Plan filesystem sources and underlays

docs/config.md

@@ -71,6 +71,31 @@ the returned configuration or inspection records cannot alter ConfigKit's privat
 snapshot. ConfigKit performs no logging. `Result.WriteEffective` exposes only the
 frozen redacted projection.
 
+### Completion and resource lifetime
+
+`Load` is synchronous and complete on return. Success means input assembly,
+defaulting, typed decoding, configured application resolution, secret lookup,
+validation, and configuration/metadata snapshotting have completed. A reported
+load failure returns diagnostics and a nil result, as described above.
+
+Before returning on success or failure, ConfigKit closes the filesystem handles
+it opened for loading, including files and directory/root handles. The returned
+configuration and inspection metadata require no close operation and remain
+usable independently of the source files. A supplied `Reader` remains
+caller-owned and is never closed by ConfigKit.
+
+ConfigKit performs no background work after returning: it does not watch inputs,
+refresh secrets, or mutate published results. Inspection and rendering run only
+when explicitly called and use the retained snapshot. Applications normally load
+once near startup, but may explicitly load again using sources that satisfy their
+documented reuse rules. Additional loads produce independently owned results.
+
+Completion is not a transaction over external state. Files and environment
+variables are observed during processing rather than as one simultaneous external
+snapshot. ConfigKit does not roll back application callback effects or manage work
+or resources created by application callbacks. The explicit secrets-directory
+bootstrap remains a separate operation invoked by the application.
+
 ### Application schema versions
 
 `VersionRule` declares a semantic path and non-nil checker. Before defaults or typed