Add explicit secrets directory bootstrap

docs/roadmap/implementation.md

@@ -1164,7 +1164,36 @@ Acceptance:
 
 ## Stage 16 — Extract explicit secrets-directory bootstrap
 
-Status: pending.
+Status: complete.
+
+Completion evidence (2026-09-06):
+
+- Added the separate, opt-in `LoadSecretsDir` startup boundary in
+  [`secrets.go`](../../secrets.go), with detached per-file results, stable status
+  values, safe `SecretsError` diagnostics, and a deterministic quoted report
+  renderer. `Load` remains process-state-free and has no secrets-directory option.
+- Adapted WeatherReporter's read/apply separation, filename/type checks, exact
+  one-LF/CRLF removal, and failure cases together with Narratio's bounded reads and
+  existing-variable preservation. The [extraction inventory](../internal/extraction.md)
+  records both inspected revisions, reused symbols/cases, and the intentional
+  removal of overwrite, rollback, permission-mode, implicit configuration, and
+  logging policies.
+- Implemented bounded immediate enumeration (1,024 entries), canonical directory
+  selection, sorted metadata validation, 1 MiB eligible-file and 8 MiB aggregate
+  reads, NUL rejection, full preflight before writes, and a per-write presence
+  recheck. Existing empty values are distinguished, skipped files are never opened,
+  and apply failures retain accurate partial progress without rollback.
+- Added real filesystem/environment and private-seam coverage in
+  [`secrets_test.go`](../../secrets_test.go) for canonical ordering, selected
+  directory symlinks, newline/empty values, invalid names/types, all bounds,
+  missing/permission/read failures, no-write preflight failures, newly populated
+  variables, controlled apply failure, defensive copies, non-disclosure, and writer
+  failures. The [configuration contract](../config.md#explicit-secrets-directory-bootstrap)
+  documents startup-only mutation, non-atomicity, reporting blocked files, and
+  retaining reports alongside configuration results. Verified `go test ./...`,
+  `go test -race ./...`, `go vet ./...`, `go build ./...`, `go mod tidy -diff`, and
+  `git diff --check` with Go 1.26.7 on linux/amd64. No deviations were required;
+  environment-backed typed secret references remain later work.
 
 Read: [secret bootstrap contract](initial.md#secret-references-and-explicit-bootstrap),
 architecture responsibility boundary, testing policy, and WeatherReporter's