Add redacted effective rendering

docs/internal/extraction.md

@@ -200,6 +200,18 @@ snapshot agreement, defensive nested copies, and concurrent load isolation. Valu
 rendering, redaction, explanation, commands, generated attribution, diffs, and
 digests remain assigned to their later owning work.
 
+Effective-rendering implementation record (2026-09-06): ConfigKit adapts Narratio's
+deterministic effective-output and side-effect-free inspection cases in
+`classifySecretPaths`, `redactedDocument`, `Result.WriteEffective`, and the private
+`internal/yaml.Write` adapter. Tests cover stable sorted mappings, preserved sequence
+order, explicit indentation/line/document formatting, tagged containers, dynamic
+current and historical paths, fixed-point dependency cycles, nil/empty distinctions,
+resolved values, text-scalar snapshot reuse, application YAML-hook isolation,
+non-disclosure through failures and record formatting, caller mutation, and writer
+failures. Unlike Narratio's marshal/reparse path, ConfigKit renders only its owned
+frozen tree and substitutes redaction before the upstream dumper boundary. Historical
+value explanation and secret references remain assigned to later work.
+
 ### Defaults, presence, and domain resolution
 
 Assigned across schema, decoding, resolution, validation, and consumer examples:

docs/internal/overview.md

@@ -30,11 +30,15 @@ module and package documentation boundary. Its implemented public primitives are
   explicitness queries, helper verification, structural mutation audit, coalesced
   intent, private before/after snapshots, and resolution metadata integration; and
 - post-resolution schema-aware report collection and validator mutation detection in
-  `validation.go`, completing the public callback lifecycle after composed input.
+  `validation.go`, completing the public callback lifecycle after composed input;
+- fixed-point tag/predicate/dependency sensitivity classification in `secret.go`; and
+- frozen-snapshot redaction and canonical effective output in `render.go`, with the
+  only upstream dumper integration isolated in `internal/yaml/write.go`.
 
 The [configuration contract](../config.md) owns implemented input, schema, decoding,
 loading lifecycle, path imports, composition, profile overlay, version checking,
-recorded resolution, semantic validation, metadata, and ownership behavior.
+recorded resolution, semantic validation, metadata, secret classification, redacted
+effective rendering, and ownership behavior.
 
 The source-extraction inventory records the application foundations assigned to
 future implementation work: