessAndSnapshots(t *testing.T) {
 		t.Fatalf("ordered search sources = %#v", sources)
 	}
 
-	_, err = Load[facadeDiscoveryConfig](SearchConfig("", Paths(filepath.Join(root, "missing.yml")), SearchOptions{Required: true}))
+	_, err = Load[facadeDiscoveryConfig](SearchConfig("", SearchPaths(filepath.Join(root, "missing.yml")), SearchOptions{Required: true}))
 	var loadErr *LoadError
 	if !errors.As(err, &loadErr) {
 		t.Fatalf("required exhausted search error = %v, want *LoadError", err)
@@ -131,7 +131,7 @@ func TestFacadeSearchWorksForLayeredMainAndUnderlay(t *testing.T) {
 	mainPath := writeFacadeImportFile(t, root, "main.yml", "settings: {main: value}\n")
 	underlayPath := writeFacadeImportFile(t, root, "underlay/base.yml", "settings: {underlay: value}\n")
 	result, err := LoadLayered(
-		Input{Source: SearchConfig("", Paths(mainPath))},
+		Input{Source: SearchConfig("", SearchPaths(mainPath))},
 		LayeredOptions[facadeDiscoveryConfig]{Underlays: []Underlay{{Inputs: []Input{{
 			Source: SearchConfig("", SearchDirectory(filepath.Dir(underlayPath), DirectorySearchOptions{
 				Filenames: []FilenameGroup{CustomFilenames("base.yml")},
@@ -142,7 +142,7 @@ func TestFacadeSearchWorksForLayeredMainAndUnderlay(t *testing.T) {
 		t.Fatalf("layered search = %#v, %v", result, err)
 	}
 	sources := result.Sources()
-	if len(sources) != 2 || sources[0].Path != canonicalFacadePath(t, mainPath) || sources[0].Layer != LayerBase ||
+	if len(sources) != 2 || sources[0].Path != canonicalFacadePath(t, mainPath) || sources[0].Layer != LayerMain ||
 		sources[1].Path != canonicalFacadePath(t, underlayPath) || sources[1].Layer != LayerUnderlay {
 		t.Fatalf("layered search sources = %#v", sources)
 	}
@@ -157,7 +157,7 @@ func TestFacadeSearchSelectedAndAbsentUseRootOnlyContext(t *testing.T) {
 	filesystem := &FilesystemContext{Root: root}
 	options := Options[facadeDiscoveryConfig]{Overlay: "testing", Filesystem: filesystem}
 
-	selected, err := Load(SearchConfig("", Paths(mainPath)), options)
+	selected, err := Load(SearchConfig("", SearchPaths(mainPath)), options)
 	if err != nil || selected.Config.Value != "overlay" {
 		t.Fatalf("selected search with root-only context = %#v, %v", selected, err)
 	}
@@ -171,7 +171,7 @@ func TestFacadeSearchSelectedAndAbsentUseRootOnlyContext(t *testing.T) {
 		t.Fatalf("selected file base context = %#v, %v", mainContext, ok)
 	}
 
-	missing := SearchConfig("", Paths(filepath.Join(root, "missing.yml")))
+	missing := SearchConfig("", SearchPaths(filepath.Join(root, "missing.yml")))
 	searchedAbsent, err := Load(missing, options)
 	if err != nil {
 		t.Fatalf("exhausted search with root-only overlay context: %v", err)
@@ -201,7 +201,7 @@ func TestFacadeSearchRejectsSelectedContextWithoutFallback(t *testing.T) {
 	inside := writeFacadeImportFile(t, root, "inside.yml", "value: fallback\n")
 	outsideRoot := t.TempDir()
 	outside := writeFacadeImportFile(t, outsideRoot, "outside.yml", "value: selected\n")
-	search := SearchConfig("", Paths(outside, inside))
+	search := SearchConfig("", SearchPaths(outside, inside))
 
 	_, err := Load(search, Options[facadeDiscoveryConfig]{Filesystem: &FilesystemContext{Root: root}})
 	var loadErr *LoadError
@@ -228,7 +228,7 @@ func TestFacadeSearchRunsCallbacksOnceAndKeepsInspectionWithSelectedFile(t *test
 	selectedPath := writeFacadeImportFile(t, root, "selected.yml", "value: selected\n")
 	writeFacadeImportFile(t, root, "later.yml", "value: later\n")
 	defaultsCalls, resolveCalls, validateCalls := 0, 0, 0
-	result, err := Load(SearchConfig("", Paths(selectedPath, filepath.Join(root, "later.yml"))), Options[facadeDiscoveryLifecycleConfig]{
+	result, err := Load(SearchConfig("", SearchPaths(selectedPath, filepath.Join(root, "later.yml"))), Options[facadeDiscoveryLifecycleConfig]{
 		Definition: Definition[facadeDiscoveryLifecycleConfig]{
 			Defaults: func() facadeDiscoveryLifecycleConfig {
 				defaultsCalls++
@@ -237,7 +237,7 @@ func TestFacadeSearchRunsCallbacksOnceAndKeepsInspectionWithSelectedFile(t *test
 			Resolve: func(configuration *facadeDiscoveryLifecycleConfig, resolution *Resolution) error {
 				resolveCalls++
 				configuration.Resolved = "from:" + configuration.Value
-				resolution.Record(Keys("resolved"), ChangeNormalization, "derive from selected value", Keys("value"))
+				resolution.RecordNormalization(Keys("resolved"), "derive from selected value", Keys("value"))
 				return nil
 			},
 			Validate: func(_ *facadeDiscoveryLifecycleConfig, _ *Validation) { validateCalls++ },
@@ -272,7 +272,7 @@ func TestFacadeSearchSequenceItemAndAbsentInputPlacement(t *testing.T) {
 		Destination:   Keys("items"),
 		PlacementMode: PlacementModeSequenceItem,
 	}
-	selected, err := Load(SearchConfig("", Paths(selectedPath)), options)
+	selected, err := Load(SearchConfig("", SearchPaths(selectedPath)), options)
 	if err != nil || len(selected.Config.Items) != 1 || selected.Config.Items[0].Name != "selected" {
 		t.Fatalf("selected sequence item = %#v, %v", selected, err)
 	}
@@ -283,7 +283,7 @@ func TestFacadeSearchSequenceItemAndAbsentInputPlacement(t *testing.T) {
 	defaults := func() facadeDiscoveryPlacementConfig {
 		return facadeDiscoveryPlacementConfig{Items: []facadeDiscoveryPlacementItem{}}
 	}
-	absent, err := Load(SearchConfig("", Paths(filepath.Join(root, "missing.yml"))), Options[facadeDiscoveryPlacementConfig]{
+	absent, err := Load(SearchConfig("", SearchPaths(filepath.Join(root, "missing.yml"))), Options[facadeDiscoveryPlacementConfig]{
 		Definition:    Definition[facadeDiscoveryPlacementConfig]{Defaults: defaults},
 		Destination:   options.Destination,
 		PlacementMode: options.PlacementMode,

facade_dynamic_redaction_test.go

@@ -0,0 +1,53 @@
+package configkit_test
+
+import (
+	"bytes"
+	"strings"
+	"testing"
+
+	configkit "go.maximumdirect.net/configkit"
+)
+
+func TestFinalDynamicTagRedactsEqualValuedResolution(t *testing.T) {
+	t.Parallel()
+	type classified struct {
+		Token string `yaml:"token" configkit:"secret"`
+	}
+	type configuration struct {
+		Value any `yaml:"value"`
+	}
+	const canary = "DYNAMIC-TAG-CANARY"
+	result, err := configkit.Load(configkit.Bytes("input", []byte("value: {token: "+canary+"}\n")), configkit.Options[configuration]{
+		Definition: configkit.Definition[configuration]{
+			Resolve: func(c *configuration, _ *configkit.Resolution) error {
+				// No canonical value changes, so no normalization record is needed.
+				c.Value = classified{Token: canary}
+				return nil
+			},
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var effective bytes.Buffer
+	if err := result.WriteEffective(&effective); err != nil {
+		t.Fatal(err)
+	}
+	if strings.Contains(effective.String(), canary) || !strings.Contains(effective.String(), "[REDACTED]") {
+		t.Fatal("effective rendering did not preserve the final dynamic tag")
+	}
+	explanation, found := result.Explain(configkit.Keys("value", "token"))
+	if !found || !explanation.Effective.Redacted || strings.Contains(explanation.Effective.YAML, canary) {
+		t.Fatal("effective explanation did not preserve the final dynamic tag")
+	}
+	if len(explanation.History) == 0 {
+		t.Fatal("source history is absent")
+	}
+	for _, change := range explanation.History {
+		for _, value := range []configkit.ValueSnapshot{change.Before, change.After} {
+			if value.Present && (!value.Redacted || strings.Contains(value.YAML, canary)) {
+				t.Fatal("historical explanation did not preserve the final dynamic tag")
+			}
+		}
+	}
+}

facade_equivalence_test.go

@@ -9,7 +9,7 @@ import (
 	"testing"
 	"testing/fstest"
 
-	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+	configkit "go.maximumdirect.net/configkit"
 )
 
 type equivalentConfig struct {
@@ -69,7 +69,7 @@ func TestEquivalentSourceFormsPreserveInputSemantics(t *testing.T) {
 			}
 			for _, field := range []string{"version", "name", "enabled", "count", "items", "optional"} {
 				info, ok := result.Metadata().Lookup(configkit.Keys(field))
-				if !ok || !info.Explicit || info.Origin.Layer != configkit.LayerBase || info.Null != (field == "optional") {
+				if !ok || !info.Explicit || info.Origin.Layer != configkit.LayerMain || info.Null != (field == "optional") {
 					t.Errorf("%s input info = %#v, %v", field, info, ok)
 				}
 			}
@@ -87,8 +87,8 @@ func TestEquivalentSourceFormsPreserveInputSemantics(t *testing.T) {
 
 func TestRepeatedImportsAcrossTiersAndReaderConsumption(t *testing.T) {
 	namespace := configkit.NewFilesystem("bundle", fstest.MapFS{
-		"left.yml":   &fstest.MapFile{Data: []byte("configkit: {imports: [{path: shared.yml}]}\n")},
-		"right.yml":  &fstest.MapFile{Data: []byte("configkit: {imports: [{path: shared.yml}]}\n")},
+		"left.yml":   &fstest.MapFile{Data: []byte("config: {imports: [{path: shared.yml}]}\n")},
+		"right.yml":  &fstest.MapFile{Data: []byte("config: {imports: [{path: shared.yml}]}\n")},
 		"shared.yml": &fstest.MapFile{Data: []byte("name: retained\n")},
 	})
 	type config struct {
@@ -132,7 +132,7 @@ func TestReplacedSecretRemainsAbsentFromSafeOutput(t *testing.T) {
 	}
 	result, err := configkit.LoadLayered(configkit.Input{Source: configkit.Bytes("main", []byte("secret: new-secret-canary\n"))}, configkit.LayeredOptions[config]{
 		Underlays:  []configkit.Underlay{{Inputs: []configkit.Input{{Source: configkit.Mapping("lower", map[string]any{"secret": "old-secret-canary"})}}}},
-		Definition: configkit.Definition[config]{Secret: func(path configkit.Path) bool { return path.String() == "/secret" }},
+		Definition: configkit.Definition[config]{Sensitive: func(path configkit.Path) bool { return path.String() == "/secret" }},
 	})
 	if err != nil || result.Config.Secret != "new-secret-canary" {
 		t.Fatalf("secret load = %#v, %v", result, err)

facade_filesystem_test.go

@@ -9,7 +9,7 @@ import (
 	"testing"
 	"testing/fstest"
 
-	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+	configkit "go.maximumdirect.net/configkit"
 )
 
 //go:embed testdata/filesystem
@@ -57,7 +57,7 @@ func TestFacadeFilesystemSourceImportsOverlayAndReuse(t *testing.T) {
 
 func TestFacadeFilesystemContextsAndIdentity(t *testing.T) {
 	first := configkit.NewFilesystem("same", fstest.MapFS{
-		"root/config/main.yml":      &fstest.MapFile{Data: []byte("configkit: {imports: [{path: ../shared.yml}]}\n")},
+		"root/config/main.yml":      &fstest.MapFile{Data: []byte("config: {imports: [{path: ../shared.yml}]}\n")},
 		"root/shared.yml":           &fstest.MapFile{Data: []byte("items: {value: first}\n")},
 		"root/overlays/testing.yml": &fstest.MapFile{Data: []byte("items: {overlay: first}\n")},
 	})
@@ -82,8 +82,8 @@ func TestFacadeFilesystemContextsAndIdentity(t *testing.T) {
 		source configkit.Source
 		kind   configkit.SourceKind
 	}{
-		{"bytes", configkit.Bytes("memory", []byte("configkit: {imports: [{path: shared.yml}]}\n")), configkit.SourceKindBytes},
-		{"reader", configkit.Reader("stream", strings.NewReader("configkit: {imports: [{path: shared.yml}]}\n")), configkit.SourceKindReader},
+		{"bytes", configkit.Bytes("memory", []byte("config: {imports: [{path: shared.yml}]}\n")), configkit.SourceKindBytes},
+		{"reader", configkit.Reader("stream", strings.NewReader("config: {imports: [{path: shared.yml}]}\n")), configkit.SourceKindReader},
 	} {
 		t.Run(input.name, func(t *testing.T) {
 			result, err := configkit.Load(input.source, configkit.Options[filesystemFacadeConfig]{Imports: true, Filesystem: &configkit.FilesystemContext{Root: "root", BaseDir: "root", FS: &first}})

facade_final_sequence_identity_test.go

@@ -5,7 +5,7 @@ import (
 	"strings"
 	"testing"
 
-	"gitea.maximumdirect.net/eric/ConfigKit"
+	"go.maximumdirect.net/configkit"
 )
 
 func TestFinalSequenceIdentityTreatsLateExtendsFieldsAsPayload(t *testing.T) {
@@ -29,7 +29,7 @@ func TestFinalSequenceIdentityTreatsLateExtendsFieldsAsPayload(t *testing.T) {
 					if phase == "resolution" {
 						definition.Resolve = func(value *map[string]any, resolution *configkit.Resolution) error {
 							(*value)["items"] = items
-							resolution.Record(configkit.Keys("items"), configkit.ChangeNormalization, "supply application payload")
+							resolution.RecordNormalization(configkit.Keys("items"), "supply application payload")
 							return nil
 						}
 					}
@@ -77,7 +77,7 @@ func TestFinalSequenceIdentityValidatesLateValues(t *testing.T) {
 				case "resolution":
 					options.Definition.Resolve = func(value *map[string]any, resolution *configkit.Resolution) error {
 						(*value)["items"] = items
-						resolution.Record(configkit.Keys("items"), configkit.ChangeNormalization, "create effective records")
+						resolution.RecordNormalization(configkit.Keys("items"), "create effective records")
 						return nil
 					}
 				}
@@ -134,7 +134,7 @@ func TestFinalSequenceIdentityMatchesLateDynamicNamespaces(t *testing.T) {
 			case "resolution":
 				options.Definition.Resolve = func(value *map[string]any, resolution *configkit.Resolution) error {
 					(*value)["collections"] = map[string]any{name: map[string]any{"items": items}}
-					resolution.Record(configkit.Keys("collections"), configkit.ChangeNormalization, "create namespaced records")
+					resolution.RecordNormalization(configkit.Keys("collections"), "create namespaced records")
 					return nil
 				}
 			}

facade_historical_paths_test.go

@@ -4,7 +4,7 @@ import (
 	"reflect"
 	"testing"
 
-	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+	configkit "go.maximumdirect.net/configkit"
 )
 
 func TestPublicHistoricalPathsEnumerateContextualShapes(t *testing.T) {
@@ -40,12 +40,16 @@ func TestPublicHistoricalPathsEnumerateContextualShapes(t *testing.T) {
 	if len(metadata.History(paths[6])) == 0 {
 		t.Fatal("enumerated numeric path lost history")
 	}
+	assertPublicShapeHistory(t, metadata, configkit.LayerCLI)
 	if _, ok := metadata.Lookup(configkit.Keys("shape", "0")); ok {
 		t.Fatal("mapping-key path resolved against the effective sequence")
 	}
 	if len((configkit.Metadata{}).HistoricalPaths()) != 0 {
 		t.Fatal("zero metadata contains historical paths")
 	}
+	if (configkit.Metadata{}).History(configkit.Keys("shape")) != nil {
+		t.Fatal("zero metadata contains history")
+	}
 
 	paths[1] = configkit.Keys("mutated")
 	if again := metadata.HistoricalPaths(); !reflect.DeepEqual(pathStrings(again), want) {
@@ -53,6 +57,60 @@ func TestPublicHistoricalPathsEnumerateContextualShapes(t *testing.T) {
 	}
 }
 
+func TestPublicHistoryUsesResolutionShapeAttribution(t *testing.T) {
+	loaded, err := configkit.Load[map[string]any](configkit.Bytes("main", []byte("shape: {'0': base}\n")), configkit.Options[map[string]any]{
+		Definition: configkit.Definition[map[string]any]{
+			Resolve: func(configuration *map[string]any, resolution *configkit.Resolution) error {
+				(*configuration)["shape"] = []any{"replacement"}
+				resolution.RecordNormalization(configkit.Keys("shape"), "replace numeric mapping key")
+				return nil
+			},
+		},
+	})
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	assertPublicShapeHistory(t, loaded.Metadata(), configkit.LayerResolution)
+}
+
+func assertPublicShapeHistory(t *testing.T, metadata configkit.Metadata, operationLayer configkit.Layer) {
+	t.Helper()
+
+	keyPath := configkit.Keys("shape", "0")
+	indexPath := configkit.Keys("shape").Index(0)
+	keyHistory := metadata.History(keyPath)
+	indexHistory := metadata.History(indexPath)
+	if len(keyHistory) == 0 || len(indexHistory) == 0 {
+		t.Fatalf("explicit shape histories = key %#v, index %#v", keyHistory, indexHistory)
+	}
+	var keyDefinition, keyReplacement, indexReplacement bool
+	for _, change := range keyHistory {
+		keyDefinition = keyDefinition || change.Origin.Layer == configkit.LayerMain
+		keyReplacement = keyReplacement || change.Origin.Layer == operationLayer && change.Path.String() == "/shape"
+	}
+	for _, change := range indexHistory {
+		if change.Origin.Layer == configkit.LayerMain {
+			t.Fatalf("introduced index inherited mapping-key history: %#v", indexHistory)
+		}
+		indexReplacement = indexReplacement || change.Origin.Layer == operationLayer && change.Path.String() == "/shape"
+		for _, previous := range change.Previous {
+			if previous.Layer == configkit.LayerMain {
+				t.Fatalf("introduced index inherited mapping-key previous origin: %#v", change)
+			}
+		}
+	}
+	if !keyDefinition || !keyReplacement || !indexReplacement {
+		t.Fatalf("shape histories missed applicable definitions or replacement: key %#v, index %#v", keyHistory, indexHistory)
+	}
+	parsed, err := configkit.ParsePath("/shape/0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if parsedHistory := metadata.History(parsed); len(parsedHistory) == 0 {
+		t.Fatal("parsed numeric query lost contextual history")
+	}
+}
+
 func pathStrings(paths []configkit.Path) []string {
 	result := make([]string, len(paths))
 	for index, path := range paths {

facade_import_alias_test.go

@@ -8,13 +8,13 @@ import (
 	"path/filepath"
 	"testing"
 
-	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+	configkit "go.maximumdirect.net/configkit"
 )
 
 func TestFacadeNativeDiscoveryPreservesAliasIdentity(t *testing.T) {
 	root := t.TempDir()
 	for name, contents := range map[string]string{
-		"data/item.yml":        "configkit:\n  imports:\n    - path: helper.yml\nvalue: item\n",
+		"data/item.yml":        "config:\n  imports:\n    - path: helper.yml\nvalue: item\n",
 		"data/helper.yml":      "owner: target\nresource: resource.txt\n",
 		"aliases/helper.yml":   "owner: alias\nresource: resource.txt\n",
 		"data/resource.txt":    "target resource",
@@ -50,7 +50,7 @@ func TestFacadeNativeDiscoveryPreservesAliasIdentity(t *testing.T) {
 		{"directory/glob", "glob: 'lin*/ite*.yml'", "linked/item.yml", "linked/helper.yml", "target", "target resource"},
 	} {
 		t.Run(test.name, func(t *testing.T) {
-			result, err := configkit.Load(configkit.Bytes("main", []byte("configkit:\n  imports:\n    - "+test.declaration+"\n")), configkit.Options[configuration]{
+			result, err := configkit.Load(configkit.Bytes("main", []byte("config:\n  imports:\n    - "+test.declaration+"\n")), configkit.Options[configuration]{
 				Imports: true, Filesystem: &configkit.FilesystemContext{FS: &filesystem, Root: ".", BaseDir: "."},
 			})
 			if err != nil {
@@ -82,14 +82,14 @@ func TestFacadeNativeDiscoveryPreservesAliasIdentity(t *testing.T) {
 	// The same native path is still a repeat when separately included. An alias
 	// to a leaf file remains a different native namespace path, as for path imports.
 	for _, selector := range []string{"path: aliases/item.yml", "dir: aliases\n      pattern: item.yml", "glob: 'aliases/ite*.yml'"} {
-		_, err := configkit.Load(configkit.Bytes("main", []byte("configkit:\n  imports:\n    - "+selector+"\n    - path: aliases/item.yml\n")), configkit.Options[configuration]{
+		_, err := configkit.Load(configkit.Bytes("main", []byte("config:\n  imports:\n    - "+selector+"\n    - path: aliases/item.yml\n")), configkit.Options[configuration]{
 			Imports: true, Filesystem: &configkit.FilesystemContext{FS: &filesystem, Root: ".", BaseDir: "."},
 		})
 		var loadError *configkit.LoadError
 		if !errors.As(err, &loadError) || len(loadError.Diagnostics()) != 1 || loadError.Diagnostics()[0].Code != configkit.CodeImportRepeated {
 			t.Fatalf("repeated source: %v", err)
 		}
-		_, err = configkit.Load(configkit.Bytes("main", []byte("configkit:\n  imports:\n    - "+selector+"\n    - path: data/item.yml\n")), configkit.Options[configuration]{
+		_, err = configkit.Load(configkit.Bytes("main", []byte("config:\n  imports:\n    - "+selector+"\n    - path: data/item.yml\n")), configkit.Options[configuration]{
 			Imports: true, Filesystem: &configkit.FilesystemContext{FS: &filesystem, Root: ".", BaseDir: "."},
 		})
 		if !errors.As(err, &loadError) || len(loadError.Diagnostics()) == 0 || loadError.Diagnostics()[0].Code != configkit.CodeComposeConflict {

facade_import_defaults_test.go

@@ -19,7 +19,7 @@ func TestImportDepthChecksSuffixAfterSaturation(t *testing.T) {
 		{"-0", true},
 	} {
 		t.Run(test.depth, func(t *testing.T) {
-			main := writeFacadeImportFile(t, t.TempDir(), "main.yml", "value: true\nconfigkit:\n  imports:\n    - dir: absent\n      recursive: true\n      depth: "+test.depth+"\n")
+			main := writeFacadeImportFile(t, t.TempDir(), "main.yml", "value: true\nconfig:\n  imports:\n    - dir: absent\n      recursive: true\n      depth: "+test.depth+"\n")
 			result, err := Load[map[string]any](File(main), Options[map[string]any]{Imports: true})
 			if test.valid {
 				if err != nil || result.Config["value"] != true {
@@ -31,7 +31,7 @@ func TestImportDepthChecksSuffixAfterSaturation(t *testing.T) {
 			if !errors.As(err, &loadError) || len(loadError.Diagnostics()) != 1 {
 				t.Fatalf("invalid depth accepted: %v", err)
 			}
-			if diagnostic := loadError.Diagnostics()[0]; diagnostic.Code != CodeImportInvalid || diagnostic.Path.String() != "/configkit/imports/0/depth" {
+			if diagnostic := loadError.Diagnostics()[0]; diagnostic.Code != CodeImportInvalid || diagnostic.Path.String() != "/config/imports/0/depth" {
 				t.Fatalf("invalid depth diagnostic = %#v", diagnostic)
 			}
 		})
@@ -47,12 +47,12 @@ func TestImportDefaultsApplyToTransitiveAndUnderlayImports(t *testing.T) {
 		IgnoredDeep string `yaml:"ignored_deep"`
 	}
 	directory := t.TempDir()
-	mainPath := writeFacadeImportFile(t, directory, "main.yml", `configkit:
+	mainPath := writeFacadeImportFile(t, directory, "main.yml", `config:
   imports:
     - path: parent/parent.yml
 main: main
 `)
-	writeFacadeImportFile(t, directory, "parent/parent.yml", `configkit:
+	writeFacadeImportFile(t, directory, "parent/parent.yml", `config:
   imports:
     - dir: generated
     - dir: explicit
@@ -64,7 +64,7 @@ main: main
 	explicitPath := writeFacadeImportFile(t, directory, "parent/explicit/exception.yaml", "exception: declaration\n")
 	writeFacadeImportFile(t, directory, "parent/explicit/deep/ignored.yaml", "ignored_deep: wrong-depth\n")
 	writeFacadeImportFile(t, directory, "parent/explicit/ignored.cfg", "ignored_deep: wrong-explicit-pattern\n")
-	underlayPath := writeFacadeImportFile(t, directory, "underlay.yml", `configkit:
+	underlayPath := writeFacadeImportFile(t, directory, "underlay.yml", `config:
   imports:
     - dir: underlay-files
 `)
@@ -93,25 +93,32 @@ main: main
 
 func TestImportDefaultsPreserveEmptyPatternAndRequiredness(t *testing.T) {
 	type config struct {
-		Value string `yaml:"value"`
+		Value  string `yaml:"value"`
+		Hidden string `yaml:"hidden"`
 	}
 	directory := t.TempDir()
-	mainPath := writeFacadeImportFile(t, directory, "main.yml", `configkit:
+	mainPath := writeFacadeImportFile(t, directory, "main.yml", `config:
   imports:
     - dir: snippets
 `)
 	writeFacadeImportFile(t, directory, "snippets/value.cfg", "value: imported\n")
+	writeFacadeImportFile(t, directory, "snippets/.hidden.cfg", "hidden: imported\n")
 
 	unrestricted, err := Load(File(mainPath), Options[config]{Imports: true})
 	if err != nil || unrestricted.Config.Value != "imported" {
 		t.Fatalf("unspecified pattern = %#v, %v", unrestricted, err)
 	}
+	includeHidden := false
+	visibleOnly, err := Load(File(mainPath), Options[config]{Imports: true, ImportDefaults: ImportDefaults{IncludeHidden: &includeHidden}})
+	if err != nil || visibleOnly.Config.Value != "imported" || visibleOnly.Config.Hidden != "" {
+		t.Fatalf("hidden-file default = %#v, %v", visibleOnly, err)
+	}
 	empty, err := Load(File(mainPath), Options[config]{Imports: true, ImportDefaults: ImportDefaults{Pattern: []string{}}})
 	if err != nil || empty.Config.Value != "" {
 		t.Fatalf("empty pattern = %#v, %v", empty, err)
 	}
 	emptySources := empty.Sources()
-	if len(emptySources) != 1 || len(emptySources[0].ImportSelections) != 1 || emptySources[0].ImportSelections[0].Path.String() != "/configkit/imports/0" || emptySources[0].ImportSelections[0].Selector != ImportSelectorDirectory || emptySources[0].ImportSelections[0].Outcome != ImportSelectionNone {
+	if len(emptySources) != 1 || len(emptySources[0].EmptyImportSelections) != 1 || emptySources[0].EmptyImportSelections[0].Path.String() != "/config/imports/0" || emptySources[0].EmptyImportSelections[0].Selector != ImportSelectorDirectory {
 		t.Fatalf("empty-pattern evidence = %#v", emptySources)
 	}
 	required := true
@@ -120,7 +127,7 @@ func TestImportDefaultsPreserveEmptyPatternAndRequiredness(t *testing.T) {
 	if !errors.As(err, &loadError) || len(loadError.Diagnostics()) != 1 || loadError.Diagnostics()[0].Code != CodeImportMissing {
 		t.Fatalf("required empty selection error = %T %v", err, err)
 	}
-	if sources := loadError.Sources(); len(sources) != 1 || len(sources[0].ImportSelections) != 0 {
+	if sources := loadError.Sources(); len(sources) != 1 || len(sources[0].EmptyImportSelections) != 0 {
 		t.Fatalf("required empty selection was recorded as optional: %#v", sources)
 	}
 }
@@ -134,7 +141,7 @@ func TestImportDefaultsAreSnapshottedBeforeOrdinaryAndLayeredCallbacks(t *testin
 		t.Run(map[bool]string{false: "ordinary", true: "layered"}[layered], func(t *testing.T) {
 			directory := t.TempDir()
 			mainPath := writeFacadeImportFile(t, directory, "main.yml", `version: v1
-configkit:
+config:
   imports:
     - dir: parts
 `)
@@ -222,7 +229,7 @@ func TestPublicImportSelectionSnapshotsAreDetachedAcrossResultErrorAndResolution
 		Value string `yaml:"value"`
 	}
 	directory := t.TempDir()
-	mainPath := writeFacadeImportFile(t, directory, "main.yml", `configkit:
+	mainPath := writeFacadeImportFile(t, directory, "main.yml", `config:
   imports:
     - dir: absent
 value: loaded
@@ -230,33 +237,33 @@ value: loaded
 	callbackPath := ""
 	loaded, err := Load(File(mainPath), Options[config]{Imports: true, Definition: Definition[config]{Resolve: func(_ *config, resolution *Resolution) error {
 		first, ok := resolution.Source("source-1")
-		if !ok || len(first.ImportSelections) != 1 {
+		if !ok || len(first.EmptyImportSelections) != 1 {
 			t.Fatalf("resolution source = %#v, %v", first, ok)
 		}
-		first.ImportSelections[0].Path = Keys("callback mutation")
+		first.EmptyImportSelections[0].Path = Keys("callback mutation")
 		second, ok := resolution.Source("source-1")
-		if !ok || second.ImportSelections[0].Path.String() != "/configkit/imports/0" {
+		if !ok || second.EmptyImportSelections[0].Path.String() != "/config/imports/0" {
 			t.Fatalf("resolution snapshot changed after mutation: %#v", second)
 		}
-		callbackPath = second.ImportSelections[0].Path.String()
+		callbackPath = second.EmptyImportSelections[0].Path.String()
 		return nil
 	}}})
 	if err != nil {
 		t.Fatal(err)
 	}
-	if callbackPath != "/configkit/imports/0" {
+	if callbackPath != "/config/imports/0" {
 		t.Fatalf("callback path = %q", callbackPath)
 	}
 	sources := loaded.Sources()
-	if len(sources) != 1 || len(sources[0].ImportSelections) != 1 || sources[0].ImportSelections[0].Location.SourceID != sources[0].ID || sources[0].ImportSelections[0].Selector != ImportSelectorDirectory {
+	if len(sources) != 1 || len(sources[0].EmptyImportSelections) != 1 || sources[0].EmptyImportSelections[0].Location.SourceID != sources[0].ID || sources[0].EmptyImportSelections[0].Selector != ImportSelectorDirectory {
 		t.Fatalf("result source evidence = %#v", sources)
 	}
-	sources[0].ImportSelections[0].Path = Keys("result mutation")
-	if got := loaded.Sources()[0].ImportSelections[0].Path.String(); got != "/configkit/imports/0" {
+	sources[0].EmptyImportSelections[0].Path = Keys("result mutation")
+	if got := loaded.Sources()[0].EmptyImportSelections[0].Path.String(); got != "/config/imports/0" {
 		t.Fatalf("result snapshot changed after mutation: %q", got)
 	}
 
-	failurePath := writeFacadeImportFile(t, directory, "failure.yml", `configkit:
+	failurePath := writeFacadeImportFile(t, directory, "failure.yml", `config:
   imports:
     - dir: absent
     - path: required-missing.yml
@@ -268,11 +275,11 @@ value: loaded
 		t.Fatalf("failed load error = %T %v", err, err)
 	}
 	errorSources := loadError.Sources()
-	if len(errorSources) != 1 || len(errorSources[0].ImportSelections) != 1 || errorSources[0].ImportSelections[0].Path.String() != "/configkit/imports/0" {
+	if len(errorSources) != 1 || len(errorSources[0].EmptyImportSelections) != 1 || errorSources[0].EmptyImportSelections[0].Path.String() != "/config/imports/0" {
 		t.Fatalf("error source evidence = %#v", errorSources)
 	}
-	errorSources[0].ImportSelections[0].Path = Keys("error mutation")
-	if got := loadError.Sources()[0].ImportSelections[0].Path.String(); got != "/configkit/imports/0" {
+	errorSources[0].EmptyImportSelections[0].Path = Keys("error mutation")
+	if got := loadError.Sources()[0].EmptyImportSelections[0].Path.String(); got != "/config/imports/0" {
 		t.Fatalf("error snapshot changed after mutation: %q", got)
 	}
 }

facade_import_lifecycle_test.go

@@ -12,7 +12,7 @@ import (
 func TestDiscoveredItemHelpersPreserveNestedInheritedResourceEvidence(t *testing.T) {
 	const canary = "PRIVATE-CONSUMED-HEADER-CANARY"
 	filesystem := NewFilesystem("bundle", fstest.MapFS{
-		"bundle/config/main.yml": {Data: []byte(`configkit:
+		"bundle/config/main.yml": {Data: []byte(`config:
   imports:
     - dir: records
       pattern: '*-item.yml'
@@ -23,7 +23,7 @@ services:
     - id: authored
       version: authored
 `)},
-		"bundle/config/records/a-item.yml": {Data: []byte(`configkit:
+		"bundle/config/records/a-item.yml": {Data: []byte(`config:
   imports:
     - path: helper.yml
 version: ` + canary + `
@@ -42,7 +42,7 @@ entries:
 		Definition: Definition[map[string]any]{
 			Version:            &VersionRule{Path: Keys("version"), Check: func(Version, *Validation) error { return nil }},
 			SequenceIdentities: []SequenceIdentity{SequenceIdentityAt(Keys("services", "records"), "id")},
-			Secret: func(candidate Path) bool {
+			Sensitive: func(candidate Path) bool {
 				return candidate.String() == "/services/records/0/version"
 			},
 		},
@@ -67,6 +67,14 @@ entries:
 	}
 
 	sources := result.Sources()
+	if len(sources) < 3 || sources[0].Layer != LayerMain || string(sources[0].Layer) != "main" {
+		t.Fatalf("main source attribution = %#v", sources)
+	}
+	for _, source := range sources[1:] {
+		if source.ImportedFrom != nil && (source.Layer != LayerMain || string(source.Layer) != "main") {
+			t.Errorf("imported main source attribution = %#v", source)
+		}
+	}
 	filesByID := make(map[string]string, len(sources))
 	for _, source := range sources {
 		filesByID[source.ID] = source.Path
@@ -77,8 +85,8 @@ entries:
 			itemSource = source
 		}
 	}
-	if itemSource.VersionCheck == nil || !itemSource.VersionCheck.Version.Present || !itemSource.VersionCheck.Redacted || itemSource.VersionCheck.Version.Text != "" {
-		t.Fatalf("consumed header inspection = %#v", itemSource.VersionCheck)
+	if itemSource.VersionEvidence == nil || !itemSource.VersionEvidence.Version.Present || !itemSource.VersionEvidence.Redacted || itemSource.VersionEvidence.Version.Text != "" {
+		t.Fatalf("consumed header inspection = %#v", itemSource.VersionEvidence)
 	}
 	idInfo, ok := result.Metadata().Lookup(Keys("services", "records").Index(0).Key("id"))
 	if !ok || len(idInfo.Origin.Locations) != 1 || filesByID[idInfo.Origin.Locations[0].SourceID] != "bundle/config/records/helper.yml" {
@@ -107,7 +115,7 @@ entries:
 		Definition: Definition[map[string]any]{
 			Version:            &VersionRule{Path: Keys("version"), Check: func(Version, *Validation) error { return nil }},
 			SequenceIdentities: []SequenceIdentity{SequenceIdentityAt(Keys("services", "records"), "version")},
-			Secret: func(candidate Path) bool {
+			Sensitive: func(candidate Path) bool {
 				return candidate.String() == "/services/records/0/version"
 			},
 		},
@@ -129,7 +137,7 @@ entries:
 			break
 		}
 	}
-	if !foundFailedItem || failedItemSource.VersionCheck == nil || failedItemSource.VersionCheck.Version.Text != "" || !failedItemSource.VersionCheck.Redacted {
+	if !foundFailedItem || failedItemSource.VersionEvidence == nil || failedItemSource.VersionEvidence.Version.Text != "" || !failedItemSource.VersionEvidence.Redacted {
 		t.Fatalf("failed-load source inspection exposed or omitted header evidence: %#v", failedItemSource)
 	}
 }

facade_import_root_test.go

@@ -7,7 +7,7 @@ import (
 	"path/filepath"
 	"testing"
 
-	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+	configkit "go.maximumdirect.net/configkit"
 )
 
 func TestFacadeDirectoryRootBelowContainedAbsoluteSymlink(t *testing.T) {
@@ -29,7 +29,7 @@ func TestFacadeDirectoryRootBelowContainedAbsoluteSymlink(t *testing.T) {
 	for _, follow := range []bool{true, false} {
 		t.Run(fmt.Sprintf("follow=%t", follow), func(t *testing.T) {
 			mainPath := filepath.Join(root, "main.yml")
-			contents := fmt.Sprintf("configkit:\n  imports:\n    - dir: absolute/parts\n      pattern: '*.yml'\n      follow: %t\n", follow)
+			contents := fmt.Sprintf("config:\n  imports:\n    - dir: absolute/parts\n      pattern: '*.yml'\n      follow: %t\n", follow)
 			if err := os.WriteFile(mainPath, []byte(contents), 0o600); err != nil {
 				t.Fatal(err)
 			}
@@ -65,7 +65,7 @@ func TestFacadeNativeDiscoveryWithNestedRoot(t *testing.T) {
 		"dir: parts", "glob: 'parts/*.yml'", "dir: linked", "glob: 'lin*/*.yml'",
 	} {
 		t.Run(selector, func(t *testing.T) {
-			result, err := configkit.Load(configkit.Bytes("main", []byte("configkit:\n  imports:\n    - "+selector+"\n")), configkit.Options[map[string]any]{Imports: true, Filesystem: context})
+			result, err := configkit.Load(configkit.Bytes("main", []byte("config:\n  imports:\n    - "+selector+"\n")), configkit.Options[map[string]any]{Imports: true, Filesystem: context})
 			if err != nil {
 				t.Fatal(err)
 			}
@@ -81,7 +81,7 @@ func TestFacadeNativeDiscoveryWithNestedRoot(t *testing.T) {
 		t.Fatal(err)
 	}
 	for _, selector := range []string{"dir: parts", "glob: 'parts/*.yml'"} {
-		_, err := configkit.Load(configkit.Bytes("main", []byte("configkit:\n  imports:\n    - "+selector+"\n")), configkit.Options[map[string]any]{Imports: true, Filesystem: context})
+		_, err := configkit.Load(configkit.Bytes("main", []byte("config:\n  imports:\n    - "+selector+"\n")), configkit.Options[map[string]any]{Imports: true, Filesystem: context})
 		var loadError *configkit.LoadError
 		if !errors.As(err, &loadError) || len(loadError.Diagnostics()) != 1 || loadError.Diagnostics()[0].Code != configkit.CodeImportOutsideRoot {
 			t.Fatalf("escaping %s: %v", selector, err)
@@ -107,7 +107,7 @@ func TestFacadeDiscoveryAllowsFiniteLinkReuse(t *testing.T) {
 			if native {
 				context = &configkit.FilesystemContext{FS: &filesystem, Root: ".", BaseDir: "."}
 			}
-			result, err := configkit.Load(configkit.Bytes("main", []byte("configkit:\n  imports:\n    - "+selector+"\n")), configkit.Options[map[string]any]{Imports: true, Filesystem: context})
+			result, err := configkit.Load(configkit.Bytes("main", []byte("config:\n  imports:\n    - "+selector+"\n")), configkit.Options[map[string]any]{Imports: true, Filesystem: context})
 			if err != nil {
 				t.Fatalf("native=%v selector=%s: %v", native, selector, err)
 			}

facade_inheritance_test.go

@@ -8,7 +8,7 @@ import (
 	"testing"
 	"testing/fstest"
 
-	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+	configkit "go.maximumdirect.net/configkit"
 )
 
 type inheritedEntry struct {
@@ -42,7 +42,7 @@ func TestFacadeInheritancePreservesPresenceOriginsAndHistory(t *testing.T) {
 			if !resolution.IsExplicit(configkit.Keys("entries", "child", "enabled")) {
 				t.Error("inherited false is not explicit")
 			}
-			info, found := resolution.InputInfo(configkit.Keys("entries", "child", "enabled"))
+			info, found := resolution.EntryInfo(configkit.Keys("entries", "child", "enabled"))
 			if !found || len(info.Origin.Inheritance) != 1 {
 				t.Errorf("resolver inherited origin = %#v, %v", info, found)
 			}
@@ -139,7 +139,7 @@ func TestFacadeIdentifiedInheritanceResolvesChainsAndNestedCollections(t *testin
 	result, err := configkit.Load(filesystem.File("config/identified.yml"), configkit.Options[configuration]{
 		Definition: configkit.Definition[configuration]{
 			SequenceIdentities: registrations,
-			Secret: func(path configkit.Path) bool {
+			Sensitive: func(path configkit.Path) bool {
 				return path.String() == "/jobs/0/credential" || path.String() == "/jobs/1/credential" || path.String() == "/jobs/2/credential"
 			},
 		},
@@ -221,7 +221,7 @@ func TestFacadeIdentifiedInheritanceFailureDoesNotRevealSecretCanary(t *testing.
 	_, err := configkit.Load(configkit.Bytes("identified-failure.yml", input), configkit.Options[configuration]{
 		Definition: configkit.Definition[configuration]{
 			SequenceIdentities: []configkit.SequenceIdentity{configkit.SequenceIdentityAt(configkit.Keys("jobs"), "id")},
-			Secret:             func(path configkit.Path) bool { return path.String() == "/jobs/0/credential" },
+			Sensitive:          func(path configkit.Path) bool { return path.String() == "/jobs/0/credential" },
 		},
 	})
 	if err == nil || strings.Contains(err.Error(), canary) {
@@ -231,7 +231,7 @@ func TestFacadeIdentifiedInheritanceFailureDoesNotRevealSecretCanary(t *testing.
 
 func TestFacadeLayeredIdentifiedInheritanceUsesSurvivingRecords(t *testing.T) {
 	policy := func(mode string) string {
-		return "configkit:\n  sequences:\n    - destination: [jobs]\n      key: id\n      mode: " + mode + "\n"
+		return "config:\n  sequences:\n    - destination: [jobs]\n      key: id\n      mode: " + mode + "\n"
 	}
 	tests := []struct {
 		name        string
@@ -416,7 +416,7 @@ func TestFacadeInheritanceFailureStopsLaterCallbacks(t *testing.T) {
 
 func TestFacadeCLIOverridesCannotChangeInheritanceRelationship(t *testing.T) {
 	filesystem := configkit.NewFilesystem("bundle", fstest.MapFS{
-		"main.yml":   &fstest.MapFile{Data: []byte("configkit: {imports: [{path: parent.yml}]}\nentries: {child: {extends: first}}\n")},
+		"main.yml":   &fstest.MapFile{Data: []byte("config: {imports: [{path: parent.yml}]}\nentries: {child: {extends: first}}\n")},
 		"parent.yml": &fstest.MapFile{Data: []byte("entries: {first: {count: 1}, second: {count: 2}}\n")},
 	})
 	_, err := configkit.Load(filesystem.File("main.yml"), configkit.Options[inheritedConfiguration]{
@@ -427,7 +427,7 @@ func TestFacadeCLIOverridesCannotChangeInheritanceRelationship(t *testing.T) {
 		t.Fatalf("CLI inheritance relationship change = %v", err)
 	}
 	conflicting := configkit.NewFilesystem("bundle", fstest.MapFS{
-		"main.yml":   &fstest.MapFile{Data: []byte("configkit: {imports: [{path: parent.yml}]}\nentries: {child: {extends: first}, first: {count: 3}}\n")},
+		"main.yml":   &fstest.MapFile{Data: []byte("config: {imports: [{path: parent.yml}]}\nentries: {child: {extends: first}, first: {count: 3}}\n")},
 		"parent.yml": &fstest.MapFile{Data: []byte("entries: {first: {count: 1}}\n")},
 	})
 	_, err = configkit.Load[inheritedConfiguration](conflicting.File("main.yml"), configkit.Options[inheritedConfiguration]{Imports: true})
@@ -468,7 +468,7 @@ func TestFacadeInheritedSecretsStayRedactedAfterLookup(t *testing.T) {
 		Entries map[string]entry `yaml:"entries"`
 	}
 	result, err := configkit.Load[configuration](configkit.Bytes("secret.yml", []byte("entries: {parent: {credential: CONFIGKIT_INHERITED_TEST_SECRET, plain: visible}, child: {extends: parent}}\n")), configkit.Options[configuration]{Definition: configkit.Definition[configuration]{
-		Secret: func(path configkit.Path) bool { return path.String() == "/entries/parent/credential" },
+		Sensitive: func(path configkit.Path) bool { return path.String() == "/entries/parent/credential" },
 	}})
 	if err != nil || result.Config.Entries["child"].Credential.Value() != canary {
 		t.Fatalf("inherited credential = %#v, %v", result, err)

facade_item_registration_scope_test.go

@@ -5,7 +5,7 @@ import (
 	"testing"
 	"testing/fstest"
 
-	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+	configkit "go.maximumdirect.net/configkit"
 )
 
 func TestFacadeItemScopesDoNotReinterpretGlobalRegistrations(t *testing.T) {
@@ -22,14 +22,14 @@ func TestFacadeItemScopesDoNotReinterpretGlobalRegistrations(t *testing.T) {
 							configkit.SequenceLiteralKey("catalog"), configkit.SequenceAnyMappingKey(), configkit.SequenceLiteralKey("prompts"),
 						}, "id")
 					}
-					item := "configkit: {imports: [{path: helper.yml}, {path: child.yml, destination: [children], placement: sequence-item}]}\n"
+					item := "config: {imports: [{path: helper.yml}, {path: child.yml, destination: [children], placement: sequence-item}]}\n"
 					if !missingOuterID {
 						item += "id: outer\n"
 					}
 					files := configkit.NewFilesystem("items", fstest.MapFS{
-						"main.yml": {Data: []byte("configkit: {imports: [{path: item.yml, destination: [items], placement: sequence-item}]}\n")},
+						"main.yml": {Data: []byte("config: {imports: [{path: item.yml, destination: [items], placement: sequence-item}]}\n")},
 						"item.yml": {Data: []byte(item)}, "helper.yml": {Data: []byte(payload)},
-						"child.yml":        {Data: []byte("id: child\nconfigkit: {imports: [{path: child-helper.yml}]}\n")},
+						"child.yml":        {Data: []byte("id: child\nconfig: {imports: [{path: child-helper.yml}]}\n")},
 						"child-helper.yml": {Data: []byte(payload)},
 					})
 					definition := configkit.Definition[map[string]any]{SequenceIdentities: []configkit.SequenceIdentity{

facade_item_version_test.go

@@ -4,7 +4,7 @@ import (
 	"testing"
 	"testing/fstest"
 
-	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+	configkit "go.maximumdirect.net/configkit"
 )
 
 func TestFacadeItemDomainVersionsKeepEffectiveScope(t *testing.T) {
@@ -13,18 +13,18 @@ func TestFacadeItemDomainVersionsKeepEffectiveScope(t *testing.T) {
 		underlay, mainItem        bool
 	}{
 		{name: "item", item: "id: item\nversion: domain\n"},
-		{name: "helper", item: "id: item\nconfigkit: {imports: [{path: helper.yml}]}\n", helper: "version: domain\n"},
-		{name: "nested", item: "id: parent\nconfigkit: {imports: [{path: child.yml, destination: [children], placement: sequence-item}]}\n", child: "id: child\nversion: domain\n"},
+		{name: "helper", item: "id: item\nconfig: {imports: [{path: helper.yml}]}\n", helper: "version: domain\n"},
+		{name: "nested", item: "id: parent\nconfig: {imports: [{path: child.yml, destination: [children], placement: sequence-item}]}\n", child: "id: child\nversion: domain\n"},
 		{name: "underlay", item: "id: item\nversion: domain\n", underlay: true},
-		{name: "main-item", item: "id: parent\nconfigkit: {imports: [{path: child.yml, destination: [children], placement: sequence-item}]}\n", child: "id: child\nversion: domain\n", mainItem: true},
+		{name: "main-item", item: "id: parent\nconfig: {imports: [{path: child.yml, destination: [children], placement: sequence-item}]}\n", child: "id: child\nversion: domain\n", mainItem: true},
 	} {
 		t.Run(test.name, func(t *testing.T) {
 			files := fstest.MapFS{
-				"main.yml":     {Data: []byte("version: 1\nconfigkit: {imports: [{path: item.yml, destination: [items], placement: sequence-item}]}\n")},
+				"main.yml":     {Data: []byte("version: 1\nconfig: {imports: [{path: item.yml, destination: [items], placement: sequence-item}]}\n")},
 				"item.yml":     {Data: []byte(test.item)},
 				"child.yml":    {Data: []byte(test.child)},
 				"helper.yml":   {Data: []byte(test.helper)},
-				"underlay.yml": {Data: []byte("configkit: {imports: [{path: item.yml, destination: [items], placement: sequence-item}]}\n")},
+				"underlay.yml": {Data: []byte("config: {imports: [{path: item.yml, destination: [items], placement: sequence-item}]}\n")},
 			}
 			filesystem := configkit.NewFilesystem("items", files)
 			definition := configkit.Definition[map[string]any]{Version: &configkit.VersionRule{

facade_layered_test.go

@@ -10,7 +10,7 @@ import (
 	"testing"
 	"testing/fstest"
 
-	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+	configkit "go.maximumdirect.net/configkit"
 )
 
 type layeredFacadeConfig struct {
@@ -28,7 +28,7 @@ func TestFacadeLayeredMixedSourcesAndInspection(t *testing.T) {
 		t.Fatal(err)
 	}
 	lower := configkit.NewFilesystem("bundle", fstest.MapFS{
-		"main.yml":             &fstest.MapFile{Data: []byte("configkit: {imports: [{path: defaults.yml}]}\nsettings: {shared: lower, native: retained, secret: old-canary}\nlist: [lower]\n")},
+		"main.yml":             &fstest.MapFile{Data: []byte("config: {imports: [{path: defaults.yml}]}\nsettings: {shared: lower, native: retained, secret: old-canary}\nlist: [lower]\n")},
 		"defaults.yml":         &fstest.MapFile{Data: []byte("settings: {imported: retained}\n")},
 		"overlays/testing.yml": &fstest.MapFile{Data: []byte("settings: {from_lower_namespace: retained}\n")},
 	})
@@ -59,8 +59,8 @@ func TestFacadeLayeredMixedSourcesAndInspection(t *testing.T) {
 				configkit.Default(resolution, configkit.Keys("derived"), &config.Derived, config.Settings["native"], "derive from native", configkit.Keys("settings", "native"))
 				return nil
 			},
-			Validate: func(config *layeredFacadeConfig, validation *configkit.Validation) { checks.validation++ },
-			Secret:   func(path configkit.Path) bool { return path.String() == "/settings/secret" },
+			Validate:  func(config *layeredFacadeConfig, validation *configkit.Validation) { checks.validation++ },
+			Sensitive: func(path configkit.Path) bool { return path.String() == "/settings/secret" },
 		},
 	})
 	if err != nil {
@@ -80,7 +80,7 @@ func TestFacadeLayeredMixedSourcesAndInspection(t *testing.T) {
 	if len(sources) != 8 {
 		t.Fatalf("sources = %#v", sources)
 	}
-	wantLayers := []configkit.Layer{configkit.LayerBase, configkit.LayerUnderlay, configkit.LayerUnderlay, configkit.LayerUnderlay, configkit.LayerUnderlay, configkit.LayerUnderlay, configkit.LayerOverlay, configkit.LayerCLI}
+	wantLayers := []configkit.Layer{configkit.LayerMain, configkit.LayerUnderlay, configkit.LayerUnderlay, configkit.LayerUnderlay, configkit.LayerUnderlay, configkit.LayerUnderlay, configkit.LayerOverlay, configkit.LayerCLI}
 	wantIndexes := []int{0, 1, 1, 1, 1, 2, 0, 0}
 	wantKinds := []configkit.SourceKind{configkit.SourceKindFile, configkit.SourceKindFilesystem, configkit.SourceKindFilesystem, configkit.SourceKindMapping, configkit.SourceKindFilesystem, configkit.SourceKindMapping, configkit.SourceKindFilesystem, configkit.SourceKindCLI}
 	for index, source := range sources {

facade_mapping_test.go

@@ -7,7 +7,7 @@ import (
 	"testing"
 	"testing/fstest"
 
-	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+	configkit "go.maximumdirect.net/configkit"
 )
 
 type mappingFacadeConfig struct {
@@ -36,7 +36,7 @@ func TestFacadeMappingSnapshotsAndMatchesYAML(t *testing.T) {
 		if !reflect.DeepEqual(result.Config, want) {
 			t.Fatalf("mapping config = %#v, want %#v", result.Config, want)
 		}
-		if sources := result.Sources(); len(sources) != 1 || sources[0].ID != "source-1" || sources[0].Kind != configkit.SourceKindMapping || sources[0].Layer != configkit.LayerBase || sources[0].Path != "" {
+		if sources := result.Sources(); len(sources) != 1 || sources[0].ID != "source-1" || sources[0].Kind != configkit.SourceKindMapping || sources[0].Layer != configkit.LayerMain || sources[0].Path != "" {
 			t.Fatalf("mapping sources = %#v", sources)
 		}
 		info, ok := result.Metadata().Lookup(configkit.Keys("name"))
@@ -80,8 +80,8 @@ func TestFacadeMappingImportsUseExplicitContext(t *testing.T) {
 		"root/shared.yml": &fstest.MapFile{Data: []byte("name: imported\n")},
 	})
 	source := configkit.Mapping("programmatic", map[string]any{
-		"configkit": map[string]any{"imports": []any{map[string]any{"path": "shared.yml"}}},
-		"enabled":   true,
+		"config":  map[string]any{"imports": []any{map[string]any{"path": "shared.yml"}}},
+		"enabled": true,
 	})
 	result, err := configkit.Load(source, configkit.Options[mappingFacadeConfig]{
 		Imports: true, Filesystem: &configkit.FilesystemContext{Root: "root", BaseDir: "root", FS: &namespace},
@@ -89,7 +89,7 @@ func TestFacadeMappingImportsUseExplicitContext(t *testing.T) {
 	if err != nil || result.Config.Name != "imported" || !result.Config.Enabled {
 		t.Fatalf("mapping import = %#v, %v", result, err)
 	}
-	if sources := result.Sources(); len(sources) != 2 || sources[0].Kind != configkit.SourceKindMapping || sources[1].Kind != configkit.SourceKindFilesystem || sources[1].Layer != configkit.LayerBase {
+	if sources := result.Sources(); len(sources) != 2 || sources[0].Kind != configkit.SourceKindMapping || sources[1].Kind != configkit.SourceKindFilesystem || sources[1].Layer != configkit.LayerMain {
 		t.Fatalf("mapping import sources = %#v", sources)
 	}
 	checkMappingCode(t, source, configkit.Options[mappingFacadeConfig]{Imports: true}, configkit.CodeOptionsInvalid)

facade_resolution_presence_test.go

@@ -0,0 +1,63 @@
+package configkit_test
+
+import (
+	"errors"
+	"testing"
+
+	configkit "go.maximumdirect.net/configkit"
+)
+
+func TestFacadeResolutionPresenceUsesDynamicEntryShape(t *testing.T) {
+	t.Parallel()
+
+	type configuration struct {
+		Shape any `yaml:"shape"`
+	}
+	tests := []struct {
+		name       string
+		input      string
+		keyPresent bool
+	}{
+		{name: "mapping key", input: "shape: {'0': input}\n", keyPresent: true},
+		{name: "sequence index", input: "shape: [input]\n", keyPresent: false},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			parsed, err := configkit.ParsePath("/shape/0")
+			if err != nil {
+				t.Fatal(err)
+			}
+			_, err = configkit.Load(configkit.Bytes("dynamic.yml", []byte(test.input)), configkit.Options[configuration]{
+				Definition: configkit.Definition[configuration]{
+					Resolve: func(_ *configuration, resolution *configkit.Resolution) error {
+						check := func(path configkit.Path, want bool) error {
+							info, found := resolution.EntryInfo(path)
+							explicit := resolution.IsExplicit(path)
+							if found != want || explicit != want || (found && info.Explicit != explicit) {
+								return errors.New("resolution presence disagrees with dynamic entry shape")
+							}
+							return nil
+						}
+						for _, checkPath := range []struct {
+							path configkit.Path
+							want bool
+						}{
+							{path: configkit.Keys("shape", "0"), want: test.keyPresent},
+							{path: configkit.Keys("shape").Index(0), want: !test.keyPresent},
+							{path: parsed, want: true},
+							{path: configkit.Keys("shape", "missing"), want: false},
+						} {
+							if err := check(checkPath.path, checkPath.want); err != nil {
+								return err
+							}
+						}
+						return nil
+					},
+				},
+			})
+			if err != nil {
+				t.Fatal(err)
+			}
+		})
+	}
+}

facade_resolution_recording_test.go

@@ -0,0 +1,43 @@
+package configkit
+
+import "testing"
+
+func TestFacadeResolutionRecordingIntents(t *testing.T) {
+	type configuration struct {
+		Derived    string `yaml:"derived"`
+		Normalized string `yaml:"normalized"`
+	}
+
+	result, err := Load(Bytes("recording.yml", []byte("derived: explicit\nnormalized: before\n")), Options[configuration]{
+		Definition: Definition[configuration]{Resolve: func(value *configuration, resolution *Resolution) error {
+			value.Derived = "changed explicit input"
+			resolution.RecordDerivedDefault(Keys("derived"), "derive explicit input")
+			value.Normalized = "after"
+			resolution.RecordNormalization(Keys("normalized"), "normalize configured input")
+			return nil
+		}},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	for _, test := range []struct {
+		path Path
+		kind ChangeKind
+	}{
+		{path: Keys("derived"), kind: ChangeDerivedDefault},
+		{path: Keys("normalized"), kind: ChangeNormalization},
+	} {
+		info, ok := result.Metadata().Lookup(test.path)
+		if !ok || info.Origin.Operation != test.kind {
+			t.Errorf("metadata %s = %#v, %v; want operation %q", test.path, info, ok, test.kind)
+		}
+		history := result.Metadata().History(test.path)
+		if len(history) == 0 || history[len(history)-1].Origin.Operation != test.kind {
+			t.Errorf("history %s = %#v; want final operation %q", test.path, history, test.kind)
+		}
+	}
+	if !result.Metadata().IsExplicit(Keys("derived")) {
+		t.Fatal("recording a derived default suppressed explicit-input provenance")
+	}
+}

facade_resolution_sequences_test.go

@@ -0,0 +1,223 @@
+package configkit_test
+
+import (
+	"errors"
+	"strings"
+	"testing"
+
+	"go.maximumdirect.net/configkit"
+)
+
+type resolutionSequenceItem struct {
+	ID    string `yaml:"id"`
+	Value string `yaml:"value"`
+}
+type resolutionSequenceConfig struct {
+	Groups map[string][]resolutionSequenceItem `yaml:"groups"`
+}
+
+func TestPublicResolutionOrdinaryListField(t *testing.T) {
+	type config struct {
+		Items []resolutionSequenceItem `yaml:"items"`
+	}
+	definition := configkit.Definition[config]{Resolve: func(value *config, r *configkit.Resolution) error {
+		configkit.Normalize(r, configkit.Keys("items").Index(0).Key("value"), &value.Items[0].Value, "changed", "normalize")
+		return nil
+	}}
+	result, err := configkit.Load(configkit.Bytes("items", []byte("items: [{id: a, value: old}]\n")), configkit.Options[config]{Definition: definition})
+	if err != nil || result.Config.Items[0].Value != "changed" {
+		t.Fatalf("result = %#v, %v", result, err)
+	}
+}
+
+func TestPublicRegisteredResolutionHistoryAndOwnership(t *testing.T) {
+	selector := configkit.SequenceSelector{configkit.SequenceLiteralKey("groups"), configkit.SequenceAnyMappingKey()}
+	path := configkit.Keys("groups", "active")
+	entryFixed := false
+	definition := configkit.Definition[resolutionSequenceConfig]{
+		SequenceIdentities: []configkit.SequenceIdentity{configkit.SequenceIdentityMatching(selector, "id")},
+		Resolve: func(value *resolutionSequenceConfig, r *configkit.Resolution) error {
+			entryFixed = r.IsExplicit(path.Index(0).Key("value")) && !r.IsExplicit(path.Index(1).Key("value"))
+			items := value.Groups["active"]
+			items[0], items[1] = items[1], items[0]
+			items[1].Value = "normalized"
+			value.Groups["active"] = items
+			r.RecordNormalization(path, "reorder")
+			r.RecordNormalization(path.Index(1).Key("value"), "normalize")
+			return nil
+		},
+	}
+	source := configkit.Bytes("records", []byte("groups:\n  active:\n    - id: a\n      value: original\n    - id: b\n"))
+	load := func() *configkit.Result[resolutionSequenceConfig] {
+		result, err := configkit.Load(source, configkit.Options[resolutionSequenceConfig]{Definition: definition})
+		if err != nil {
+			t.Fatal(err)
+		}
+		return result
+	}
+	result := load()
+	if !entryFixed || result.Config.Groups["active"][1].Value != "normalized" {
+		t.Fatalf("result = %#v", result.Config)
+	}
+	info, ok := result.Metadata().Lookup(path.Index(1).Key("value"))
+	if !ok || !info.Explicit || info.Origin.Layer != configkit.LayerResolution {
+		t.Fatalf("metadata = %#v, %t", info, ok)
+	}
+	explanation, ok := result.Explain(path.Index(1).Key("value"))
+	if !ok {
+		t.Fatal("missing explanation")
+	}
+	found := false
+	for _, change := range explanation.History {
+		if change.Origin.Layer == configkit.LayerResolution && change.Before.YAML == "original\n" && change.After.YAML == "normalized\n" {
+			found = true
+		}
+	}
+	if !found {
+		t.Fatalf("history = %#v", explanation.History)
+	}
+	other := load()
+	result.Config.Groups["active"][1].Value = "mutated"
+	if len(explanation.History) != 0 {
+		explanation.History[0].After.YAML = "mutated"
+	}
+	again, _ := result.Explain(path.Index(1).Key("value"))
+	if strings.Contains(again.Effective.YAML, "mutated") || other.Config.Groups["active"][1].Value != "normalized" {
+		t.Fatal("inspection or independent load changed")
+	}
+	plain, err := configkit.Load[resolutionSequenceConfig](source)
+	if err != nil {
+		t.Fatal(err)
+	}
+	differences, err := configkit.Diff(plain, result)
+	if err != nil || len(differences) != 1 || differences[0].Path.String() != "/groups/active" {
+		t.Fatalf("diff = %#v, %v", differences, err)
+	}
+	layered, err := configkit.LoadLayered(configkit.Input{Source: source}, configkit.LayeredOptions[resolutionSequenceConfig]{Definition: definition})
+	if err != nil || layered.Config.Groups["active"][1].Value != other.Config.Groups["active"][1].Value {
+		t.Fatalf("layered = %#v, %v", layered, err)
+	}
+}
+
+func TestPublicRegisteredMoveRequiresContainerRecord(t *testing.T) {
+	type config struct {
+		Items []resolutionSequenceItem `yaml:"items"`
+	}
+	_, err := configkit.Load(configkit.Bytes("items", []byte("items: [{id: a}, {id: b}]\n")), configkit.Options[config]{Definition: configkit.Definition[config]{
+		SequenceIdentities: []configkit.SequenceIdentity{configkit.SequenceIdentityAt(configkit.Keys("items"), "id")},
+		Resolve: func(value *config, r *configkit.Resolution) error {
+			value.Items[0], value.Items[1] = value.Items[1], value.Items[0]
+			r.RecordNormalization(configkit.Keys("items").Index(1).Key("id"), "record field")
+			return nil
+		},
+	}})
+	var failure *configkit.LoadError
+	if !errors.As(err, &failure) {
+		t.Fatalf("error = %v", err)
+	}
+	for _, diagnostic := range failure.Diagnostics() {
+		if diagnostic.Code == configkit.CodeResolveUnrecordedChange && diagnostic.Path.String() == "/items" {
+			return
+		}
+	}
+	t.Fatalf("diagnostics = %#v", failure.Diagnostics())
+}
+
+func TestPublicRegisteredRemovalKeepsSurvivorHistory(t *testing.T) {
+	type config struct {
+		Items []resolutionSequenceItem `yaml:"items"`
+	}
+	definition := configkit.Definition[config]{
+		SequenceIdentities: []configkit.SequenceIdentity{configkit.SequenceIdentityAt(configkit.Keys("items"), "id")},
+		Resolve: func(value *config, r *configkit.Resolution) error {
+			value.Items = value.Items[1:]
+			r.RecordNormalization(configkit.Keys("items"), "remove first")
+			return nil
+		},
+	}
+	result, err := configkit.Load(configkit.Bytes("items", []byte("items:\n  - id: reports\n    value: report\n  - id: invoices\n    value: invoice\n")), configkit.Options[config]{Definition: definition})
+	if err != nil {
+		t.Fatal(err)
+	}
+	explanation, ok := result.Explain(configkit.Keys("items").Index(0).Key("value"))
+	if !ok {
+		t.Fatal("missing survivor")
+	}
+	for _, change := range explanation.History {
+		if change.Origin.Layer == configkit.LayerMain && change.After.YAML == "report\n" {
+			t.Fatalf("wrong lineage = %#v", explanation.History)
+		}
+	}
+	container, ok := result.Explain(configkit.Keys("items"))
+	if !ok {
+		t.Fatal("missing collection explanation")
+	}
+	found := false
+	for _, change := range container.History {
+		if change.Origin.Layer == configkit.LayerResolution && strings.Contains(change.Before.YAML, "reports") {
+			found = true
+		}
+	}
+	if !found {
+		t.Fatalf("missing removal evidence = %#v", container.History)
+	}
+	if _, ok := result.Explain(configkit.Keys("items").Index(1)); !ok {
+		t.Fatal("missing historical position")
+	}
+}
+
+func TestPublicYAMLIdentityRemainsPositionalDuringResolution(t *testing.T) {
+	type config struct {
+		Items []resolutionSequenceItem `yaml:"items"`
+	}
+	result, err := configkit.Load(configkit.Bytes("items", []byte("config: {sequences: [{destination: [items], key: id}]}\nitems: [{id: a, value: first}, {id: b, value: second}]\n")), configkit.Options[config]{Definition: configkit.Definition[config]{Resolve: func(value *config, r *configkit.Resolution) error {
+		value.Items[0], value.Items[1] = value.Items[1], value.Items[0]
+		r.RecordNormalization(configkit.Keys("items"), "reorder")
+		return nil
+	}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	explanation, ok := result.Explain(configkit.Keys("items").Index(0).Key("value"))
+	if !ok {
+		t.Fatal("missing explanation")
+	}
+	for _, change := range explanation.History {
+		if change.Origin.Layer == configkit.LayerResolution && change.Before.YAML == "first\n" && change.After.YAML == "second\n" {
+			return
+		}
+	}
+	t.Fatalf("positional history = %#v", explanation.History)
+}
+
+func TestPublicMovedSensitiveRecordIsHidden(t *testing.T) {
+	type config struct {
+		Items []resolutionSequenceItem `yaml:"items"`
+	}
+	result, err := configkit.Load(configkit.Bytes("items", []byte("items: [{id: a, value: FACADE_PRIVATE_CANARY}, {id: b, value: public}]\n")), configkit.Options[config]{Definition: configkit.Definition[config]{
+		SequenceIdentities: []configkit.SequenceIdentity{configkit.SequenceIdentityAt(configkit.Keys("items"), "id")},
+		Sensitive:          func(path configkit.Path) bool { return path.String() == "/items/0/value" },
+		Resolve: func(value *config, r *configkit.Resolution) error {
+			value.Items[0], value.Items[1] = value.Items[1], value.Items[0]
+			r.RecordNormalization(configkit.Keys("items"), "reorder")
+			return nil
+		},
+	}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, path := range []configkit.Path{configkit.Keys("items"), configkit.Keys("items").Index(1).Key("value")} {
+		explanation, ok := result.Explain(path)
+		if !ok {
+			t.Fatalf("missing explanation %s", path.String())
+		}
+		if strings.Contains(explanation.Effective.YAML, "FACADE_PRIVATE_CANARY") {
+			t.Fatal("effective leak")
+		}
+		for _, change := range explanation.History {
+			if strings.Contains(change.Before.YAML, "FACADE_PRIVATE_CANARY") || strings.Contains(change.After.YAML, "FACADE_PRIVATE_CANARY") {
+				t.Fatal("history leak")
+			}
+		}
+	}
+}

facade_resource_context_test.go

@@ -12,7 +12,7 @@ import (
 	"testing"
 	"testing/fstest"
 
-	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+	configkit "go.maximumdirect.net/configkit"
 )
 
 type observedResourceFS struct {
@@ -45,7 +45,7 @@ func TestFacadeSourceContextsFollowOriginsWithoutQueryIO(t *testing.T) {
 		t.Fatal(err)
 	}
 	borrowed := &observedResourceFS{files: fstest.MapFS{
-		"bundle/config/defaults.yml":  &fstest.MapFile{Data: []byte("configkit: {imports: [{path: ../shared.yml}]}\nnative: icon.txt\n")},
+		"bundle/config/defaults.yml":  &fstest.MapFile{Data: []byte("config: {imports: [{path: ../shared.yml}]}\nnative: icon.txt\n")},
 		"bundle/shared.yml":           &fstest.MapFile{Data: []byte("shared: shared.txt\n")},
 		"bundle/overlays/test.yml":    &fstest.MapFile{Data: []byte("selected: overlay.txt\n")},
 		"bundle/config/icon.txt":      &fstest.MapFile{Data: []byte("icon-v1")},
@@ -224,8 +224,8 @@ func TestFacadeSyntheticSourceContextsAndContextlessSources(t *testing.T) {
 
 func TestFacadeRelativeImportDestinationsPreserveNativeResourceContexts(t *testing.T) {
 	borrowed := &observedResourceFS{files: fstest.MapFS{
-		"bundle/config/main.yml":                   &fstest.MapFile{Data: []byte("configkit:\n  imports:\n    - path: entries/parent.yml\n      destination: [logical]\n")},
-		"bundle/config/entries/parent.yml":         &fstest.MapFile{Data: []byte("configkit:\n  imports:\n    - path: nested/details.yml\n      destination: [details]\nresource: icon.txt\n")},
+		"bundle/config/main.yml":                   &fstest.MapFile{Data: []byte("config:\n  imports:\n    - path: entries/parent.yml\n      destination: [logical]\n")},
+		"bundle/config/entries/parent.yml":         &fstest.MapFile{Data: []byte("config:\n  imports:\n    - path: nested/details.yml\n      destination: [details]\nresource: icon.txt\n")},
 		"bundle/config/entries/nested/details.yml": &fstest.MapFile{Data: []byte("resource: detail.txt\n")},
 		"bundle/config/entries/icon.txt":           &fstest.MapFile{Data: []byte("parent-resource")},
 		"bundle/config/entries/nested/detail.txt":  &fstest.MapFile{Data: []byte("nested-resource")},

facade_sequence_identity_test.go

@@ -5,7 +5,7 @@ import (
 	"strings"
 	"testing"
 
-	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+	configkit "go.maximumdirect.net/configkit"
 )
 
 func TestFacadeSequenceIdentitySnapshotsSelectorsAndFields(t *testing.T) {

facade_sequence_test.go

@@ -9,7 +9,7 @@ import (
 	"testing"
 	"testing/fstest"
 
-	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+	configkit "go.maximumdirect.net/configkit"
 )
 
 func TestFacadeNoSourcePreservesAbsenceWithSequencePolicy(t *testing.T) {
@@ -54,12 +54,12 @@ func TestFacadeNoSourcePreservesAbsenceWithSequencePolicy(t *testing.T) {
 func TestFacadeItemHelperHistoryPreservesScheduledPlacement(t *testing.T) {
 	t.Parallel()
 	filesystem := configkit.NewFilesystem("history", fstest.MapFS{
-		"main.yml":         {Data: []byte("records: [{id: authored}]\nconfigkit: {imports: [{path: one.yml, destination: [records], placement: sequence-item}, {path: two.yml, destination: [records], placement: sequence-item}]}\n")},
-		"one.yml":          {Data: []byte("id: one\nconfigkit: {imports: [{path: helper-one.yml}, {path: child.yml, destination: [children], placement: sequence-item}]}\n")},
-		"two.yml":          {Data: []byte("id: two\nconfigkit: {imports: [{path: helper-two.yml}]}\n")},
+		"main.yml":         {Data: []byte("records: [{id: authored}]\nconfig: {imports: [{path: one.yml, destination: [records], placement: sequence-item}, {path: two.yml, destination: [records], placement: sequence-item}]}\n")},
+		"one.yml":          {Data: []byte("id: one\nconfig: {imports: [{path: helper-one.yml}, {path: child.yml, destination: [children], placement: sequence-item}]}\n")},
+		"two.yml":          {Data: []byte("id: two\nconfig: {imports: [{path: helper-two.yml}]}\n")},
 		"helper-one.yml":   {Data: []byte("text: first helper\n")},
 		"helper-two.yml":   {Data: []byte("text: second helper\n")},
-		"child.yml":        {Data: []byte("id: child\nconfigkit: {imports: [{path: child-helper.yml}]}\n")},
+		"child.yml":        {Data: []byte("id: child\nconfig: {imports: [{path: child-helper.yml}]}\n")},
 		"child-helper.yml": {Data: []byte("text: nested helper\n")},
 	})
 	result, err := configkit.Load(filesystem.File("main.yml"), configkit.Options[map[string]any]{
@@ -107,7 +107,7 @@ func TestFacadeRegisteredReplacementExplainsRemovedDescendants(t *testing.T) {
 		{"removed field", []any{map[string]any{"id": "main"}}, configkit.Keys("records").Index(0).Key("text")},
 	} {
 		t.Run(test.name, func(t *testing.T) {
-			mainYAML := "configkit:\n  sequences:\n    - destination: [records]\n      key: id\n      mode: replace\n"
+			mainYAML := "config:\n  sequences:\n    - destination: [records]\n      key: id\n      mode: replace\n"
 			if len(test.upper) == 0 {
 				mainYAML += "records: []\n"
 			} else {
@@ -125,7 +125,7 @@ func TestFacadeRegisteredReplacementExplainsRemovedDescendants(t *testing.T) {
 				t.Fatalf("removal not explained: %#v", explanation)
 			}
 			last := explanation.History[len(explanation.History)-1]
-			if !last.Before.Present || last.After.Present || last.Origin.Layer != configkit.LayerBase || len(last.Origin.Locations) != 1 || last.Origin.Locations[0].SourceID != result.Sources()[0].ID {
+			if !last.Before.Present || last.After.Present || last.Origin.Layer != configkit.LayerMain || len(last.Origin.Locations) != 1 || last.Origin.Locations[0].SourceID != result.Sources()[0].ID {
 				t.Fatalf("wrong removal transition/origin: %#v", last)
 			}
 		})
@@ -135,12 +135,12 @@ func TestFacadeRegisteredReplacementExplainsRemovedDescendants(t *testing.T) {
 func TestFacadeItemConflictDiagnosticsFollowEnclosingIndexes(t *testing.T) {
 	t.Parallel()
 	filesystem := configkit.NewFilesystem("conflicts", fstest.MapFS{
-		"main.yml":   {Data: []byte("records: [{id: authored}]\nconfigkit: {imports: [{path: good.yml, destination: [records], placement: sequence-item}, {path: bad.yml, destination: [records], placement: sequence-item}]}\n")},
-		"group.yml":  {Data: []byte("records: [{id: authored}]\nconfigkit: {imports: [{path: bad.yml, destination: [records], placement: sequence-item}]}\n")},
-		"nested.yml": {Data: []byte("records: [{id: authored}]\nconfigkit: {imports: [{path: parent.yml, destination: [records], placement: sequence-item}]}\n")},
-		"parent.yml": {Data: []byte("id: parent\nchildren: [{id: authored-child}]\nconfigkit: {imports: [{path: bad.yml, destination: [children], placement: sequence-item}]}\n")},
+		"main.yml":   {Data: []byte("records: [{id: authored}]\nconfig: {imports: [{path: good.yml, destination: [records], placement: sequence-item}, {path: bad.yml, destination: [records], placement: sequence-item}]}\n")},
+		"group.yml":  {Data: []byte("records: [{id: authored}]\nconfig: {imports: [{path: bad.yml, destination: [records], placement: sequence-item}]}\n")},
+		"nested.yml": {Data: []byte("records: [{id: authored}]\nconfig: {imports: [{path: parent.yml, destination: [records], placement: sequence-item}]}\n")},
+		"parent.yml": {Data: []byte("id: parent\nchildren: [{id: authored-child}]\nconfig: {imports: [{path: bad.yml, destination: [children], placement: sequence-item}]}\n")},
 		"good.yml":   {Data: []byte("id: good\n")},
-		"bad.yml":    {Data: []byte("id: bad\nconfigkit: {imports: [{path: helper.yml}]}\n")},
+		"bad.yml":    {Data: []byte("id: bad\nconfig: {imports: [{path: helper.yml}]}\n")},
 		"helper.yml": {Data: []byte("id: duplicate-field\n")},
 	})
 	definition := configkit.Definition[map[string]any]{SequenceIdentities: []configkit.SequenceIdentity{configkit.SequenceIdentityAt(configkit.Keys("records"), "id")}}
@@ -211,7 +211,7 @@ func TestFacadeSequencePlacementControlsAcrossLoadEntryPoints(t *testing.T) {
 	if got := ordinary.Config["entries"].([]any); len(got) != 1 || got[0].(map[string]any)["id"] != "one" {
 		t.Fatalf("ordinary item placement = %#v", ordinary.Config)
 	}
-	if sources := ordinary.Sources(); len(sources) != 1 || sources[0].PlacementMode != configkit.PlacementModeSequenceItem || sources[0].Destination.String() != "/entries" || sources[0].DestinationUnresolved {
+	if sources := ordinary.Sources(); len(sources) != 1 || sources[0].PlacementMode != configkit.PlacementModeSequenceItem || sources[0].Destination.String() != "/entries" || sources[0].DestinationIsFallback {
 		t.Fatalf("ordinary item source = %#v", sources)
 	}
 
@@ -230,7 +230,7 @@ func TestFacadeSequencePlacementControlsAcrossLoadEntryPoints(t *testing.T) {
 		t.Fatalf("layered item placement = %#v", layered.Config)
 	}
 	for _, source := range layered.Sources() {
-		if source.PlacementMode != configkit.PlacementModeSequenceItem || source.Destination.String() != "/entries" || source.DestinationUnresolved {
+		if source.PlacementMode != configkit.PlacementModeSequenceItem || source.Destination.String() != "/entries" || source.DestinationIsFallback {
 			t.Errorf("layered item source = %#v", source)
 		}
 	}
@@ -277,7 +277,7 @@ func TestFacadeSequencePlacementControlsAcrossLoadEntryPoints(t *testing.T) {
 func TestFacadeItemImportGlobComposesWithAuthoredSequence(t *testing.T) {
 	directory := t.TempDir()
 	mainPath := filepath.Join(directory, "main.yml")
-	if err := os.WriteFile(mainPath, []byte(`configkit:
+	if err := os.WriteFile(mainPath, []byte(`config:
   imports:
     - glob: records/*.yml
       destination: [items]
@@ -334,7 +334,7 @@ items:
 		t.Fatalf("callback snapshots = %#v, contexts %#v", callbackSources, callbackContexts)
 	}
 	for index, source := range callbackSources {
-		if source.PlacementMode != configkit.PlacementModeSequenceItem || source.Destination.String() != "/items" || source.DestinationUnresolved {
+		if source.PlacementMode != configkit.PlacementModeSequenceItem || source.Destination.String() != "/items" || source.DestinationIsFallback {
 			t.Errorf("callback source = %#v", source)
 		}
 		if callbackContexts[index].FS == nil || callbackContexts[index].BaseDir != "records" {
@@ -349,7 +349,7 @@ items:
 			t.Errorf("shifted item origin at %s = %#v, %v", path.String(), info, ok)
 		}
 	}
-	if got := result.Sources(); len(got) != 3 || got[1].Destination.String() != "/items" || got[1].DestinationUnresolved {
+	if got := result.Sources(); len(got) != 3 || got[1].Destination.String() != "/items" || got[1].DestinationIsFallback {
 		t.Fatalf("final item sources = %#v", got)
 	}
 }
@@ -358,7 +358,7 @@ func TestFacadeItemDestinationFallbackEvidenceSurvivesFailures(t *testing.T) {
 	directory := t.TempDir()
 	mainPath := filepath.Join(directory, "main.yml")
 	helperPath := filepath.Join(directory, "helper.yml")
-	if err := os.WriteFile(mainPath, []byte("configkit: {imports: [{path: helper.yml, destination: [metadata]}]}\nid: main\n"), 0o600); err != nil {
+	if err := os.WriteFile(mainPath, []byte("config: {imports: [{path: helper.yml, destination: [metadata]}]}\nid: main\n"), 0o600); err != nil {
 		t.Fatal(err)
 	}
 	if err := os.WriteFile(helperPath, []byte("value: [unterminated\n"), 0o600); err != nil {
@@ -372,9 +372,9 @@ func TestFacadeItemDestinationFallbackEvidenceSurvivesFailures(t *testing.T) {
 		t.Fatalf("early failure = %v", err)
 	}
 	sources := loadError.Sources()
-	if len(sources) != 2 || sources[0].Destination.String() != "/items" || sources[0].DestinationUnresolved ||
+	if len(sources) != 2 || sources[0].Destination.String() != "/items" || sources[0].DestinationIsFallback ||
 		sources[0].PlacementMode != configkit.PlacementModeSequenceItem ||
-		sources[1].Destination.String() != "/items" || !sources[1].DestinationUnresolved ||
+		sources[1].Destination.String() != "/items" || !sources[1].DestinationIsFallback ||
 		sources[1].PlacementMode != configkit.PlacementModeMapping {
 		t.Fatalf("early source snapshots = %#v", sources)
 	}
@@ -399,13 +399,13 @@ func TestFacadeItemDestinationFallbackEvidenceSurvivesFailures(t *testing.T) {
 		t.Fatalf("post-placement failure = %v", err)
 	}
 	sources = loadError.Sources()
-	if len(sources) != 2 || sources[0].Destination.String() != "/items" || sources[0].DestinationUnresolved ||
-		sources[1].Destination.String() != "/items/0/metadata" || sources[1].DestinationUnresolved {
+	if len(sources) != 2 || sources[0].Destination.String() != "/items" || sources[0].DestinationIsFallback ||
+		sources[1].Destination.String() != "/items/0/metadata" || sources[1].DestinationIsFallback {
 		t.Fatalf("post-placement source snapshots = %#v", sources)
 	}
 	firstSnapshot := sources[1]
 	sources[1].Destination = configkit.Keys("mutated")
-	if again := loadError.Sources(); len(again) != 2 || again[1].Destination.String() != firstSnapshot.Destination.String() || again[1].DestinationUnresolved {
+	if again := loadError.Sources(); len(again) != 2 || again[1].Destination.String() != firstSnapshot.Destination.String() || again[1].DestinationIsFallback {
 		t.Fatalf("failure source snapshots were aliased: %#v", again)
 	}
 
@@ -420,7 +420,7 @@ func TestFacadeItemDestinationFallbackEvidenceSurvivesFailures(t *testing.T) {
 	if err != nil {
 		t.Fatalf("successful item load: %v", err)
 	}
-	if callback.Destination.String() != "/items/0/metadata" || callback.DestinationUnresolved || callback.PlacementMode != configkit.PlacementModeMapping {
+	if callback.Destination.String() != "/items/0/metadata" || callback.DestinationIsFallback || callback.PlacementMode != configkit.PlacementModeMapping {
 		t.Fatalf("callback source snapshot = %#v", callback)
 	}
 }
@@ -430,10 +430,10 @@ func TestFacadeNestedItemFallbackUsesNearestResolvedContainer(t *testing.T) {
 	mainPath := filepath.Join(directory, "main.yml")
 	childPath := filepath.Join(directory, "child.yml")
 	helperPath := filepath.Join(directory, "helper.yml")
-	if err := os.WriteFile(mainPath, []byte("configkit: {imports: [{path: child.yml, destination: [children], placement: sequence-item}]}\nid: parent\n"), 0o600); err != nil {
+	if err := os.WriteFile(mainPath, []byte("config: {imports: [{path: child.yml, destination: [children], placement: sequence-item}]}\nid: parent\n"), 0o600); err != nil {
 		t.Fatal(err)
 	}
-	if err := os.WriteFile(childPath, []byte("configkit: {imports: [{path: helper.yml, destination: [metadata]}]}\nid: child\n"), 0o600); err != nil {
+	if err := os.WriteFile(childPath, []byte("config: {imports: [{path: helper.yml, destination: [metadata]}]}\nid: child\n"), 0o600); err != nil {
 		t.Fatal(err)
 	}
 	if err := os.WriteFile(helperPath, []byte("value: [unterminated\n"), 0o600); err != nil {
@@ -450,13 +450,13 @@ func TestFacadeNestedItemFallbackUsesNearestResolvedContainer(t *testing.T) {
 	if len(sources) != 3 {
 		t.Fatalf("nested source snapshots = %#v", sources)
 	}
-	if got := sources[0]; got.Destination.String() != "/groups" || got.DestinationUnresolved || got.PlacementMode != configkit.PlacementModeSequenceItem {
+	if got := sources[0]; got.Destination.String() != "/groups" || got.DestinationIsFallback || got.PlacementMode != configkit.PlacementModeSequenceItem {
 		t.Errorf("outer item snapshot = %#v", got)
 	}
-	if got := sources[1]; got.Destination.String() != "/groups" || !got.DestinationUnresolved || got.PlacementMode != configkit.PlacementModeSequenceItem {
+	if got := sources[1]; got.Destination.String() != "/groups" || !got.DestinationIsFallback || got.PlacementMode != configkit.PlacementModeSequenceItem {
 		t.Errorf("nested item fallback = %#v", got)
 	}
-	if got := sources[2]; got.Destination.String() != "/groups" || !got.DestinationUnresolved || got.PlacementMode != configkit.PlacementModeMapping {
+	if got := sources[2]; got.Destination.String() != "/groups" || !got.DestinationIsFallback || got.PlacementMode != configkit.PlacementModeMapping {
 		t.Errorf("nested helper fallback = %#v", got)
 	}
 }
@@ -496,7 +496,7 @@ func TestFacadeSequenceIdentityRegistrationIsDetached(t *testing.T) {
 
 func TestFacadeSourceInfoPlacementCopiesAndZeroValues(t *testing.T) {
 	zero := configkit.SourceInfo{}
-	if zero.PlacementMode != configkit.PlacementModeMapping || zero.DestinationUnresolved {
+	if zero.PlacementMode != configkit.PlacementModeMapping || zero.DestinationIsFallback {
 		t.Fatalf("zero source info = %#v", zero)
 	}
 	loaded, err := configkit.Load[map[string]any](configkit.Mapping("mapping", map[string]any{"value": true}))
@@ -504,12 +504,12 @@ func TestFacadeSourceInfoPlacementCopiesAndZeroValues(t *testing.T) {
 		t.Fatal(err)
 	}
 	sources := loaded.Sources()
-	if len(sources) != 1 || sources[0].PlacementMode != configkit.PlacementModeMapping || sources[0].DestinationUnresolved {
+	if len(sources) != 1 || sources[0].PlacementMode != configkit.PlacementModeMapping || sources[0].DestinationIsFallback {
 		t.Fatalf("mapping source evidence = %#v", sources)
 	}
 	first := sources[0]
 	first.Destination = configkit.Keys("caller")
-	if again := loaded.Sources(); len(again) != 1 || again[0].Destination.String() != "" || again[0].DestinationUnresolved {
+	if again := loaded.Sources(); len(again) != 1 || again[0].Destination.String() != "" || again[0].DestinationIsFallback {
 		t.Fatalf("source evidence changed after caller mutation: %#v", again)
 	}
 }
@@ -556,7 +556,7 @@ func TestFacadeSequenceReplacementKeepsTypedAndHistoricalEvidenceAligned(t *test
 	directory := t.TempDir()
 	mainPath := filepath.Join(directory, "main.yml")
 	underlayPath := filepath.Join(directory, "underlay.yml")
-	if err := os.WriteFile(mainPath, []byte(`configkit:
+	if err := os.WriteFile(mainPath, []byte(`config:
   sequences:
     - destination: [entries]
       key: id
@@ -571,7 +571,7 @@ entries:
 `), 0o600); err != nil {
 		t.Fatal(err)
 	}
-	if err := os.WriteFile(underlayPath, []byte(`configkit:
+	if err := os.WriteFile(underlayPath, []byte(`config:
   imports:
     - glob: records/*.yml
       destination: [entries]
@@ -598,7 +598,7 @@ entries:
 		Underlays: []configkit.Underlay{{Inputs: []configkit.Input{{Source: configkit.File(underlayPath), Imports: true}}}},
 		Definition: configkit.Definition[configuration]{
 			SequenceIdentities: []configkit.SequenceIdentity{configkit.SequenceIdentityAt(configkit.Keys("entries"), "id")},
-			Secret: func(path configkit.Path) bool {
+			Sensitive: func(path configkit.Path) bool {
 				return path.String() == "/entries/0/token" || path.String() == "/entries/1/token"
 			},
 			Resolve: func(value *configuration, resolution *configkit.Resolution) error {
@@ -611,8 +611,8 @@ entries:
 				if resolution.IsExplicit(configkit.Keys("entries").Index(0).Key("omitted")) {
 					t.Error("resolver treated an omitted field as explicit")
 				}
-				info, found := resolution.InputInfo(configkit.Keys("entries").Index(0).Key("count"))
-				if !found || info.Origin.Layer != configkit.LayerBase {
+				info, found := resolution.EntryInfo(configkit.Keys("entries").Index(0).Key("count"))
+				if !found || info.Origin.Layer != configkit.LayerMain {
 					t.Errorf("resolver current-record input info = %#v, %v", info, found)
 				}
 				for _, id := range []string{"source-3", "source-4"} {
@@ -646,7 +646,7 @@ entries:
 		t.Fatalf("callback sources = %#v; contexts = %#v", callbackItems, callbackContexts)
 	}
 	for _, source := range callbackItems {
-		if source.PlacementMode != configkit.PlacementModeSequenceItem || source.Destination.String() != "/entries" || source.DestinationUnresolved {
+		if source.PlacementMode != configkit.PlacementModeSequenceItem || source.Destination.String() != "/entries" || source.DestinationIsFallback {
 			t.Errorf("callback item source = %#v", source)
 		}
 	}

facade_sequence_version_test.go

@@ -5,7 +5,7 @@ import (
 	"testing"
 	"testing/fstest"
 
-	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+	configkit "go.maximumdirect.net/configkit"
 )
 
 type movedVersionItem struct {
@@ -64,7 +64,7 @@ func TestMainVersionDecodingFollowsSequenceMovement(t *testing.T) {
 						t.Fatal("unrelated underlay payload was treated as the main declaration")
 					}
 					for _, source := range loaded.Sources() {
-						if source.Layer == configkit.LayerBase && source.VersionCheck.Path.String() != path.String() {
+						if source.Layer == configkit.LayerMain && source.VersionEvidence.Path.String() != path.String() {
 							t.Fatal("effective movement changed source-local version evidence")
 						}
 					}
@@ -131,7 +131,7 @@ func TestUnderlayVersionProtectionUsesMainRecordPosition(t *testing.T) {
 			want := configkit.CodeUnderlayVersion
 			if imported {
 				files := configkit.NewFilesystem("lower", fstest.MapFS{
-					"main.yml":     {Data: []byte("configkit: {imports: [{path: fragment.yml}]}\n")},
+					"main.yml":     {Data: []byte("config: {imports: [{path: fragment.yml}]}\n")},
 					"fragment.yml": {Data: []byte(payload)},
 				})
 				lower.Source, lower.Imports = files.File("main.yml"), true

facade_source_version_mode_test.go

@@ -10,7 +10,7 @@ import (
 	"testing"
 	"testing/fstest"
 
-	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+	configkit "go.maximumdirect.net/configkit"
 )
 
 func TestFacadeSourceVersionEvidenceFollowsAssembledSequenceRanges(t *testing.T) {
@@ -25,7 +25,7 @@ func TestFacadeSourceVersionEvidenceFollowsAssembledSequenceRanges(t *testing.T)
 				definition := configkit.Definition[map[string]any]{
 					SequenceIdentities: []configkit.SequenceIdentity{configkit.SequenceIdentityAt(configkit.Keys("records"), "id")},
 					Version:            &configkit.VersionRule{Path: configkit.Keys("records").Index(0).Key("version"), Check: func(configkit.Version, *configkit.Validation) error { return nil }},
-					Secret:             func(path configkit.Path) bool { return sensitivePath != "" && path.String() == sensitivePath },
+					Sensitive:          func(path configkit.Path) bool { return sensitivePath != "" && path.String() == sensitivePath },
 				}
 				first := "records: [{id: first, version: first-version}]\n"
 				child := "records: [{id: child, version: PRIVATE-VERSION-CANARY}]\n"
@@ -40,7 +40,7 @@ func TestFacadeSourceVersionEvidenceFollowsAssembledSequenceRanges(t *testing.T)
 					})
 				} else {
 					filesystem := configkit.NewFilesystem("versions", fstest.MapFS{
-						"main.yml":  {Data: []byte("configkit: {imports: [{path: child.yml}]}\n" + first)},
+						"main.yml":  {Data: []byte("config: {imports: [{path: child.yml}]}\n" + first)},
 						"child.yml": {Data: []byte(child)},
 					})
 					result, err = configkit.Load(filesystem.File("main.yml"), configkit.Options[map[string]any]{
@@ -61,7 +61,7 @@ func TestFacadeSourceVersionEvidenceFollowsAssembledSequenceRanges(t *testing.T)
 					}
 				}
 				sources := result.Sources()
-				check := sources[len(sources)-1].VersionCheck
+				check := sources[len(sources)-1].VersionEvidence
 				if check == nil || check.Path.String() != "/records/0/version" || check.Location == nil || check.Location.SourceID != sources[len(sources)-1].ID {
 					t.Fatalf("source-local evidence changed: %#v", check)
 				}
@@ -98,7 +98,7 @@ func TestFacadeSourceVersionOwnershipAcceptsContextualIndexes(t *testing.T) {
 					Underlays: []configkit.Underlay{{Inputs: []configkit.Input{{Source: configkit.Bytes("lower", []byte(child))}}}},
 				})
 			} else {
-				filesystem := configkit.NewFilesystem("versions", fstest.MapFS{"main.yml": {Data: []byte("configkit: {imports: [{path: child.yml}]}\n" + first)}, "child.yml": {Data: []byte(child)}})
+				filesystem := configkit.NewFilesystem("versions", fstest.MapFS{"main.yml": {Data: []byte("config: {imports: [{path: child.yml}]}\n" + first)}, "child.yml": {Data: []byte(child)}})
 				result, err = configkit.Load(filesystem.File("main.yml"), configkit.Options[map[string]any]{Definition: definition, SourceVersionMode: configkit.SourceVersionModeRequired, Imports: true})
 			}
 			if err != nil || result == nil {
@@ -121,7 +121,7 @@ func TestFacadeItemMainKeepsDefaultVersionOwnership(t *testing.T) {
 				helper = "other: {version: permitted}\n"
 			}
 			filesystem := configkit.NewFilesystem("item-main", fstest.MapFS{
-				"main.yml": {Data: []byte(body + "configkit: {imports: [{path: helper.yml}]}\n")}, "helper.yml": {Data: []byte(helper)},
+				"main.yml": {Data: []byte(body + "config: {imports: [{path: helper.yml}]}\n")}, "helper.yml": {Data: []byte(helper)},
 			})
 			checks := 0
 			definition := configkit.Definition[map[string]any]{Version: &configkit.VersionRule{
@@ -209,7 +209,7 @@ func TestFacadeSourceVersionEvidenceRedactsCollidingShapes(t *testing.T) {
 				continue
 			}
 			foundMapping = true
-			if check := source.VersionCheck; check == nil || !check.Version.Present || !check.Redacted || check.Version.Text != "" {
+			if check := source.VersionEvidence; check == nil || !check.Version.Present || !check.Redacted || check.Version.Text != "" {
 				t.Errorf("reverse=%v: schema-tagged header was not redacted", reverse)
 			}
 		}
@@ -223,7 +223,7 @@ func TestFacadeSourceVersionModesPreserveImportOptIn(t *testing.T) {
 	t.Parallel()
 	for _, mode := range []configkit.SourceVersionMode{configkit.SourceVersionModeIfPresent, configkit.SourceVersionModeRequired} {
 		for _, underlay := range []bool{false, true} {
-			bad := configkit.Bytes("disabled-imports", []byte("version: accepted\nconfigkit: {imports: [{path: missing.yml}]}\nvalue: visible\n"))
+			bad := configkit.Bytes("disabled-imports", []byte("version: accepted\nconfig: {imports: [{path: missing.yml}]}\nvalue: visible\n"))
 			definition := configkit.Definition[map[string]any]{Version: &configkit.VersionRule{
 				Path: configkit.Keys("version"), Check: func(configkit.Version, *configkit.Validation) error { return nil },
 			}}
@@ -246,7 +246,7 @@ func TestFacadeSourceVersionModesPreserveImportOptIn(t *testing.T) {
 				continue
 			}
 			diagnostics := failure.Diagnostics()
-			if len(diagnostics) != 1 || diagnostics[0].Code != configkit.CodeImportDisabled || diagnostics[0].Path.String() != "/configkit" ||
+			if len(diagnostics) != 1 || diagnostics[0].Code != configkit.CodeImportDisabled || diagnostics[0].Path.String() != "/config" ||
 				diagnostics[0].Primary == nil || diagnostics[0].Primary.SourceID != wantSource {
 				t.Errorf("mode=%v underlay=%v: diagnostics=%#v", mode, underlay, diagnostics)
 			}
@@ -265,7 +265,7 @@ func TestFacadeSourceVersionAbsenceKeepsCompleteEvidencePath(t *testing.T) {
 		{"unavailable index", "meta: [null, null, null, {version: main}]\n", "meta: []\n", configkit.Keys("meta").Index(3).Key("version")},
 	} {
 		for _, mode := range []configkit.SourceVersionMode{configkit.SourceVersionModeIfPresent, configkit.SourceVersionModeRequired} {
-			var callbackEvidence *configkit.SourceVersionCheck
+			var callbackEvidence *configkit.SourceVersionEvidence
 			loaded, err := configkit.LoadLayered(configkit.Input{Source: configkit.Bytes("main", []byte(test.main))}, configkit.LayeredOptions[map[string]any]{
 				SourceVersionMode: mode,
 				Definition: configkit.Definition[map[string]any]{
@@ -275,7 +275,7 @@ func TestFacadeSourceVersionAbsenceKeepsCompleteEvidencePath(t *testing.T) {
 						if !found {
 							t.Fatal("missing callback source")
 						}
-						callbackEvidence = source.VersionCheck
+						callbackEvidence = source.VersionEvidence
 						return nil
 					},
 				},
@@ -283,7 +283,7 @@ func TestFacadeSourceVersionAbsenceKeepsCompleteEvidencePath(t *testing.T) {
 					Source: configkit.Bytes("underlay", []byte(test.underlay)), Destination: configkit.Keys("under"),
 				}}}},
 			})
-			var evidence *configkit.SourceVersionCheck
+			var evidence *configkit.SourceVersionEvidence
 			if mode == configkit.SourceVersionModeRequired {
 				var failure *configkit.LoadError
 				if loaded != nil || !errors.As(err, &failure) {
@@ -293,12 +293,12 @@ func TestFacadeSourceVersionAbsenceKeepsCompleteEvidencePath(t *testing.T) {
 				if len(diagnostics) != 1 || diagnostics[0].Code != configkit.CodeVersionError || diagnostics[0].Path.String() != test.path.String() {
 					t.Fatalf("%s: required diagnostics=%#v", test.name, diagnostics)
 				}
-				evidence = failure.Sources()[1].VersionCheck
+				evidence = failure.Sources()[1].VersionEvidence
 			} else {
 				if err != nil {
 					t.Fatalf("%s: %v", test.name, err)
 				}
-				evidence = loaded.Sources()[1].VersionCheck
+				evidence = loaded.Sources()[1].VersionEvidence
 				if callbackEvidence == nil || callbackEvidence.Path.String() != test.path.String() {
 					t.Errorf("%s: callback path is incomplete", test.name)
 				}
@@ -365,7 +365,7 @@ func TestFacadeSourceVersionMissingHeaderDoesNotOverlapControl(t *testing.T) {
 			if child["value"] != "good" {
 				t.Fatal("valid sibling inheritance was not applied")
 			}
-			check := loaded.Sources()[1].VersionCheck
+			check := loaded.Sources()[1].VersionEvidence
 			if check == nil || check.Version.Present || check.Path.String() != path.String() {
 				t.Fatal("optional omission evidence was not retained")
 			}
@@ -544,16 +544,16 @@ func TestFacadeSourceVersionEvidenceIsSanitizedAndDetached(t *testing.T) {
 	var callbackSource configkit.SourceInfo
 	var callbackContext configkit.ResourceContext
 	definition := configkit.Definition[map[string]any]{
-		Version: &configkit.VersionRule{Path: configkit.Keys("version"), Check: func(configkit.Version, *configkit.Validation) error { return nil }},
-		Secret:  func(candidate configkit.Path) bool { return candidate.String() == "/service/version" },
+		Version:   &configkit.VersionRule{Path: configkit.Keys("version"), Check: func(configkit.Version, *configkit.Validation) error { return nil }},
+		Sensitive: func(candidate configkit.Path) bool { return candidate.String() == "/service/version" },
 		Resolve: func(_ *map[string]any, resolution *configkit.Resolution) error {
 			var found bool
 			callbackSource, found = resolution.Source("source-1")
 			if !found {
 				t.Fatal("resolution callback could not query the acquired source")
 			}
-			if callbackSource.VersionCheck == nil || !callbackSource.VersionCheck.Redacted || callbackSource.VersionCheck.Version.Text != "" {
-				t.Fatalf("callback source did not conservatively redact evidence: %#v", callbackSource.VersionCheck)
+			if callbackSource.VersionEvidence == nil || !callbackSource.VersionEvidence.Redacted || callbackSource.VersionEvidence.Version.Text != "" {
+				t.Fatalf("callback source did not conservatively redact evidence: %#v", callbackSource.VersionEvidence)
 			}
 			callbackContext, found = resolution.SourceContext("source-1")
 			if !found || callbackContext.FS == nil || callbackContext.BaseDir != "." {
@@ -568,17 +568,17 @@ func TestFacadeSourceVersionEvidenceIsSanitizedAndDetached(t *testing.T) {
 	if err != nil || loaded == nil {
 		t.Fatalf("LoadLayered = %#v, %v", loaded, err)
 	}
-	if callbackSource.VersionCheck == nil || !callbackSource.VersionCheck.Redacted || callbackSource.VersionCheck.Version.Text != "" {
-		t.Fatalf("callback evidence lost its conservative snapshot: %#v", callbackSource.VersionCheck)
+	if callbackSource.VersionEvidence == nil || !callbackSource.VersionEvidence.Redacted || callbackSource.VersionEvidence.Version.Text != "" {
+		t.Fatalf("callback evidence lost its conservative snapshot: %#v", callbackSource.VersionEvidence)
 	}
-	callbackSource.VersionCheck.Path = configkit.Keys("mutated-callback")
-	callbackSource.VersionCheck.Version.Text = canary
-	callbackSource.VersionCheck.Location.Line = 98
+	callbackSource.VersionEvidence.Path = configkit.Keys("mutated-callback")
+	callbackSource.VersionEvidence.Version.Text = canary
+	callbackSource.VersionEvidence.Location.Line = 98
 	finalSources := loaded.Sources()
-	if len(finalSources) != 1 || finalSources[0].Path != path || finalSources[0].VersionCheck == nil {
+	if len(finalSources) != 1 || finalSources[0].Path != path || finalSources[0].VersionEvidence == nil {
 		t.Fatalf("final sources = %#v", finalSources)
 	}
-	check := finalSources[0].VersionCheck
+	check := finalSources[0].VersionEvidence
 	if check.Path.String() != "/version" || check.Version != (configkit.Version{Present: true}) || !check.Redacted ||
 		check.Location == nil || check.Location.SourceID != finalSources[0].ID || check.Location.Line != 1 {
 		t.Fatalf("final classified evidence = %#v", check)
@@ -594,9 +594,9 @@ func TestFacadeSourceVersionEvidenceIsSanitizedAndDetached(t *testing.T) {
 	check.Redacted = false
 	check.Version.Text = "mutated"
 	repeated := loaded.Sources()
-	if len(repeated) != 1 || repeated[0].VersionCheck.Path.String() != "/version" ||
-		repeated[0].VersionCheck.Location.Line != 1 || !repeated[0].VersionCheck.Redacted ||
-		repeated[0].VersionCheck.Version.Text != "" {
+	if len(repeated) != 1 || repeated[0].VersionEvidence.Path.String() != "/version" ||
+		repeated[0].VersionEvidence.Location.Line != 1 || !repeated[0].VersionEvidence.Redacted ||
+		repeated[0].VersionEvidence.Version.Text != "" {
 		t.Fatalf("source evidence was aliased or re-read after source removal: %#v", repeated)
 	}
 
@@ -612,14 +612,14 @@ func TestFacadeSourceVersionEvidenceIsSanitizedAndDetached(t *testing.T) {
 			},
 		},
 	})
-	if err != nil || public == nil || len(public.Sources()) != 1 || public.Sources()[0].VersionCheck == nil {
+	if err != nil || public == nil || len(public.Sources()) != 1 || public.Sources()[0].VersionEvidence == nil {
 		t.Fatalf("unclassified source evidence = %#v, %v", public, err)
 	}
-	if got := public.Sources()[0].VersionCheck; got.Redacted || got.Version.Text != publicText || !got.Version.Present {
+	if got := public.Sources()[0].VersionEvidence; got.Redacted || got.Version.Text != publicText || !got.Version.Present {
 		t.Fatalf("unclassified evidence = %#v", got)
 	}
-	if publicCallback.VersionCheck == nil || !publicCallback.VersionCheck.Redacted || publicCallback.VersionCheck.Version.Text != "" {
-		t.Fatalf("unclassified callback evidence was not initially conservative: %#v", publicCallback.VersionCheck)
+	if publicCallback.VersionEvidence == nil || !publicCallback.VersionEvidence.Redacted || publicCallback.VersionEvidence.Version.Text != "" {
+		t.Fatalf("unclassified callback evidence was not initially conservative: %#v", publicCallback.VersionEvidence)
 	}
 }
 
@@ -636,7 +636,7 @@ func TestFacadeSourceVersionEvidenceOnFailedLoadsAndSyntheticSources(t *testing.
 			Path: configkit.Keys("version"), Check: func(configkit.Version, *configkit.Validation) error { checked++; return nil },
 		}}
 		path := filepath.Join(t.TempDir(), "main.yml")
-		contents := "version: " + canary + "\nconfigkit:\n  imports:\n    - path: missing.yml\n      required: true\n"
+		contents := "version: " + canary + "\nconfig:\n  imports:\n    - path: missing.yml\n      required: true\n"
 		if err := os.WriteFile(path, []byte(contents), 0o600); err != nil {
 			t.Fatal(err)
 		}
@@ -650,7 +650,7 @@ func TestFacadeSourceVersionEvidenceOnFailedLoadsAndSyntheticSources(t *testing.
 		if checked != 1 {
 			t.Fatalf("main declaration checker calls = %d; error %v", checked, err)
 		}
-		check := failure.Sources()[0].VersionCheck
+		check := failure.Sources()[0].VersionEvidence
 		if check == nil || !check.Redacted || !check.Version.Present || check.Version.Text != "" {
 			t.Fatalf("early acquisition evidence was not conservatively redacted: %#v; sources %#v", check, failure.Sources())
 		}
@@ -666,14 +666,14 @@ func TestFacadeSourceVersionEvidenceOnFailedLoadsAndSyntheticSources(t *testing.
 		t.Fatalf("malformed version error = %v", err)
 	}
 	sources := loadError.Sources()
-	if len(sources) != 1 || sources[0].VersionCheck == nil || !sources[0].VersionCheck.Redacted ||
-		!sources[0].VersionCheck.Version.Present || sources[0].VersionCheck.Version.Text != "" || sources[0].VersionCheck.Path.String() != "/version" {
+	if len(sources) != 1 || sources[0].VersionEvidence == nil || !sources[0].VersionEvidence.Redacted ||
+		!sources[0].VersionEvidence.Version.Present || sources[0].VersionEvidence.Version.Text != "" || sources[0].VersionEvidence.Path.String() != "/version" {
 		t.Fatalf("failed-load source evidence = %#v", sources)
 	}
-	sources[0].VersionCheck.Path = configkit.Keys("mutated-error")
-	sources[0].VersionCheck.Version.Text = "mutated"
-	sources[0].VersionCheck.Location.Line = 99
-	if again := loadError.Sources()[0].VersionCheck; again.Path.String() != "/version" || again.Version.Text != "" || again.Location.Line == 99 {
+	sources[0].VersionEvidence.Path = configkit.Keys("mutated-error")
+	sources[0].VersionEvidence.Version.Text = "mutated"
+	sources[0].VersionEvidence.Location.Line = 99
+	if again := loadError.Sources()[0].VersionEvidence; again.Path.String() != "/version" || again.Version.Text != "" || again.Location.Line == 99 {
 		t.Fatalf("LoadError source evidence was aliased: %#v", again)
 	}
 	for _, test := range []struct {
@@ -707,7 +707,7 @@ func TestFacadeSourceVersionEvidenceOnFailedLoadsAndSyntheticSources(t *testing.
 			if strings.Contains(err.Error(), test.canary) {
 				t.Fatalf("late failure disclosed source-version canary: %v", err)
 			}
-			check := failure.Sources()[0].VersionCheck
+			check := failure.Sources()[0].VersionEvidence
 			if check == nil || !check.Redacted || !check.Version.Present || check.Version.Text != "" {
 				t.Fatalf("late-failure evidence was not conservatively redacted: %#v", check)
 			}
@@ -715,7 +715,7 @@ func TestFacadeSourceVersionEvidenceOnFailedLoadsAndSyntheticSources(t *testing.
 	}
 
 	defaultResult, err := configkit.Load(configkit.Bytes("default", []byte("version: 7\n")), configkit.Options[map[string]any]{})
-	if err != nil || defaultResult == nil || len(defaultResult.Sources()) != 1 || defaultResult.Sources()[0].VersionCheck != nil {
+	if err != nil || defaultResult == nil || len(defaultResult.Sources()) != 1 || defaultResult.Sources()[0].VersionEvidence != nil {
 		t.Fatalf("default source version check = %#v, %v", defaultResult, err)
 	}
 
@@ -728,7 +728,7 @@ func TestFacadeSourceVersionEvidenceOnFailedLoadsAndSyntheticSources(t *testing.
 	}
 	sawCLI := false
 	for _, source := range withCLI.Sources() {
-		if source.Kind == configkit.SourceKindCLI && source.VersionCheck != nil {
+		if source.Kind == configkit.SourceKindCLI && source.VersionEvidence != nil {
 			t.Fatalf("synthetic CLI source acquired declaration evidence: %#v", source)
 		}
 		sawCLI = sawCLI || source.Kind == configkit.SourceKindCLI
@@ -764,14 +764,14 @@ func TestFacadeSourceVersionEvidencePreservesAbsenceAndNull(t *testing.T) {
 		t.Fatalf("checker calls = %#v; absent contribution must skip while null is checked", checked)
 	}
 	sources := loaded.Sources()
-	if len(sources) != 3 || sources[1].VersionCheck == nil || sources[2].VersionCheck == nil {
+	if len(sources) != 3 || sources[1].VersionEvidence == nil || sources[2].VersionEvidence == nil {
 		t.Fatalf("source version evidence = %#v", sources)
 	}
-	absent := sources[1].VersionCheck
+	absent := sources[1].VersionEvidence
 	if absent.Version.Present || absent.Path.String() != "/version" || absent.Location == nil || absent.Redacted {
 		t.Fatalf("optional omission evidence = %#v", absent)
 	}
-	null := sources[2].VersionCheck
+	null := sources[2].VersionEvidence
 	if !null.Version.Present || !null.Version.Null || null.Version.Text != "" || null.Path.String() != "/version" {
 		t.Fatalf("null declaration evidence = %#v", null)
 	}
@@ -807,7 +807,7 @@ func TestFacadeSourceVersionLifecycleKeepsConsumedHeadersOutOfPayloadHistory(t *
 		},
 		Resolve: func(current *configuration, resolution *configkit.Resolution) error {
 			current.Service.Resolved = "resolved once"
-			resolution.Record(configkit.Keys("service", "resolved"), configkit.ChangeNormalization, "derive resolved value")
+			resolution.RecordNormalization(configkit.Keys("service", "resolved"), "derive resolved value")
 			return nil
 		},
 		Validate: func(current *configuration, validation *configkit.Validation) {
@@ -865,8 +865,8 @@ func TestFacadeSourceVersionLifecycleKeepsConsumedHeadersOutOfPayloadHistory(t *
 		t.Fatalf("consumed declarations affected effective rendering:\n%s\n%s", firstEffective.String(), secondEffective.String())
 	}
 	sourcesA, sourcesB := first.Sources(), second.Sources()
-	if len(sourcesA) != 2 || len(sourcesB) != 2 || sourcesA[1].VersionCheck == nil || sourcesB[1].VersionCheck == nil ||
-		sourcesA[1].VersionCheck.Version.Text != "underlay-release-a" || sourcesB[1].VersionCheck.Version.Text != "underlay-release-b" {
+	if len(sourcesA) != 2 || len(sourcesB) != 2 || sourcesA[1].VersionEvidence == nil || sourcesB[1].VersionEvidence == nil ||
+		sourcesA[1].VersionEvidence.Version.Text != "underlay-release-a" || sourcesB[1].VersionEvidence.Version.Text != "underlay-release-b" {
 		t.Fatalf("sanitized evidence did not retain distinct accepted declarations: %#v / %#v", sourcesA, sourcesB)
 	}
 	versionExplanation, found := first.Explain(configkit.Keys("service", "version"))

facade_tier_history_test.go

@@ -0,0 +1,50 @@
+package configkit_test
+
+import (
+	"testing"
+
+	configkit "go.maximumdirect.net/configkit"
+)
+
+func TestTierHistoryRecordsEachContributionOnce(t *testing.T) {
+	t.Parallel()
+	for _, middle := range []string{"mid", "low"} {
+		t.Run(middle, func(t *testing.T) {
+			result, err := configkit.LoadLayered[map[string]any](
+				configkit.Input{Source: configkit.Bytes("main", []byte("x: high\n"))},
+				configkit.LayeredOptions[map[string]any]{Underlays: []configkit.Underlay{
+					{Inputs: []configkit.Input{{Source: configkit.Bytes("low", []byte("x: low\n"))}}},
+					{Inputs: []configkit.Input{{Source: configkit.Bytes("middle", []byte("x: "+middle+"\n"))}}},
+				}},
+			)
+			if err != nil {
+				t.Fatal(err)
+			}
+			history := result.Metadata().History(configkit.Keys("x"))
+			if len(history) != 3 {
+				t.Fatalf("history has %d records; want the three independent contributions", len(history))
+			}
+			explanation, found := result.Explain(configkit.Keys("x"))
+			if !found || len(explanation.History) != len(history) {
+				t.Fatal("explanation lost ordered tier contributions")
+			}
+			for index, sourceID := range []string{"source-2", "source-3", "source-1"} {
+				change := history[index]
+				if len(change.Origin.Locations) != 1 || change.Origin.Locations[0].SourceID != sourceID {
+					t.Fatalf("contribution %d has origin %#v", index, change.Origin)
+				}
+				if len(explanation.History[index].Origin.Locations) != 1 || explanation.History[index].Origin.Locations[0] != change.Origin.Locations[0] {
+					t.Fatalf("explanation contribution %d has a different source origin", index)
+				}
+				if index == 0 {
+					if len(change.Previous) != 0 {
+						t.Fatal("first source contribution has a previous origin")
+					}
+				} else if len(change.Previous) != 1 || len(change.Previous[0].Locations) != 1 ||
+					change.Previous[0].Locations[0] != history[index-1].Origin.Locations[0] {
+					t.Fatalf("contribution %d has incorrect previous origin %#v", index, change.Previous)
+				}
+			}
+		})
+	}
+}

facade_underlay_origins_test.go

@@ -5,7 +5,7 @@ import (
 	"testing"
 	"testing/fstest"
 
-	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+	configkit "go.maximumdirect.net/configkit"
 )
 
 func TestUnderlaySequenceDescendantOrigins(t *testing.T) {
@@ -16,7 +16,7 @@ func TestUnderlaySequenceDescendantOrigins(t *testing.T) {
 		}
 		t.Run(name, func(t *testing.T) {
 			bundle := configkit.NewFilesystem("bundle", fstest.MapFS{
-				"main.yml":  &fstest.MapFile{Data: []byte("configkit: {imports: [{path: items.yml}]}\n")},
+				"main.yml":  &fstest.MapFile{Data: []byte("config: {imports: [{path: items.yml}]}\n")},
 				"items.yml": &fstest.MapFile{Data: []byte("items: [{name: first, nested: [false]}]\n")},
 			})
 			tiers := []configkit.Underlay{}
@@ -31,7 +31,7 @@ func TestUnderlaySequenceDescendantOrigins(t *testing.T) {
 				Definition: configkit.Definition[map[string]any]{Resolve: func(_ *map[string]any, resolution *configkit.Resolution) error {
 					for _, pointer := range paths {
 						path, _ := configkit.ParsePath(pointer)
-						info, ok := resolution.InputInfo(path)
+						info, ok := resolution.EntryInfo(path)
 						if !ok {
 							t.Errorf("missing resolver input %s", pointer)
 						}

facade_version_test.go

@@ -5,7 +5,7 @@ import (
 	"strings"
 	"testing"
 
-	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+	configkit "go.maximumdirect.net/configkit"
 )
 
 type versionCountingReader struct {

go.mod

@@ -1,13 +1,13 @@
-module gitea.maximumdirect.net/eric/ConfigKit
+module go.maximumdirect.net/configkit
 
-go 1.26.0
+go 1.27.0
 
 require go.yaml.in/yaml/v4 v4.0.0-rc.6
 
 require (
-	gitea.maximumdirect.net/eric/ReleaseKit v0.4.2 // indirect
 	github.com/yuin/goldmark/v2 v2.1.6 // indirect
+	go.maximumdirect.net/releasekit v0.8.0 // indirect
 	golang.org/x/mod v0.40.0 // indirect
 )
 
-tool gitea.maximumdirect.net/eric/ReleaseKit/cmd/releasekit
+tool go.maximumdirect.net/releasekit/cmd/releasekit

go.sum

@@ -1,7 +1,7 @@
-gitea.maximumdirect.net/eric/ReleaseKit v0.4.2 h1:P2eDQ29BgyYqHnaz5MV+vzOk7r3s8py2y9k8JISFtJ0=
-gitea.maximumdirect.net/eric/ReleaseKit v0.4.2/go.mod h1:LVodqNQ3OIKv9NBq+fFeyMByd1lHY25YOmmpah/NaNI=
 github.com/yuin/goldmark/v2 v2.1.6 h1:igy0q9JcqovoFXFx/XjtU8sHVhcUHavPj2sA3EoKJUE=
 github.com/yuin/goldmark/v2 v2.1.6/go.mod h1:G6M4/qOFtfn01/o14BU1UR2Lo5N3S9Qo7xCuz/sHjGQ=
+go.maximumdirect.net/releasekit v0.8.0 h1:hSaHPbUI7tAhnolfbu7UMj2fvmm9FGBY+jhkygdbxR0=
+go.maximumdirect.net/releasekit v0.8.0/go.mod h1:QE4BLrAhVJTzi+/YTcVl21K/qZp9ojRLg5kuoy3Zb44=
 go.yaml.in/yaml/v4 v4.0.0-rc.6 h1:1h7H1ohdUh93/FyE4YaDa1Zh64K6VVbjF4K6WUxMtH4=
 go.yaml.in/yaml/v4 v4.0.0-rc.6/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
 golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs=