Add explicit secrets directory bootstrap

docs/internal/extraction.md

@@ -300,6 +300,16 @@ Assigned to the explicit bootstrap operation:
   fixed budgets. Logging, configuration-driven implicit invocation, private-mode
   conventions, and application API-key plumbing remain in Narratio.
 
+Implementation record (2026-09-06): `LoadSecretsDir`, `readSecretsEntries`,
+`readSecretValue`, and the private environment/file seams in `secrets.go` adapt
+Narratio's bounded-read and preserve-existing mechanisms at revision
+`b68435128be1e24b94fc7ec259d6e9093669fd99`. The corresponding tests retain its
+valid-file, existing-variable (including empty), missing/permission/read,
+nonregular, symlink, and byte-limit cases. ConfigKit validates invalid entries
+rather than skipping them, permits ordinary deployment permission modes, resolves
+the selected directory symlink, performs complete preflight before mutation, and
+emits per-file safe records without application configuration or logging.
+
 ## WeatherReporter evidence
 
 ### Secrets bootstrap
@@ -324,6 +334,15 @@ Assigned to the explicit bootstrap operation:
   entries are not read. Bootstrap is explicitly invoked and remains independent of
   YAML loading and semantic validation.
 
+Implementation record (2026-09-06): the same `secrets.go` state machine adapts
+WeatherReporter's `loadSecrets`/`applySecrets` separation, environment-name check,
+regular-file rejection, and exact one-LF/CRLF removal at revision
+`5d306a202471e10fe98923a1df27d0b0fce5c666`. Tests adapt its newline matrix,
+invalid-entry and preflight-no-write cases, and controlled application failure.
+The overwrite/rollback expectation is intentionally replaced by existing-winner,
+presence-recheck, and partial-progress statuses; no configuration loader invokes
+the bootstrap.
+
 ### Defaults, explicit presence, and module options
 
 Assigned to consumer-shaped examples and migration checks: