Add redacted effective rendering

docs/roadmap/implementation.md

@@ -2,7 +2,7 @@
 
 ## Status and ownership
 
-Status: implementation in progress; Stages 1–14 are complete and later stages are
+Status: implementation in progress; Stages 1–15 are complete and later stages are
 pending.
 
 Audience: a `gpt-5.6-terra` coding agent implementing one stage per prompt, in
@@ -1092,7 +1092,36 @@ Acceptance:
 
 ## Stage 15 — Implement secret classification and effective rendering
 
-Status: pending.
+Status: complete.
+
+Completion evidence (2026-09-06):
+
+- Removed the dynamic-secret gate and combined descriptor `configkit:"secret"` roots
+  with a pure application path predicate over final and historical paths. Tagged
+  containers cover descendants, replaced/deleted definitions stay classified, and
+  resolution dependencies propagate sensitivity to a fixed point, including
+  container dependencies and cycles independent of record-map iteration order.
+- Added `Result.WriteEffective` over the frozen resolved document. It clones and
+  redacts before crossing the adapter boundary, sorts mappings by decoded key,
+  preserves sequence order and nil/empty distinctions, and never invokes application
+  YAML hooks or text codecs during rendering. Caller mutation cannot change output;
+  there is no unredacted path or implicit logging.
+- Added a private v4 dumper adapter with explicit two-space/noncompact-sequence
+  indentation, unlimited line width, Unicode, unique keys, block collections,
+  single-quote preference, LF endings, one document, and disabled start/end markers.
+  Secret roots render as the quoted string `'[REDACTED]'`; writer errors and short
+  writes propagate while internal dumper errors collapse to a fixed safe error.
+- Tests cover tagged containers, dynamic current and overwritten paths, dependency
+  cycles, container dependencies, custom text scalars, application marshal-hook
+  isolation, resolved values, sorted/stable YAML, sequence order, nil/empty forms,
+  snapshot mutation isolation, writer failures, and canary non-disclosure through
+  parsing, decoding, returned hook errors, warnings, metadata, and ordinary/Go-syntax
+  record formatting. The
+  [current redaction contract](../config.md#secret-classification-and-effective-rendering)
+  owns the behavior. Historical-value explanation and secret references/bootstrap
+  remain later work. Verified `go test ./...`, `go test -race ./...`, `go vet ./...`,
+  `go build ./...`, `go mod tidy -diff`, and `git diff --check` with Go 1.26.7 on
+  linux/amd64.
 
 Read: feature [redaction](initial.md#provenance-diagnostics-and-redaction),
 [secret predicate](initial.md#schema-checking-and-secret-classification), result API.