Correct mounted mapping diagnostic paths

README.md

@@ -20,7 +20,11 @@ secrets-directory bootstrap is available as a separate startup operation. Explic
 CLI override records apply above overlays. Value explanation is available through
 detached structured records and deterministic redacted output. Built-in
 `extends` relationships let a mapping inherit from a named sibling during the
-same load, retaining explicit presence and source/derivation history.
+same load, retaining explicit presence and source/derivation history. The root
+`Diff` API compares frozen effective values from two successful same-type loads;
+the [configuration contract](docs/config.md#effective-configuration-diffs) and
+[consumer guide](docs/consumers/README.md#effective-configuration-diffs) describe
+its safe changed-region records and maintained workflows.
 
 ```go
 type Config struct {
@@ -64,12 +68,14 @@ The [architecture goals](docs/policy/architecture.md#success-criteria) explain
 these priorities and how genuine new needs can justify extending the shared
 model. The [deferred scope](docs/roadmap/deferred.md) records deliberate exclusions.
 
-The [configuration contract](docs/config.md) describes implemented behavior. The
-[consumer adoption guide](docs/consumers/README.md) provides maintained simple
-native-filesystem, layered, and sibling-inheritance examples alongside the migration shapes.
-See the [development guide](docs/development.md) for repository orientation and the
-[release procedure](docs/release.md) for maintainer-only candidate and publication
-steps.
+The [configuration contract](docs/config.md) describes implemented behavior,
+including [input destinations](docs/config.md#input-destinations). The
+[consumer adoption guide](docs/consumers/README.md) provides maintained simple,
+layered, and mounted-collection examples alongside the migration shapes. The
+accepted placement decision is recorded in [ADR 0011](docs/adr/0011-input-destinations.md).
+See the [development guide](docs/development.md) for repository orientation and
+the [release procedure](docs/release.md) for maintainer-only candidate and
+publication steps.
 
 ConfigKit code is licensed under the [LGPL v3.0 or later](COPYRIGHT).
 

conversion.go

@@ -43,10 +43,10 @@ func toEngineLocations(values []Location) []engine.Location {
 	return result
 }
 func fromEngineSourceInfo(value engine.SourceInfo) SourceInfo {
-	return SourceInfo{ID: value.ID, Label: value.Label, Path: value.Path, Layer: Layer(value.Layer), Kind: SourceKind(value.Kind), UnderlayIndex: value.UnderlayIndex, ImportedFrom: fromEngineLocationPointer(value.ImportedFrom)}
+	return SourceInfo{ID: value.ID, Label: value.Label, Path: value.Path, Destination: fromEnginePath(value.Destination), Layer: Layer(value.Layer), Kind: SourceKind(value.Kind), UnderlayIndex: value.UnderlayIndex, ImportedFrom: fromEngineLocationPointer(value.ImportedFrom)}
 }
 func toEngineSourceInfo(value SourceInfo) engine.SourceInfo {
-	return engine.SourceInfo{ID: value.ID, Label: value.Label, Path: value.Path, Layer: engine.Layer(value.Layer), Kind: engine.SourceKind(value.Kind), UnderlayIndex: value.UnderlayIndex, ImportedFrom: toEngineLocationPointer(value.ImportedFrom)}
+	return engine.SourceInfo{ID: value.ID, Label: value.Label, Path: value.Path, Destination: toEnginePath(value.Destination), Layer: engine.Layer(value.Layer), Kind: engine.SourceKind(value.Kind), UnderlayIndex: value.UnderlayIndex, ImportedFrom: toEngineLocationPointer(value.ImportedFrom)}
 }
 func fromEngineOrigin(value engine.Origin) Origin {
 	result := Origin{Layer: Layer(value.Layer), Locations: fromEngineLocations(value.Locations), Operation: ChangeKind(value.Operation)}

development_check_test.go

@@ -66,7 +66,7 @@ func TestDevelopmentCheckHandlesFilenamesAndStopsOnFailure(t *testing.T) {
 						t.Fatal(err)
 					}
 					cmd := exec.Command("/bin/bash", filepath.Join(root, "scripts", scriptName))
-					cmd.Env = append(os.Environ(), "PATH="+bin+string(os.PathListSeparator)+os.Getenv("PATH"), "CONFIGKIT_BASELINE_TOOLCHAIN=test-baseline", "CONFIGKIT_NEWER_TOOLCHAIN=", "CONFIGKIT_TEST_FMT_LOG="+log, "CONFIGKIT_TEST_GO_LOG="+calls)
+					cmd.Env = append(os.Environ(), "PATH="+bin+string(os.PathListSeparator)+os.Getenv("PATH"), "CONFIGKIT_TEST_FMT_LOG="+log, "CONFIGKIT_TEST_GO_LOG="+calls)
 					// Log only targets selected by the script, not inherited host settings.
 					cmd.Env = append(cmd.Env, "GOOS=", "GOARCH=")
 					if name == "failed-go-check" {
@@ -108,90 +108,3 @@ func TestDevelopmentCheckHandlesFilenamesAndStopsOnFailure(t *testing.T) {
 		})
 	}
 }
-
-func TestCheckScriptsReleaseGates(t *testing.T) {
-	script, err := os.ReadFile("scripts/release-check.sh")
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, scenario := range []string{"success", "failed-test", "missing-toolchain"} {
-		t.Run(scenario, func(t *testing.T) {
-			root := t.TempDir()
-			bin := t.TempDir()
-			for _, directory := range []string{"scripts", "nested"} {
-				if err := os.Mkdir(filepath.Join(root, directory), 0700); err != nil {
-					t.Fatal(err)
-				}
-			}
-			checker := filepath.Join(root, "scripts", "release-check.sh")
-			if err := os.WriteFile(checker, script, 0700); err != nil {
-				t.Fatal(err)
-			}
-			calls := filepath.Join(bin, "go.calls")
-			goStub := `#!/bin/sh
-printf '%s|%s|%s|%s|%s|%s\n' "$GOTOOLCHAIN" "$GOPROXY" "${CGO_ENABLED-}" "${GOOS-}" "${GOARCH-}" "$*" >> "$CONFIGKIT_TEST_GO_LOG"
-if [ "${CONFIGKIT_TEST_FAIL-}" = toolchain ] && [ "${1-}" = version ]; then exit 37; fi
-if [ "${CONFIGKIT_TEST_FAIL-}" = test ] && [ "${1-}" = test ]; then exit 37; fi
-`
-			if err := os.WriteFile(filepath.Join(bin, "go"), []byte(goStub), 0700); err != nil {
-				t.Fatal(err)
-			}
-			cmd := exec.Command("/bin/bash", checker)
-			cmd.Dir = filepath.Join(root, "nested")
-			cmd.Env = append(os.Environ(),
-				"PATH="+bin+string(os.PathListSeparator)+os.Getenv("PATH"),
-				"CONFIGKIT_BASELINE_TOOLCHAIN=test-baseline",
-				"CONFIGKIT_TEST_GO_LOG="+calls,
-				"GOOS=", "GOARCH=", "CGO_ENABLED=",
-			)
-			switch scenario {
-			case "failed-test":
-				cmd.Env = append(cmd.Env, "CONFIGKIT_TEST_FAIL=test")
-			case "missing-toolchain":
-				cmd.Env = append(cmd.Env, "CONFIGKIT_TEST_FAIL=toolchain")
-			}
-			output, err := cmd.CombinedOutput()
-			if scenario == "success" && err != nil {
-				t.Fatalf("checker: %v\n%s", err, output)
-			}
-			if scenario != "success" && err == nil {
-				t.Fatalf("checker accepted %s", scenario)
-			}
-			data, err := os.ReadFile(calls)
-			if err != nil {
-				t.Fatal(err)
-			}
-			lines := strings.Split(strings.TrimSpace(string(data)), "\n")
-			for _, line := range lines {
-				if !strings.HasPrefix(line, "test-baseline|off|") {
-					t.Fatalf("toolchain or offline setting lost: %q", line)
-				}
-			}
-			if scenario == "missing-toolchain" {
-				if len(lines) != 1 || !strings.HasSuffix(lines[0], "|version") {
-					t.Fatalf("checker ran after unavailable toolchain: %q", lines)
-				}
-				return
-			}
-			if len(lines) < 2 || lines[1] != "test-baseline|off||||test -mod=readonly -vet=off -race -v ./..." {
-				t.Fatalf("release suite command changed: %q", lines)
-			}
-			if scenario == "failed-test" {
-				if len(lines) != 2 {
-					t.Fatalf("checker continued after failure: %q", lines)
-				}
-				return
-			}
-			want := []string{
-				"test-baseline|off||||version",
-				"test-baseline|off||||test -mod=readonly -vet=off -race -v ./...",
-				"test-baseline|off||||vet -mod=readonly ./...",
-				"test-baseline|off|0|linux|amd64|build -mod=readonly ./...",
-				"test-baseline|off|0|linux|arm64|build -mod=readonly ./...",
-			}
-			if strings.Join(lines, "\n") != strings.Join(want, "\n") {
-				t.Fatalf("unexpected release gates:\n%s", data)
-			}
-		})
-	}
-}

diff.go

@@ -0,0 +1,53 @@
+package configkit
+
+import "gitea.maximumdirect.net/eric/ConfigKit/internal/engine"
+
+// Difference describes one canonical changed region between two successful
+// loads. Left is the earlier value and Right is the later value. Each snapshot
+// is detached; Present distinguishes absence from an explicit null, and
+// Redacted reports whether combined sensitivity affected that side. Mappings
+// are compared recursively, while sequences are reported as atomic values.
+// Records are ordered by canonical JSON pointer. HiddenChanged indicates that
+// a value concealed by combined sensitivity changed, without revealing which
+// concealed member changed.
+type Difference struct {
+	Path          Path
+	Left          ValueSnapshot
+	Right         ValueSnapshot
+	HiddenChanged bool
+}
+
+// Diff compares the frozen effective values of two successful loads of the
+// same configuration type. It does not reread sources, environment variables,
+// or rerun defaults or resolvers. Equal values produce no records even when
+// their sources, defaults, or resolution histories differ. Credential contents
+// are not compared: typed secret references compare by reference name only.
+//
+// Both results must be non-nil successful loads with inspection state; nil or
+// zero results return an error and no records. Load errors are returned by
+// Load, so callers must handle those before calling Diff. Snapshots are safe
+// for presentation but are not a complete reloadable configuration.
+func Diff[T any](left, right *Result[T]) ([]Difference, error) {
+	var leftInspection, rightInspection *engine.Inspection
+	if left != nil {
+		leftInspection = left.inspection
+	}
+	if right != nil {
+		rightInspection = right.inspection
+	}
+
+	values, err := engine.Diff(leftInspection, rightInspection)
+	if err != nil {
+		return nil, err
+	}
+	differences := make([]Difference, len(values))
+	for index, value := range values {
+		differences[index] = Difference{
+			Path:          fromEnginePath(value.Path),
+			Left:          fromEngineValueSnapshot(value.Left),
+			Right:         fromEngineValueSnapshot(value.Right),
+			HiddenChanged: value.HiddenChanged,
+		}
+	}
+	return differences, nil
+}

docs/adr/0010-effective-configuration-diff.md

@@ -0,0 +1,99 @@
+# ADR 0010: Compare Frozen Effective Configuration Snapshots
+
+## Status
+
+Accepted and implemented. The
+[configuration contract](../config.md#effective-configuration-diffs) owns current
+behavior. Completed planning and remediation records are preserved in Git
+history at `1c2610c` under `docs/roadmap/`.
+
+## Date
+
+2026-10-09
+
+## Context
+
+Applications need to inspect how two completed configurations differ, including
+the effective impact of an overlay after defaults and application resolution.
+ConfigKit already retains canonical typed inspection snapshots, semantic paths,
+presence information, and sensitivity classification for successful loads.
+
+Extending this inspection model lets applications share configuration comparison
+and safe disclosure while keeping their presentation and domain interpretation.
+The operation should follow ConfigKit's existing equality, ownership, and secret
+boundaries so consumers can reason about loading and inspection consistently.
+
+## Decision
+
+Provide structured effective-value comparison between successful results of the
+same configuration type. Compare their retained canonical inspection snapshots
+through the root-owned public facade. Each comparison uses the completed load
+state and returns detached records with a semantic path and safe left and right
+value snapshots.
+
+Use canonical value equality and the existing structural comparison rules.
+Mappings compare recursively, sequences report atomic changes, and scalar or
+kind replacements report the affected region. Presence distinguishes additions
+and removals from explicit null. Equal effective values produce an empty diff;
+source attribution, explicit-input status, and history remain separately
+inspectable through each result. Canonical pointer ordering makes reporting
+deterministic.
+
+Detect changes before masking values. Apply sensitivity from both loads to both
+returned sides, including historical and dependency-derived classification.
+Preserve public content where the shapes permit corresponding sensitive regions
+to be identified. When a structural replacement prevents safe correspondence,
+mask the complete reported replacement region on both present sides. Absence
+retains its own representation.
+
+Keep masking and hidden-change information distinct. Each record indicates
+whether an actual change is withheld by redaction, allowing applications to
+display a changed-sensitive-value indicator even when safe snapshots render
+identically. Public-only changes alongside unchanged masked content retain that
+distinction.
+
+Typed secret references participate through their configured environment names.
+Resolved credential bytes remain behind the existing explicit secret accessor.
+The comparison uses the same frozen inspection boundary as effective rendering
+and explanation.
+
+ConfigKit owns comparison and paired safe disclosure. Applications own labels,
+layout, and rendering of the returned changed regions. Reusing the existing
+snapshot representation and engine boundary keeps the extension consistent with
+the library's established inspection model.
+
+## Alternatives considered
+
+- **Compare input text or separately rendered YAML.** Supports familiar textual
+  displays, but input text precedes composition and resolution, and independently
+  redacted output can hide changes or apply different disclosure rules. Canonical
+  comparison with paired masking represents the completed configuration.
+- **Leave comparison to applications using returned Go values.** Offers direct
+  access to application types, but duplicates structural and redaction machinery
+  and observes caller mutation. Retained inspection snapshots preserve the
+  completed load's values and established ownership boundary.
+- **Align sequence elements and return context-rich rendering data.** Enables
+  finer-grained displays, but requires additional correspondence and disclosure
+  rules. Atomic sequence records and existing value snapshots satisfy the
+  selected changed-region workflows with a smaller public model.
+- **Compare resolved credentials or retain credential-derived tokens.** Could
+  detect rotation behind an unchanged reference, but expands retained sensitive
+  state and introduces a separate trusted comparison mechanism. Reference-name
+  comparison preserves the existing inspection boundary.
+
+## Consequences
+
+Applications can compare independently loaded configurations using ConfigKit's
+shared equality, presence, and disclosure rules. Existing composition and load
+semantics continue to determine the values being compared. Caller mutation of a
+returned configuration leaves its retained comparison snapshot unchanged.
+
+Paired redaction can conceal public content within a structurally incompatible
+replacement. The changed region and hidden-change indicator still communicate
+its effective impact. Credential rotation behind an unchanged environment name
+produces equal reference values for comparison.
+
+The implementation requires operation-local disclosure preparation and focused
+coverage for presence, shape changes, historical sensitivity, and detached
+results. Applications retain control of presentation; changed-region records
+supply the safe data needed for that responsibility.

docs/adr/0011-input-destinations.md

@@ -0,0 +1,70 @@
+# ADR 0011: Place Configuration Inputs at Mapping Destinations
+
+## Status
+
+Accepted. The [input-destinations roadmap](../roadmap/input-destinations.md)
+owns implementation status and the [implementation plan](../roadmap/implementation.md)
+owns sequencing and completion evidence.
+
+## Date
+
+2026-10-14
+
+## Context
+
+Consumers assembling collections of independently authored configuration
+fragments need each source to contribute beneath a selected application path.
+Requiring consumers to rewrite source documents or merge completed values would
+separate placement from ConfigKit's existing composition, precedence, source
+identity, and inspection behavior. Placement should remain part of the ordinary
+loading lifecycle and preserve the root-owned public facade.
+
+## Decision
+
+Add an optional `Destination Path` to root-owned `Input` and expose the effective
+destination on existing `SourceInfo` records. The empty path means the existing
+application root. A non-empty destination is a sequence of literal mapping keys;
+explicit sequence-index segments are invalid. Existing reserved structural keys
+remain reserved, while keys that merely contain their spelling remain ordinary
+keys.
+
+Acquire and interpret each source using its original physical identity and
+source-local directives, then place its application body before strict
+composition and the existing final lifecycle. Imported application bodies
+inherit the input destination. Placement applies to main and underlay inputs;
+ordinary root loading, selected overlays, and CLI inputs retain root placement.
+The main-owned version rule continues to check its effective application path
+at its existing lifecycle point.
+
+Placement preserves authored node locations and source identity. Introduced
+mapping structure belongs to the contributing source and uses that document's
+root location as its source-coordinate fallback. A present empty mapping
+materializes its destination; an absent `NoSource` contributes nothing. The
+result continues through the existing strict composition, overlay, inheritance,
+typed loading, diagnostics, provenance, history, sensitivity, and resource
+context mechanisms.
+
+The added exported fields preserve keyed and zero-value struct use. Callers
+using unkeyed composite literals for `Input` or `SourceInfo` must migrate to
+keyed literals. Treat this feature as minor-release work; select the version and
+document the compatibility impact during separately authorized release
+preparation, consistent with the release policy.
+
+## Alternatives considered
+
+- **Rewrite or merge sources in consumers.** This makes each consumer reproduce
+  placement, strict composition, source attribution, and inspection semantics.
+- **Add a separate loading entry point or public wrapper type.** This creates a
+  parallel API for a behavior that belongs to existing per-input loading.
+- **Load each fragment as a complete application before placement.** This runs
+  defaults, decoding, resolution, and validation on incomplete fragments rather
+  than once on the assembled application.
+
+## Consequences
+
+Consumers can assemble contributions at effective mapping paths in one ordinary
+layered load and inspect each source's placement through existing source
+records. Paths, conflicts, and later application operations use the placed
+structure while source coordinates and relative-resource contexts continue to
+identify their original sources. Public field additions require release-note
+guidance for callers using unkeyed literals.

docs/config.md

@@ -149,6 +149,33 @@ have index zero. Explicit empty groups and `NoSource` consume no source ID.
 Byte, source, node, and glob-entry budgets are shared across the load, while
 the existing per-source and import-depth bounds still apply.
 
+#### Input destinations
+
+`Input.Destination` places the source's application mapping beneath a path
+relative to the configuration root. Its zero or empty value means root, so
+existing inputs keep their behavior. Main inputs and underlay inputs use the
+same destination model. Destination segments are literal mapping keys: dots,
+slashes, and numeric-looking text are not split or interpreted as sequence
+indexes. Explicit index segments and paths that introduce the reserved
+`configkit` or mapping-valued `extends` structure are invalid input options and
+produce a structured `LoadError` before source acquisition.
+
+Source-root `configkit.imports` directives are processed before placement, and
+each imported application contribution inherits its input's destination,
+including transitive imports. A valid destination on `NoSource()` contributes
+nothing; an actual empty mapping materializes its destination containers. Once
+placed, contributions follow the same strict composition within a tier and
+recursive precedence behavior described above. A selected overlay and CLI
+overrides remain rooted at the application root and are not moved beneath the
+main input's destination.
+
+`SourceInfo.Destination` reports the placement for each acquired input source,
+including imports. Placement does not change source IDs, acquisition identity,
+physical source locations, or passive resource contexts. Introduced ancestor
+mappings use the contributing document's root location as a source fallback;
+authored content retains its original source coordinates. Returned source
+records are detached copies.
+
 The maintained [layered consumer example](consumers/README.md#native-filesystem-and-layered-input)
 shows a main host file, two underlay tiers, embedded defaults, a mapping source,
 and explicit resource access without a second configuration pass.
@@ -423,6 +450,46 @@ an explicit `LoadSecretsDir` bootstrap, then use `WriteDiagnostics`,
 ConfigKit does not infer bootstrap outcomes from a secret reference and does not
 bundle these independent reports into a command framework.
 
+## Effective configuration diffs
+
+`configkit.Diff(left, right)` compares two completed successful loads of the same
+configuration type. `left` is the earlier state and `right` is the later state.
+Applications load both sides with the sources and options they choose; to inspect
+an overlay's impact, load the same base once without the overlay and once with it
+selected. The [consumer guide](consumers/README.md#effective-configuration-diffs)
+links to maintained examples. The public API returns safe changed-region records;
+applications own their presentation.
+
+Comparison uses the frozen canonical effective inspection values, not mutable
+`Result.Config`, source text, provenance, or history. It does not reopen sources,
+reread environment variables, or rerun defaults or callbacks. Equal effective
+values produce no records even when sources, explicit-input status, defaults, or
+resolution histories differ; for example, explicit zero and defaulted zero are
+equal. Mappings compare recursively, sequences compare atomically, and scalar,
+kind, or null/container replacements report their affected region. Records use
+the existing comparator's canonical pointer ordering. `Present=false` with empty
+YAML means absence; explicit null is present and renders as `null`.
+
+Before either side is returned, sensitivity from both loads is applied to both
+snapshots, including historical and dependency-derived classification. A
+classification on either side protects the corresponding values on both sides.
+`Redacted` reports masking, while `HiddenChanged` reports an actual concealed
+value or presence change; it is not implied merely by redaction. A structural
+replacement that prevents safe correspondence masks the complete reported
+region, and an absent side remains absent. Record membership establishes that a
+change occurred even when safe snapshots render identically. Literal
+marker-looking input is ordinary input; consumers use the record fields rather
+than interpreting marker text.
+
+Typed secret references contribute their configured environment names to the
+frozen comparison, never resolved credential bytes. Credential rotation behind
+an unchanged reference is therefore not detected. The records contain changed
+regions only, not paired full-document context; independently calling
+`WriteEffective` on each result does not create cross-protected context. Nil or
+uninitialized results return an error with no records. A failed `Load` retains
+its normal nil-result/`LoadError` behavior, which callers handle before invoking
+`Diff`.
+
 ## Typed secret references
 
 Credential-bearing fields use the opaque `Secret` type and store an environment

docs/consumers/README.md

@@ -17,7 +17,9 @@ sanitized shapes using only ConfigKit and the Go standard library:
 | Seriatim-like | Independent strict ordered speaker and autocorrect rule files | First-match and ordered replacement algorithms; no central application configuration file |
 | Bundled file | Simple native `fs.FS` source through ordinary `Load` | Selection and lifetime of the application-owned embedded filesystem |
 | Layered catalog | Embedded defaults with an import, a mapping underlay, an independent host main file, explicit false/zero input, and source-relative resource access | Domain validation and opening/interpreting the template resource |
+| Mounted collections | Literal input destinations, peer prompt/profile fragments, local inheritance, imported collection metadata, and a version-only higher-tier override | Collection IDs, profile meaning, and opening/interpreting prompt resources |
 | Named presets | One-load sibling inheritance, explicit false, nested destination resolution, and source/derivation inspection | Choosing and executing a preset |
+| Effective configuration diff | Same-type frozen effective comparisons for two selected files or base-versus-overlay impact | Source/options selection and consumer-owned safe presentation |
 
 The YAML under [`testdata`](../../examples/consumers/testdata) is loaded by the
 executable examples and ordinary tests. It contains no private application data,
@@ -51,6 +53,25 @@ both without redefining their syntax. ConfigKit overlays are configuration overl
 they do not select or replace an application's LLM, model, pipeline, report, or
 execution profile concepts.
 
+## Effective configuration diffs
+
+[`CompareFiles`](../../examples/consumers/diff.go) loads two caller-selected files
+with one application definition, handles each load error, calls `configkit.Diff`,
+and presents the safe records through consumer-owned `FormatDifferences`.
+[`CompareRolloutOverlay`](../../examples/consumers/diff.go) loads the same base
+once without an overlay and once with the selected overlay, so omitted lower
+priority values remain present. Its resolver records a derived endpoint URL after
+overlay application, and its nested typed secret reference is classified before
+the resulting records are presented.
+
+The maintained [behavior tests and executable examples](../../examples/consumers/diff_test.go)
+use temporary files and disposable secret values. Presenters should use
+`ValueSnapshot.Present` for absence, record membership for change, and
+`HiddenChanged` for a withheld change indicator. Do not parse the redaction marker
+or add separately rendered full contexts that lack combined sensitivity. The
+[configuration contract](../config.md#effective-configuration-diffs) owns shared
+equality, granularity, and disclosure semantics.
+
 ## Named sibling inheritance
 
 [`LoadPresets`](../../examples/consumers/inheritance.go) loads the maintained
@@ -88,6 +109,37 @@ and may fail independently of the completed configuration load. The
 [configuration contract](../config.md#source-resource-contexts) owns exact
 lifetime and precedence rules.
 
+## Input destinations and mounted collections
+
+Main and underlay inputs use the same destination field; imported application
+contributions inherit the declaring input's destination. A destination is an
+application mapping path, independent of filesystem context. The configuration
+contract owns the complete behavior and validation rules.
+
+The small [`Example_inputDestination`](../../examples/consumers/destinations_test.go)
+mounts one mapping source beneath literal collection/prompt keys and loads a
+second input without a destination to show that root placement remains the
+default. Consumers pass paths, not filenames or namespace strings for ConfigKit
+to interpret.
+
+[`LoadCollectionBundle`](../../examples/consumers/destinations.go) assembles an
+embedded collection manifest with a source-root import, separate prompt and
+profile peers, and a higher-priority input that changes only one prompt's
+ordinary `version` field. The main document alone supplies the application
+schema version. A prompt's local `extends` relationship resolves after all
+tiers, so `custom` inherits the final `brief` content and fields while retaining
+its own profile selection.
+
+The resolver follows each effective `content_file` origin to its declaring
+source context. This also works for `custom`'s inherited resource. The
+application-owned [`ReadCollectionPromptContent`](../../examples/consumers/destinations.go)
+demonstrates the same lookup after loading; ConfigKit does not open or interpret
+the resource. [`destinations_test.go`](../../examples/consumers/destinations_test.go)
+checks source destinations and authored coordinates, presence, inherited values,
+relative resources, and strict peer conflicts. The
+[configuration contract](../config.md#input-destinations) owns shared placement,
+import, source-location, and ownership behavior.
+
 Known module catalogs should use canonical object entries with a module identifier
 and typed options. A small union struct is sufficient when the available option
 fields are known; validation selects which fields apply to each module. Runtime-
@@ -167,7 +219,9 @@ focused behavioral owner:
 | Canonical module objects and dynamic option handling | WeatherReporter- and Notarius-shaped examples and migration tests |
 | `LoadSecretsDir`, bootstrap reporting, typed lookup, CLI explanation | `Example_weatherStartup` |
 | Native filesystem, grouped underlays, programmatic mapping, retained resource context | `Example_nativeFilesystem`, `Example_layeredCatalog`, and their focused consumer tests |
+| Literal input destinations, root-default compatibility, and mounted peer collections | `Example_inputDestination`, `LoadCollectionBundle`, and `destinations_test.go` |
 | Named sibling inheritance, presence, and derivation | `Example_inheritedPresets` and `TestPresetCatalogOneLoadAndDerivation` |
+| Effective configuration diffs and consumer-owned presentation | `ExampleDiff`, `ExampleCompareFiles`, and `ExampleCompareRolloutOverlay` |
 | Results, metadata, diagnostics, effective output, and writer failures | Focused root-package load, provenance, rendering, and explanation tests |
 
 The package-level import-boundary test covers the consumer examples too: supported

docs/development.md

@@ -39,6 +39,7 @@ public behavior.
 | Task | Read |
 | --- | --- |
 | Repository orientation or component responsibility | [Component overview](internal/overview.md) |
+| Input destinations | [Configuration contract](config.md#input-destinations), [ADR 0011](adr/0011-input-destinations.md), and the destination tests below |
 | Documentation changes | The owning document |
 | Licensing, dependencies, attribution, or release-document changes | [Project grant](../COPYRIGHT) and [attribution](oss/attribution.md); release changes also follow the release procedure |
 | Architecture decisions or future work | [Deferred scope](roadmap/deferred.md) and relevant ADRs listed below |
@@ -54,6 +55,8 @@ Accepted decisions:
 - [Secret references and explicit bootstrap](adr/0004-secret-references-and-explicit-bootstrap.md)
 - [Explicit overrides and safe explanation](adr/0005-explicit-overrides-and-safe-explanation.md)
 - [Keep the public facade root-owned](adr/0006-public-facade.md)
+- [Compare frozen effective configuration snapshots](adr/0010-effective-configuration-diff.md)
+- [Place inputs at literal application mapping paths](adr/0011-input-destinations.md)
 
 For cross-cutting changes, follow every applicable row. Completed implementation
 and remediation plans are preserved in Git history at `cb5b435`; use current
@@ -64,8 +67,9 @@ git show cb5b435:docs/roadmap/remediation.md
 ```
 
 Release-candidate, publication, and verification work follows the operational
-[release procedure](release.md). Its single publication command validates the
-committed candidate and publishes only the intended refs.
+[release procedure](release.md). Its module-selected ReleaseKit `publish`
+invocation validates the committed candidate and publishes only the intended
+tag; those release checks remain distinct from the everyday development check.
 
 The completed string-and-integer schema-version implementation and remediation
 records are preserved in Git history at `244104f`. The
@@ -93,9 +97,27 @@ preserved in Git history at `73ce6e9` under `docs/roadmap/`. Current overlay
 behavior belongs to the [configuration contract](config.md#selected-overlays),
 and release operations belong to the [release procedure](release.md).
 
-Install Go 1.25.0 or a supported patched/newer Go toolchain. Acquire declared
-dependencies explicitly before entering an offline development or validation
-environment:
+The completed ReleaseKit adoption, startup performance request and experiments,
+benchmark evidence, performance audit, implementation plan, and remediation
+record are preserved in Git history at `8e91a2b` under `docs/roadmap/`. For example:
+
+```sh
+git show 8e91a2b:docs/roadmap/startup-benchmark.md
+```
+
+Remaining optimization candidates belong to
+[deferred scope](roadmap/deferred.md#deferred-performance-experiments).
+
+The completed effective-configuration diff roadmap, implementation plan, and
+resolved review findings are preserved in Git history at `1c2610c` under
+`docs/roadmap/`. The
+[configuration contract](config.md#effective-configuration-diffs) owns current
+comparison and disclosure behavior, and
+[ADR 0010](adr/0010-effective-configuration-diff.md) records the decision.
+
+Install the Go version required by `go.mod` or a compatible newer toolchain.
+Acquire declared dependencies explicitly before entering an offline
+development or validation environment:
 
 ```sh
 go mod download
@@ -125,11 +147,10 @@ Use focused checks while iterating, with validation proportionate to the change
 under the testing policy. Documentation-only work normally needs the local-link
 check below and whitespace review; behavior-bearing examples and commands also
 need execution. Use `go test -race ./...` for ownership or concurrency changes.
-The [publication command](release.md#4-publish-the-committed-candidate) invokes
-the release checker once. It performs one minimum-toolchain offline race-suite
-run, one full vet pass, and Linux cross-builds using readonly module mode.
-It already covers examples, links, and package boundaries; do not additionally
-run the everyday checker just to repeat those checks. CI never gates a release.
+The [release procedure](release.md#4-publish-the-committed-candidate) performs
+its selected validation through one `publish` invocation. The everyday checker
+remains a development gate and is not a separate release prerequisite. CI never
+gates a release.
 
 ## Task-to-test map
 
@@ -145,17 +166,19 @@ code changes. Use the component overview to find the corresponding implementatio
 | Composition, selected overlays, CLI precedence | [Composition](../internal/engine/compose_test.go), [overlay](../internal/engine/overlay_test.go), [selected overlays](../internal/engine/selected_overlay_test.go), [overrides](../internal/engine/override_test.go) | `go test ./internal/engine -run 'Compose\|Overlay\|Override'` |
 | Sibling inheritance, provenance, history, sensitivity | [Expansion](../internal/engine/inheritance_test.go), [destination scopes](../internal/engine/inheritance_walk_test.go), [origins](../internal/engine/inheritance_origin_test.go), [history](../internal/engine/inheritance_history_test.go), [secrets](../internal/engine/inheritance_secret_test.go), [public loading](../facade_inheritance_test.go) | `go test ./internal/engine -run 'Inheritance\|Inherited'` and `go test . -run '^TestFacadeInheritance\|^TestFacadeInheritedSecrets'` |
 | Layered loading and source equivalence | [Grouped lifecycle](../internal/engine/load_request_test.go), [layered facade](../facade_layered_test.go), [equivalence](../facade_equivalence_test.go) | `go test ./internal/engine -run '^TestGrouped'`, `go test . -run '^TestFacadeLayered'`, and `go test . -run '^TestEquivalentSourceForms'` |
+| Input destinations, mounted sources, and source ownership | [Destination engine tests](../internal/engine/destination_test.go), [tier and import tests](../internal/engine/destination_tiers_test.go), [integration and provenance tests](../internal/engine/destination_integration_test.go), [public facade tests](../facade_destination_test.go), and [consumer examples](../examples/consumers/destinations_test.go) | `go test ./internal/engine -run 'Destination|Mounted'`, `go test . -run 'Destination|FacadeMounted'`, and `go test ./examples/consumers -run 'CollectionBundle|CollectionPeer'` |
 | Schema, defaults, projection, cloning | [Schema](../internal/engine/schema_test.go), [decoding](../internal/engine/decode_test.go), [projection](../internal/engine/projection_test.go) | `go test ./internal/engine -run 'Schema\|Decode\|Projection\|Clone\|Inline\|CompareDocument'` |
 | Lifecycle, resolution, validation, callback ownership | [Loading](../internal/engine/load_test.go), [resolution](../internal/engine/resolution_test.go), [validation](../internal/engine/validation_test.go), [ownership](../internal/engine/callback_ownership_test.go), [independence](../internal/engine/independence_test.go) | `go test ./internal/engine -run 'Load\|Resolution\|Validation\|Validator\|Hook\|Callback\|Parallel'` |
 | Paths, metadata, provenance | [Paths](../internal/engine/path_test.go), [metadata](../internal/engine/metadata_test.go), [provenance](../internal/engine/provenance_test.go) | `go test ./internal/engine -run 'Path\|Metadata\|Provenance\|Queries'` |
 | Passive resource contexts | [Engine contexts](../internal/engine/resource_context_test.go), [public contexts](../facade_resource_context_test.go) | `go test ./internal/engine -run 'Resource'` and `go test . -run 'SourceContext'` |
 | Secrets, bootstrap, redaction, explanation | [References](../internal/engine/secret_reference_test.go), [bootstrap](../internal/engine/secrets_test.go), [rendering](../internal/engine/render_test.go), [explanation](../internal/engine/explain_test.go) | `go test ./internal/engine -run 'Secret\|Bootstrap\|Effective\|Explain\|Explanation\|History\|Sensitivity'` |
+| Effective configuration diff | [Engine comparison and masking tests](../internal/engine/diff_test.go), [engine operation tests](../internal/engine/diff_operation_test.go), [root facade tests](../facade_diff_test.go), and [consumer examples](../examples/consumers/diff_test.go) | `go test ./internal/engine -run 'Diff|Explain|History|Secret|Independent'`, `go test . -run 'Diff|FacadeInspection|PublicFacadeBoundary|DependencyImportBoundary'`, `go test ./examples/consumers`, and `go test . -run '^ExampleDiff$'` |
 | Consumer examples and migration fixtures | [Consumer tests](../examples/consumers/consumers_test.go), [native and layered examples](../examples/consumers/layered_test.go), [API examples](../example_test.go) | `go test ./examples/consumers` and `go test . -run '^Example'` |
 | Assembly and layered scaling evidence | [Assembly benchmarks](../internal/engine/assembly_bench_test.go), [layered benchmarks](../internal/engine/underlay_bench_test.go) | `go test ./internal/engine -run '^$' -bench '^BenchmarkUnderlay' -benchmem`; repeat with `^BenchmarkCompose` and `^BenchmarkOverlay` |
 | Inheritance scaling evidence | [Expansion benchmarks](../internal/engine/inheritance_bench_test.go) | `go test ./internal/engine -run '^$' -bench '^BenchmarkInheritance' -benchmem` |
 | Documentation links and dependency isolation | [Link checks](../documentation_test.go), [import boundary](../import_boundary_test.go), [public boundary](../public_boundary_test.go) | `go test . -run 'TestLocalDocumentationLinks\|TestDependencyImportBoundary\|TestPublicFacadeBoundary'` |
-| Development and release checker behavior | [Shell regression](../release_check_test.go) | `go test . -run 'TestCheckScripts\|TestDevelopmentCheck'` |
-| Guarded release publication and recovery | [Publication regression](../release_publish_test.go) | `go test . -run '^TestReleasePublication'` |
+| Development check behavior | [Development checker test](../development_check_test.go) | `go test . -run '^TestDevelopmentCheckHandlesFilenamesAndStopsOnFailure$'` |
+| Release profile wiring | [Release profile test](../releasekit_profile_test.go) | `go test . -run '^TestReleaseKitProfile$'` |
 
 ## Fuzz validation
 

docs/internal/overview.md

@@ -8,11 +8,14 @@ private state; public signatures and fields do not expose engine types.
 Implemented component owners:
 
 - `internal/engine` owns host and native-filesystem source acquisition,
-  grouped strict composition, recursive precedence assembly, and destination-local
-  sibling inheritance before typed decoding. It also owns schema
+  grouped strict composition, recursive precedence assembly, per-input mapping
+  placement within that assembly, and destination-local sibling inheritance
+  before typed decoding. It retains source placement alongside physical source
+  identity and owns schema
   inspection, lifecycle coordination, callback auditing,
   provenance/history, passive source-context retention, secret resolution and
-  bootstrap, and safe inspection rendering. It never imports the root package.
+  bootstrap, safe inspection rendering, and effective-value comparison over
+  frozen inspection snapshots. It never imports the root package.
 - Root `Source`, `Filesystem`, `Input`, `Underlay`, `Path`, `Secret`, records,
   lifecycle callbacks, results, and bootstrap reports are root-defined wrappers
   or records. Callback wrappers pass only live engine context during a callback;
@@ -21,6 +24,9 @@ Implemented component owners:
 - Root conversion files explicitly cross the path, record, callback, secret, and
   error boundaries. There are no public aliases, anonymous engine embeddings, or
   public engine bridge methods.
+- Root `Diff` and `Difference` provide the public comparison boundary and
+  convert detached engine records to root-owned paths and snapshots; consumer
+  examples own presentation of the safe changed regions.
 - `internal/document` owns the parser-independent ordered tree and cloning.
   `internal/yaml` is the sole upstream YAML adapter and parser/dumper boundary.
 - Engine mechanism tests own source, composition, inheritance, decoding,
@@ -37,9 +43,13 @@ these constraints and rejects exported aliases, fields, or signatures involving
 internal types.
 
 The [configuration contract](../config.md) owns implemented YAML and lifecycle
-semantics. The [consumer adoption guide](../consumers/README.md) owns application
-guidance. The [architecture policy](../policy/architecture.md) owns contributor
-boundaries, and [ADR 0006](../adr/0006-public-facade.md) records the facade
+semantics, including [input destinations](../config.md#input-destinations) and
+[effective configuration diffs](../config.md#effective-configuration-diffs).
+The [consumer adoption guide](../consumers/README.md) owns application guidance.
+The [architecture policy](../policy/architecture.md) owns contributor
+boundaries; [ADR 0006](../adr/0006-public-facade.md) records the facade decision
+and [ADR 0010](../adr/0010-effective-configuration-diff.md) records the diff
+decision; [ADR 0011](../adr/0011-input-destinations.md) records the placement
 decision. See the [development guide](../development.md) for validation commands
 and [release procedure](../release.md) for source-candidate gates. [ADR
 0009](../adr/0009-sibling-inheritance.md) records why inheritance is a built-in

docs/oss/attribution.md

@@ -2,11 +2,12 @@
 
 ## Standard Repository Policies
 
-Material: `docs/policy/meta.md`, `docs/policy/oss.md`,
+Material: `docs/policy/release.md`, adapted from
+`e833faddf120c789a9b45348edaf75720de16348`; `docs/policy/meta.md`, `docs/policy/oss.md`,
 `docs/policy/documentation.md`, `docs/policy/agents.md`,
-`docs/policy/architecture.md`, `docs/policy/testing.md`, and
-`docs/policy/release.md`; root `AGENTS.md`; and the Policy Reading Guide in
-`docs/development.md`, adapted for this repository.
+`docs/policy/architecture.md`, `docs/policy/testing.md`; root `AGENTS.md`; and the
+Policy Reading Guide in `docs/development.md`, adapted from
+`d84a38ebab26f048cafbe59a2246700c35d29843` for this repository.
 
 Copyright (C) 2026 Eric Rakestraw
 
@@ -14,10 +15,14 @@ SPDX-License-Identifier: CC-BY-SA-4.0
 
 License and notices: [CC BY-SA 4.0](licenses/CC-BY-SA-4.0.txt) |
 [COPYRIGHT](https://gitea.maximumdirect.net/eric/policy/src/commit/d84a38ebab26f048cafbe59a2246700c35d29843/COPYRIGHT) |
-[LICENSE](https://gitea.maximumdirect.net/eric/policy/src/commit/d84a38ebab26f048cafbe59a2246700c35d29843/LICENSE).
+[LICENSE](https://gitea.maximumdirect.net/eric/policy/src/commit/d84a38ebab26f048cafbe59a2246700c35d29843/LICENSE) |
+[COPYRIGHT](https://gitea.maximumdirect.net/eric/policy/src/commit/e833faddf120c789a9b45348edaf75720de16348/COPYRIGHT) |
+[LICENSE](https://gitea.maximumdirect.net/eric/policy/src/commit/e833faddf120c789a9b45348edaf75720de16348/LICENSE).
 
 [Source](https://gitea.maximumdirect.net/eric/policy/src/commit/d84a38ebab26f048cafbe59a2246700c35d29843).
 
+[Source](https://gitea.maximumdirect.net/eric/policy/src/commit/e833faddf120c789a9b45348edaf75720de16348).
+
 ## go-yaml v4
 
 Selected module: `go.yaml.in/yaml/v4` at `v4.0.0-rc.6`.

docs/policy/architecture.md

@@ -99,6 +99,13 @@ types, field meanings, defaults, normalization, semantic validation, and schema
 version policy. Applications also own main-file search conventions, CLI wiring,
 remote acquisition, runtime initialization, and resource checks.
 
+The engine applies each input's mapping destination within the existing source
+assembly and retains that placement with source identity and inspection records;
+the root facade owns the public fields and conversions. The
+[configuration contract](../config.md#input-destinations) defines the observable
+placement behavior, and [ADR 0011](../adr/0011-input-destinations.md) records the
+accepted decision.
+
 Library code must not depend on consuming applications or initialize their
 runtime resources. It must not perform implicit network access, discover
 application-specific paths, or change process-global state during ordinary `Load`.
@@ -201,6 +208,13 @@ See [ADR 0005](../adr/0005-explicit-overrides-and-safe-explanation.md).
 Detailed syntax and operation tables belong to the
 [current configuration contract](../config.md).
 
+The frozen inspection boundary also supports comparing completed same-type
+results without reopening sources or rerunning the load lifecycle. The
+[configuration contract](../config.md#effective-configuration-diffs) owns
+comparison and disclosure behavior, the [component overview](../internal/overview.md)
+owns implementation responsibility, and [ADR 0010](../adr/0010-effective-configuration-diff.md)
+records the accepted decision.
+
 ## Ownership And Confidentiality
 
 Returned configuration and metadata must not share mutable state across loads.

docs/policy/release.md

@@ -1,10 +1,10 @@
 # Release Policy
 
-**Base Policy Version:** 1.4
+**Base Policy Version:** 1.6
 
-**Last Updated**: 2026-09-28
+**Last Updated**: 2026-10-09
 
-**Upstream Source:** [Standard Repository Policies](https://gitea.maximumdirect.net/eric/policy/src/commit/d84a38ebab26f048cafbe59a2246700c35d29843/docs/policy/release.md)
+**Upstream Source:** [Standard Repository Policies](https://gitea.maximumdirect.net/eric/policy/src/commit/e833faddf120c789a9b45348edaf75720de16348/docs/policy/release.md)
 
 ## Purpose
 
@@ -12,6 +12,9 @@ This policy defines a proportionate workflow for validating and publishing an
 intended source revision under a fresh version. Releases should require little
 routine intervention, avoid repeated work, and preserve published contents.
 
+Adopt stronger verification or reproducibility requirements through an explicit
+project-specific decision justified by the intended audience and support needs.
+
 The repository-specific commands belong in `docs/release.md`. Historical release
 summaries belong in `docs/releases/`. The procedure must agree with the adopted
 policy and link to it rather than introduce additional release requirements.
@@ -54,10 +57,11 @@ authoritative primary branch, completes the release. The source commit may be
 pushed before the tag or published together with it through an atomic push.
 The procedure must choose and document the supported approach.
 
-ConfigKit uses sequential explicit pushes: first the captured candidate to
-authoritative `main`, then the annotated tag. Its
-[release procedure](../release.md) names `origin` and checks that its fetch and
-push destinations resolve to the authoritative URL.
+ConfigKit uses sequential publication: first push the committed candidate to
+authoritative `main`, then invoke ReleaseKit once to validate that candidate and
+publish its annotated tag. The [release procedure](../release.md) names
+`origin`; ReleaseKit checks its exact effective push URL before validation and
+tag publication.
 
 Release commands must finish at successful publication. They must not wait for
 or poll CI, require successful CI status, inspect downloadable artifacts, or
@@ -76,8 +80,9 @@ the tagged source. The procedure must identify those deliverables and the
 responsibility of their automation. Published deliverables must be traceable
 to that source and identify the same version.
 
-ConfigKit currently declares no additional deliverables. Its source-tag push
-is the completion point.
+ConfigKit currently declares no additional deliverables. Confirmed publication
+of the intended source tag is the completion point. CI, macOS validation,
+hosted delivery, and consumer retrieval are outside the release gates.
 
 ## Versioning And Compatibility
 
@@ -96,7 +101,8 @@ requires a deliberate update to the policy and procedure where needed.
 For releases at or after `v1.0.0`:
 
 - a major release may make intentional incompatible changes;
-- a minor release may add backward-compatible behavior; and
+- a minor release may add backward-compatible behavior or raise the Go consumer
+  minimum as described below; and
 - a patch release may make backward-compatible fixes.
 
 Before `v1.0.0`, a minor release may change a documented public, operational,
@@ -108,13 +114,53 @@ Additional compatibility promises and deliberate exceptions belong in the
 adopted policy or canonical contract documentation. Release notes explain
 changes; they do not redefine current compatibility contracts.
 
+## Consumer Minimum And Release Toolchain
+
+Distinguish the minimum toolchain supported for consumers from the toolchain
+maintainers use to build and validate a release. Record the consumer minimum in
+the language's standard metadata and explain its support meaning in canonical
+documentation. Define the selected release toolchain and its setup commands in
+`docs/release.md`. Toolchain selection and upgrade cadence are repository-specific
+choices.
+
+For Go repositories, normally declare the initial stable release of the selected
+series as the consumer minimum, such as `go 1.26.0`. Use a higher patch minimum
+when a dependency or an identified correctness fix requires it, and document
+the reason.
+
+For release-policy purposes, successful build and release validation on the
+selected Go patch release are sufficient to presume support across that Go
+series, subject to the declared consumer minimum and concrete evidence of
+incompatibility. Investigate specific compatibility concerns as they arise.
+
+Use the selected release toolchain for candidate validation and release builds,
+including CI jobs performing those tasks. A newer validation patch version alone
+leaves the consumer minimum unchanged.
+
+A minor release may raise the Go consumer minimum, including from one Go series
+to the next, both before and after `v1.0.0`. This is an explicit exception to the
+backward-compatibility requirement for minor releases. Patch releases preserve
+the consumer minimum. Explain an increase's impact and required consumer action
+in the release note. Other incompatible changes remain subject to the versioning
+rules above.
+
+### ConfigKit Toolchain Selection
+
+For minor and major releases, select the newest stable Go series available in
+the development environment. For patch releases, retain the series recorded in
+`go.mod` and its consumer minimum. Use the latest locally available compatible
+patch in the selected series, with `GOTOOLCHAIN=local`, to build the
+module-selected ReleaseKit CLI and validate the candidate. The same Go
+executable builds the tool and runs its validation commands.
+
 ## Release Documentation And Preparation
 
 Every new release must include `docs/releases/<version>.md` in the tagged
 source tree. Use the complete version tag as the filename and begin with a
 title containing the product name and that exact version.
 
-ConfigKit requires the first line `# ConfigKit <version>`.
+ConfigKit requires the first line `# ConfigKit <version>`. ReleaseKit's
+publication guard checks the release-note H1 for the product and version.
 
 Include a short summary and any relevant compatibility impact or upgrade
 instructions. Choose sections suited to the release and keep the note
@@ -146,10 +192,9 @@ checks publication state, and publishes the intended refs. A validation-only
 mode or command may be provided for diagnosis, but must not be a required step
 before publication repeats the same checks.
 
-ConfigKit uses `./scripts/release.sh vMAJOR.MINOR.PATCH`. The separate
-`scripts/release-check.sh` remains an optional diagnostic command; the
-publication command invokes it once and does not use a persistent candidate
-record.
+ConfigKit uses the module-selected ReleaseKit CLI's `publish
+vMAJOR.MINOR.PATCH` command. Its `check` command is optional for diagnosis; it
+is not a required preliminary pass to publication.
 
 Run the complete deterministic, offline default test suite once for the final
 candidate, following the [testing policy](testing.md). For repositories that
@@ -157,13 +202,17 @@ publish builds, verify the required build targets. Select those targets for
 the application's actual support commitments; native testing on each platform
 and access to particular hardware are not default release prerequisites.
 
-ConfigKit's one maintained Go 1.25 baseline runs the full suite with the race
-detector and test-time vet disabled. This protects library behavior, ownership,
-and concurrent use; the suite already includes examples, consumer fixtures,
-documentation links, and package boundaries. One full vet pass adds static
-checks beyond the test-time subset. CGO-disabled Linux amd64 and arm64 builds
-cover supported configurations distinct from native race compilation. macOS
-and newer-toolchain checks are optional.
+Prepare dependencies and build the tool before offline validation; the
+publication command is the required validation run, with no separate successful
+test or CI run required before it.
+
+The selected profile runs the complete deterministic, offline default suite
+once with the race detector and test-time vet disabled. The suite already
+includes examples, consumer fixtures, documentation links, and package
+boundaries. One full vet pass adds static checks beyond the test-time subset.
+CGO-disabled Linux amd64 and arm64 package compilation covers supported
+configurations distinct from native race compilation. macOS and newer-toolchain
+checks are optional.
 
 Additional gates must address a concrete risk that the existing checks do not
 adequately cover. Do not automatically require linting, race testing, module
@@ -172,9 +221,10 @@ expanded platform matrices solely because they are possible. Retain such
 checks when their distinct protection justifies their cost. A one-time migration
 check must not silently become a permanent release requirement.
 
-The selected Go commands use readonly module mode with `GOPROXY=off`; acquire
-the baseline toolchain and dependencies before validation. Formatting and
-whitespace remain ordinary development checks in `scripts/check.sh`.
+ReleaseKit runs its selected Go commands with readonly module mode and
+`GOPROXY=off`; acquire dependencies and build the tool before candidate
+validation. Formatting and whitespace remain ordinary development checks in
+`scripts/check.sh`.
 Review module tidiness when dependencies change, not as a release gate.
 
 Release tests must not require real credentials, mutable application services,
@@ -206,16 +256,19 @@ Automate the checks needed to publish the intended source under a fresh version:
   authoritative remote;
 - the worktree and index are clean on the primary release branch;
 - the source being published is the exact candidate that passed validation,
-  including its matching release note;
+  including its matching release note H1;
 - the remote primary branch can be advanced to that candidate without
   discarding remote history, and is published before the tag; and
 - the tag identifies the validated candidate and only the intended refs are
   published.
 
-ConfigKit also checks that `origin` has exactly the authoritative fetch and
-push destination, including configured push URLs. The command checks the
-candidate and unused version again after validation, and checks local state
-before creating the tag. Ignored local files do not block publication.
+ReleaseKit checks that `origin`'s effective push URL exactly matches the
+authoritative URL before candidate validation. This does not assert the
+configured fetch URL or require the release-note H1 to be the first line; the
+required `# ConfigKit <version>` first-line format remains a content rule. The
+command checks the candidate and unused version again after validation, and
+checks local state before creating the tag. Ignored local files do not block
+publication.
 
 Fetch the authoritative branch and tag state as needed for these checks.
 Do not force branch or tag updates to bypass a failed guard. Publish explicit
@@ -248,10 +301,10 @@ release without replacing its contents or reusing its version.
 ## Repository Release Procedure
 
 Maintain `docs/release.md` as a short, executable maintainer runbook. It must
-identify prerequisites, the primary branch and authoritative remote, version
-and note preparation, one publication command with local checks and guards,
-source-only deliverables, the successful-tag-push completion point, and
-partial or unknown-state recovery.
+identify prerequisites, the selected release toolchain, the primary branch and
+authoritative remote, version and note preparation, one publication command with
+local checks and guards, source-only deliverables, the successful-tag-push
+completion point, and partial or unknown-state recovery.
 
 Use copyable commands where practical. Keep optional diagnostics and consumer
 verification clearly optional. The procedure must not turn preparation work,

docs/release.md

@@ -1,7 +1,7 @@
 # ConfigKit Release Procedure
 
 This is the maintainer runbook for ConfigKit's [release policy](policy/release.md).
-ConfigKit publishes one source-only Go module. The immutable annotated tag and
+ConfigKit publishes a source-only Go module. The immutable annotated tag and
 matching checked-in release note are the deliverables; there is no binary,
 container image, generated package, or separate registry publication.
 
@@ -9,183 +9,221 @@ container image, generated package, or separate registry publication.
 
 - Module: `gitea.maximumdirect.net/eric/ConfigKit`
 - Primary branch: `main`
-- Authoritative remote: `origin`, with fetch and push destination
-  `https://gitea.maximumdirect.net/eric/ConfigKit.git`
+- Authoritative remote: `origin`
+- Authoritative push URL: `https://gitea.maximumdirect.net/eric/ConfigKit.git`
 - Tags: stable Semantic Versions such as `v0.5.0`; no prereleases
-- Minimum Go line: Go 1.25, validated with one maintained patch
+- Minimum Go version: the first stable patch of the selected Go series, or a
+  higher patch when required by a dependency or specific correctness fix, as
+  recorded in `go.mod`; see the
+  [consumer minimum policy](policy/release.md#consumer-minimum-and-release-toolchain)
 - Release-gated targets: Linux amd64 and arm64
 - Best-effort targets: macOS amd64 and arm64, under the
   [platform support policy](policy/release.md#platform-support)
 
-The checker runs one offline race suite, one full vet pass, and CGO-disabled
-builds for both Linux targets. It reports skipped filesystem cases. macOS checks
-and newer-toolchain tests are optional. CI is never a readiness or completion
-gate; do not wait for or poll it.
+Release validation runs one offline race-enabled Go suite, one full vet pass,
+and CGO-disabled package compilation for both Linux targets. macOS and CI are
+not release gates; do not wait for or poll CI.
 
-## 1. Prepare access and tools
+## 1. Select Go and prepare the tool
 
-Use a clean checkout with Git, Bash 3.2 or newer, a maintained Go 1.25 patch,
-and a native compiler for race tests. Configure private-host access through the
-normal credential manager. Keep credentials and environment dumps outside the
-repository and command transcript.
+Use a clean checkout with Git, Bash 3.2 or newer, and a native compiler for race
+tests. Choose the release type before selecting Go. For a minor or major release,
+select the newest stable Go series available in the development environment.
+For a patch release, retain the series recorded in `go.mod` and leave its consumer
+minimum unchanged. Follow the
+[toolchain selection policy](policy/release.md#configkit-toolchain-selection).
 
-Verify access without displaying credentials:
+Put the selected series' latest locally available compatible patch first on
+`PATH`, ensuring it meets `go.mod`'s minimum. The same `go` executable must build
+ReleaseKit and run its child validation commands. Set local toolchain selection
+and verify it:
 
 ```sh
-git remote get-url origin
-git ls-remote origin HEAD
+export GOTOOLCHAIN=local
+go version
+go env GOVERSION
+command -v go
 ```
 
-The fetch URL and all configured push destinations must resolve to the
-authoritative URL above. The publication command checks this again. Acquire the
-selected toolchain and dependencies explicitly before offline validation:
+Only when a minor or major release advances the consumer minimum to a newer Go
+series, derive that series' initial stable release from the selected executable:
 
 ```sh
-export CONFIGKIT_BASELINE_TOOLCHAIN=go1.25.14
-GOTOOLCHAIN="$CONFIGKIT_BASELINE_TOOLCHAIN" go version
-GOTOOLCHAIN="$CONFIGKIT_BASELINE_TOOLCHAIN" go mod download
+selected_go=$(GOTOOLCHAIN=local go env GOVERSION)
+selected_series=${selected_go#go}
+selected_series=${selected_series%.*}
+release_minimum="$selected_series.0"
+go mod edit -go="$release_minimum"
 ```
 
-A maintained patch may replace the example pin. No per-release latest-version
-survey is required. Dependencies must be cached; the checker sets `GOPROXY=off`.
-Publication requires user authorization. Standing authorization for local
-commits does not authorize a push or release.
+If a dependency or identified correctness fix requires a higher patch minimum,
+use that required version instead and document the reason. When the series is
+unchanged, leave the minimum unchanged unless a minor or major release
+deliberately changes it under the
+[consumer minimum policy](policy/release.md#consumer-minimum-and-release-toolchain).
+For example, validating with Go 1.26.8 leaves `go 1.26.0` unchanged. There is no
+separate requirement to validate with Go 1.26.0.
 
-## 2. Select the version and review compatibility
+Prepare dependencies whether or not the minimum changes:
 
-Choose an unused stable version. Compare the candidate with the previous tag.
-Review exported Go signatures and ownership, YAML and scalar semantics,
-precedence, diagnostic codes, minimum Go version, and platform support. A
-signature-preserving change may still affect consumers. Before `v1.0.0`,
-intentional incompatible minor-release changes need a note explaining impact
-and consumer action; patch releases remain compatible within their minor line.
-Review the maintained consumer examples and migration guide.
+```sh
+go mod download
+```
 
-When dependencies change, review parser behavior and migration impact as part
-of that change. Module tidiness belongs to dependency-change review, not the
-release checker. Do not repeat a dependency-version survey for every release.
+Build the tool selected by `go.mod` into temporary storage outside the checkout.
+Ensure `$TMPDIR` names a system temporary location, not the repository. These
+commands never install another ReleaseKit version:
 
-## 3. Write and commit the release note
+```sh
+releasekit_tmp=$(mktemp -d "${TMPDIR:-/tmp}/configkit-releasekit.XXXXXX")
+releasekit_bin="$releasekit_tmp/releasekit"
+go build -o "$releasekit_bin" gitea.maximumdirect.net/eric/ReleaseKit/cmd/releasekit
+go list -m gitea.maximumdirect.net/eric/ReleaseKit
+"$releasekit_bin" version
+```
 
-Create `docs/releases/<version>.md` for the selected version. Its first line
-must be `# ConfigKit <version>`. Give a meaningful summary and include
-compatibility impact or upgrade instructions when applicable. Link to current
-contracts for exact behavior. Review the note and affected canonical documents
-as ordinary preparation, then commit the complete candidate.
+The module-selected executable is ReleaseKit v0.4.1. Use the built executable
+for publication to preserve its exit status and publication-state diagnostics.
+`go run` maps a nonzero child exit status to 1. ReleaseKit's child Go commands
+use the `go` found on `PATH` with `GOTOOLCHAIN=local`; keep the selected
+executable first on `PATH` through the publication command.
 
-End every new note with these links, replacing `VERSION` with the complete tag:
+Verify access to the authoritative remote without displaying credentials:
+
+```sh
+git ls-remote https://gitea.maximumdirect.net/eric/ConfigKit.git HEAD refs/heads/main
+```
+
+Publication requires explicit authorization. Local implementation commits do
+not authorize a push or release.
+
+## 2. Prepare and commit the candidate
+
+Choose an unused stable version locally and on the authoritative remote. Compare
+the candidate with the previous tag and review exported Go signatures and
+ownership, YAML and resolution semantics, diagnostic contracts, minimum Go
+version, and platform support. Review maintained consumer examples and the
+migration guidance. Explain any consumer-minimum increase and required consumer
+action under the
+[consumer minimum policy](policy/release.md#consumer-minimum-and-release-toolchain).
+
+Create `docs/releases/<version>.md`. Its first line must be exactly
+`# ConfigKit <version>`, and it must end with the license and attribution footer:
 
 ```markdown
 [COPYRIGHT](https://gitea.maximumdirect.net/eric/ConfigKit/src/tag/VERSION/COPYRIGHT) | [LICENSE](https://gitea.maximumdirect.net/eric/ConfigKit/src/tag/VERSION/LICENSE) | [ATTRIBUTION](https://gitea.maximumdirect.net/eric/ConfigKit/src/tag/VERSION/docs/oss/attribution.md)
 ```
 
-Confirm the three target files exist in the candidate and review the version in
-the URLs. The future tag need not resolve remotely yet; this review adds no
-network gate. ConfigKit uses checked-in notes without hosted release objects.
-If a hosted page is used later, reuse the note and preserve its footer. Do not
-rewrite historical notes or add downloadable license assets.
+Replace `VERSION` with the full tag and confirm the three target files exist in
+the candidate. Retire completed roadmaps, preserve unfinished and deferred
+work, and repair affected links. Review the complete candidate for unintended
+files and credentials, then commit it on `main`. These are ordinary preparation
+tasks, not separate approval gates. Any `go.mod` change belongs in this
+candidate.
+
+## 3. Push the candidate to `main`
+
+Push only that committed candidate to the literal authoritative URL. This does
+not follow local tags:
+
+```sh
+git push --no-follow-tags https://gitea.maximumdirect.net/eric/ConfigKit.git HEAD:refs/heads/main
+```
+
+ReleaseKit requires authoritative `main` to equal this candidate before it
+validates. A failure before this push means ReleaseKit publication has not
+started. If the push result is uncertain, inspect authoritative `main` and
+continue only when it is confirmed at the candidate. If validation later fails,
+no release tag is published; correct the issue in a new commit, push the new
+candidate to `main`, and invoke validation again.
 
 ## 4. Publish the committed candidate
 
-Before publication, review compatibility, release-note accuracy, and the file
-list for unintended content or credentials. Retire completed roadmaps as part of
-release preparation, preserving unfinished and deferred work and repairing
-links. These are ordinary preparation tasks, not separate human sign-offs.
-
-With the release explicitly authorized, run the one publication command.
-The script resolves the repository root from its own path, so it may be invoked
-from another directory by using its path there. Replace the sample version with
-the selected version:
+With the authorized candidate already on authoritative `main`, invoke the
+module-selected native executable exactly once:
 
 ```sh
-./scripts/release.sh v0.5.0
+"$releasekit_bin" publish vMAJOR.MINOR.PATCH
 ```
 
-The command requires `main`, a clean index/worktree, an unused version locally
-and on the authoritative remote, and a matching note in the captured commit.
-Ignored local files do not block it. It checks remote ancestry, runs
-[`release-check.sh`](../scripts/release-check.sh) once against that commit,
-rechecks candidate and version state, pushes only that commit to `main`, then
-creates and pushes one annotated tag. The tag message is the checked-in note.
-It never commits or repairs the checkout.
-
-A successful intended tag push completes publication. The command reports the
-version and commit immediately. No CI, module retrieval, remote read-back, or
-hosted release object is required. The checker may be run separately for
-diagnosis, but it is not a prerequisite: a fresh publication invocation
-validates its candidate once.
-
-## 5. Recover from a failed or uncertain push
-
-The command performs one bounded authoritative-state check after a failed push.
-If the main push failed but authoritative main equals the candidate, it proceeds.
-If the tag push failed but its exact tag object reached the remote, it reports
-success. Otherwise it reports branch-only, conflicting, or unknown state and
-retains any local tag.
-
-Inspect exact refs before any retry. Set `release_version` to the attempted
-version and compare main with the candidate from the command's report:
+Replace the placeholder with the selected version. ReleaseKit checks the
+effective push URL against `expected_push_url`, verifies the candidate on
+`main`, and checks the release-note H1 for the product and version. It then
+runs the selected race-enabled standard suite once with test-time vet disabled,
+one full vet pass, and CGO-disabled package compilation for Linux amd64 and
+arm64. It publishes only the annotated tag for that candidate. Confirmed
+publication of the intended tag completes the release. The tag points to the
+captured commit and uses the complete checked-in note as its annotation message.
+The optional `check`
+command is available for diagnosis but is not a separate required pass:
 
 ```sh
-release_version=v0.5.0
-authoritative=https://gitea.maximumdirect.net/eric/ConfigKit.git
-if remote_main=$(git ls-remote --refs --exit-code "$authoritative" refs/heads/main); then
-  printf 'remote main: %s\n' "$remote_main"
-else
-  result=$?
-  if [ "$result" -eq 2 ]; then
-    printf 'authoritative main confirmed absent\n' >&2
-  else
-    printf 'remote main state unknown; inspect before retrying\n' >&2
-  fi
-fi
-ref="refs/tags/$release_version"
-if remote_tag=$(git ls-remote --refs --exit-code "$authoritative" "$ref"); then
-  printf 'remote tag: %s\n' "$remote_tag"
-else
-  result=$?
-  if [ "$result" -eq 2 ]; then
-    printf 'remote tag confirmed absent\n'
-  else
-    printf 'remote tag state unknown; do not reuse the version\n' >&2
-  fi
-fi
-if local_tag=$(git rev-parse --verify "refs/tags/$release_version" 2>/dev/null); then
-  printf 'local tag object: %s\n' "$local_tag"
-else
-  printf 'no local tag object\n'
-fi
+"$releasekit_bin" check vMAJOR.MINOR.PATCH
 ```
 
-A query failure is not proof that the tag is absent. Compare the remote tag
-object ID with the local annotated tag object ID; its peeled commit alone is
-insufficient to establish identical publication. A conflicting published tag
-must not be moved or replaced. If remote main advanced but the tag was not
-published, report that partial progress. Only after confirming the local tag
-was never published or used by another channel may a maintainer remove it:
+Status 0 confirms publication, status 1 reports a known publication failure or
+conflict, status 2 reports usage, profile, or version errors, and status 3 means
+the push outcome remains unknown. Preserve both the native exit status and its
+diagnostics.
+
+The command does not push or repair `main`, wait for CI, or publish binaries or
+a hosted release page. A successful intended-tag publication does not require
+remote read-back or consumer retrieval; those checks remain optional.
+
+## 5. Recover from a failed or uncertain tag push
+
+The executable reports the publication state, phase, version, candidate commit,
+tag-object ID, effective endpoint, and error on standard error. It performs one
+bounded authoritative reconciliation after a failed tag push. Exit status 3
+means the tag outcome remains unknown; do not blindly retry or move a tag.
+
+For an uncertain result, use the exact endpoint, candidate commit, version, and
+tag-object ID from the report. Copy the captured endpoint into the variable
+below using normal shell quoting. Check that Git still resolves it to itself,
+then query the authoritative refs once:
+
+```sh
+authoritative='COPY_CAPTURED_ENDPOINT'
+release_version='vMAJOR.MINOR.PATCH'
+test "$(git ls-remote --get-url -- "$authoritative")" = "$authoritative" &&
+  git ls-remote --refs -- "$authoritative" refs/heads/main "refs/tags/$release_version"
+```
+
+A failed URL-equality check or remote query leaves the outcome unresolved.
+Correct transport configuration before continuing; a rewritten destination
+cannot establish absence at the captured endpoint.
+
+Compare the `main` object ID with the reported candidate commit and the tag
+object ID with the reported tag-object ID. `--refs` returns the annotated tag
+object itself, not merely its peeled commit. If the tag object matches, the
+release is published. If the query fails, the result is conflicting, or the
+endpoint or candidate differs, stop and resolve the state before retrying. If
+the endpoint is reachable, the tag is confirmed absent, and `main` still equals
+the reported candidate, remove a retained local tag only after confirming it
+was not published or used by another channel; then rerun `publish`, which
+revalidates the candidate:
 
 ```sh
 git tag -d "$release_version"
+"$releasekit_bin" publish "$release_version"
 ```
 
-A subsequent invocation revalidates the candidate; a correctly published tag
-needs no rerun. Do not roll back main or automatically delete a tag. Transport
-or authentication failure alone does not require a new version. A defect in
-published source requires a corrected commit, a new semantically appropriate
-version and note, and the release procedure again.
+A validation failure after the candidate reached `main` leaves an untagged
+candidate there. Correct it with a new commit rather than rewriting or rolling
+back `main`. A conflicting published tag must never be moved or reused. A
+defect in published source requires a corrected commit, a new semantically
+appropriate version, and a matching release note.
 
 ## 6. Optional consumer verification
 
-Only when useful or requested, read back the remote tag or retrieve the exact
-version into a new module without a local `replace` directive. These checks
-are optional and non-gating. Do not poll CI or wait for module propagation.
-Private-host credentials must already be configured. For direct-origin
-verification, set the version to the release just published (replace the sample
-below), then use a temporary consumer module and check the exact module path
-and version reported by `go list -m`:
+When useful or requested, read back the remote tag or retrieve the exact
+version into a new module without a local `replace` directive. These checks are
+optional and non-gating. Do not poll CI or wait for module propagation. For
+direct-origin verification, use the exact published version in a temporary
+consumer module:
 
 ```sh
-release_version=v0.5.0
+release_version=vMAJOR.MINOR.PATCH
 consumer_dir=$(mktemp -d)
 (
   cd "$consumer_dir"

docs/releases/v0.6.0.md

@@ -0,0 +1,63 @@
+# ConfigKit v0.6.0
+
+This minor release reduces avoidable configuration-loading and inspection work,
+adopts ReleaseKit for source publication, and raises the consumer Go minimum to
+1.26.0. The public configuration model remains unchanged from v0.5.0.
+
+## Changes
+
+- Reduce temporary path allocations by sizing pointer-formatting buffers,
+  combining final metadata traversal, reusing parsed sensitivity paths, and
+  avoiding path construction when detecting inheritance. Effective and
+  historical metadata indexes retain independently owned paths.
+- Replace repeated resolution-coverage, metadata-update, CLI-overlap, and
+  sensitivity-propagation scans with private indexes and incremental processing.
+  Preserve diagnostic ordering, history, contextual path shapes, and redaction.
+- Make presence-only metadata queries avoid materializing provenance. Prepare
+  resolution replay descriptors and immutable mapping and inheritance-history
+  lookups for inspection, and use ordered membership indexes for provenance
+  collections. Returned records remain detached; explanations still replay
+  complete trees and render on demand.
+- Add a maintained public-API startup construction benchmark. The initial path
+  formatting and metadata traversal experiments reproduced allocation reductions
+  across local and downstream workloads. Later algorithmic improvements were
+  validated behaviorally without a new benchmark campaign. Busy-host timings
+  were inconclusive; no fixed speedup or allocation threshold is promised.
+- Replace ConfigKit-owned release scripts with a small profile and the
+  module-selected ReleaseKit v0.3.0 tool. The
+  [release procedure](../release.md) documents candidate preparation, tag-only
+  publication, and failed-push recovery. Existing release checks and the
+  successful-tag-push completion point remain unchanged; CI is not a gate.
+- Adopt release policy 1.6, distinguishing the consumer Go minimum from the
+  validation toolchain. Retire completed planning and measurement records into
+  Git history while preserving [deferred work](../roadmap/deferred.md).
+
+## Compatibility and upgrade
+
+The consumer minimum increases from Go 1.25.0 to **Go 1.26.0**. Install Go 1.26.0
+or newer before upgrading, and update application build and CI environments that
+still use Go 1.25. The `go.mod` directive records the consumer minimum; using a
+newer validation patch does not itself raise that minimum. See the
+[consumer minimum policy](../policy/release.md#consumer-minimum-and-release-toolchain).
+
+Select this version and rebuild:
+
+```sh
+go get gitea.maximumdirect.net/eric/ConfigKit@v0.6.0
+```
+
+No application-code or configuration migration is required from v0.5.0. Public
+Go signatures, strict within-tier composition, recursive tier precedence,
+sibling inheritance, presence/null distinctions, provenance, secret handling,
+and synchronous completion retain their existing contracts. See the
+[configuration contract](../config.md) and
+[consumer guide](../consumers/README.md).
+
+The YAML dependency remains `go.yaml.in/yaml/v4 v4.0.0-rc.6`. ReleaseKit is a
+declared Go tool dependency for maintainer commands, not a library runtime
+import; its requirements participate in ConfigKit's module graph. Linux amd64
+and arm64 remain release-validated targets, and macOS remains best-effort.
+Maintainers should use the current release procedure instead of the retired
+`scripts/release.sh` and `scripts/release-check.sh` commands.
+
+[COPYRIGHT](https://gitea.maximumdirect.net/eric/ConfigKit/src/tag/v0.6.0/COPYRIGHT) | [LICENSE](https://gitea.maximumdirect.net/eric/ConfigKit/src/tag/v0.6.0/LICENSE) | [ATTRIBUTION](https://gitea.maximumdirect.net/eric/ConfigKit/src/tag/v0.6.0/docs/oss/attribution.md)

docs/releases/v0.7.0.md

@@ -0,0 +1,58 @@
+# ConfigKit v0.7.0
+
+This minor release adds structured comparison of completed configurations.
+Applications can inspect changes between two configuration files or the
+effective impact of a selected overlay, with ConfigKit handling comparison and
+safe value disclosure while applications own presentation.
+
+## Changes
+
+- Add `Diff[T](left, right *Result[T]) ([]Difference, error)` through the public
+  facade. It compares frozen effective inspection values from successful loads,
+  including defaults and recorded application resolution, rather than source
+  text or later mutations of `Result.Config`.
+- Return detached changed-region records containing a semantic path, safe left
+  and right `ValueSnapshot` values, and `HiddenChanged`. Mappings compare
+  recursively, sequences report atomic changes, and records follow canonical
+  pointer order. Presence distinguishes additions and removals from explicit
+  null; equal effective values produce no records regardless of provenance or
+  loading history.
+- Protect both snapshots with sensitivity from both loads, including historical
+  and dependency-derived classification. Compatible regions retain public
+  siblings; incompatible structural replacements use complete-region masking
+  where required. `HiddenChanged` identifies actual changes withheld by masking,
+  rather than merely indicating that a snapshot contains redacted content.
+- Preserve visible public scalar changes when only historical sensitive
+  descendants remain, including additions and removals. Historical explanation
+  redaction and masking of incompatible present shapes remain intact.
+- Add maintained file-comparison and base-versus-overlay examples with
+  consumer-owned formatting, plus an executable public API example. See the
+  [consumer guide](../consumers/README.md#effective-configuration-diffs) and
+  [configuration contract](../config.md#effective-configuration-diffs).
+
+## Compatibility and upgrade
+
+No application-code or configuration migration is required from v0.6.0.
+Adopting the new API is optional. Loading, composition, inheritance, provenance,
+existing inspection, and secret-handling contracts remain unchanged.
+
+Load both configurations successfully before calling `Diff`; nil or
+uninitialized results return an error with no records. Comparison does not
+reopen sources, rerun callbacks, or reread environment variables. Typed secret
+references compare by configured reference name, not resolved credential bytes,
+so credential rotation behind an unchanged name is not reported. Returned
+snapshots describe changed regions, not cross-protected full-document context.
+
+Select this version and rebuild:
+
+```sh
+go get gitea.maximumdirect.net/eric/ConfigKit@v0.7.0
+```
+
+The consumer minimum remains Go 1.26.0. The YAML dependency remains
+`go.yaml.in/yaml/v4 v4.0.0-rc.6`, and the maintainer tool dependency remains
+ReleaseKit v0.3.0. Linux amd64 and arm64 remain release-validated targets;
+macOS remains best-effort. Publication follows the existing
+[release procedure](../release.md).
+
+[COPYRIGHT](https://gitea.maximumdirect.net/eric/ConfigKit/src/tag/v0.7.0/COPYRIGHT) | [LICENSE](https://gitea.maximumdirect.net/eric/ConfigKit/src/tag/v0.7.0/LICENSE) | [ATTRIBUTION](https://gitea.maximumdirect.net/eric/ConfigKit/src/tag/v0.7.0/docs/oss/attribution.md)

docs/releases/v0.7.1.md

@@ -0,0 +1,22 @@
+# ConfigKit v0.7.1
+
+This patch updates the maintainer release tool to ReleaseKit v0.4.1. ConfigKit's
+runtime behavior and public API are unchanged.
+
+## Compatibility and upgrade
+
+No application-code or configuration migration is required from v0.7.0. The
+consumer minimum remains Go 1.26.0, and the YAML dependency is unchanged.
+
+Select this version and rebuild:
+
+```sh
+go get gitea.maximumdirect.net/eric/ConfigKit@v0.7.1
+```
+
+ReleaseKit v0.4.1 is a maintainer tool dependency and does not change consumer
+configuration or runtime behavior. Linux amd64 and arm64 remain
+release-validated targets; macOS remains best-effort. Publication follows the
+existing [release procedure](../release.md).
+
+[COPYRIGHT](https://gitea.maximumdirect.net/eric/ConfigKit/src/tag/v0.7.1/COPYRIGHT) | [LICENSE](https://gitea.maximumdirect.net/eric/ConfigKit/src/tag/v0.7.1/LICENSE) | [ATTRIBUTION](https://gitea.maximumdirect.net/eric/ConfigKit/src/tag/v0.7.1/docs/oss/attribution.md)

docs/roadmap/deferred.md

@@ -23,12 +23,35 @@ The following remain deliberately excluded:
 - automatic schema migrations;
 - hot reload, runtime resource replacement, and remote resource validation;
 - a bundled CLI framework or application commands; and
-- configuration diffs and fingerprints.
+- configuration fingerprints.
 
 Applications may build their own validate, effective-value, source, bootstrap, and
 explanation commands around the library. Broadening these boundaries requires
 concrete consumer evidence, compatibility review, and an explicit design change.
 
+Effective configuration diffs are implemented over frozen successful-load
+inspections; their current comparison and disclosure contract is in the
+[configuration contract](../config.md#effective-configuration-diffs), with
+consumer workflows in the [adoption guide](../consumers/README.md#effective-configuration-diffs).
+Fingerprints remain deferred.
+
 Built-in sibling inheritance using `extends` is implemented as described in the
 [configuration contract](../config.md#sibling-inheritance). It is distinct from
 inheritance between selected overlay files, which remains excluded above.
+
+## Deferred performance experiments
+
+The completed performance audit left these internal optimization candidates for
+separate investigation:
+
+- branch-local explanation replay instead of the current whole-tree replay;
+- redesigning the private metadata-copy handoff while preserving detached public
+  records;
+- caching schema descriptors across loads; and
+- indexing complex contributor-trace membership while preserving its equality
+  rules and compact linked traces.
+
+These are not committed implementation work. Reconsider them with evidence that
+the benefit justifies the ownership, retained-memory, or equivalence risks. The
+completed audit and implementation evidence are preserved in Git history at
+`8e91a2b` under `docs/roadmap/`.

docs/roadmap/implementation.md

@@ -0,0 +1,580 @@
+# Implement configuration input destinations
+
+Status: complete. Stages 1–12 are implemented and audited. The
+[feature roadmap](input-destinations.md) owns the approved behavior and rationale; the
+[consumer request](promptkit-feature-request.md#public-acceptance-scenarios)
+supplies the public acceptance scenarios. This document owns execution and
+completion evidence. Planning baseline: `6353598`.
+
+## Working instructions
+
+- Start each stage with `AGENTS.md`, [development.md](../development.md), the
+  applicable policies, and working-tree inspection. Use graph-first code
+  discovery. Preserve unrelated changes and previously completed stages.
+- Implement only that stage and its supporting tests/documentation. Mark it
+  complete here with actual commands and evidence, then commit the nonempty
+  validated unit with a short plain-English message. Subsequent stages remain
+  planned. A stage is not complete solely because its narrow tests pass.
+- Keep early mechanics private until the complete engine behavior is ready.
+  Root destination fields land in Stage 10. Ordinary root loading must remain
+  working throughout. Do not publish a partially supported public placement API.
+- Follow the existing engine/document/YAML boundaries. Reuse strict composition,
+  recursive overlay, sibling inheritance, paths, history, and sensitivity.
+  No dependencies, toolchain changes, alternate mergers, mount registry,
+  per-fragment lifecycle, import-destination syntax, resource discovery, or new
+  release gates are needed. These are scope boundaries, not new prohibitions
+  on separately approved future work.
+- Update current-behavior documentation when public behavior lands; keep future
+  claims here or in the roadmap until then. Add the ADR in Stage 1 under the
+  documentation policy's accepted-decision exception.
+- Use focused offline tests while iterating; run `./scripts/check.sh` before
+  committing production changes. Documentation-only stages need whitespace and
+  local-link checks. Stage 12 adds full ownership/race validation. Tests protect
+  observable behavior, not wrapper allocation or helper-call counts. Reuse
+  coverage rather than repeat an entire loading matrix at every layer.
+- No benchmark campaign or public complexity guarantee is required. Prefer
+  straightforward bounded walks and wrapping each acquired contribution once;
+  avoid rescanning all preceding contributions for every new input.
+- Do not push, tag, publish, update downstream dependencies, or retire unfinished
+  records. Release compatibility review is separate from publication.
+
+## Resolved implementation decisions
+
+1. Add root-owned `Input.Destination Path` and `SourceInfo.Destination Path`,
+   mirrored privately in engine input/source records. Extend `loadInput` and
+   explicit root/engine conversion and cloning. No new loading entry point,
+   public wrapper type, option, or origin field is needed. Ordinary `Load`
+   continues to supply root placement.
+2. The zero path means root. Validate `Path.valid()` and reject every explicit
+   index segment, including a negative index. Normalize parsed tokens to literal
+   mapping-key segments: `/0` means the key `0`, not sequence element zero.
+   Empty, dot, dot-dot, slash-containing, tilde-containing, and numeric keys keep
+   existing semantic-path meaning. Do not split dots, interpret filesystem
+   traversal, enforce identifier grammar, or add namespace uniqueness.
+3. Reject destination segments equal to `configkit` or `extends`: placement
+   would introduce a reserved mapping key with a mapping value. Substrings such
+   as `myextends` are ordinary keys. This preserves the approved structural
+   rules rather than adding an application naming policy. Source-root import
+   directives are still processed before placement.
+4. Validate destination shape/reservations for all declared inputs during
+   grouped option preflight, before reading any source. Reuse
+   `CodeOptionsInvalid` for invalid destination declarations; include the
+   offending semantic path when representable, with no fabricated physical
+   location. An invalid source still follows existing source-option validation.
+   A valid destination on `NoSource` contributes no nodes, source record, or
+   budget charges. No extra error type or exact message contract is introduced.
+5. Separate acquired source syntax from application placement. Retain original
+   parsed source metadata for filesystem/directive handling. Strip source-root
+   directives, then wrap each application body at the normalized destination
+   before fragment version checks and strict composition. Imports inherit the
+   same destination transitively. Do not wrap both a source application and its
+   recomposed result; every retained application must already use effective
+   coordinates. Content roots remain mappings under existing source contracts.
+6. Wrapping a body at `Keys("a", "b")` creates `{a: {b: body}}` as private
+   document mappings. Actual body nodes and entries keep their physical source
+   coordinates. Introduced mappings/entries use the contributing document's root
+   location as a documented source fallback, not purported authored coordinates.
+   They have the same contributing source ID and create no synthetic source.
+   Retained history trees remain immutable and separate from assembly mutation.
+7. A present empty body creates explicit destination mappings, including an
+   import-only source whose application body is empty. It still cannot clear
+   lower mappings. A missing optional import and `NoSource` remain absent. Empty
+   source text remains the existing invalid document, not an empty mapping.
+8. `VersionRule.Path` stays an effective application path. Check main once after
+   its own imports compose and before underlays/overlay/CLI, at the existing
+   phase. Imported and underlay claims are checked against placed application
+   content, including scalar/null/sequence ancestors replacing a protected path.
+   A mapping ancestor with no protected descendant is not a version claim.
+   Mounted domain `version` fields are ordinary data. Existing inheritance,
+   selected-overlay, CLI protection and exact-path numeric conversion remain;
+   no nested blanket conversion or additional fragment checker is introduced.
+9. Placement does not alter physical source identity, filesystem namespace,
+   source IDs, acquisition order, imported-from locations, or resource contexts.
+   Repeated physical sources in one strict group still fail even at different
+   destinations. The same physical source in separate tiers retains the existing
+   independent source applications/records and each record's own destination.
+   Overlay and CLI source records have root `Destination`; they are not mounted
+   merely because main is mounted. Active layered overlays retain their explicit
+   independent filesystem selection and application-root meaning.
+10. Value-level paths use effective coordinates. Keep genuine source-local
+    import-directive diagnostics and parse/read failures at their original
+    locations; do not invent a logical child path when parsing cannot identify
+    one. Prefix existing application-relative diagnostic paths exactly once
+    where available. Preserve structured codes, related physical locations,
+    deterministic ordering, and value-free messages.
+11. Use current depth/node limits, not a new destination cap. With root depth
+    zero, each destination segment adds one level and, under `countInputNodes`,
+    one mapping node plus one key. Retain current raw input accounting (including
+    directives); charge only the additional `2 * segmentCount` synthetic nodes
+    per acquired body, once, to the shared input budget. Placement adds no bytes,
+    acquired sources, import nesting, or glob visits. Validate placed application
+    depth and per-document node bounds before composition; share accounting
+    across inputs and imports. Precheck wrapper depth/count before allocating
+    wrappers. Use existing source/import limit diagnostics in their acquisition
+    contexts; retain projection, expansion, and history bounds independently.
+    Root placement adds no charge or new rejection. NoSource adds none either.
+12. Cloned source records include independently owned destination paths at every
+    existing publication boundary: results, load errors, metadata/inspection,
+    callback input information, and root conversion. Passive resource contexts
+    remain keyed by the real source identity; inspection must work without an
+    open configuration handle after load. This does not extend caller-owned
+    filesystem or callback resource lifetimes.
+
+## Stage 1 — Record the decision and capture the baseline
+
+Status: complete. Scope: decision record and evidence, no feature code.
+
+1. Read the roadmap, request, relevant policies, and ADRs 0001, 0003, 0006,
+   0008, and 0009. Inspect the owners identified in the roadmap and the function
+   map below. Confirm the baseline and worktree before starting.
+2. Run `./scripts/check.sh`; record the commit, Go version, and results here.
+   Locate existing coverage for root loading, strict underlays, version ownership,
+   repeated sources, history, resource contexts, and detached records.
+3. Write `docs/adr/0011-input-destinations.md` after confirming the number is
+   unused. Record the approved input-placement decision as Accepted, with the
+   roadmap owning implementation status. Follow the repository ADR format.
+   Focus on ConfigKit, put rejected options only in Alternatives Considered,
+   and avoid negative parallelism elsewhere. No PromptKit-specific semantics.
+4. Record the compatibility assessment under the release policy: adding fields
+   preserves zero-value/keyed-literal use, but callers using unkeyed literals
+   for `Input` or `SourceInfo` must migrate to keyed literals. Treat the feature
+   as minor-release work; select a version and write its note only during
+   separately authorized release preparation.
+
+Validated: `./scripts/check.sh` (go1.26.8 linux/amd64) passed on candidate
+`d3d468a8b47d780787fca329ff65b107d98ca59f`; this includes formatting,
+whitespace, local documentation links, tests, vet, and build. The planning
+baseline `6353598bd6cce2eb78a5fe990e144cc0cadf1280` is present in history. The
+worktree was clean before this stage.
+
+Coverage located for later destination work:
+
+- Root and equivalent source loading: `TestEquivalentSourceFormsPreserveInputSemantics`
+  (`facade_equivalence_test.go`) and
+  `TestFacadeLayeredZeroUnderlaysMatchesOrdinaryLoad` (`facade_layered_test.go`).
+- Strict underlays and group budgets: `TestGroupedLoadStrictConflictsRepetitionAndBudgets`
+  and `TestGroupedLoadPrecedenceSourceOrderAndSingleLifecycle`
+  (`internal/engine/load_request_test.go`).
+- Version ownership and imported claims: `TestLoadRejectsImportConflictsAndFragmentVersions`
+  (`internal/engine/imports_test.go`) and version-path coverage in
+  `internal/engine/load_test.go`.
+- Repeated physical sources: `TestRepeatedImportsAcrossTiersAndReaderConsumption`
+  (`facade_equivalence_test.go`).
+- History and source contexts: `TestUnderlayHistoryRetainsLaterMappingContributors`
+  (`facade_underlay_origins_test.go`) and
+  `TestFacadeSourceContextsFollowOriginsWithoutQueryIO`
+  (`facade_resource_context_test.go`).
+- Detached records: `TestLoadMetadataReflectsDefaultsInputAndDetachedRecords`
+  (`internal/engine/load_test.go`) and
+  `TestMetadataQueriesReturnDetachedRecords` (`internal/engine/metadata_test.go`).
+
+The decision is recorded in [ADR 0011](../adr/0011-input-destinations.md).
+Compatibility assessment: adding the two public fields breaks callers using
+unkeyed literals for `Input` or `SourceInfo`; keyed and zero-value use remains
+compatible. The release policy permits the intentional pre-1.0 contract change
+in a minor release when the release note states impact and migration. Version
+selection and release-note preparation remain out of scope until separately
+authorized. No feature code or current behavior contract changed.
+
+## Stage 2 — Add private destination normalization and wrapping
+
+Status: complete. Scope: pure private mechanics with bounded unit tests.
+
+1. Add a small engine helper file for normalized mapping-only destinations and
+   constructing placed document bodies. Follow decisions 2–7; keep helpers
+   private and avoid introducing a second path abstraction.
+2. Validate invalid paths, explicit indices, and exact reserved tokens. Normalize
+   parsed numeric tokens into keys, preserving literal text and pointer escaping.
+3. Build wrappers without mutating the supplied tree. Preserve body locations;
+   give introduced entries/mappings the source-root fallback. Implement depth and
+   node measurement/prechecks usable with existing limits, including the extra
+   synthetic-node count; aggregate charging is wired in Stage 7.
+4. Cover root identity/equivalence, nested empty mapping, literal/escaped/numeric
+   keys, invalid index/path, exact versus substring reserved keys, owned paths,
+   unchanged body coordinates, and bounded wrapper checks. Do not count helper
+   invocations or fix an allocation strategy in tests.
+
+Validated with `go test ./internal/engine -run 'Destination|PlaceDocument'`
+and `./scripts/check.sh` (go1.26.8 linux/amd64); both passed. The private
+helpers normalize mapping-only destinations, preserve authored nodes and source
+coordinates, and check per-document depth/node bounds before allocating wrappers.
+No loader accepts a new public field yet.
+
+## Stage 3 — Integrate private non-import input placement
+
+Status: complete. Scope: engine request plumbing and ordinary acquired bodies.
+
+1. Add destination fields to engine `Input`, `loadInput`, and `SourceInfo`.
+   Preserve ownership through engine `LoadLayered` request construction,
+   `cloneSourceInfo`, and source-record copies. Keep the root facade unchanged.
+2. Extend grouped preflight to validate/normalize destinations before source
+   reads. Use the existing diagnostic accumulator and options-invalid category.
+   Ordinary `Load` supplies root placement through its existing request adapter.
+3. Thread placement into `assembleBaseInputTracked` without confusing raw
+   `parsedSource` with effective `assembledInput.document`. Preserve the root
+   path through existing wrappers/callers. For imports-disabled acquisition,
+   validate disabled directives on raw content, place the body, and retain the
+   destination on the acquired source record. NoSource still short-circuits.
+4. Use engine loads to cover mounted main and underlay bodies, omitted versus
+   explicit root destinations, empty mapping versus NoSource, and preflight
+   rejection without consuming a test-owned reader. Reuse current source-kind
+   acquisition tests; full source equivalence is verified publicly in Stage 10.
+
+Validated with `go test ./internal/engine -run 'Destination|PlaceDocument|Grouped'`
+and `./scripts/check.sh` (go1.26.8 linux/amd64); both passed. Private non-import
+placement reaches assembly, with root behavior unchanged. Imports are the next
+private integration step.
+
+## Stage 4 — Carry placement through import acquisition
+
+Status: complete. Scope: source-local directives and placed imported applications.
+
+1. Thread a normalized destination through `loadImportedDocumentsTracked`,
+   `loadImportedWithAccessTracked`, and `importTraversal`, retaining root defaults
+   for current private callers. Place the selected body's application content
+   after `splitImportDirectives`; do the same for every imported body.
+2. Set placement on selected/imported source records, including error records
+   once a source has been acquired. Keep `ImportedFrom` at the physical directive.
+   Run imported `fragmentVersionClaim` against placed bodies and retain placed
+   bodies in `state.documents` before `composeDocuments` builds applications.
+3. Leave filesystem joins, containment, glob traversal, optional missing inputs,
+   active cycles, visited identities, and acquisition IDs/order unchanged.
+   Destination must not become part of the repeated-source identity key.
+4. Test native and host transitive imports, nested source-root directives,
+   import-only bodies, and mounted imported protected versus ordinary version
+   paths. Verify a repeated file at two destinations in one group still fails,
+   including an import/direct-input alias. Reuse cycle/containment regressions.
+
+Validated with `go test ./internal/engine -run 'Destination|PlaceDocument|Import|Grouped'`
+and `./scripts/check.sh` (go1.26.8 linux/amd64); both passed. Retained imported
+contributions have effective placement and physical source identity, with no
+double wrapping or application-level directive leakage.
+
+## Stage 5 — Complete strict tiers and main version ownership
+
+Status: complete. Scope: assembly and version interactions, not a new merger.
+
+1. Review `acquireUnderlayGroup`: version checks must use placed content, and
+   documents taken from `acquired.composition.applications` must already be
+   placed. Recompose strict peers with ordinary `composeDocuments`; preserve
+   per-source applications, origins, UnderlayIndex, and input accounting.
+2. In `executeLoadRequest`, main's version check uses its placed main/import
+   composition at the existing point. `assembleLayeredInput` recursively overlays
+   completed underlay groups beneath main, selected overlay, and CLI as before.
+   Do not mount the final assembly or prepend main's destination to upper tiers.
+3. Test disjoint same-destination peers, different destinations, equal and unequal
+   conflicts, ancestor/descendant destinations, and a strict conflict despite an
+   upper override. Verify recursive mapping overlays, atomic sequences, null,
+   explicit false/zero, and version-only domain overrides retaining lower fields.
+4. Exercise mounted main with a nested VersionRule, absent root declarations,
+   imported/underlay direct and ancestor claims, and nonclaiming mapping ancestors.
+   Check the hook runs once and does not inspect each fragment independently.
+   Preserve exact configured-path integer conversion and ordinary nested typing.
+
+Validate: destination/composition/overlay/version/grouped tests and everyday
+check. Validated with `go test ./internal/engine -run 'LayeredDestination'`,
+`go test ./internal/engine -run 'Destination|Composition|Overlay|Version|Grouped'`,
+and `./scripts/check.sh` (go1.26.8 linux/amd64); all passed. The new mounted
+cases verify strict same-tier conflicts and disjoint composition, independent
+destinations and nested paths, recursive/atomic overlay behavior, explicit
+null/false/zero, and main-only nested version checking after imports compose.
+Done: placed and authored equivalents agree on values and conflicts; main
+ownership and lifecycle timing are preserved.
+
+## Stage 6 — Reconcile diagnostic coordinate systems
+
+Status: complete. Scope: useful paths without fictional source locations.
+
+1. Audit early acquisition, import, fragment-version, and composition failures.
+   Use one narrow path-prefix translation where diagnostics genuinely identify
+   application content; do not blanket-prefix every diagnostic or double-prefix
+   diagnostics already produced by placed trees.
+2. Preserve syntax/read/directive locations and related import sites. Value
+   conflicts and later typed/resolver/validation failures use effective paths
+   but original content coordinates. Invalid introduced structure identifies
+   the destination declaration rather than a nonexistent source wrapper line.
+3. Add focused assertions for a mounted conflict with two real sources, a mounted
+   decode or validation error, an imported version error, invalid destination,
+   and malformed source-local directives. Test stable codes/paths/locations and
+   nil results, not whole messages or callback choreography.
+
+Validate: destination/diagnostic/import/version/decode tests and everyday check.
+Validated with `go test ./internal/engine -run 'LayeredDestinationDiagnostics'`,
+`go test ./internal/engine -run 'Destination|Diagnostic|Import|Version|Decode'`,
+and `./scripts/check.sh` (go1.26.8 linux/amd64); all passed. The mounted
+conflict, decode, and imported-version assertions use effective application
+paths with authored source locations; invalid destinations have no physical
+location; malformed source-root directives retain their authored path and
+location. Later value diagnostics are produced from placed trees, while directive
+diagnostics retain their raw source coordinates. Post-review remediation also
+rebases known Mapping value-builder failure paths, which are produced before
+placement. `TestFacadeDestinationMappingFailurePaths` covers mounted main and
+underlay failures, escaped keys and sequence-index intent, cycles, unchanged
+root paths, and unchanged source-constructor failures. Its mounted value cases
+failed before the fix and pass afterward.
+Done: diagnostics consistently distinguish application paths from source syntax.
+
+## Stage 7 — Complete shared placement accounting
+
+Status: complete. Scope: resource bounds with no new public limit system.
+
+1. Wire Stage 2's prechecks and synthetic-node charges into both tracked ordinary
+   acquisition and import traversal, using `importAccounting` and current limit
+   structures. Charge each source body once, including empty import bodies.
+2. Preserve existing raw byte/source/node accounting and imported directive
+   inspection. Additional wrappers count in per-body depth/node checks and
+   shared aggregate nodes; recomposition must not charge them again. Ensure
+   selected overlays and CLI start from totals including placement charges.
+3. Test below/at/above relevant bounds using small private limit fixtures where
+   existing seams permit; add a narrow private seam if necessary. Cover deep
+   body plus destination, many shallow mounted inputs, imported wrappers, and
+   empty mappings. Verify root placement and NoSource do not add charges.
+   Preserve history/expansion limits; do not turn fixture values into defaults.
+
+Validated with `go test ./internal/engine -run 'Destination|Import|Grouped|Overlay|Override'`
+and `./scripts/check.sh` (go1.26.8 linux/amd64); both passed. New coverage in
+`TestDestinationPlacementCountsAgainstSharedNodeBudget`,
+`TestMultipleMountedInputsSharePlacementCharges`,
+`TestImportedEmptyBodiesChargeEachDestinationWrapper`,
+`TestSelectedOverlayAndCLIUsePlacementNodeCharges`, and
+`TestNoSourceAndRootPlacementAddNoWrapperCharges` checks totals below, at, and
+above the boundary, multiple shallow inputs, imported empty bodies, and charging
+of upper tiers from mounted inputs. `TestPlaceDocumentRootAndBounds` continues
+to cover per-document depth/node boundaries; existing grouped accounting tests
+cover unchanged raw source/byte charging. Done: placement cannot bypass current
+budgets and introduces no unrelated caps.
+
+## Stage 8 — Preserve provenance, history, and source resource contexts
+
+Status: complete. Scope: engine inspection and retained evidence.
+
+1. Audit `compositionOrigins`, `completeCompositionOrigins`, application replay,
+   metadata construction/finalization, and source-record cloning against placed
+   applications. Prefer feeding placed trees into existing processing rather
+   than adding another path-offset index or rewriting final metadata afterward.
+2. Verify explicit destination containers, actual leaves, composite origins,
+   superseded/removed descendants, and root/source fallbacks. Historical and
+   effective indexes keep independently owned paths and existing shape semantics.
+3. Preserve source-ID resource contexts through imports, surviving lower-tier
+   values, and inheritance. Test completed-result and resolution-time context
+   queries against real relative files, without making ConfigKit open the
+   referenced application resource or retain loading handles.
+4. Exercise the same physical source in separate tiers with different placement,
+   inspect each source record, and verify independent destination paths. Repeat
+   inspection after comparison and independent loads to detect retained mutation.
+
+Validated with `go test ./internal/engine -run 'Destination|Metadata|Provenance|History|Resource|SourceContext'`,
+`go test -race ./internal/engine`, and `./scripts/check.sh` (go1.26.8
+linux/amd64); all passed. `TestLayeredDestinationsRetainOriginsHistoryAndDetachedRecords`
+checks synthetic-container fallback locations, authored leaf coordinates,
+composite origins, removed-descendant history, and the same host file retained
+at distinct destinations in separate tiers before and after comparison and an
+independent load. `TestLayeredImportedInheritedValuesRetainResourceContexts`
+uses real temporary files to verify resolution-time and completed-result
+relative-resource lookup through an imported surviving parent and its inherited
+child. Existing metadata and resource-context tests continue to cover detached
+records and loading-handle closure. Done: inspection explains effective
+placement and physical origin without consumer reconstruction.
+
+## Stage 9 — Verify final inheritance, sensitivity, and lifecycle integration
+
+Status: complete. Scope: complete private engine behavior before facade exposure.
+
+1. Resolve sibling inheritance only after full source precedence using the
+   existing expansion path. Cover a child and parent supplied by separate peers,
+   nested destination-local siblings, cancellation, and an inherited relative
+   resource retaining its declaring context. Cross-collection search is unchanged.
+2. Reuse existing inheritance-version, overlay, and CLI guards; add targeted
+   mounted cases for actual protected paths and their ancestors. Do not reject
+   unrelated inheritance merely because it shares a mapping ancestor.
+3. Test effective-path secret predicates, field tags and recorded dependencies,
+   superseded classified values, safe effective output/history/explanation, and
+   bilateral diff redaction using disposable canaries. Compare mounted versus
+   explicitly wrapped loads for equal effective values and no differences.
+4. Verify defaults, decoding, resolution, secret lookup, and validation execute
+   once on the final shape; failures return no usable result. Reuse existing
+   ordinary-load lifetime/ownership coverage and add mounted protection where
+   placement creates a distinct risk.
+
+Validate: destination/inheritance/secret/sensitivity/explain/diff/lifecycle tests
+and everyday check. Validated with
+`go test ./internal/engine -run 'Destination|Inheritance|Secret|Sensitivity|Explain|Diff|Load|Version|Grouped' -count=1`,
+`go test -race ./internal/engine`, and `./scripts/check.sh` (go1.26.8
+linux/amd64); all passed.
+
+`TestLayeredDestinationInheritanceUsesFinalSiblingScopes` verifies parent and
+child contributions from separate peers, a higher-tier parent update, nested
+destination-local siblings, and cancellation. `TestLayeredDestinationInheritanceDoesNotSearchOtherCollections`
+keeps sibling lookup local. `TestLayeredMountedVersionProtectionCoversInheritanceAndUpperTiers`
+protects inherited values, scalar/null ancestors, consumed directives, selected
+overlays, and CLI overrides at mounted paths while allowing nonclaiming mapping
+ancestors and unrelated inheritance. The coverage exposed an ancestor gap in
+the existing inheritance-version check; it now applies the shared fragment claim
+logic to the transferred parent subtree.
+
+`TestLayeredDestinationLifecycleAndSensitiveInspectionUseFinalShape` checks one
+defaults/resolution/secret-lookup/validation lifecycle, final mounted decoding,
+field tags and effective-path predicates, superseded history, and safe effective
+output/explanation against canaries; it compares mounted and explicitly wrapped
+loads for equal configuration and no diff. `TestLayeredDestinationDiffUsesBilateralSensitivity`
+checks redaction from either side and recorded dependencies, and
+`TestLayeredDestinationDecodeFailureReturnsNoResultOrLaterCallbacks` checks a
+mounted decode failure returns no result. Stage 8's
+`TestLayeredImportedInheritedValuesRetainResourceContexts` continues to verify
+the declaring context for inherited relative resources. Done: approved engine
+semantics integrate without per-fragment loading or a post-return processing
+pass.
+
+## Stage 10 — Expose the root-owned facade and public acceptance tests
+
+Status: complete. Scope: the two public fields and complete consumer behavior.
+
+1. Add `Input.Destination Path` and `SourceInfo.Destination Path` to root types.
+   Extend `toEngineInput`, `fromEngineSourceInfo`, `toEngineSourceInfo`, and all
+   source publication paths with owned conversion. Run existing public/import
+   boundary tests; expose no engine nodes, aliases, or bridge methods.
+2. Document zero/root behavior, mapping-only paths, main/underlay parity,
+   inherited import placement, source-coordinate fallback, and source ownership
+   beside declarations. Update the configuration contract for implemented input
+   destinations, preserving canonical ownership of shared semantics.
+3. Add external-package public-load coverage for equivalent host file, native
+   fs.FS file, byte, reader, and Mapping sources. Cover default/root destinations,
+   literal escaped/numeric keys, empty mapping, NoSource, and invalid declarations.
+   Include one public mounted main case, not just underlays.
+4. Add representative public tests tying final configuration to metadata,
+   source placement, history, resources, callbacks, and safe diffs. Mutate returned
+   record copies and repeat queries/loads to confirm detachment. Reuse engine
+   matrices; public tests demonstrate supported integration rather than every
+   private branch. Confirm failed loads expose detached source destinations.
+
+Validated with `go test . -run 'Destination|FacadeLayered|PublicFacadeBoundary|DependencyImportBoundary' -count=1`,
+`go test -race ./...`, and `./scripts/check.sh` (go1.26.8 linux/amd64); all
+passed.
+
+`TestFacadeInputDestinationsAcrossSourceKinds` exercises host, native
+filesystem, bytes, reader, and mapping inputs with literal escaped and
+numeric-looking mapping keys. `TestFacadeDestinationRootEmptyMappingNoSourceAndInvalidPaths`
+covers omitted/empty root placement, empty mapping presence, absent `NoSource`,
+invalid index/reserved destinations, and reader preflight. `TestFacadeImportedSourcesRetainInputDestination`
+checks public transitive import placement. `TestFacadeMountedMainAndUnderlayInspectionResourcesAndDiff`
+ties mounted main/underlay values to metadata, both source destinations, callback
+source context, relative-resource access during and after loading, history, safe
+effective/explanation rendering, and bilateral diff redaction; it also mutates
+returned records and confirms later queries and comparisons remain unchanged.
+`TestFacadeFailedLoadExposesDetachedSourceDestination` verifies failure records,
+and `TestSourceInfoDestinationConversionsAndCopies` covers root/engine source
+record conversion. Existing public-boundary tests pass with the new root-owned
+fields. Done: destination selection and inspection are available through the
+supported ConfigKit import path.
+
+## Stage 11 — Add maintained simple and collection-style consumer examples
+
+Status: complete. Scope: executable adoption examples with consumer-owned types.
+
+1. Add a minimal mounted-fragment example using `Input.Destination` in an
+   ordinary layered load. Show literal keys and root-default compatibility
+   without introducing consumer parsing or generic merge helpers.
+2. Add one representative collection assembly under `examples/consumers`: peer
+   prompt/profile fragments, collection metadata with ordinary `version`, a
+   source-root import, local sibling inheritance, and an intentional higher-tier
+   version-only override retaining the body. Keep the application VersionRule
+   main-owned. Use a controlled native filesystem or temporary files.
+3. Demonstrate effective-path inspection plus source-relative resource lookup
+   during resolution and from the result, including an inherited/surviving field.
+   Application code owns opening/interpreting the resource and any qualified IDs.
+4. Add tests for final values, presence, actual source placement/coordinates,
+   resource context, and expected conflict behavior. Link maintained examples
+   from the consumer guide; add a small executable root example if useful for
+   discovery without duplicating the complete scenario.
+
+Validated with `go test ./examples/consumers -count=1`,
+`go test . -run '^Example' -count=1`, and `./scripts/check.sh` (go1.26.8
+linux/amd64); all passed, including local documentation links.
+
+`Example_inputDestination` demonstrates a literal mounted mapping path and an
+ordinary root input without consumer-side parsing or merging.
+`LoadCollectionBundle` and `TestCollectionBundleAssemblesMountedPeersAndResources`
+exercise prompt/profile peer sources, imported collection metadata with an
+ordinary version label, main-owned schema-version checking, local sibling
+inheritance, and a higher-tier prompt version-only change that retains the rest
+of its body. The resolver and `ReadCollectionPromptContent` follow direct and
+inherited `content_file` provenance to the declaring native-filesystem context.
+The test checks final values, explicit presence, source destinations and authored
+coordinates, relative resources, and the inherited field's origin.
+`TestCollectionPeerPromptConflictsRemainStrict` preserves expected conflict
+behavior. The examples are linked from the consumer adoption guide. Done: simple
+and representative consumers substantiate the same model without a compensating
+structural pass.
+
+## Stage 12 — Reconcile documentation and audit the complete implementation
+
+Status: complete. Scope: final integration audit and evidence, not release work.
+
+1. Update README navigation, consumer guidance, the component overview, and
+   development reading/test maps. Add ADR 0011 to navigation. Update architecture
+   policy only as needed to recognize placement within existing assembly and
+   source ownership, linking precise behavior to the configuration contract.
+   Do not change unrelated policies, deferred boundaries, or published notes.
+2. Audit every resolved decision, roadmap behavior, and request acceptance row
+   against implementation and tests. Record the corresponding test names here;
+   for reused coverage explain the behavior it proves. Do not mark complete
+   based on green tests that do not exercise mounting.
+3. Review the complete baseline-to-candidate diff for accidental strengthening:
+   extra naming rules, namespace uniqueness, main-only restrictions, changed
+   merge/version semantics, invented source-read ordering guarantees, new limits,
+   or expanded secret policies. Remove temporary helpers/unsupported branches
+   left by staged integration. Confirm original source coordinates remain real.
+4. Run `./scripts/check.sh` and
+   `GOTOOLCHAIN=local GOPROXY=off go test -race ./...`. Review source-kind and
+   placement ownership coverage, error disclosure, complete-on-return handling,
+   and root/private boundaries. Record commit, Go version, results, and any
+   limitations. No release command, CI waiting, benchmark, or downstream upgrade.
+5. Mark this plan and the roadmap implemented only when code, public examples,
+   and owning contracts agree. Retain completed planning evidence until separately
+   authorized release preparation.
+
+Audit evidence for the approved decisions and request acceptance surface:
+
+| Behavior reviewed | Evidence and what it proves |
+| --- | --- |
+| Root-owned `Input.Destination` and `SourceInfo.Destination`; detached conversions and publication | `TestSourceInfoDestinationConversionsAndCopies`, `TestFacadeFailedLoadExposesDetachedSourceDestination`, and `TestFacadeMountedMainAndUnderlayInspectionResourcesAndDiff` verify root/engine conversion, error records, and returned record detachment. `TestPublicFacadeBoundary` and `TestDependencyImportBoundary` verify no engine types cross the facade. |
+| Literal mapping keys, parsed numeric keys, reserved structural tokens, and invalid-path preflight | `TestNormalizeDestinationUsesLiteralMappingKeys`, `TestNormalizeDestinationRejectsIndicesAndReservedKeys`, and `TestLayeredLoadPreflightsDestinationsBeforeReadingSources` cover mapping-only normalization and rejection before reader consumption; `TestFacadeDestinationRootEmptyMappingNoSourceAndInvalidPaths` verifies the public error boundary. |
+| Placement of acquired bodies, empty mappings versus absence, imports, all source kinds, physical identity, and authored coordinates | `TestFacadeInputDestinationsAcrossSourceKinds` covers host/native/bytes/reader/mapping sources; `TestFacadeSameFragmentMountsAtSeparateCollectionDestinations` proves independent public collections can retain the same local key. `TestLayeredImportOnlyInputMaterializesDestination`, `TestLayeredHostImportsInheritInputDestinationTransitively`, `TestLayeredNativeFilesystemImportsInheritInputDestination`, and `TestLayeredDestinationsDoNotChangeRepeatedSourceIdentity` cover inherited import placement and unchanged identity. `TestPlaceDocumentWrapsEmptyMappingAndPreservesSourceCoordinates`, `TestPlaceDocumentPreservesAuthoredEntryCoordinates`, and `TestLayeredDestinationDiagnosticsUseEffectivePathsAndAuthoredLocations` distinguish fallback wrapper locations from authored coordinates. |
+| Strict composition, explicit-wrapper equivalence, precedence, empty values, and domain `version` overrides | `TestLayeredDestinationStrictCompositionBoundaries`, `TestLayeredDestinationMatchesExplicitlyWrappedInput`, `TestEmptyMountedMappingRetainsLowerChildren`, and `TestLayeredDestinationOverlayRetainsOrdinaryValueSemantics` prove existing group and overlay semantics are retained; the latter includes ordinary field-only updates rather than whole-record replacement. |
+| Main-owned version checks and imported, underlay, inheritance, overlay, CLI, and ancestor protection | `TestLayeredDestinationChecksVersionOnceOnComposedMain`, `TestLayeredDestinationVersionClaimsUsePlacedApplicationPaths`, `TestLayeredImportedVersionClaimsUseEffectiveDestination`, and `TestLayeredMountedVersionProtectionCoversInheritanceAndUpperTiers` cover effective paths, one main check, protected-path claims/ancestors, and nonclaiming mapping ancestors. `TestLoadVersionDestinationTypesKeepOrdinaryDecoding` preserves exact configured-path conversion and ordinary nested decoding. |
+| Final-shape sibling inheritance, no cross-collection lookup, one lifecycle, and failure without a usable partial result | `TestLayeredDestinationInheritanceUsesFinalSiblingScopes`, `TestLayeredDestinationInheritanceDoesNotSearchOtherCollections`, `TestLayeredDestinationLifecycleAndSensitiveInspectionUseFinalShape`, and `TestLayeredDestinationDecodeFailureReturnsNoResultOrLaterCallbacks` exercise these behaviors. Reused inheritance, lifecycle, and callback tests cover generic behavior that destination placement does not alter. |
+| Effective paths, presence, provenance/history, safe rendering, sensitivity, bilateral diff, and source-relative resources | `TestLayeredDestinationsRetainOriginsHistoryAndDetachedRecords`, `TestLayeredDestinationLifecycleAndSensitiveInspectionUseFinalShape`, `TestLayeredDestinationDiffUsesBilateralSensitivity`, `TestLayeredImportedInheritedValuesRetainResourceContexts`, and `TestFacadeMountedMainAndUnderlayInspectionResourcesAndDiff` connect mounted values to inspection. The imported-inheritance test specifically proves the inherited value keeps the declaring source's passive resource context. |
+| Shared depth/node limits and unchanged root/absence accounting | `TestPlaceDocumentRootAndBounds`, `TestDestinationPlacementCountsAgainstSharedNodeBudget`, `TestMultipleMountedInputsSharePlacementCharges`, `TestImportedEmptyBodiesChargeEachDestinationWrapper`, `TestSelectedOverlayAndCLIUsePlacementNodeCharges`, and `TestNoSourceAndRootPlacementAddNoWrapperCharges` cover per-document and aggregate limits without adding a new limit class. |
+| Maintained consumer usage and strict peer behavior | `Example_inputDestination`, `TestCollectionBundleAssemblesMountedPeersAndResources`, and `TestCollectionPeerPromptConflictsRemainStrict` verify the simple and representative collection examples against actual values, resources, source records, and conflict behavior. |
+
+The wider baseline-to-candidate review covered all 38 changed files (`6353598..2d8df22`): production changes are limited to the root facade fields/conversions, private input/import assembly and accounting, source record ownership, and the inheritance version-claim correction described above. The contract and tests do not impose identifier grammar, namespace uniqueness, main-only placement, source-read ordering, new budgets, nested version conversion, or expanded secret policy. The implementation wraps only acquired application bodies after processing source-root directives; placement does not change physical source identity, authored node locations, filesystem resolution, or later-tier semantics. Stage evidence above reuses existing general composition, resource, inheritance, version, lifecycle, sensitivity, and boundary tests where those behaviors are unchanged; mounted-specific cases are named separately.
+
+Completion record: audited source candidate `2d8df22dd1cb9fde8e60853da3e2260731acf2bb`. On `go1.26.8 linux/amd64`, `./scripts/check.sh` passed, including formatting, whitespace, documentation links, tests, vet, and build. `GOTOOLCHAIN=local GOPROXY=off go test -race ./...` also passed with dependency downloads disabled. No remaining implementation limitations were found; release preparation, CI, benchmark campaigns, and downstream upgrades remain separately scoped.
+
+Done: one complete layered load supports input destinations with coherent values,
+diagnostics, inspection, limits, and source ownership across the approved surface.
+
+## Implementation owner map
+
+Use graph tools to locate these symbols rather than assume line numbers:
+
+- Public input forwarding: `layered.go`, `records.go`, `conversion.go`
+  (source conversions), and existing facade tests.
+- Private request and lifecycle: `internal/engine/layered.go`, `load_request.go`
+  (`loadInput`, `acquireUnderlayGroup`, `assembleLayeredInput`), `load.go`
+  (`executeLoadRequest`), and `load_input.go` (`assembleBaseInputTracked`).
+- Directives and imports: `directives.go` (`splitImportDirectives`,
+  `fragmentVersionClaim`), and `imports.go` (`visitPath`).
+- Shared document semantics: `compose.go`, `document_walk.go`
+  (`countInputNodes`), `path.go`, `parse.go`, and `value_operation.go` limits.
+- Inspection: `metadata.go`, `history.go`, `explain.go`, `resource_context.go`,
+  `inheritance_origin.go`, `render.go`, and `diff.go`; source copies live in
+  engine `records.go`. Confirm current filenames through the component overview.
+
+## Open Questions
+
+None required for implementation. The four policy choices are approved; this
+plan selects API spelling, validation timing/error category, coordinate handling,
+and accounting within them. Surface a newly discovered incompatibility or scope
+change with evidence rather than resolving it by silently narrowing the feature
+or strengthening an unrelated contract.

docs/roadmap/input-destinations.md

@@ -0,0 +1,171 @@
+# Configuration Input Destinations Roadmap
+
+Status: implemented. This roadmap records the approved behavior and rationale
+for the [PromptKit feature request](promptkit-feature-request.md). The
+[implementation plan](implementation.md) records the completed sequence and
+audit evidence; the [configuration contract](../config.md#input-destinations)
+owns current behavior.
+
+## Targeted end state
+
+A consumer can assign a mapping destination to a configuration input and perform
+one ordinary `LoadLayered` call. The input's application content contributes
+beneath that destination while retaining normal composition, precedence,
+inheritance, typed loading, diagnostics, and inspection. PromptKit can assemble
+collections without parsing and rewriting sources, merging values, or rebuilding
+provenance itself.
+
+For example, a fragment defining `summarize.alerts` can contribute beneath
+`collections`, `weatherreporter`, `prompts`. An independent source with the same
+local key can contribute beneath another collection without conflict. Collection
+and prompt names remain ordinary application keys, not ConfigKit namespaces.
+
+The public surface adds an optional `Destination Path` field on `Input`, not a
+new loading entry point or an operation on completed results. Content-bearing
+main inputs and underlay inputs support
+the same destination model; root placement remains the default.
+
+The following behavior defines the target:
+
+- Omitted and empty destinations retain root placement. Destinations consist of
+  literal mapping keys, including dots, slashes, and numeric-looking text.
+  Explicit sequence-index destinations are outside the requested capability.
+- A valid destination on `NoSource` contributes nothing. An actual empty
+  application mapping materializes its destination mappings as explicit input,
+  matching authored wrappers, without clearing lower-tier children.
+- Existing structural reservations apply to introduced mappings. Destinations
+  that materialize `configkit` or a mapping-valued `extends` contrary to existing
+  contracts fail through the structured loading-error boundary. Keys merely
+  containing those words remain ordinary keys.
+- Host files, native filesystem files, bytes, readers, and mapping sources all
+  support placement under their existing acquisition and ownership contracts.
+  Filesystem context, import opt-in, and precedence remain independent choices.
+- Mounted contributions have the same application values and conflict behavior
+  as explicitly wrapped contributions, with accurate original source locations.
+  Disjoint mappings combine; overlapping non-mapping values within a group
+  conflict even when equal. A later tier cannot repair a strict-group conflict.
+- Different destinations can coexist in one group, and the same destination can
+  occur in different tiers. Ancestor/descendant destinations follow ordinary
+  composition and overlay rules without namespace uniqueness restrictions.
+  Later tiers recursively overlay mappings and replace other values. Empty
+  mappings do not clear lower values; sequences remain atomic.
+- A prompt's ordinary `version` override changes that field and retains omitted
+  lower fields. It neither identifies a merge record nor replaces a whole prompt.
+- Source-root `configkit.imports` remains structural. Imported application data
+  inherits the input destination transitively. Import paths still resolve from
+  their declaring source; containment, optionality, cycles, and repeated-source
+  rules remain applicable. Placement does not change physical source identity.
+- Sibling inheritance runs after assembly in the effective destination scope.
+  Peer fragments can supply a child and its sibling parent. Qualified PromptKit
+  references do not acquire cross-collection inheritance meaning.
+- Version ownership is enforced at effective application paths. A collection's
+  mounted `version` is ordinary data, while underlay/import contributions to the
+  actual protected path, or replacements of its ancestors, remain invalid.
+  There is one main-owned version check and no blanket nested numeric conversion.
+- Defaults, decoding, resolution, secret lookup, and validation run once on the
+  assembled application, not independently on fragments. Callbacks and value
+  diagnostics use effective paths. Failures use structured load errors and yield
+  no usable partial result.
+- Presence, provenance, history, explanations, effective rendering, and diffs
+  agree with the final values. Sensitivity is evaluated at effective application
+  paths under the existing historical and dependency rules.
+- Existing source records expose placement, including inherited import
+  placement. Introduced ancestor mappings retain the contributing source's
+  identity; any root-location fallback identifies that document, not an authored
+  wrapper. Actual content retains its real source coordinates.
+- Original source locations and passive resource contexts survive placement,
+  overrides, and inheritance. `Result.SourceContext` and
+  `Resolution.SourceContext` still identify the declaring filesystem and base
+  directory for a field such as `content_file: ./summary.md`.
+- Destinations and the structure they introduce participate in existing load
+  limits; placement cannot bypass depth or node accounting. Source ownership,
+  complete-on-return loading, and detached result behavior remain intact.
+
+Import-destination syntax, independent collection specification headers, and
+cross-collection inheritance are separate possible follow-ups. This work does
+not add directory discovery, collection installation, remote acquisition,
+namespace ownership enforcement, dependency solving, live reload, filename-based
+identity, arbitrary transformations, or new merge strategies. PromptKit owns its
+collection inventory, qualified IDs, and execution semantics.
+
+## Implementation baseline (v0.7.1)
+
+The request reviewed v0.7.1. At that baseline, the relevant boundaries were:
+
+- [Input](../../layered.go) holds a source, import opt-in, and filesystem context,
+  but no destination. Root types delegate to the engine through the existing
+  [facade boundary](../internal/overview.md).
+- [Layered loading](../config.md#layered-loading) already provides strict groups,
+  ordered precedence, shared acquisition budgets, and one final lifecycle.
+  [Underlay acquisition](../../internal/engine/load_request.go) gathers source
+  applications and recomposes them into their strict group.
+- [Input acquisition](../../internal/engine/load_input.go) and
+  [import traversal](../../internal/engine/imports.go) process source-root
+  directives and source identity before final assembly. Imported version claims
+  are checked during traversal; underlay claims are checked before group
+  composition. These currently operate without a destination.
+- [Version claim checks](../../internal/engine/directives.go) inspect a document
+  using the configured application path. Wrapping only an already acquired
+  result would leave early fragment checks and diagnostic paths incorrect.
+- [Sibling inheritance](../adr/0009-sibling-inheritance.md) already runs after
+  source precedence and preserves source-to-destination derivation. Placement
+  must feed that existing mechanism rather than resolve fragments independently.
+- Existing source records identify acquisition and precedence but do not expose
+  input placement. Existing history retains source applications, so moving only
+  the final tree would be insufficient for coherent inspection.
+
+The architectural fit is an extension of input assembly, not a parser extension
+or a second configuration model. The
+[architecture policy](../policy/architecture.md) supplies the ownership and
+consistency constraints; [deferred scope](deferred.md) continues to govern the
+unrequested features above.
+
+## Selected Design Decisions
+
+### Main-input destinations and absent inputs
+
+Allow the same destination model for content-bearing main inputs and underlays,
+with `VersionRule.Path` remaining an effective application path and any
+specification declaration still owned by main. The checker retains its existing
+handling of an absent declaration and its existing lifecycle phase. `NoSource`
+contributes nothing even with a valid destination. This keeps `Input` coherent
+across its roles and preserves absence without per-fragment version checks.
+
+### Public placement inspection and synthetic ancestors
+
+Expose effective placement as `SourceInfo.Destination Path` on existing source
+records, including inherited import placement.
+Use original source identity for introduced ancestor mappings, documenting that
+any root-location fallback identifies the contributing document rather than a
+physically authored wrapper. Actual content keeps its real coordinates. This
+allows consumers to connect placement to sources without a new query system.
+
+Preserve that relationship through inherited fields, composite origins, and the
+same source selected in separate tiers. Placement is per source application;
+consumers can inspect it without inferring it from final paths.
+
+### Reserved structural keys in destinations
+
+Use existing `Path` conventions for literal keys and parsed
+numeric tokens, reject explicit index segments, and preserve current structural
+reservations in the effective tree. Reject destination segments that would
+materialize `configkit` or a mapping-valued `extends` contrary to those contracts,
+with a clear structured destination error. Ordinary keys containing those words,
+dots, or slashes remain ordinary keys. Source-root directives are processed before
+placement and are not rejected simply because their application body is mounted.
+
+Mounted and authored wrappers therefore retain the same structural meaning.
+Destination diagnostics identify placement as the cause of invalid introduced
+structure, using existing error categories where suitable.
+
+### Empty mappings and presence of introduced containers
+
+Mounting an actual empty application mapping materializes its
+destination mappings as explicit contributions, matching authored wrappers.
+This preserves the request's equivalence principle and lets consumers inspect
+an intentionally empty collection. Such mappings still do not clear lower-tier
+children. An absent source contributes nothing.
+
+This applies equally to empty imported application bodies and inputs containing
+only import directives. Presence follows the contribution's meaning rather than
+whether an implementation happened to allocate wrapper nodes.

docs/roadmap/promptkit-feature-request.md

@@ -0,0 +1,319 @@
+# PromptKit Feature Request: Configuration Input Destinations
+
+Status: consumer feature request; not accepted or implemented.
+
+## Requested Capability
+
+Provide a public API through which a consumer can select a destination mapping
+path for each configuration input. The input's application content contributes
+beneath that path while retaining ConfigKit's normal composition, precedence,
+inheritance, validation, diagnostics, and inspection behavior.
+
+PromptKit needs this capability for its proposal 3, **Collections With Mounted
+Configuration Fragments**, recorded in PromptKit's
+`docs/roadmap/configuration-collections-mounted-fragments.md`. This request
+describes the public API needs and observable acceptance criteria. It does not
+prescribe ConfigKit's internal design or an implementation plan.
+
+The reviewed public baseline is ConfigKit v0.7.1. The current
+[layered-loading contract](../config.md#layered-loading) lets consumers choose
+sources, import policy, filesystem context, and precedence groups, but does not
+provide an input destination. Existing behavior remains authoritative until an
+extension is adopted.
+
+## Consumer Problem
+
+PromptKit applications assemble independently maintained collections of prompts,
+inference profiles, and backends. Collections can contain identical local names,
+such as `summarize.alerts`, without identifying the same resource. PromptKit wants
+an effective configuration organized by collection, while letting authors omit
+repeated collection and resource-container wrappers from individual files.
+
+A file selected from a collection's `prompts` directory would contain:
+
+```yaml
+summarize.alerts:
+  version: "1"
+  default_profile: provider/brief
+  messages:
+    - role: user
+      content: Summarize the weather alerts.
+  output:
+    format: text
+    validation_mode: none
+```
+
+Given destination `[collections, weatherreporter, prompts]`, its contribution
+would appear in the final application configuration as:
+
+```yaml
+collections:
+  weatherreporter:
+    prompts:
+      summarize.alerts:
+        version: "1"
+        default_profile: provider/brief
+        messages:
+          - role: user
+            content: Summarize the weather alerts.
+        output:
+          format: text
+          validation_mode: none
+```
+
+Another collection can contribute `summarize.alerts` beneath
+`[collections, homewatch, prompts]` without conflicting. After final handoff,
+PromptKit interprets these as `weatherreporter/summarize.alerts` and
+`homewatch/summarize.alerts`. The profile reference is illustrative and must be
+supplied separately by the application configuration.
+
+PromptKit will support one installed definition per prompt. Its optional flat
+`version` is ordinary domain metadata, not a merge identity. This request does
+not need identified-record sequences, sequence-root documents, or a custom
+merge policy.
+
+Authors could write the complete wrappers today, but that repeats assembly
+details in every fragment. Consumer-side parsing and wrapping would put generic
+source processing back into PromptKit and complicate source attribution.
+PromptKit instead wants to select sources and destinations, then receive one
+final configuration through ConfigKit's supported loading lifecycle.
+
+## Minimum Public API
+
+### Per-Input Destination
+
+Allow a destination to be attached to each `Input` passed to `LoadLayered`.
+One possible public spelling is an optional `Destination Path` field on `Input`.
+The name and exact signature are suggestions; equivalent public API designs
+are welcome.
+
+Illustrative consumer code using the proposed field, which does not exist in
+v0.7.1:
+
+```go
+promptInput := configkit.Input{
+    Source: configkit.File("/usr/local/share/collections/weatherreporter/prompts/alerts.yml"),
+    Destination: configkit.Keys("collections", "weatherreporter", "prompts"),
+}
+
+peers := configkit.Underlay{
+    Inputs: []configkit.Input{promptInput},
+}
+```
+
+The consumer would include `peers` in its existing `LayeredOptions` and invoke
+`LoadLayered` with its normal root main input and application `Definition`.
+This is a partial API sketch, not an executable example or a proposed new
+loading entry point. A single public layered load is sufficient for PromptKit;
+it does not require a separate mounting operation on completed results.
+
+The API must let the consumer:
+
+- Express a destination relative to the application configuration root using
+  literal mapping-key segments. Dots, slashes, and numeric-looking text inside
+  a key are not implicit path separators or array indexes. PromptKit's namespace
+  grammar remains its own domain rule.
+- Omit the destination to retain existing root placement. An explicitly empty
+  destination should have the same meaning. Mapping destinations are sufficient;
+  sequence-index destinations are not needed by this request.
+- Assign different destinations to inputs in the same strict composition group,
+  and assign the same destination to inputs in separate precedence groups.
+- Use the destination with existing content-bearing source kinds: host files,
+  native filesystem files, bytes, readers, and mapping sources, subject to their
+  existing acquisition and ownership contracts.
+- Retain the existing import opt-in and filesystem context independently of the
+  destination. A configuration destination is not a filesystem root or base
+  directory.
+
+PromptKit can continue to enumerate an explicitly selected directory and attach
+the same destination to its returned inputs. ConfigKit does not need a new
+directory scanner, namespace registry, filename convention, or PromptKit schema.
+The namespace comes from the application's assembly declaration, not from an
+implicit interpretation of a directory basename.
+
+### Representative Assembly
+
+These are application choices, not ConfigKit-specific reserved paths:
+
+| Selected inputs | Destination key segments |
+| --- | --- |
+| Application main document | Root |
+| `weatherreporter/collection.yml` | `collections`, `weatherreporter` |
+| YAML files under `weatherreporter/prompts` | `collections`, `weatherreporter`, `prompts` |
+| YAML files under `homewatch/prompts` | `collections`, `homewatch`, `prompts` |
+| YAML files under `provider/profiles` | `collections`, `provider`, `profiles` |
+| YAML files under `provider/backends` | `collections`, `provider`, `backends` |
+
+Peer collection contributions belong to a single strict underlay group when the
+application wants conflict detection among them. Intentional operator overrides
+use later groups or main. Destination selection must not establish precedence
+or make source traversal order authorize replacement.
+
+## Required Observable Behavior
+
+### Composition And Precedence
+
+Mounted and explicitly wrapped contributions must have equivalent application
+values and conflict behavior at their effective destinations. Actual source
+locations naturally differ and must remain accurate.
+
+Retain the [strict composition](../config.md#strict-document-composition) and
+[layering](../config.md#layered-loading) rules:
+
+- Disjoint mapping entries at the same destination combine.
+- Overlapping non-mapping values within a strict group conflict, including equal
+  scalars, nulls, and sequences. Different destinations do not collide merely
+  because the source documents share a local key.
+- Later precedence layers recursively override mappings and replace other
+  values. A strict conflict cannot be repaired by an upper layer.
+- Empty mappings do not clear lower definitions; ordinary arrays remain atomic.
+  In particular, `messages` does not acquire sequence-merging behavior.
+- Overlapping destination paths and contributions at their ancestors follow
+  those same rules. No namespace-level uniqueness restriction is requested.
+
+Changing only a prompt's `version` in a later layer changes that field while
+retaining omitted lower-layer fields. ConfigKit must not treat a domain version
+label as a request to replace an entire definition.
+
+### Imports And Existing Structural Directives
+
+An input with imports enabled must be able to use its existing source-root
+`configkit.imports` directive while contributing application data at a nested
+destination. The directive remains structural configuration, not an application
+field below that destination.
+
+For the minimum API, imports inherit their importing input's destination,
+including transitive imports. Import paths continue to resolve relative to
+their declaring source's filesystem context. A mounted document must not send
+its imported application fields back to the configuration root accidentally.
+
+Existing opt-in, containment, missing-input, cycle, and repeated-source behavior
+must remain applicable. A different destination is not a request to bypass the
+current rejection of a repeated physical source within a strict group.
+
+Sibling `extends` must resolve against mappings at their effective destinations.
+For example, two independently supplied profile fragments mounted beneath the
+same collection's `profiles` mapping can establish `extends: brief` once they
+compose. Inheritance remains ConfigKit-owned; PromptKit does not perform another
+relationship-resolution pass.
+
+### Protected Specification Paths
+
+The distinction between source-local field names and effective application
+paths is essential. PromptKit's main document will declare `version: 1` at the
+configuration root. A separate collection metadata file can contain:
+
+```yaml
+version: "2.4.0"
+```
+
+Mounted at `[collections, weatherreporter]`, that field is an ordinary collection
+release label. It must not be rejected as an attempt to contribute the protected
+root specification field. The same applies to a prompt's nested optional
+version. Only the main-owned specification declaration uses the application's
+configured [VersionRule](../config.md#application-schema-versions).
+
+Conversely, placement must not permit an underlay or imported fragment to claim
+or replace the actual protected specification path or an ancestor that would
+replace it. The public contract must define protection in terms of effective
+application paths, rather than reserving the spelling `version` in every source.
+Protection must remain valid with imports, inheritance, overlays, and explicit
+CLI overrides.
+
+PromptKit needs one main-owned specification check with the existing lifecycle.
+It does not need main mounted away from the root, integer-to-string conversion
+for every nested `version`, or separate compatibility checks for every fragment.
+
+### Typed Loading, Diagnostics, And Inspection
+
+The destination must be visible consistently through the ordinary public
+loading and inspection surface:
+
+- Final typed configuration and application callbacks use effective destination
+  paths. Defaults, resolution, and validation retain the existing single-load
+  lifecycle; fragments are not independently validated as whole applications.
+- Metadata and presence queries distinguish omission, explicit null, and other
+  explicit values at the mounted paths.
+- Diagnostics identify the effective conflicting or invalid path and the real
+  contributing source locations. Consumers can determine which source and
+  placement produced a value without recreating that relationship themselves.
+- Effective rendering, explanations, history, and configuration comparison agree
+  with the final configuration. Existing sensitivity and disclosure rules apply
+  to mounted fields, including application path-based secret classification.
+- Unsupported destination forms and destination-related loading failures use
+  the normal structured error boundary. Exact new diagnostic codes, if needed,
+  are for ConfigKit to define.
+
+PromptKit does not require a separate mount registry or new inspection facade.
+Existing inspection APIs are sufficient if they expose accurate effective paths,
+source attribution, and placement information. ConfigKit should document how
+source-local locations relate to effective paths.
+
+### Source-Relative Resources And Lifecycle
+
+For a mounted field such as `content_file: ./summary.md`, obtaining its effective
+origin and calling `Result.SourceContext` or `Resolution.SourceContext` must
+still identify the declaring source's filesystem and base directory. The same
+holds when that field survives an override or is inherited into another mapping.
+Its configuration destination must not change the meaning of the relative file
+reference.
+
+Retain existing source ownership, load completion, result lifetime, containment,
+and resource-access behavior. Destinations must participate in documented load
+limits without creating a way to bypass them; this request does not prescribe
+new limit values or their accounting machinery.
+
+## Optional Follow-Ups, Not Prerequisites
+
+**Import destinations in YAML.** A destination on an import directive could let
+publishers describe assembly in configuration rather than Go. Proposal 3
+recommends destinations relative to the importing document's destination, with
+omission retaining that destination. This is useful, but per-input placement
+through the public API is sufficient for initial PromptKit adoption. No new
+directive spelling is selected by this request.
+
+**Independent specification headers.** A collection entry document might later
+declare its own supported specification version. That needs a distinct contract
+for checking the header and determining its role in the composed configuration.
+Mounting collection release metadata does not supply this capability. Keep it a
+separate request if PromptKit decides it is necessary.
+
+**Cross-collection inheritance.** Nested collection profiles are not immediate
+siblings across collections. Current sibling inheritance remains sufficient for
+the initial proposal, with authored definitions flattened where necessary.
+Generic cross-path inheritance could be considered separately if consumer needs
+justify revisiting the [deferred scope](deferred.md). Mounting must not silently
+reinterpret `extends: provider/brief` as a cross-collection reference.
+
+PromptKit also does not request collection installation, automatic directory
+discovery, remote fetching, namespace ownership enforcement, dependency solving,
+live reload, filename-derived identity, or arbitrary document transformations.
+Its qualified resource IDs, optional prompt version semantics, collection
+inventory, and execution APIs remain PromptKit responsibilities.
+
+## Public Acceptance Scenarios
+
+Evaluate the extension through supported public loading and inspection APIs:
+
+| Scenario | Expected consumer-visible result |
+| --- | --- |
+| Destination omitted or empty | Existing root-placement behavior |
+| Same fragment shape mounted under two distinct collection keys from independent sources | Two separate effective resources |
+| Disjoint inputs at the same destination in one group | Mapping contributions combine |
+| Equal or unequal overlapping scalar fields in one group | Structured composition conflict with both source locations |
+| Same destination across deliberate precedence tiers | Existing recursive overlay behavior |
+| Version-only prompt override | Label changes; omitted prompt body fields survive |
+| Nested mounted import without a destination directive | Imported fields contribute at the inherited destination |
+| Local profile inheritance across mounted peer fragments | Parent resolves at the effective sibling scope |
+| Collection metadata containing `version` mounted below root | Ordinary nested field, independent of root VersionRule |
+| Mounted/imported contribution actually targeting the protected version path | Rejected under version ownership rules |
+| Mounted field using source-relative content, including inheritance | Original declaring resource context remains available |
+| Mounted explicit null and omitted field | Distinct effective presence information |
+| Mounted validation error or secret field | Effective paths, physical locations, and existing disclosure rules agree |
+| File, native filesystem, byte, reader, or mapping input with equivalent content | Equivalent application values, subject to existing source contracts |
+| Unsupported destination or failed load | Normal structured failure, no usable partial result |
+
+The minimum usable outcome is a consumer that selects collection sources and
+destinations, performs one ordinary layered load, and receives final typed
+configuration with reliable diagnostics and inspection. It should need no
+consumer-side source rewriting, generic merging, or provenance reconstruction.

docs/roadmap/remediation.md

@@ -0,0 +1,89 @@
+# Input destination review findings
+
+Reviewed `d3d468a..945e111` against the approved
+[input-destinations roadmap](input-destinations.md),
+[implementation plan](implementation.md), and
+[ADR 0011](../adr/0011-input-destinations.md).
+
+The root-owned destination fields, placement before strict composition,
+transitive import placement, effective-path version ownership, final lifecycle,
+source records, resource contexts, retained history, and existing disclosure
+mechanisms broadly match the selected architecture. The required correction
+below concerns an early diagnostic path, not loading or composition semantics.
+No additional unintended strengthening of contracts was identified.
+
+## 1. Rebase known Mapping-source failure paths to the input destination (P2)
+
+Status: complete. Known Mapping value-builder paths are now prefixed with the
+normalized destination at acquisition, preserving semantic key/index segments.
+Public regressions cover mounted main and underlay failures, escaped keys,
+sequence indices, cyclic values, unchanged root paths, and source-constructor
+errors retaining source coordinates. The mounted value cases failed before the
+fix and pass afterward. Existing directive/syntax checks remain unchanged.
+Focused destination/source/diagnostic/import tests, `./scripts/check.sh`, and
+`GOTOOLCHAIN=local GOPROXY=off go test -race ./...` passed on
+`go1.26.8 linux/amd64`.
+
+Affected: `assembleBaseInputTracked` in
+[load_input.go](../../internal/engine/load_input.go), lines 27–32 at the reviewed
+commit; the Mapping failure originates in `readSource` in
+[source.go](../../internal/engine/source.go), lines 206–208.
+
+`Mapping` snapshots its input through the existing value builder. When a nested
+value is unsupported, cyclic, or exceeds a value-builder limit, the retained
+issue already identifies a semantic path inside that application mapping.
+`readSource` turns it into a structured diagnostic. The early return from
+`assembleBaseInputTracked` annotates the source record with its destination but
+returns those diagnostic paths unchanged.
+
+For example, select this input as either main or an underlay:
+
+```go
+configkit.Input{
+    Source: configkit.Mapping("bad mapping", map[string]any{
+        "item": map[string]any{"bad": func() {}},
+    }),
+    Destination: configkit.Keys("catalog", "entries"),
+}
+```
+
+The load correctly fails with `source.invalid`, but `Diagnostic.Path` is
+`/item/bad` rather than `/catalog/entries/item/bad`. The source record correctly
+reports `/catalog/entries`, so the two inspection records use inconsistent
+application coordinates. A consumer displaying or associating the failure with
+the final application shape would point to the wrong configuration field.
+
+This diverges from implementation decision 10 and Stage 6: existing paths that
+genuinely identify application content must be translated to effective paths
+exactly once. A Mapping value-builder issue has that information; it is not a
+source-read or YAML syntax failure for which a logical child path is unavailable.
+
+Required remediation:
+
+- Prefix known application-relative Mapping value-builder diagnostic paths with
+  the normalized input destination at the acquisition boundary. Preserve key
+  escaping and sequence-index intent in the existing semantic Path model.
+- Keep source IDs, original primary/related locations, codes, value-free
+  messages, source destinations, and nil-result behavior unchanged. Root
+  placement must retain its current paths.
+- Do not blanket-prefix parse/read failures, source-constructor errors, or
+  structural import-directive diagnostics. Do not invent logical child paths
+  for failures that do not identify application content.
+- Add bounded regression coverage through the public API for mounted main and
+  underlay Mapping failures, alongside unchanged root placement. Reuse existing
+  syntax/directive tests to protect their different coordinate convention.
+- Run the focused destination/source/diagnostic checks and the everyday check.
+  Reconcile the completed plan's diagnostic evidence with this correction;
+  do not redefine the agreed effective-path behavior to accept the gap.
+
+## Review validation
+
+- `GOTOOLCHAIN=local ./scripts/check.sh` passed at `945e111` on
+  `go1.26.8 linux/amd64` (formatting, whitespace, tests, vet, and build).
+- `GOTOOLCHAIN=local GOPROXY=off go test -race ./...` passed.
+- `GOTOOLCHAIN=local GOPROXY=off go test -count=1 ./...` passed.
+- An additional external-package probe in a disposable checkout outside the
+  repository failed for both main and underlay placement, observing `/item/bad`
+  instead of `/catalog/entries/item/bad` with `source.invalid`.
+- No production fixes or regression tests were added to this repository during
+  the review. No performance measurements or new guarantees were inferred.

example_test.go

@@ -30,6 +30,32 @@ func ExampleNoSource() {
 	// Output: 4 0 <nil>
 }
 
+func ExampleDiff() {
+	type Config struct {
+		Workers int `yaml:"workers"`
+	}
+	before, err := configkit.Load[Config](configkit.Mapping("before", map[string]any{"workers": 2}))
+	if err != nil {
+		fmt.Println(err)
+		return
+	}
+	after, err := configkit.Load[Config](configkit.Mapping("after", map[string]any{"workers": 4}))
+	if err != nil {
+		fmt.Println(err)
+		return
+	}
+	differences, err := configkit.Diff(before, after)
+	if err != nil {
+		fmt.Println(err)
+		return
+	}
+	for _, difference := range differences {
+		fmt.Printf("%s: %s -> %s\n", difference.Path.String(),
+			strings.TrimSpace(difference.Left.YAML), strings.TrimSpace(difference.Right.YAML))
+	}
+	// Output: /workers: 2 -> 4
+}
+
 func ExampleValidation_Error() {
 	type Config struct {
 		First  string `yaml:"first"`

examples/consumers/destinations.go

@@ -0,0 +1,159 @@
+package consumers
+
+import (
+	"errors"
+	"fmt"
+	"io/fs"
+	"path"
+
+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+)
+
+// CollectionBundleConfig is a representative application-owned collection
+// shape. Collection and prompt version labels remain ordinary domain fields.
+type CollectionBundleConfig struct {
+	Version     string                          `yaml:"version"`
+	Collections map[string]CollectionDefinition `yaml:"collections"`
+}
+
+type CollectionDefinition struct {
+	Name        string                       `yaml:"name"`
+	Version     string                       `yaml:"version"`
+	Description string                       `yaml:"description"`
+	Prompts     map[string]CollectionPrompt  `yaml:"prompts"`
+	Profiles    map[string]CollectionProfile `yaml:"profiles"`
+}
+
+type CollectionPrompt struct {
+	Version        string              `yaml:"version"`
+	DefaultProfile string              `yaml:"default_profile"`
+	ContentFile    string              `yaml:"content_file"`
+	ResourceText   string              `yaml:"resource_text"`
+	Messages       []CollectionMessage `yaml:"messages"`
+}
+
+type CollectionMessage struct {
+	Role    string `yaml:"role"`
+	Content string `yaml:"content"`
+}
+
+type CollectionProfile struct {
+	Format      string  `yaml:"format"`
+	Temperature float64 `yaml:"temperature"`
+}
+
+// LoadCollectionBundle demonstrates one layered collection load. Its main
+// document owns the application schema version; imported collection metadata,
+// prompt/profile peers, and an operator prompt-version override use ordinary
+// destinations and domain fields.
+func LoadCollectionBundle() (*configkit.Result[CollectionBundleConfig], error) {
+	files, err := fs.Sub(bundledFiles, "testdata/collection-bundle")
+	if err != nil {
+		return nil, err
+	}
+	bundle := configkit.NewFilesystem("collection bundle", files)
+	collectionDestination := configkit.Keys("collections", "weatherreporter")
+	promptDestination := collectionDestination.Key("prompts")
+	profileDestination := collectionDestination.Key("profiles")
+	return configkit.LoadLayered(
+		configkit.Input{Source: configkit.Bytes("application main", []byte("version: 1\n"))},
+		configkit.LayeredOptions[CollectionBundleConfig]{
+			Definition: configkit.Definition[CollectionBundleConfig]{
+				Version: &configkit.VersionRule{Path: configkit.Keys("version"), Check: func(version configkit.Version, _ *configkit.Validation) error {
+					if !version.Present || version.Text != "1" {
+						return errors.New("unsupported application schema version")
+					}
+					return nil
+				}},
+				Resolve:  resolveCollectionResources,
+				Validate: validateCollectionBundle,
+			},
+			Underlays: []configkit.Underlay{
+				{Inputs: []configkit.Input{
+					{Source: bundle.File("collections/weather/collection.yml"), Imports: true, Destination: collectionDestination},
+					{Source: bundle.File("collections/weather/prompts/brief.yml"), Destination: promptDestination},
+					{Source: bundle.File("collections/weather/prompts/custom.yml"), Destination: promptDestination},
+					{Source: bundle.File("collections/weather/profiles/compact.yml"), Destination: profileDestination},
+					{Source: bundle.File("collections/weather/profiles/weather.yml"), Destination: profileDestination},
+				}},
+				{Inputs: []configkit.Input{{
+					Source: bundle.File("operators/weather-prompt-version.yml"), Destination: promptDestination,
+				}}},
+			},
+		},
+	)
+}
+
+func resolveCollectionResources(configuration *CollectionBundleConfig, resolution *configkit.Resolution) error {
+	for collectionID, collection := range configuration.Collections {
+		for promptID, prompt := range collection.Prompts {
+			if prompt.ContentFile == "" {
+				continue
+			}
+			contentPath := configkit.Keys("collections", collectionID, "prompts", promptID, "content_file")
+			info, found := resolution.InputInfo(contentPath)
+			if !found || len(info.Origin.Locations) != 1 {
+				return fmt.Errorf("prompt resource has no single declaring source")
+			}
+			resourceSource, found := resolution.Source(info.Origin.Locations[0].SourceID)
+			if !found {
+				return fmt.Errorf("prompt resource source is unavailable")
+			}
+			context, found := resolution.SourceContext(resourceSource.ID)
+			if !found {
+				return fmt.Errorf("prompt resource context is unavailable")
+			}
+			data, err := fs.ReadFile(context.FS, path.Join(context.BaseDir, prompt.ContentFile))
+			if err != nil {
+				return fmt.Errorf("read prompt resource: %w", err)
+			}
+			prompt.ResourceText = string(data)
+			collection.Prompts[promptID] = prompt
+			resolution.Record(
+				configkit.Keys("collections", collectionID, "prompts", promptID, "resource_text"),
+				configkit.ChangeNormalization, "read source-relative prompt content", contentPath,
+			)
+		}
+		configuration.Collections[collectionID] = collection
+	}
+	return nil
+}
+
+func validateCollectionBundle(configuration *CollectionBundleConfig, validation *configkit.Validation) {
+	for collectionID, collection := range configuration.Collections {
+		for promptID, prompt := range collection.Prompts {
+			if prompt.DefaultProfile == "" {
+				continue
+			}
+			if _, found := collection.Profiles[prompt.DefaultProfile]; !found {
+				validation.Error(configkit.Keys("collections", collectionID, "prompts", promptID, "default_profile"), "must name a profile in this collection")
+			}
+		}
+	}
+}
+
+// ReadCollectionPromptContent follows the effective content field's physical
+// source, including when it was inherited from a peer prompt.
+func ReadCollectionPromptContent(result *configkit.Result[CollectionBundleConfig], collectionID, promptID string) (string, error) {
+	if result == nil {
+		return "", errors.New("collection result is nil")
+	}
+	contentPath := configkit.Keys("collections", collectionID, "prompts", promptID, "content_file")
+	info, found := result.Metadata().Lookup(contentPath)
+	if !found || len(info.Origin.Locations) != 1 {
+		return "", errors.New("prompt resource has no single declaring source")
+	}
+	context, found := result.SourceContext(info.Origin.Locations[0].SourceID)
+	if !found {
+		return "", errors.New("prompt resource context is unavailable")
+	}
+	prompt, found := result.Config.Collections[collectionID].Prompts[promptID]
+	if !found {
+		return "", errors.New("prompt is unavailable")
+	}
+	data, err := fs.ReadFile(context.FS, path.Join(context.BaseDir, prompt.ContentFile))
+	if err != nil {
+		return "", err
+	}
+	return string(data), nil
+}

examples/consumers/destinations_test.go

@@ -0,0 +1,116 @@
+package consumers_test
+
+import (
+	"errors"
+	"fmt"
+	"testing"
+
+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+	"gitea.maximumdirect.net/eric/ConfigKit/examples/consumers"
+)
+
+func Example_inputDestination() {
+	mounted, err := configkit.LoadLayered[map[string]any](configkit.Input{
+		Source: configkit.Mapping("weather prompt", map[string]any{
+			"summarize.alerts": map[string]any{"version": "1"},
+		}),
+		Destination: configkit.Keys("collections", "weather.reporter", "prompts"),
+	})
+	if err != nil {
+		fmt.Println(err)
+		return
+	}
+	root, err := configkit.LoadLayered[map[string]any](configkit.Input{
+		Source: configkit.Bytes("standalone", []byte("name: standalone\n")),
+	})
+	if err != nil {
+		fmt.Println(err)
+		return
+	}
+	_, found := mounted.Config["collections"]
+	fmt.Println(found, root.Config["name"])
+	// Output: true standalone
+}
+
+func TestCollectionBundleAssemblesMountedPeersAndResources(t *testing.T) {
+	result, err := consumers.LoadCollectionBundle()
+	if err != nil {
+		t.Fatalf("LoadCollectionBundle: %v", err)
+	}
+	collection := result.Config.Collections["weatherreporter"]
+	if result.Config.Version != "1" || collection.Name != "Weather Reporter" || collection.Version != "2.4.0" {
+		t.Fatalf("main and collection versions = %q, %#v", result.Config.Version, collection)
+	}
+	brief := collection.Prompts["brief"]
+	custom := collection.Prompts["custom"]
+	if brief.Version != "2" || brief.DefaultProfile != "compact" || brief.ContentFile != "welcome.txt" || len(brief.Messages) != 1 {
+		t.Fatalf("version-only override replaced lower prompt fields: %#v", brief)
+	}
+	if custom.Version != "2" || custom.DefaultProfile != "weather" || custom.ContentFile != brief.ContentFile ||
+		len(custom.Messages) != 1 || custom.ResourceText != "Welcome to the weather collection.\n" {
+		t.Fatalf("inherited prompt = %#v", custom)
+	}
+	weatherProfile := collection.Profiles["weather"]
+	if weatherProfile.Format != "text" || weatherProfile.Temperature != 0.4 {
+		t.Fatalf("inherited profile = %#v", weatherProfile)
+	}
+	resource, err := consumers.ReadCollectionPromptContent(result, "weatherreporter", "custom")
+	if err != nil || resource != custom.ResourceText {
+		t.Fatalf("inherited prompt resource = %q, %v", resource, err)
+	}
+
+	versionInfo, ok := result.Metadata().Lookup(configkit.Keys("version"))
+	if !ok || !versionInfo.Explicit || versionInfo.Origin.Layer != configkit.LayerBase || len(versionInfo.Origin.Locations) != 1 {
+		t.Fatalf("main-owned version metadata = %#v, %v", versionInfo, ok)
+	}
+	collectionVersionPath := configkit.Keys("collections", "weatherreporter", "version")
+	collectionVersion, ok := result.Metadata().Lookup(collectionVersionPath)
+	if !ok || !collectionVersion.Explicit || collectionVersion.Origin.Layer != configkit.LayerUnderlay || len(collectionVersion.Origin.Locations) != 1 {
+		t.Fatalf("ordinary collection version metadata = %#v, %v", collectionVersion, ok)
+	}
+	var metadataSource configkit.SourceInfo
+	var parentPromptSource configkit.SourceInfo
+	var promptVersionSource configkit.SourceInfo
+	for _, source := range result.Sources() {
+		switch source.Path {
+		case "collections/weather/metadata.yml":
+			metadataSource = source
+		case "collections/weather/prompts/brief.yml":
+			parentPromptSource = source
+		case "operators/weather-prompt-version.yml":
+			promptVersionSource = source
+		}
+	}
+	collectionVersionLocation := collectionVersion.Origin.Locations[0]
+	if metadataSource.ID == "" || collectionVersionLocation.SourceID != metadataSource.ID ||
+		metadataSource.Destination.String() != "/collections/weatherreporter" || collectionVersionLocation.Line != 1 {
+		t.Fatalf("imported collection version source = %#v, %#v", metadataSource, collectionVersionLocation)
+	}
+	if promptVersionSource.ID == "" || promptVersionSource.Destination.String() != "/collections/weatherreporter/prompts" || promptVersionSource.UnderlayIndex != 2 {
+		t.Fatalf("prompt version source = %#v", promptVersionSource)
+	}
+	contentPath := configkit.Keys("collections", "weatherreporter", "prompts", "custom", "content_file")
+	contentInfo, ok := result.Metadata().Lookup(contentPath)
+	if !ok || !contentInfo.Explicit || len(contentInfo.Origin.Inheritance) != 1 || len(contentInfo.Origin.Locations) != 1 {
+		t.Fatalf("inherited content field metadata = %#v, %v", contentInfo, ok)
+	}
+	contentLocation := contentInfo.Origin.Locations[0]
+	if parentPromptSource.ID == "" || contentLocation.SourceID != parentPromptSource.ID || contentLocation.Line != 4 ||
+		parentPromptSource.Destination.String() != "/collections/weatherreporter/prompts" {
+		t.Fatalf("inherited resource source coordinates = %#v, source %#v", contentLocation, parentPromptSource)
+	}
+}
+
+func TestCollectionPeerPromptConflictsRemainStrict(t *testing.T) {
+	destination := configkit.Keys("collections", "weatherreporter", "prompts")
+	_, err := configkit.LoadLayered[map[string]any](configkit.Input{Source: configkit.NoSource()}, configkit.LayeredOptions[map[string]any]{
+		Underlays: []configkit.Underlay{{Inputs: []configkit.Input{
+			{Source: configkit.Bytes("peer-a", []byte("brief: {version: '1'}\n")), Destination: destination},
+			{Source: configkit.Bytes("peer-b", []byte("brief: {version: '1'}\n")), Destination: destination},
+		}}},
+	})
+	var loadError *configkit.LoadError
+	if !errors.As(err, &loadError) || len(loadError.Diagnostics()) == 0 || loadError.Diagnostics()[0].Code != configkit.CodeComposeConflict {
+		t.Fatalf("duplicate peer prompt error = %v", err)
+	}
+}

examples/consumers/diff.go

@@ -0,0 +1,136 @@
+package consumers
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+
+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+)
+
+// FileComparisonConfig is a small application-owned shape for comparing
+// caller-selected configuration files.
+type FileComparisonConfig struct {
+	Name    string         `yaml:"name"`
+	Entries map[string]any `yaml:"entries"`
+}
+
+// CompareFiles loads two caller-selected files with the same application
+// definition, then formats only the safe records returned by configkit.Diff.
+func CompareFiles(leftPath, rightPath string) (string, error) {
+	options := configkit.Options[FileComparisonConfig]{
+		Definition: configkit.Definition[FileComparisonConfig]{
+			Defaults: func() FileComparisonConfig {
+				return FileComparisonConfig{Entries: map[string]any{}}
+			},
+		},
+	}
+	left, err := configkit.Load(configkit.File(leftPath), options)
+	if err != nil {
+		return "", fmt.Errorf("load left configuration: %w", err)
+	}
+	right, err := configkit.Load(configkit.File(rightPath), options)
+	if err != nil {
+		return "", fmt.Errorf("load right configuration: %w", err)
+	}
+	differences, err := configkit.Diff(left, right)
+	if err != nil {
+		return "", err
+	}
+	return FormatDifferences(differences), nil
+}
+
+// RolloutConfig models a service endpoint whose URL is derived by the
+// application resolver and whose credential reference is classified.
+type RolloutConfig struct {
+	Service RolloutService `yaml:"service"`
+}
+
+// RolloutService contains endpoint settings and a classified credential.
+type RolloutService struct {
+	Endpoint   RolloutEndpoint   `yaml:"endpoint"`
+	Credential RolloutCredential `yaml:"credential"`
+}
+
+// RolloutEndpoint is the effective destination used by the application.
+type RolloutEndpoint struct {
+	Host string `yaml:"host"`
+	Port int    `yaml:"port"`
+	URL  string `yaml:"url"`
+}
+
+// RolloutCredential holds only a typed secret reference in configuration.
+type RolloutCredential struct {
+	Token configkit.Secret `yaml:"token" configkit:"secret"`
+}
+
+// LoadRollout loads a base file, optionally with one selected configuration
+// overlay. Resolution derives the effective URL after the overlay is applied.
+func LoadRollout(basePath, overlayName string) (*configkit.Result[RolloutConfig], error) {
+	return configkit.Load(configkit.File(basePath), configkit.Options[RolloutConfig]{
+		Overlay: overlayName,
+		Definition: configkit.Definition[RolloutConfig]{
+			Resolve: resolveRollout,
+		},
+	})
+}
+
+// CompareRolloutOverlay compares the effective base configuration with that
+// same file plus one selected overlay. It presents only safe diff records.
+func CompareRolloutOverlay(basePath, overlayName string) (string, error) {
+	base, err := LoadRollout(basePath, "")
+	if err != nil {
+		return "", fmt.Errorf("load base configuration: %w", err)
+	}
+	withOverlay, err := LoadRollout(basePath, overlayName)
+	if err != nil {
+		return "", fmt.Errorf("load overlay configuration: %w", err)
+	}
+	differences, err := configkit.Diff(base, withOverlay)
+	if err != nil {
+		return "", err
+	}
+	return FormatDifferences(differences), nil
+}
+
+func resolveRollout(configuration *RolloutConfig, resolution *configkit.Resolution) error {
+	endpoint := &configuration.Service.Endpoint
+	if endpoint.Host == "" || endpoint.Port <= 0 {
+		return nil
+	}
+	url := fmt.Sprintf("https://%s:%d", endpoint.Host, endpoint.Port)
+	if endpoint.URL != url {
+		endpoint.URL = url
+		resolution.Record(configkit.Keys("service", "endpoint", "url"),
+			configkit.ChangeNormalization, "derived endpoint URL",
+			configkit.Keys("service", "endpoint", "host"),
+			configkit.Keys("service", "endpoint", "port"))
+	}
+	return nil
+}
+
+// FormatDifferences is consumer-owned presentation. It distinguishes absence
+// through Present and reports withheld changes through HiddenChanged without
+// interpreting redaction marker text.
+func FormatDifferences(differences []configkit.Difference) string {
+	if len(differences) == 0 {
+		return "No effective changes.\n"
+	}
+	var output strings.Builder
+	for _, difference := range differences {
+		fmt.Fprintf(&output, "%s: left=%s right=%s", difference.Path.String(),
+			formatSnapshot(difference.Left), formatSnapshot(difference.Right))
+		if difference.HiddenChanged {
+			output.WriteString(" hidden-change")
+		}
+		output.WriteByte('\n')
+	}
+	return output.String()
+}
+
+func formatSnapshot(snapshot configkit.ValueSnapshot) string {
+	if !snapshot.Present {
+		return "<absent>"
+	}
+	return strconv.Quote(snapshot.YAML)
+}

examples/consumers/diff_test.go

@@ -0,0 +1,187 @@
+package consumers_test
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+	"gitea.maximumdirect.net/eric/ConfigKit/examples/consumers"
+)
+
+func ExampleCompareFiles() {
+	directory, err := os.MkdirTemp("", "configkit-diff-files-")
+	if err != nil {
+		fmt.Println(err)
+		return
+	}
+	defer os.RemoveAll(directory)
+	leftPath := filepath.Join(directory, "before.yml")
+	rightPath := filepath.Join(directory, "after.yml")
+	if err := os.WriteFile(leftPath, []byte("name: before\nentries: {}\n"), 0o600); err != nil {
+		fmt.Println(err)
+		return
+	}
+	if err := os.WriteFile(rightPath, []byte("name: after\nentries:\n  added: null\n"), 0o600); err != nil {
+		fmt.Println(err)
+		return
+	}
+	output, err := consumers.CompareFiles(leftPath, rightPath)
+	if err != nil {
+		fmt.Println(err)
+		return
+	}
+	fmt.Print(output)
+	// Output:
+	// /entries/added: left=<absent> right="null\n"
+	// /name: left="before\n" right="after\n"
+}
+
+func ExampleCompareRolloutOverlay() {
+	const baseToken = "CONFIGKIT_DIFF_EXAMPLE_BASE_TOKEN"
+	const overlayToken = "CONFIGKIT_DIFF_EXAMPLE_OVERLAY_TOKEN"
+	defer preserveEnvironment(baseToken)()
+	defer preserveEnvironment(overlayToken)()
+	_ = os.Setenv(baseToken, "disposable-example-base-credential")
+	_ = os.Setenv(overlayToken, "disposable-example-overlay-credential")
+
+	directory, err := os.MkdirTemp("", "configkit-diff-overlay-")
+	if err != nil {
+		fmt.Println(err)
+		return
+	}
+	defer os.RemoveAll(directory)
+	basePath := filepath.Join(directory, "config.yml")
+	overlayPath := filepath.Join(directory, "overlays", "canary.yml")
+	if err := os.MkdirAll(filepath.Dir(overlayPath), 0o700); err != nil {
+		fmt.Println(err)
+		return
+	}
+	base := "service:\n  endpoint:\n    host: base.example\n    port: 8443\n  credential:\n    token: " + baseToken + "\n"
+	overlay := "service:\n  endpoint:\n    host: canary.example\n  credential:\n    token: " + overlayToken + "\n"
+	if err := os.WriteFile(basePath, []byte(base), 0o600); err != nil {
+		fmt.Println(err)
+		return
+	}
+	if err := os.WriteFile(overlayPath, []byte(overlay), 0o600); err != nil {
+		fmt.Println(err)
+		return
+	}
+	output, err := consumers.CompareRolloutOverlay(basePath, "canary")
+	if err != nil {
+		fmt.Println(err)
+		return
+	}
+	fmt.Print(output)
+	// Output:
+	// /service/credential/token: left="'[REDACTED]'\n" right="'[REDACTED]'\n" hidden-change
+	// /service/endpoint/host: left="base.example\n" right="canary.example\n"
+	// /service/endpoint/url: left="https://base.example:8443\n" right="https://canary.example:8443\n"
+}
+
+func TestCompareFilesUsesCallerSelectedSourcesAndSafePresence(t *testing.T) {
+	directory := t.TempDir()
+	leftPath := filepath.Join(directory, "before.yml")
+	rightPath := filepath.Join(directory, "after.yml")
+	writeConfiguration(t, leftPath, "name: before\nentries: {}\n")
+	writeConfiguration(t, rightPath, "name: after\nentries:\n  added: null\n")
+
+	output, err := consumers.CompareFiles(leftPath, rightPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := "/entries/added: left=<absent> right=\"null\\n\"\n" +
+		"/name: left=\"before\\n\" right=\"after\\n\"\n"
+	if output != want {
+		t.Fatalf("comparison output = %q, want %q", output, want)
+	}
+	if again, err := consumers.CompareFiles(leftPath, rightPath); err != nil || again != output {
+		t.Fatalf("repeat output = %q, %v", again, err)
+	}
+}
+
+func TestCompareFilesReturnsEachLoadError(t *testing.T) {
+	directory := t.TempDir()
+	leftPath := filepath.Join(directory, "before.yml")
+	rightPath := filepath.Join(directory, "after.yml")
+	writeConfiguration(t, leftPath, "name: before\n")
+	writeConfiguration(t, rightPath, "unknown: invalid\n")
+
+	output, err := consumers.CompareFiles(leftPath, rightPath)
+	if err == nil || output != "" || !strings.Contains(err.Error(), "load right configuration") {
+		t.Fatalf("right load failure = %q, %v", output, err)
+	}
+	if _, err := consumers.CompareFiles(filepath.Join(directory, "missing.yml"), rightPath); err == nil || !strings.Contains(err.Error(), "load left configuration") {
+		t.Fatalf("left load failure = %v", err)
+	}
+}
+
+func TestCompareRolloutOverlayShowsResolvedSafeChangesAndRetainsSiblings(t *testing.T) {
+	t.Setenv("CONFIGKIT_DIFF_BASE_TOKEN", "disposable-base-credential")
+	t.Setenv("CONFIGKIT_DIFF_OVERLAY_TOKEN", "disposable-overlay-credential")
+	directory := t.TempDir()
+	basePath := filepath.Join(directory, "config.yml")
+	overlayPath := filepath.Join(directory, "overlays", "canary.yml")
+	if err := os.MkdirAll(filepath.Dir(overlayPath), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	writeConfiguration(t, basePath, "service:\n  endpoint:\n    host: base.example\n    port: 8443\n  credential:\n    token: CONFIGKIT_DIFF_BASE_TOKEN\n")
+	writeConfiguration(t, overlayPath, "service:\n  endpoint:\n    host: canary.example\n  credential:\n    token: CONFIGKIT_DIFF_OVERLAY_TOKEN\n")
+
+	base, err := consumers.LoadRollout(basePath, "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	withOverlay, err := consumers.LoadRollout(basePath, "canary")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if base.Config.Service.Endpoint.Port != 8443 || withOverlay.Config.Service.Endpoint.Port != 8443 {
+		t.Fatalf("lower-priority port was not retained: base=%#v overlay=%#v", base.Config.Service.Endpoint, withOverlay.Config.Service.Endpoint)
+	}
+	urlInfo, found := withOverlay.Metadata().Lookup(configkit.Keys("service", "endpoint", "url"))
+	if !found || urlInfo.Origin.Layer != configkit.LayerResolution || withOverlay.Config.Service.Endpoint.URL != "https://canary.example:8443" {
+		t.Fatalf("resolved endpoint = %#v, metadata=%#v, %v", withOverlay.Config.Service.Endpoint, urlInfo, found)
+	}
+
+	differences, err := configkit.Diff(base, withOverlay)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(differences) != 3 {
+		t.Fatalf("differences = %#v", differences)
+	}
+	wantPaths := []string{"/service/credential/token", "/service/endpoint/host", "/service/endpoint/url"}
+	for index, difference := range differences {
+		if got := difference.Path.String(); got != wantPaths[index] {
+			t.Errorf("path[%d] = %q, want %q", index, got, wantPaths[index])
+		}
+	}
+	secret := differences[0]
+	if !secret.Left.Redacted || !secret.Right.Redacted || !secret.HiddenChanged || secret.Left.YAML != "'[REDACTED]'\n" || secret.Right.YAML != "'[REDACTED]'\n" {
+		t.Fatalf("classified credential difference = %#v", secret)
+	}
+	if strings.Contains(consumers.FormatDifferences(differences), "disposable-") {
+		t.Fatal("formatted differences exposed credential contents")
+	}
+
+	output, err := consumers.CompareRolloutOverlay(basePath, "canary")
+	if err != nil || output != consumers.FormatDifferences(differences) {
+		t.Fatalf("formatted base/overlay comparison = %q, %v", output, err)
+	}
+}
+
+func TestFormatDifferencesUsesRecordMembershipForNoChange(t *testing.T) {
+	if got := consumers.FormatDifferences(nil); got != "No effective changes.\n" {
+		t.Fatalf("no-change output = %q", got)
+	}
+}
+
+func writeConfiguration(t *testing.T, filename, contents string) {
+	t.Helper()
+	if err := os.WriteFile(filename, []byte(contents), 0o600); err != nil {
+		t.Fatal(err)
+	}
+}

examples/consumers/layered.go

@@ -9,7 +9,7 @@ import (
 	configkit "gitea.maximumdirect.net/eric/ConfigKit"
 )
 
-//go:embed testdata/native-source testdata/layered-bundle
+//go:embed testdata/native-source testdata/layered-bundle testdata/collection-bundle
 var bundledFiles embed.FS
 
 // BundledConfig is a small configuration loaded directly from an embedded file.

examples/consumers/testdata/collection-bundle/collections/weather/collection.yml

@@ -0,0 +1,4 @@
+configkit:
+  imports:
+    - path: metadata.yml
+name: Weather Reporter

examples/consumers/testdata/collection-bundle/collections/weather/metadata.yml

@@ -0,0 +1,2 @@
+version: "2.4.0"
+description: Imported collection metadata.

examples/consumers/testdata/collection-bundle/collections/weather/profiles/compact.yml

@@ -0,0 +1,3 @@
+compact:
+  format: text
+  temperature: 0.2

examples/consumers/testdata/collection-bundle/collections/weather/profiles/weather.yml

@@ -0,0 +1,3 @@
+weather:
+  extends: compact
+  temperature: 0.4

examples/consumers/testdata/collection-bundle/collections/weather/prompts/brief.yml

@@ -0,0 +1,7 @@
+brief:
+  version: "1"
+  default_profile: compact
+  content_file: welcome.txt
+  messages:
+    - role: user
+      content: Write a concise weather summary.

examples/consumers/testdata/collection-bundle/collections/weather/prompts/custom.yml

@@ -0,0 +1,3 @@
+custom:
+  extends: brief
+  default_profile: weather

examples/consumers/testdata/collection-bundle/collections/weather/prompts/welcome.txt

@@ -0,0 +1 @@
+Welcome to the weather collection.

examples/consumers/testdata/collection-bundle/operators/weather-prompt-version.yml

@@ -0,0 +1,2 @@
+brief:
+  version: "2"

facade_destination_test.go

@@ -0,0 +1,443 @@
+package configkit_test
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"io"
+	"io/fs"
+	"os"
+	"path"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"testing"
+	"testing/fstest"
+
+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+)
+
+func TestFacadeInputDestinationsAcrossSourceKinds(t *testing.T) {
+	directory := t.TempDir()
+	hostPath := filepath.Join(directory, "host.yml")
+	if err := os.WriteFile(hostPath, []byte("value: host\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	native := configkit.NewFilesystem("native", fstest.MapFS{
+		"main.yml": &fstest.MapFile{Data: []byte("value: native\n")},
+	})
+	const literalValuePath = "/collections/weather.reporter/profiles/a~1b/~0/0"
+	destination := configkit.Keys("collections", "weather.reporter", "profiles", "a/b", "~", "0")
+	for _, test := range []struct {
+		name   string
+		source configkit.Source
+		want   string
+		kind   configkit.SourceKind
+	}{
+		{name: "host file", source: configkit.File(hostPath), want: "host", kind: configkit.SourceKindFile},
+		{name: "native filesystem", source: native.File("main.yml"), want: "native", kind: configkit.SourceKindFilesystem},
+		{name: "bytes", source: configkit.Bytes("bytes", []byte("value: bytes\n")), want: "bytes", kind: configkit.SourceKindBytes},
+		{name: "reader", source: configkit.Reader("reader", strings.NewReader("value: reader\n")), want: "reader", kind: configkit.SourceKindReader},
+		{name: "mapping", source: configkit.Mapping("mapping", map[string]any{"value": "mapping"}), want: "mapping", kind: configkit.SourceKindMapping},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			result, err := configkit.LoadLayered[map[string]any](configkit.Input{Source: test.source, Destination: destination})
+			if err != nil {
+				t.Fatalf("LoadLayered: %v", err)
+			}
+			if got := facadeDestinationValue(t, result.Config, "collections", "weather.reporter", "profiles", "a/b", "~", "0", "value"); got != test.want {
+				t.Fatalf("placed value = %#v, want %q", got, test.want)
+			}
+			sources := result.Sources()
+			if len(sources) != 1 || sources[0].Kind != test.kind || sources[0].Destination.String() != destination.String() || destination.String() != literalValuePath {
+				t.Fatalf("source placement = %#v, destination = %q", sources, destination.String())
+			}
+		})
+	}
+}
+
+func TestFacadeDestinationRootEmptyMappingNoSourceAndInvalidPaths(t *testing.T) {
+	for _, test := range []struct {
+		name        string
+		destination configkit.Path
+	}{
+		{name: "omitted destination"},
+		{name: "explicit empty destination", destination: configkit.Path{}},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			result, err := configkit.LoadLayered[map[string]any](configkit.Input{Source: configkit.Bytes("root", []byte("value: root\n")), Destination: test.destination})
+			if err != nil {
+				t.Fatalf("root load: %v", err)
+			}
+			if result.Config["value"] != "root" || len(result.Sources()) != 1 || result.Sources()[0].Destination.String() != "" {
+				t.Fatalf("root placement = %#v, sources %#v", result.Config, result.Sources())
+			}
+		})
+	}
+
+	emptyPath := configkit.Keys("collections", "empty")
+	empty, err := configkit.LoadLayered[map[string]any](configkit.Input{
+		Source: configkit.Mapping("empty", map[string]any{}), Destination: emptyPath,
+	})
+	if err != nil {
+		t.Fatalf("empty mapping load: %v", err)
+	}
+	if value := facadeDestinationMap(t, empty.Config, "collections")["empty"]; value == nil {
+		t.Fatal("empty mapping did not materialize its destination")
+	}
+	if info, ok := empty.Metadata().Lookup(emptyPath); !ok || !info.Explicit {
+		t.Fatalf("empty destination metadata = %#v, %v", info, ok)
+	}
+
+	absentPath := configkit.Keys("collections", "absent")
+	absent, err := configkit.LoadLayered[map[string]any](configkit.Input{Source: configkit.NoSource(), Destination: absentPath})
+	if err != nil {
+		t.Fatalf("NoSource with a destination: %v", err)
+	}
+	if len(absent.Sources()) != 0 {
+		t.Fatalf("NoSource created source records: %#v", absent.Sources())
+	}
+	if _, ok := absent.Metadata().Lookup(absentPath); ok {
+		t.Fatal("NoSource materialized its destination")
+	}
+
+	reader := &destinationCountingReader{}
+	for _, test := range []struct {
+		name        string
+		source      configkit.Source
+		destination configkit.Path
+		wantReads   int
+	}{
+		{name: "index segment", source: configkit.Reader("unread", reader), destination: configkit.Keys("catalog").Index(0)},
+		{name: "reserved configkit key", source: configkit.NoSource(), destination: configkit.Keys("configkit")},
+		{name: "reserved extends key", source: configkit.NoSource(), destination: configkit.Keys("catalog", "extends")},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			_, err := configkit.LoadLayered[map[string]any](configkit.Input{Source: test.source, Destination: test.destination})
+			loadError, ok := err.(*configkit.LoadError)
+			if !ok || len(loadError.Diagnostics()) == 0 || loadError.Diagnostics()[0].Code != configkit.CodeOptionsInvalid {
+				t.Fatalf("invalid destination error = %#v", err)
+			}
+			if reader.reads != test.wantReads {
+				t.Fatalf("reader calls = %d, want %d", reader.reads, test.wantReads)
+			}
+		})
+	}
+}
+
+func TestFacadeImportedSourcesRetainInputDestination(t *testing.T) {
+	directory := t.TempDir()
+	mainPath := filepath.Join(directory, "main.yml")
+	fragmentPath := filepath.Join(directory, "fragment.yml")
+	if err := os.WriteFile(mainPath, []byte("configkit: {imports: [{path: fragment.yml}]}\nmain: present\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(fragmentPath, []byte("imported: present\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	destination := configkit.Keys("collections", "weatherreporter")
+	result, err := configkit.LoadLayered[map[string]any](configkit.Input{
+		Source: configkit.File(mainPath), Imports: true, Destination: destination,
+	})
+	if err != nil {
+		t.Fatalf("mounted import load: %v", err)
+	}
+	collection := facadeDestinationMap(t, result.Config, "collections", "weatherreporter")
+	if collection["main"] != "present" || collection["imported"] != "present" {
+		t.Fatalf("mounted imported values = %#v", collection)
+	}
+	sources := result.Sources()
+	if len(sources) != 2 || sources[0].Destination.String() != destination.String() || sources[1].Destination.String() != destination.String() {
+		t.Fatalf("mounted import source destinations = %#v", sources)
+	}
+	if sources[1].ImportedFrom == nil {
+		t.Fatalf("imported source lacks its authored directive: %#v", sources[1])
+	}
+}
+
+func TestFacadeSameFragmentMountsAtSeparateCollectionDestinations(t *testing.T) {
+	weatherDestination := configkit.Keys("collections", "weather", "prompts")
+	homeDestination := configkit.Keys("collections", "homewatch", "prompts")
+	result, err := configkit.LoadLayered(
+		configkit.Input{Source: configkit.NoSource()},
+		configkit.LayeredOptions[map[string]any]{Underlays: []configkit.Underlay{{Inputs: []configkit.Input{
+			{Source: configkit.Bytes("weather", []byte("summarize.alerts: {title: weather}\n")), Destination: weatherDestination},
+			{Source: configkit.Bytes("homewatch", []byte("summarize.alerts: {title: home}\n")), Destination: homeDestination},
+		}}}},
+	)
+	if err != nil {
+		t.Fatalf("LoadLayered: %v", err)
+	}
+	for _, test := range []struct {
+		path []string
+		want string
+	}{
+		{path: []string{"collections", "weather", "prompts", "summarize.alerts", "title"}, want: "weather"},
+		{path: []string{"collections", "homewatch", "prompts", "summarize.alerts", "title"}, want: "home"},
+	} {
+		if got := facadeDestinationValue(t, result.Config, test.path...); got != test.want {
+			t.Errorf("value at %v = %#v, want %q", test.path, got, test.want)
+		}
+	}
+	sources := result.Sources()
+	if len(sources) != 2 || sources[0].Destination.String() != weatherDestination.String() || sources[1].Destination.String() != homeDestination.String() {
+		t.Fatalf("independent collection source placements = %#v", sources)
+	}
+}
+
+type destinationCountingReader struct{ reads int }
+
+func (reader *destinationCountingReader) Read([]byte) (int, error) {
+	reader.reads++
+	return 0, io.EOF
+}
+
+func TestFacadeMountedMainAndUnderlayInspectionResourcesAndDiff(t *testing.T) {
+	t.Parallel()
+
+	filesystem := configkit.NewFilesystem("resources", fstest.MapFS{
+		"assets/summary.md": &fstest.MapFile{Data: []byte("source-relative summary")},
+	})
+	context := &configkit.FilesystemContext{Root: ".", BaseDir: "assets", FS: &filesystem}
+	destination := configkit.Keys("catalog", "entries")
+	tokenPath := configkit.Keys("catalog", "entries", "item", "token")
+	titlePath := configkit.Keys("catalog", "entries", "item", "title")
+	var callbacks struct{ resolve, validate int }
+	load := func(token string) *configkit.Result[map[string]any] {
+		t.Helper()
+		main := configkit.Input{
+			Source:      configkit.Bytes("main", []byte("item:\n  title: main\n  resource: summary.md\n  token: "+token+"\n")),
+			Destination: destination, Filesystem: context,
+		}
+		underlay := configkit.Input{
+			Source:      configkit.Bytes("underlay", []byte("item:\n  title: lower\n  retained: lower-value\n  token: LOWER-TOKEN-CANARY\n")),
+			Destination: destination,
+		}
+		result, err := configkit.LoadLayered(main, configkit.LayeredOptions[map[string]any]{
+			Underlays: []configkit.Underlay{{Inputs: []configkit.Input{underlay}}},
+			Definition: configkit.Definition[map[string]any]{
+				Resolve: func(configuration *map[string]any, resolution *configkit.Resolution) error {
+					callbacks.resolve++
+					resourcePath := configkit.Keys("catalog", "entries", "item", "resource")
+					input, ok := resolution.InputInfo(resourcePath)
+					if !ok || len(input.Origin.Locations) != 1 {
+						return fmt.Errorf("mounted resource input has no single source origin")
+					}
+					source, ok := resolution.Source(input.Origin.Locations[0].SourceID)
+					if !ok || source.Destination.String() != destination.String() {
+						return fmt.Errorf("resolution source did not retain its destination")
+					}
+					resourceContext, ok := resolution.SourceContext(source.ID)
+					if !ok {
+						return fmt.Errorf("resolution source context is unavailable")
+					}
+					data, err := fs.ReadFile(resourceContext.FS, path.Join(resourceContext.BaseDir, "summary.md"))
+					if err != nil {
+						return fmt.Errorf("read source-relative resource: %w", err)
+					}
+					entry := facadeDestinationMap(t, facadeDestinationMap(t, facadeDestinationMap(t, *configuration, "catalog"), "entries"), "item")
+					entry["resource_text"] = string(data)
+					resolution.Record(configkit.Keys("catalog", "entries", "item", "resource_text"), configkit.ChangeNormalization, "read source-relative summary", resourcePath)
+					return nil
+				},
+				Validate: func(*map[string]any, *configkit.Validation) { callbacks.validate++ },
+				Secret:   func(candidate configkit.Path) bool { return candidate.String() == tokenPath.String() },
+			},
+		})
+		if err != nil {
+			t.Fatalf("mounted load: %v", err)
+		}
+		return result
+	}
+
+	first := load("FIRST-TOKEN-CANARY")
+	second := load("SECOND-TOKEN-CANARY")
+	if callbacks.resolve != 2 || callbacks.validate != 2 {
+		t.Fatalf("lifecycle callbacks = %#v", callbacks)
+	}
+	for _, result := range []*configkit.Result[map[string]any]{first, second} {
+		entry := facadeDestinationMap(t, facadeDestinationMap(t, facadeDestinationMap(t, result.Config, "catalog"), "entries"), "item")
+		if entry["title"] != "main" || entry["retained"] != "lower-value" || entry["resource_text"] != "source-relative summary" {
+			t.Fatalf("mounted main/underlay configuration = %#v", entry)
+		}
+		sources := result.Sources()
+		if len(sources) != 2 || sources[0].Destination.String() != destination.String() || sources[1].Destination.String() != destination.String() {
+			t.Fatalf("public source destinations = %#v", sources)
+		}
+		resource, ok := result.SourceContext(sources[0].ID)
+		if !ok || resource.BaseDir != "assets" {
+			t.Fatalf("completed source context = %#v, %v", resource, ok)
+		}
+		data, err := fs.ReadFile(resource.FS, path.Join(resource.BaseDir, "summary.md"))
+		if err != nil || string(data) != "source-relative summary" {
+			t.Fatalf("completed relative resource = %q, %v", data, err)
+		}
+		if info, ok := result.Metadata().Lookup(titlePath); !ok || info.Origin.Layer != configkit.LayerBase {
+			t.Fatalf("mounted title metadata = %#v, %v", info, ok)
+		}
+		if history := result.Metadata().History(titlePath); len(history) < 2 {
+			t.Fatalf("mounted title history = %#v", history)
+		}
+		if explanation, ok := result.Explain(tokenPath); !ok || !explanation.Effective.Redacted {
+			t.Fatalf("mounted secret explanation = %#v, %v", explanation, ok)
+		}
+		var effective, explanation bytes.Buffer
+		if err := result.WriteEffective(&effective); err != nil {
+			t.Fatal(err)
+		}
+		if err := result.WriteExplanation(&explanation, tokenPath); err != nil {
+			t.Fatal(err)
+		}
+		output := effective.String() + explanation.String()
+		for _, canary := range []string{"FIRST-TOKEN-CANARY", "SECOND-TOKEN-CANARY", "LOWER-TOKEN-CANARY"} {
+			if strings.Contains(output, canary) {
+				t.Fatalf("public inspection leaked %q: %s", canary, output)
+			}
+		}
+	}
+
+	// Mutating published records and query copies must not alter the retained result.
+	returnedSources := first.Sources()
+	returnedSources[0].Destination = configkit.Keys("mutated")
+	if got := first.Sources()[0].Destination.String(); got != destination.String() {
+		t.Fatalf("source destination changed after caller mutation: %q", got)
+	}
+	info, ok := first.Metadata().Lookup(titlePath)
+	if !ok {
+		t.Fatal("mounted metadata lookup failed")
+	}
+	info.Origin.Locations[0].SourceID = "mutated"
+	if fresh, ok := first.Metadata().Lookup(titlePath); !ok || fresh.Origin.Locations[0].SourceID == "mutated" {
+		t.Fatalf("metadata copy mutation escaped: %#v, %v", fresh, ok)
+	}
+	history := first.Metadata().History(titlePath)
+	if len(history) == 0 {
+		t.Fatal("mounted history is empty")
+	}
+	history[0].Path = configkit.Keys("mutated")
+	if fresh := first.Metadata().History(titlePath); len(fresh) == 0 || fresh[0].Path.String() != titlePath.String() {
+		t.Fatalf("history copy mutation escaped: %#v", fresh)
+	}
+
+	differences, err := configkit.Diff(first, second)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(differences) != 1 || differences[0].Path.String() != tokenPath.String() ||
+		!differences[0].Left.Redacted || !differences[0].Right.Redacted ||
+		strings.Contains(differences[0].Left.YAML+differences[0].Right.YAML, "TOKEN-CANARY") {
+		t.Fatalf("public mounted secret diff = %#v", differences)
+	}
+	if callbacks.resolve != 2 || callbacks.validate != 2 {
+		t.Fatalf("inspection reran lifecycle callbacks: %#v", callbacks)
+	}
+}
+
+func TestFacadeFailedLoadExposesDetachedSourceDestination(t *testing.T) {
+	type configuration struct {
+		Tenant struct {
+			Count int `yaml:"count"`
+		} `yaml:"tenant"`
+	}
+	destination := configkit.Keys("tenant")
+	_, err := configkit.LoadLayered[configuration](configkit.Input{
+		Source: configkit.Bytes("invalid", []byte("count: not-an-integer\n")), Destination: destination,
+	})
+	loadError, ok := err.(*configkit.LoadError)
+	if !ok {
+		t.Fatalf("failed load error = %T %v", err, err)
+	}
+	sources := loadError.Sources()
+	if len(sources) != 1 || sources[0].Destination.String() != destination.String() {
+		t.Fatalf("failed source destinations = %#v", sources)
+	}
+	sources[0].Destination = configkit.Keys("caller-change")
+	if fresh := loadError.Sources(); len(fresh) != 1 || fresh[0].Destination.String() != destination.String() {
+		t.Fatalf("failed source destination was not detached: %#v", fresh)
+	}
+}
+
+func TestFacadeDestinationMappingFailurePaths(t *testing.T) {
+	t.Parallel()
+
+	cycle := map[string]any{}
+	cycle["self"] = cycle
+	for _, fixture := range []struct {
+		name   string
+		values map[string]any
+		path   func(configkit.Path) configkit.Path
+	}{
+		{
+			name:   "unsupported nested sequence value",
+			values: map[string]any{"a/b": []any{map[string]any{"~": func() {}}}},
+			path:   func(base configkit.Path) configkit.Path { return base.Key("a/b").Index(0).Key("~") },
+		},
+		{
+			name:   "cyclic value",
+			values: map[string]any{"item": cycle},
+			path:   func(base configkit.Path) configkit.Path { return base.Key("item").Key("self") },
+		},
+		{
+			name: "constructor failure keeps source coordinates",
+			path: func(configkit.Path) configkit.Path { return configkit.Path{} },
+		},
+	} {
+		t.Run(fixture.name, func(t *testing.T) {
+			for _, role := range []string{"root", "mounted main", "mounted underlay"} {
+				t.Run(role, func(t *testing.T) {
+					var destination configkit.Path
+					if role != "root" {
+						destination = configkit.Keys("catalog", "entries")
+					}
+					wantPath := fixture.path(destination)
+					input := configkit.Input{Source: configkit.Mapping("invalid mapping", fixture.values), Destination: destination}
+					var result *configkit.Result[map[string]any]
+					var err error
+					if role == "mounted underlay" {
+						result, err = configkit.LoadLayered(configkit.Input{Source: configkit.NoSource()}, configkit.LayeredOptions[map[string]any]{
+							Underlays: []configkit.Underlay{{Inputs: []configkit.Input{input}}},
+						})
+					} else {
+						result, err = configkit.LoadLayered[map[string]any](input)
+					}
+					var loadError *configkit.LoadError
+					if result != nil || !errors.As(err, &loadError) {
+						t.Fatalf("failed load = %#v, %v", result, err)
+					}
+					diagnostics := loadError.Diagnostics()
+					if len(diagnostics) != 1 {
+						t.Fatalf("diagnostics = %#v", diagnostics)
+					}
+					diagnostic := diagnostics[0]
+					if diagnostic.Code != configkit.CodeSourceInvalid || !reflect.DeepEqual(diagnostic.Path, wantPath) {
+						t.Fatalf("diagnostic = %#v; want source.invalid at %q", diagnostic, wantPath.String())
+					}
+					if diagnostic.Primary == nil || *diagnostic.Primary != (configkit.Location{SourceID: "source-1"}) || len(diagnostic.Related) != 0 {
+						t.Fatalf("mapping source locations = %#v, %#v", diagnostic.Primary, diagnostic.Related)
+					}
+					sources := loadError.Sources()
+					if len(sources) != 1 || sources[0].ID != "source-1" || sources[0].Destination.String() != destination.String() {
+						t.Fatalf("error sources = %#v", sources)
+					}
+				})
+			}
+		})
+	}
+}
+
+func facadeDestinationMap(t *testing.T, value map[string]any, keys ...string) map[string]any {
+	t.Helper()
+	for _, key := range keys {
+		child, ok := value[key].(map[string]any)
+		if !ok {
+			t.Fatalf("%q = %#v, want mapping", key, value[key])
+		}
+		value = child
+	}
+	return value
+}
+
+func facadeDestinationValue(t *testing.T, value map[string]any, keys ...string) any {
+	t.Helper()
+	return facadeDestinationMap(t, value, keys[:len(keys)-1]...)[keys[len(keys)-1]]
+}

facade_diff_test.go

@@ -0,0 +1,327 @@
+package configkit_test
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+)
+
+type facadeDiffConfig struct {
+	Value   string         `yaml:"value"`
+	Count   int            `yaml:"count"`
+	Items   []string       `yaml:"items"`
+	Dynamic map[string]any `yaml:"dynamic"`
+}
+
+type facadeDiffSecretConfig struct {
+	Secret configkit.Secret `yaml:"secret"`
+}
+
+func TestFacadeDiffKeepsPublicSequenceChangesWithHistoricalDescendants(t *testing.T) {
+	type configuration struct {
+		Items []any `yaml:"items"`
+	}
+	load := func(public string) *configkit.Result[configuration] {
+		t.Helper()
+		result, err := configkit.Load(configkit.Bytes("historical-sequence.yml", []byte("items: [{secret: disposable-canary}, "+public+"]\n")),
+			configkit.Options[configuration]{Definition: configkit.Definition[configuration]{
+				Secret: func(path configkit.Path) bool { return path.String() == "/items/0/secret" },
+				Resolve: func(current *configuration, resolution *configkit.Resolution) error {
+					current.Items[0] = "public scalar"
+					resolution.Record(configkit.Keys("items"), configkit.ChangeNormalization, "normalize first item")
+					return nil
+				},
+			}})
+		if err != nil {
+			t.Fatal(err)
+		}
+		return result
+	}
+	left, right := load("1"), load("2")
+	history, ok := left.Explain(configkit.Keys("items").Index(0).Key("secret"))
+	if !ok || history.Effective.Present || len(history.History) == 0 {
+		t.Fatalf("removed historical secret = %#v, known=%v", history, ok)
+	}
+	maskedHistory := false
+	for _, change := range history.History {
+		maskedHistory = maskedHistory || change.Before.Redacted || change.After.Redacted
+	}
+	if !maskedHistory {
+		t.Fatal("historical sensitivity was not retained")
+	}
+	differences, err := configkit.Diff(left, right)
+	if err != nil || len(differences) != 1 || differences[0].Path.String() != "/items" {
+		t.Fatalf("sequence difference = %#v, %v", differences, err)
+	}
+	difference := differences[0]
+	if !difference.Left.Present || !difference.Right.Present || difference.Left.Redacted || difference.Right.Redacted || difference.HiddenChanged {
+		t.Fatalf("public sequence change was concealed: %#v", difference)
+	}
+	if difference.Left.YAML != "- public scalar\n- 1\n" || difference.Right.YAML != "- public scalar\n- 2\n" {
+		t.Fatalf("public sequence snapshots = %#v", difference)
+	}
+}
+
+func TestFacadeDiffKeepsPublicScalarAcrossHistoricalAbsence(t *testing.T) {
+	type configuration struct {
+		Dynamic map[string]any `yaml:"dynamic"`
+	}
+	options := configkit.Options[configuration]{Definition: configkit.Definition[configuration]{
+		Secret: func(path configkit.Path) bool { return path.String() == "/dynamic/entry/token" },
+		Resolve: func(current *configuration, resolution *configkit.Resolution) error {
+			delete(current.Dynamic, "entry")
+			resolution.Record(configkit.Keys("dynamic", "entry"), configkit.ChangeNormalization, "remove entry")
+			return nil
+		},
+	}}
+	absent, err := configkit.Load(configkit.Bytes("removed-entry.yml", []byte("dynamic: {entry: {token: disposable-canary}}\n")), options)
+	if err != nil {
+		t.Fatal(err)
+	}
+	options.Definition.Resolve = nil
+	present, err := configkit.Load(configkit.Bytes("public-entry.yml", []byte("dynamic: {entry: public}\n")), options)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, test := range []struct {
+		name        string
+		left, right *configkit.Result[configuration]
+		leftPresent bool
+	}{
+		{name: "addition", left: absent, right: present},
+		{name: "removal", left: present, right: absent, leftPresent: true},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			differences, err := configkit.Diff(test.left, test.right)
+			if err != nil || len(differences) != 1 || differences[0].Path.String() != "/dynamic/entry" {
+				t.Fatalf("entry difference = %#v, %v", differences, err)
+			}
+			difference := differences[0]
+			if difference.Left.Present != test.leftPresent || difference.Right.Present == test.leftPresent ||
+				difference.Left.Redacted || difference.Right.Redacted || difference.HiddenChanged {
+				t.Fatalf("public presence change was concealed: %#v", difference)
+			}
+			wantLeft, wantRight := "", "public\n"
+			if test.leftPresent {
+				wantLeft, wantRight = wantRight, wantLeft
+			}
+			if difference.Left.YAML != wantLeft || difference.Right.YAML != wantRight {
+				t.Fatalf("entry snapshots = %#v", difference)
+			}
+		})
+	}
+}
+
+func TestFacadeDiffReturnsDetachedCanonicalRecords(t *testing.T) {
+	left, err := configkit.Load[facadeDiffConfig](configkit.Bytes("left.yml", []byte("value: before\ncount: 0\nitems: [one, two]\ndynamic: {}\n")))
+	if err != nil {
+		t.Fatalf("load left: %v", err)
+	}
+	right, err := configkit.Load[facadeDiffConfig](configkit.Bytes("right.yml", []byte("value: after\ncount: 0\nitems: [one, three]\ndynamic:\n  added: null\n")))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	differences, err := configkit.Diff(left, right)
+	if err != nil {
+		t.Fatal(err)
+	}
+	wantPaths := []string{"/dynamic/added", "/items", "/value"}
+	if len(differences) != len(wantPaths) {
+		t.Fatalf("differences = %#v", differences)
+	}
+	for index, difference := range differences {
+		if got := difference.Path.String(); got != wantPaths[index] {
+			t.Errorf("path[%d] = %q, want %q", index, got, wantPaths[index])
+		}
+	}
+	if differences[0].Left.Present || !differences[0].Right.Present || differences[0].Right.YAML != "null\n" {
+		t.Errorf("null/absence snapshots = %#v / %#v", differences[0].Left, differences[0].Right)
+	}
+	if differences[1].Left.YAML != "- one\n- two\n" || differences[1].Right.YAML != "- one\n- three\n" {
+		t.Errorf("sequence snapshots = %#v / %#v", differences[1].Left, differences[1].Right)
+	}
+
+	left.Config.Value = "caller mutation"
+	left.Config.Items[0] = "caller mutation"
+	right.Config.Dynamic["added"] = "caller mutation"
+	differences[2].Left.YAML = "record mutation"
+	differences[2].Path = configkit.Keys("rewritten")
+
+	again, err := configkit.Diff(left, right)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if again[2].Path.String() != "/value" || again[2].Left.YAML != "before\n" || again[1].Left.YAML != "- one\n- two\n" {
+		t.Fatalf("repeat diff changed = %#v", again)
+	}
+	explanation, ok := left.Explain(configkit.Keys("value"))
+	if !ok || explanation.Effective.YAML != "before\n" {
+		t.Fatalf("frozen explanation = %#v, %v", explanation, ok)
+	}
+}
+
+func TestFacadeDiffRejectsUnavailableResults(t *testing.T) {
+	type config struct {
+		Value string `yaml:"value"`
+	}
+	loaded, err := configkit.Load[config](configkit.Bytes("valid.yml", []byte("value: valid\n")))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var nilResult *configkit.Result[config]
+	zeroResult := &configkit.Result[config]{Config: config{Value: "must not be inspected"}}
+	for name, left := range map[string]*configkit.Result[config]{"nil": nilResult, "zero": zeroResult} {
+		t.Run(name, func(t *testing.T) {
+			if records, err := configkit.Diff(left, loaded); err == nil || records != nil {
+				t.Fatalf("Diff = %#v, %v; want nil records and error", records, err)
+			}
+		})
+	}
+	if records, err := configkit.Diff(loaded, nilResult); err == nil || records != nil {
+		t.Fatalf("right nil Diff = %#v, %v", records, err)
+	}
+}
+
+func TestFacadeDiffIgnoresSourceAndResolutionHistory(t *testing.T) {
+	type config struct {
+		Count int `yaml:"count"`
+	}
+	defaults := configkit.Options[config]{Definition: configkit.Definition[config]{
+		Defaults: func() config { return config{Count: 7} },
+	}}
+	defaulted, err := configkit.Load[config](configkit.NoSource(), defaults)
+	if err != nil {
+		t.Fatal(err)
+	}
+	explicit, err := configkit.Load[config](configkit.Bytes("explicit.yml", []byte("count: 7\n")))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if differences, err := configkit.Diff(defaulted, explicit); err != nil || len(differences) != 0 {
+		t.Fatalf("default/source difference = %#v, %v", differences, err)
+	}
+
+	zeroDefault, err := configkit.Load[config](configkit.NoSource(), configkit.Options[config]{Definition: configkit.Definition[config]{Defaults: func() config { return config{} }}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	explicitZero, err := configkit.Load[config](configkit.Bytes("explicit-zero.yml", []byte("count: 0\n")))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if differences, err := configkit.Diff(zeroDefault, explicitZero); err != nil || len(differences) != 0 {
+		t.Fatalf("explicit/defaulted zero difference = %#v, %v", differences, err)
+	}
+
+	resolve := func(value string) configkit.Options[config] {
+		return configkit.Options[config]{Definition: configkit.Definition[config]{Resolve: func(current *config, resolution *configkit.Resolution) error {
+			current.Count = len(value) + 8
+			resolution.Record(configkit.Keys("count"), configkit.ChangeNormalization, "set effective count")
+			return nil
+		}}}
+	}
+	resolvedA, err := configkit.Load[config](configkit.Bytes("a.yml", []byte("{}\n")), resolve("a"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	resolvedB, err := configkit.Load[config](configkit.Bytes("b.yml", []byte("{}\n")), resolve("b"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if differences, err := configkit.Diff(resolvedA, resolvedB); err != nil || len(differences) != 0 {
+		t.Fatalf("equal resolved values = %#v, %v", differences, err)
+	}
+}
+
+func TestFacadeDiffUsesFrozenFilesAndRunsCallbacksOnlyDuringLoad(t *testing.T) {
+	type config struct {
+		Value string `yaml:"value"`
+	}
+	calls := 0
+	options := configkit.Options[config]{Definition: configkit.Definition[config]{Defaults: func() config {
+		calls++
+		return config{}
+	}}}
+	dir := t.TempDir()
+	paths := []string{filepath.Join(dir, "left.yml"), filepath.Join(dir, "right.yml")}
+	for index, contents := range []string{"value: left\n", "value: right\n"} {
+		if err := os.WriteFile(paths[index], []byte(contents), 0o600); err != nil {
+			t.Fatal(err)
+		}
+	}
+	left, err := configkit.Load[config](configkit.File(paths[0]), options)
+	if err != nil {
+		t.Fatal(err)
+	}
+	right, err := configkit.Load[config](configkit.File(paths[1]), options)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if calls != 2 {
+		t.Fatalf("defaults calls after loads = %d", calls)
+	}
+	for _, path := range paths {
+		if err := os.Remove(path); err != nil {
+			t.Fatal(err)
+		}
+	}
+	differences, err := configkit.Diff(left, right)
+	if err != nil || len(differences) != 1 || differences[0].Path.String() != "/value" {
+		t.Fatalf("Diff after removing files = %#v, %v", differences, err)
+	}
+	if calls != 2 {
+		t.Fatalf("defaults reran during Diff: %d calls", calls)
+	}
+}
+
+func TestFacadeDiffCombinesSecretSensitivityAndLoadErrors(t *testing.T) {
+	t.Setenv("FACADE_DIFF_SECRET", "credential-one")
+	secretOptions := configkit.Options[facadeDiffSecretConfig]{Definition: configkit.Definition[facadeDiffSecretConfig]{Secret: func(path configkit.Path) bool {
+		return path.String() == "/secret"
+	}}}
+	left, err := configkit.Load[facadeDiffSecretConfig](configkit.Bytes("left.yml", []byte("secret: FACADE_DIFF_SECRET\n")), secretOptions)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("FACADE_DIFF_SECRET", "credential-two")
+	right, err := configkit.Load[facadeDiffSecretConfig](configkit.Bytes("right.yml", []byte("secret: FACADE_DIFF_SECRET\n")), secretOptions)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if differences, err := configkit.Diff(left, right); err != nil || len(differences) != 0 {
+		t.Fatalf("credential rotation = %#v, %v", differences, err)
+	}
+	t.Setenv("OTHER_FACADE_DIFF_SECRET", "other-credential")
+	otherReference, err := configkit.Load[facadeDiffSecretConfig](configkit.Bytes("other.yml", []byte("secret: OTHER_FACADE_DIFF_SECRET\n")), secretOptions)
+	if err != nil {
+		t.Fatal(err)
+	}
+	differences, err := configkit.Diff(left, otherReference)
+	if err != nil || len(differences) != 1 || !differences[0].HiddenChanged || !differences[0].Left.Redacted || !differences[0].Right.Redacted {
+		t.Fatalf("reference change = %#v, %v", differences, err)
+	}
+	if strings.Contains(differences[0].Left.YAML+differences[0].Right.YAML, "credential") {
+		t.Fatalf("credential leaked: %#v", differences)
+	}
+
+	invalidLeft, leftErr := configkit.Load[facadeDiffSecretConfig](configkit.Bytes("invalid-left.yml", []byte("unknown: true\n")))
+	if invalidLeft != nil || leftErr == nil {
+		t.Fatalf("invalid left load = %#v, %v", invalidLeft, leftErr)
+	}
+	var loadError *configkit.LoadError
+	if !errors.As(leftErr, &loadError) {
+		t.Fatalf("left load error = %T, want *configkit.LoadError", leftErr)
+	}
+	invalidRight, rightErr := configkit.Load[facadeDiffSecretConfig](configkit.Bytes("invalid-right.yml", []byte("unknown: true\n")))
+	if invalidRight != nil || rightErr == nil {
+		t.Fatalf("invalid right load = %#v, %v", invalidRight, rightErr)
+	}
+	if !errors.As(rightErr, &loadError) {
+		t.Fatalf("right load error = %T, want *configkit.LoadError", rightErr)
+	}
+}

go.mod

@@ -1,5 +1,13 @@
 module gitea.maximumdirect.net/eric/ConfigKit
 
-go 1.25.0
+go 1.26.0
 
 require go.yaml.in/yaml/v4 v4.0.0-rc.6
+
+require (
+	gitea.maximumdirect.net/eric/ReleaseKit v0.4.1 // indirect
+	github.com/yuin/goldmark/v2 v2.1.6 // indirect
+	golang.org/x/mod v0.40.0 // indirect
+)
+
+tool gitea.maximumdirect.net/eric/ReleaseKit/cmd/releasekit

go.sum

@@ -1,2 +1,8 @@
+gitea.maximumdirect.net/eric/ReleaseKit v0.4.1 h1:Qn+mdebYOzCVCEXgCbuGSO/WHmJtItwaQ8e3XwY3qtI=
+gitea.maximumdirect.net/eric/ReleaseKit v0.4.1/go.mod h1:LVodqNQ3OIKv9NBq+fFeyMByd1lHY25YOmmpah/NaNI=
+github.com/yuin/goldmark/v2 v2.1.6 h1:igy0q9JcqovoFXFx/XjtU8sHVhcUHavPj2sA3EoKJUE=
+github.com/yuin/goldmark/v2 v2.1.6/go.mod h1:G6M4/qOFtfn01/o14BU1UR2Lo5N3S9Qo7xCuz/sHjGQ=
 go.yaml.in/yaml/v4 v4.0.0-rc.6 h1:1h7H1ohdUh93/FyE4YaDa1Zh64K6VVbjF4K6WUxMtH4=
 go.yaml.in/yaml/v4 v4.0.0-rc.6/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
+golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs=
+golang.org/x/mod v0.40.0/go.mod h1:0/weTWkPWGBikyTWAX3dkjVztMmBA5hM0DH6BElSupE=

internal/engine/destination.go

@@ -0,0 +1,127 @@
+package engine
+
+import (
+	"errors"
+
+	"gitea.maximumdirect.net/eric/ConfigKit/internal/document"
+)
+
+var (
+	errInvalidDestination = errors.New("configkit: destination must contain only non-reserved mapping keys")
+	errDestinationLimit   = errors.New("configkit: destination exceeds document limits")
+)
+
+func normalizeDestination(path Path) (Path, error) {
+	if !path.valid() {
+		return Path{}, errInvalidDestination
+	}
+
+	segments := make([]pathSegment, 0, len(path.segments))
+	for _, segment := range path.segments {
+		if segment.kind != pathSegmentKey && segment.kind != pathSegmentParsed {
+			return Path{}, errInvalidDestination
+		}
+		if segment.key == "configkit" || segment.key == "extends" {
+			return Path{}, errInvalidDestination
+		}
+		segments = append(segments, pathSegment{kind: pathSegmentKey, key: segment.key})
+	}
+	return Path{segments: segments}, nil
+}
+
+func invalidDestinationDiagnostic(destination Path) Diagnostic {
+	return Diagnostic{
+		Code: CodeOptionsInvalid, Severity: SeverityError,
+		Path:    destination.clone(),
+		Message: "input destination must contain only non-reserved mapping keys",
+	}
+}
+
+func setSourceDestinations(sources []SourceInfo, destination Path) {
+	for index := range sources {
+		sources[index].Destination = destination.clone()
+	}
+}
+
+// placeDocument checks all per-document bounds before allocating destination
+// wrappers. Aggregate accounting remains the caller's responsibility.
+func placeDocument(body *document.Node, destination Path, sourceRoot document.Location, maxDepth, maxNodes int) (Path, *document.Node, error) {
+	normalized, err := normalizeDestination(destination)
+	if err != nil {
+		return Path{}, nil, err
+	}
+	if body == nil {
+		return normalized, nil, nil
+	}
+	if !destinationWithinLimits(body, normalized, maxDepth, maxNodes) {
+		return normalized, nil, errDestinationLimit
+	}
+
+	placed := body
+	for index := len(normalized.segments) - 1; index >= 0; index-- {
+		key := normalized.segments[index].key
+		placed = &document.Node{
+			Kind:     document.Mapping,
+			Location: sourceRoot,
+			Mapping: []document.Entry{{
+				Key:           key,
+				KeyLocation:   sourceRoot,
+				ValueLocation: sourceRoot,
+				Value:         placed,
+			}},
+		}
+	}
+	return normalized, placed, nil
+}
+
+// destinationWithinLimits expects a normalized mapping-key destination.
+func destinationWithinLimits(body *document.Node, destination Path, maxDepth, maxNodes int) bool {
+	if body == nil {
+		return true
+	}
+	if maxDepth < 0 || maxNodes < 0 || !destination.valid() {
+		return false
+	}
+	segments := len(destination.segments)
+	if segments > maxDepth || segments > maxNodes/2 {
+		return false
+	}
+	wrapperNodes := destinationWrapperNodeCount(destination)
+	for _, segment := range destination.segments {
+		if segment.kind != pathSegmentKey {
+			return false
+		}
+	}
+	if documentDepth(body) > maxDepth-segments {
+		return false
+	}
+	return countInputNodes(body) <= maxNodes-wrapperNodes
+}
+
+func destinationWrapperNodeCount(destination Path) int {
+	return 2 * len(destination.segments)
+}
+
+func documentDepth(node *document.Node) int {
+	if node == nil {
+		return -1
+	}
+	depth := 0
+	var visit func(*document.Node, int)
+	visit = func(current *document.Node, currentDepth int) {
+		if current == nil {
+			return
+		}
+		if currentDepth > depth {
+			depth = currentDepth
+		}
+		for _, entry := range current.Mapping {
+			visit(entry.Value, currentDepth+1)
+		}
+		for _, child := range current.Sequence {
+			visit(child, currentDepth+1)
+		}
+	}
+	visit(node, 0)
+	return depth
+}

internal/engine/destination_accounting_test.go

@@ -0,0 +1,176 @@
+package engine
+
+import (
+	"testing"
+	"testing/fstest"
+
+	"gitea.maximumdirect.net/eric/ConfigKit/internal/document"
+)
+
+func TestDestinationPlacementCountsAgainstSharedNodeBudget(t *testing.T) {
+	t.Parallel()
+
+	limits := defaultImportLimits()
+	destination := Keys("collections", "entry")
+	empty := Mapping("empty", map[string]any{})
+	parsed, diagnostics := parseSource(empty, "fixture", defaultParseLimits())
+	if len(diagnostics) != 0 {
+		t.Fatal(diagnostics)
+	}
+	perInput := countInputNodes(parsed.document) + destinationWrapperNodeCount(destination)
+
+	for _, test := range []struct {
+		name       string
+		delta      int
+		wantError  bool
+		wantCharge int
+	}{
+		{name: "below aggregate bound", delta: -1, wantCharge: perInput},
+		{name: "at aggregate bound", delta: 0, wantCharge: perInput},
+		{name: "above aggregate bound", delta: 1, wantError: true},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+			accounting := &importAccounting{nodes: limits.nodes - perInput + test.delta}
+			composition, _, _, diagnostics := acquireUnderlayGroup(loadGroup{inputs: []loadInput{{
+				source: empty, destination: destination,
+			}}}, 1, nil, accounting)
+			if test.wantError {
+				if composition != nil || len(diagnostics) != 1 || diagnostics[0].Code != CodeSourceLimitExceeded {
+					t.Fatalf("over-budget placement = %#v, %#v", composition, diagnostics)
+				}
+				return
+			}
+			if composition == nil || len(diagnostics) != 0 || composition.inputNodes != test.wantCharge {
+				t.Fatalf("bounded placement = %#v, %#v", composition, diagnostics)
+			}
+		})
+	}
+}
+
+func TestMultipleMountedInputsSharePlacementCharges(t *testing.T) {
+	t.Parallel()
+
+	limits := defaultImportLimits()
+	inputs := []loadInput{
+		{source: Mapping("one", map[string]any{}), destination: Keys("collection", "one")},
+		{source: Mapping("two", map[string]any{}), destination: Keys("collection", "two")},
+		{source: Mapping("three", map[string]any{}), destination: Keys("collection", "three")},
+	}
+	perInput := countInputNodes(&document.Node{Kind: document.Mapping}) + destinationWrapperNodeCount(Keys("collection", "one"))
+	charge := len(inputs) * perInput
+	accounting := &importAccounting{nodes: limits.nodes - charge}
+	composition, _, _, diagnostics := acquireUnderlayGroup(loadGroup{inputs: inputs}, 1, nil, accounting)
+	if len(diagnostics) != 0 || composition == nil || accounting.nodes != limits.nodes || composition.inputNodes != charge {
+		t.Fatalf("shared placement accounting = %#v, %#v, accounting %#v; want charge %d", composition, diagnostics, accounting, charge)
+	}
+}
+
+func TestImportedEmptyBodiesChargeEachDestinationWrapper(t *testing.T) {
+	t.Parallel()
+
+	filesystem := NewFilesystem("bundle", fstest.MapFS{
+		"main.yml":     &fstest.MapFile{Data: []byte("configkit: {imports: [{path: fragment.yml}]}\n")},
+		"fragment.yml": &fstest.MapFile{Data: []byte("{}\n")},
+	})
+	mainSource := filesystem.File("main.yml")
+	mainParsed, diagnostics := parseSource(mainSource, "fixture", defaultParseLimits())
+	if len(diagnostics) != 0 {
+		t.Fatal(diagnostics)
+	}
+	fragmentParsed, diagnostics := parseSource(Bytes("fragment", []byte("{}\n")), "fixture", defaultParseLimits())
+	if len(diagnostics) != 0 {
+		t.Fatal(diagnostics)
+	}
+	rawNodes := countInputNodes(mainParsed.document) + countInputNodes(fragmentParsed.document)
+	destination := Keys("collection", "empty")
+	placementNodes := 2 * destinationWrapperNodeCount(destination)
+	limits := defaultImportLimits()
+	for _, test := range []struct {
+		name      string
+		delta     int
+		wantError bool
+	}{
+		{name: "below aggregate bound", delta: -1},
+		{name: "at aggregate bound", delta: 0},
+		{name: "above aggregate bound", delta: 1, wantError: true},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+			accounting := &importAccounting{nodes: limits.nodes - rawNodes - placementNodes + test.delta}
+			composition, sources, _, diagnostics := acquireUnderlayGroup(loadGroup{inputs: []loadInput{{
+				source: mainSource, imports: true, destination: destination,
+			}}}, 1, nil, accounting)
+			if test.wantError {
+				if composition != nil || len(diagnostics) == 0 || diagnostics[0].Code != CodeImportLimitExceeded {
+					t.Fatalf("over-budget imports = %#v, %#v", composition, diagnostics)
+				}
+				return
+			}
+			if len(diagnostics) != 0 || composition == nil || len(sources) != 2 {
+				t.Fatalf("bounded imports = %#v, sources %#v, diagnostics %#v", composition, sources, diagnostics)
+			}
+			if composition.inputNodes != rawNodes+placementNodes || accounting.nodes != limits.nodes+test.delta {
+				t.Fatalf("import node charge = %d, accounting %d; want %d and %d", composition.inputNodes, accounting.nodes, rawNodes+placementNodes, limits.nodes+test.delta)
+			}
+			if node, present := documentAtPath(composition.root, Keys("collection", "empty")); !present || node.Kind != document.Mapping || len(node.Mapping) != 0 {
+				t.Fatalf("placed empty import body = %#v, present %v", node, present)
+			}
+		})
+	}
+}
+
+func TestNoSourceAndRootPlacementAddNoWrapperCharges(t *testing.T) {
+	t.Parallel()
+
+	accounting := &importAccounting{}
+	composition, sources, _, diagnostics := acquireUnderlayGroup(loadGroup{inputs: []loadInput{
+		{source: NoSource(), destination: Keys("absent")},
+		{source: Mapping("root", map[string]any{})},
+	}}, 1, nil, accounting)
+	if len(diagnostics) != 0 || composition == nil || len(sources) != 1 || accounting.nodes != 1 || composition.inputNodes != 1 {
+		t.Fatalf("root and absent placement = %#v, sources %#v, diagnostics %#v, accounting %#v", composition, sources, diagnostics, accounting)
+	}
+}
+
+func TestSelectedOverlayAndCLIUsePlacementNodeCharges(t *testing.T) {
+	t.Parallel()
+
+	limits := defaultImportLimits()
+	baseNodes := countInputNodes(&document.Node{Kind: document.Mapping}) + destinationWrapperNodeCount(Keys("mounted"))
+
+	t.Run("selected overlay", func(t *testing.T) {
+		t.Parallel()
+		filesystem := NewFilesystem("bundle", fstest.MapFS{
+			"overlays/test.yml": &fstest.MapFile{Data: []byte("{}\n")},
+		})
+		request := loadRequest[map[string]any]{
+			underlays: []loadGroup{{inputs: []loadInput{{source: Mapping("empty", map[string]any{}), destination: Keys("mounted")}}}},
+			overlay:   "test", overlayFilesystem: &FilesystemContext{Root: ".", BaseDir: ".", FS: &filesystem},
+		}
+		accounting := &importAccounting{nodes: limits.nodes - baseNodes}
+		_, diagnostics := assembleLayeredInput(request, assembledInput{}, accounting)
+		if len(diagnostics) != 1 || diagnostics[0].Code != CodeOverlayLimitExceeded {
+			t.Fatalf("overlay diagnostics = %#v", diagnostics)
+		}
+	})
+
+	t.Run("CLI override", func(t *testing.T) {
+		t.Parallel()
+		override := Override{Path: Keys("mounted", "value"), Value: "x", Flag: "--value"}
+		builder := valueBuilder{sourceID: "fixture", active: make(map[valueVisit]bool)}
+		if _, issue := builder.build(override.Value, override.Path, len(override.Path.segments)); issue != nil {
+			t.Fatal(issue)
+		}
+		overrideNodes := builder.nodes + destinationWrapperNodeCount(override.Path)
+		request := loadRequest[map[string]any]{
+			underlays: []loadGroup{{inputs: []loadInput{{source: Mapping("empty", map[string]any{}), destination: Keys("mounted")}}}},
+			overrides: []Override{override},
+		}
+		accounting := &importAccounting{nodes: limits.nodes - baseNodes - overrideNodes + 1}
+		_, diagnostics := assembleLayeredInput(request, assembledInput{}, accounting)
+		if len(diagnostics) != 1 || diagnostics[0].Code != CodeOverrideLimitExceeded {
+			t.Fatalf("override diagnostics = %#v", diagnostics)
+		}
+	})
+}

internal/engine/destination_diagnostic_test.go

@@ -0,0 +1,142 @@
+package engine
+
+import (
+	"path/filepath"
+	"testing"
+	"testing/fstest"
+)
+
+func TestLayeredDestinationDiagnosticsUseEffectivePathsAndAuthoredLocations(t *testing.T) {
+	t.Parallel()
+
+	t.Run("strict conflict retains both source locations", func(t *testing.T) {
+		t.Parallel()
+		loaded, err := LoadLayered(
+			Input{Source: NoSource()},
+			testSecretBinding(),
+			LayeredOptions[map[string]any]{Underlays: []Underlay{{Inputs: []Input{
+				{Source: Bytes("left", []byte("section:\n  value: left\n")), Destination: Keys("application")},
+				{Source: Bytes("right", []byte("section:\n  value: right\n")), Destination: Keys("application")},
+			}}}},
+		)
+		if loaded != nil {
+			t.Fatalf("conflicting load returned a result: %#v", loaded)
+		}
+		diagnostic := firstDestinationDiagnostic(t, err)
+		if diagnostic.Code != CodeComposeConflict || diagnostic.Path.String() != "/application/section/value" {
+			t.Fatalf("conflict diagnostic = %#v", diagnostic)
+		}
+		if diagnostic.Primary == nil || diagnostic.Primary.SourceID != "source-1" || diagnostic.Primary.Line != 2 {
+			t.Fatalf("primary location = %#v", diagnostic.Primary)
+		}
+		if len(diagnostic.Related) != 1 || diagnostic.Related[0].SourceID != "source-2" || diagnostic.Related[0].Line != 2 {
+			t.Fatalf("related locations = %#v", diagnostic.Related)
+		}
+	})
+
+	t.Run("decode failure keeps effective path and content line", func(t *testing.T) {
+		t.Parallel()
+		type section struct {
+			Count int `yaml:"count"`
+		}
+		type config struct {
+			Application struct {
+				Section section `yaml:"section"`
+			} `yaml:"application"`
+		}
+		loaded, err := LoadLayered(
+			Input{Source: Bytes("main", []byte("section:\n  count: invalid\n")), Destination: Keys("application")},
+			testSecretBinding(),
+			LayeredOptions[config]{},
+		)
+		if loaded != nil {
+			t.Fatalf("invalid load returned a result: %#v", loaded)
+		}
+		diagnostic := firstDestinationDiagnostic(t, err)
+		if diagnostic.Code != CodeDecodeType || diagnostic.Path.String() != "/application/section/count" {
+			t.Fatalf("decode diagnostic = %#v", diagnostic)
+		}
+		if diagnostic.Primary == nil || diagnostic.Primary.SourceID != "source-1" || diagnostic.Primary.Line != 2 {
+			t.Fatalf("decode location = %#v", diagnostic.Primary)
+		}
+	})
+
+	t.Run("imported version failure uses effective path and import source", func(t *testing.T) {
+		t.Parallel()
+		directory := t.TempDir()
+		writeImportFile(t, directory, "main.yml", "configkit: {imports: [{path: fragment.yml}]}\n")
+		writeImportFile(t, directory, "fragment.yml", "version: forbidden\n")
+		rule := &VersionRule{Path: Keys("application", "version"), Check: func(Version, *Validation) error { return nil }}
+		loaded, err := LoadLayered(
+			Input{Source: NoSource()},
+			testSecretBinding(),
+			LayeredOptions[map[string]any]{
+				Definition: Definition[map[string]any]{Version: rule},
+				Underlays: []Underlay{{Inputs: []Input{{
+					Source: File(filepath.Join(directory, "main.yml")), Imports: true, Destination: Keys("application"),
+				}}}},
+			},
+		)
+		if loaded != nil {
+			t.Fatalf("invalid import returned a result: %#v", loaded)
+		}
+		diagnostic := firstDestinationDiagnostic(t, err)
+		if diagnostic.Code != CodeImportVersion || diagnostic.Path.String() != "/application/version" {
+			t.Fatalf("import version diagnostic = %#v", diagnostic)
+		}
+		if diagnostic.Primary == nil || diagnostic.Primary.SourceID != "source-2" || diagnostic.Primary.Line != 1 {
+			t.Fatalf("import version location = %#v", diagnostic.Primary)
+		}
+	})
+
+	t.Run("invalid destination has no fictional source location", func(t *testing.T) {
+		t.Parallel()
+		loaded, err := LoadLayered(
+			Input{Source: Bytes("main", []byte("value: present\n")), Destination: Keys("configkit")},
+			testSecretBinding(),
+			LayeredOptions[map[string]any]{},
+		)
+		if loaded != nil {
+			t.Fatalf("invalid destination returned a result: %#v", loaded)
+		}
+		diagnostic := firstDestinationDiagnostic(t, err)
+		if diagnostic.Code != CodeOptionsInvalid || diagnostic.Path.String() != "/configkit" || diagnostic.Primary != nil {
+			t.Fatalf("invalid destination diagnostic = %#v", diagnostic)
+		}
+	})
+
+	t.Run("malformed source directive keeps its local path and location", func(t *testing.T) {
+		t.Parallel()
+		filesystem := NewFilesystem("bundle", fstest.MapFS{
+			"main.yml": &fstest.MapFile{Data: []byte("configkit: {imports: [true]}\nvalue: present\n")},
+		})
+		loaded, err := LoadLayered(
+			Input{Source: filesystem.File("main.yml"), Imports: true, Destination: Keys("application")},
+			testSecretBinding(),
+			LayeredOptions[map[string]any]{},
+		)
+		if loaded != nil {
+			t.Fatalf("malformed directive returned a result: %#v", loaded)
+		}
+		diagnostic := firstDestinationDiagnostic(t, err)
+		if diagnostic.Code != CodeImportInvalid || diagnostic.Path.String() != "/configkit/imports/0" {
+			t.Fatalf("malformed directive diagnostic = %#v", diagnostic)
+		}
+		if diagnostic.Primary == nil || diagnostic.Primary.SourceID != "source-1" || diagnostic.Primary.Line != 1 {
+			t.Fatalf("malformed directive location = %#v", diagnostic.Primary)
+		}
+	})
+}
+
+func firstDestinationDiagnostic(t *testing.T, err error) Diagnostic {
+	t.Helper()
+	loadError, ok := err.(*LoadError)
+	if !ok {
+		t.Fatalf("load error = %#v", err)
+	}
+	diagnostics := loadError.Diagnostics()
+	if len(diagnostics) == 0 {
+		t.Fatal("load error has no diagnostics")
+	}
+	return diagnostics[0]
+}

internal/engine/destination_import_test.go

@@ -0,0 +1,208 @@
+package engine
+
+import (
+	"path/filepath"
+	"testing"
+	"testing/fstest"
+)
+
+type importDestinationConfig struct {
+	Mounted     map[string]string            `yaml:"mounted"`
+	Collections map[string]map[string]string `yaml:"collections"`
+}
+
+func TestLayeredHostImportsInheritInputDestinationTransitively(t *testing.T) {
+	t.Parallel()
+
+	directory := t.TempDir()
+	mainPath := writeImportFile(t, directory, "main.yml", `configkit:
+  imports:
+    - path: first.yml
+    - path: second.yml
+root: main
+`)
+	firstPath := writeImportFile(t, directory, "first.yml", `configkit:
+  imports:
+    - path: nested/third.yml
+first: one
+`)
+	thirdPath := writeImportFile(t, directory, "nested/third.yml", "nested: three\n")
+	secondPath := writeImportFile(t, directory, "second.yml", "second: two\n")
+
+	loaded, err := LoadLayered(
+		Input{Source: File(mainPath), Imports: true, Destination: Keys("mounted")},
+		testSecretBinding(),
+		LayeredOptions[importDestinationConfig]{},
+	)
+	if err != nil {
+		if loadError, ok := err.(*LoadError); ok {
+			t.Fatalf("LoadLayered diagnostics: %#v", loadError.Diagnostics())
+		}
+		t.Fatalf("LoadLayered: %v", err)
+	}
+	result := testLoaded(loaded)
+	want := map[string]string{"root": "main", "first": "one", "nested": "three", "second": "two"}
+	if len(result.Config.Mounted) != len(want) {
+		t.Fatalf("mounted values = %#v", result.Config.Mounted)
+	}
+	for key, value := range want {
+		if result.Config.Mounted[key] != value {
+			t.Errorf("mounted[%q] = %q, want %q", key, result.Config.Mounted[key], value)
+		}
+	}
+	if _, ok := result.Metadata().Lookup(Keys("mounted", "configkit")); ok {
+		t.Fatal("source-root import directive leaked into application content")
+	}
+	sources := result.Sources()
+	wantPaths := []string{canonicalTestPath(t, mainPath), canonicalTestPath(t, firstPath), canonicalTestPath(t, thirdPath), canonicalTestPath(t, secondPath)}
+	if len(sources) != len(wantPaths) {
+		t.Fatalf("sources = %#v", sources)
+	}
+	for index, source := range sources {
+		if source.Destination.String() != "/mounted" {
+			t.Errorf("source %d destination = %q", index, source.Destination.String())
+		}
+		if source.Path != wantPaths[index] {
+			t.Errorf("source %d path = %q, want %q", index, source.Path, wantPaths[index])
+		}
+		if index > 0 && source.ImportedFrom == nil {
+			t.Errorf("imported source %d has no physical import location", index)
+		}
+	}
+}
+
+func TestLayeredNativeFilesystemImportsInheritInputDestination(t *testing.T) {
+	t.Parallel()
+
+	native := fstest.MapFS{
+		"main.yml":   &fstest.MapFile{Data: []byte("configkit:\n  imports:\n    - path: first.yml\nroot: main\n")},
+		"first.yml":  &fstest.MapFile{Data: []byte("configkit: {imports: [{path: nested.yml}]}\nfirst: imported\n")},
+		"nested.yml": &fstest.MapFile{Data: []byte("nested: imported\n")},
+	}
+	namespace := newNativeNamespace("bundle", native)
+	loaded, err := LoadLayered(
+		Input{Source: filesystemFile(namespace, "main.yml"), Imports: true, Destination: Keys("mounted")},
+		testSecretBinding(),
+		LayeredOptions[importDestinationConfig]{},
+	)
+	if err != nil {
+		if loadError, ok := err.(*LoadError); ok {
+			t.Fatalf("LoadLayered diagnostics: %#v", loadError.Diagnostics())
+		}
+		t.Fatalf("LoadLayered: %v", err)
+	}
+	result := testLoaded(loaded)
+	if result.Config.Mounted["root"] != "main" || result.Config.Mounted["first"] != "imported" || result.Config.Mounted["nested"] != "imported" {
+		t.Fatalf("mounted native filesystem values = %#v", result.Config.Mounted)
+	}
+	sources := result.Sources()
+	if len(sources) != 3 || sources[0].Destination.String() != "/mounted" || sources[1].Destination.String() != "/mounted" || sources[2].Destination.String() != "/mounted" {
+		t.Fatalf("native source destinations = %#v", sources)
+	}
+}
+
+func TestLayeredImportOnlyInputMaterializesDestination(t *testing.T) {
+	t.Parallel()
+
+	directory := t.TempDir()
+	mainPath := writeImportFile(t, directory, "main.yml", `configkit:
+  imports:
+    - path: optional.yml
+      optional: true
+`)
+	loaded, err := LoadLayered(
+		Input{Source: File(mainPath), Imports: true, Destination: Keys("collections", "empty")},
+		testSecretBinding(),
+		LayeredOptions[importDestinationConfig]{},
+	)
+	if err != nil {
+		t.Fatalf("LoadLayered: %v", err)
+	}
+	result := testLoaded(loaded)
+	info, ok := result.Metadata().Lookup(Keys("collections", "empty"))
+	if !ok || !info.Explicit {
+		t.Fatalf("import-only body destination = %#v, %v", info, ok)
+	}
+	sources := result.Sources()
+	if len(sources) != 1 || sources[0].Destination.String() != "/collections/empty" {
+		t.Fatalf("sources = %#v", sources)
+	}
+}
+
+func TestLayeredImportedVersionClaimsUseEffectiveDestination(t *testing.T) {
+	t.Parallel()
+
+	for _, test := range []struct {
+		name        string
+		rulePath    Path
+		destination Path
+		wantCode    Code
+	}{
+		{name: "protected effective path", rulePath: Keys("mounted", "version"), destination: Keys("mounted"), wantCode: CodeImportVersion},
+		{name: "ordinary nested domain version", rulePath: Keys("version"), destination: Keys("collections", "entry")},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+			directory := t.TempDir()
+			writeImportFile(t, directory, "main.yml", "configkit: {imports: [{path: fragment.yml}]}\n")
+			writeImportFile(t, directory, "fragment.yml", "version: v2\n")
+			rule := &VersionRule{Path: test.rulePath, Check: func(Version, *Validation) error { return nil }}
+			loaded, err := LoadLayered(
+				Input{Source: NoSource()},
+				testSecretBinding(),
+				LayeredOptions[importDestinationConfig]{
+					Definition: Definition[importDestinationConfig]{Version: rule},
+					Underlays: []Underlay{{Inputs: []Input{{
+						Source: File(filepath.Join(directory, "main.yml")), Imports: true, Destination: test.destination,
+					}}}},
+				},
+			)
+			if test.wantCode != "" {
+				if err == nil {
+					t.Fatal("protected imported version claim was accepted")
+				}
+				loadError, ok := err.(*LoadError)
+				if !ok || len(loadError.Diagnostics()) == 0 || loadError.Diagnostics()[0].Code != test.wantCode {
+					t.Fatalf("load error = %#v", err)
+				}
+				if test.name == "protected effective path" {
+					sources := loadError.Sources()
+					if len(sources) != 2 || sources[0].Destination.String() != "/mounted" || sources[1].Destination.String() != "/mounted" {
+						t.Fatalf("error source destinations = %#v", sources)
+					}
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("ordinary nested version was rejected: %v", err)
+			}
+			result := testLoaded(loaded)
+			if got := result.Config.Collections["entry"]["version"]; got != "v2" {
+				t.Fatalf("nested version = %q", got)
+			}
+		})
+	}
+}
+
+func TestLayeredDestinationsDoNotChangeRepeatedSourceIdentity(t *testing.T) {
+	t.Parallel()
+
+	directory := t.TempDir()
+	writeImportFile(t, directory, "shared.yml", "value: shared\n")
+	importerPath := writeImportFile(t, directory, "importer.yml", "configkit: {imports: [{path: shared.yml}]}\n")
+	_, err := LoadLayered(
+		Input{Source: NoSource()},
+		testSecretBinding(),
+		LayeredOptions[importDestinationConfig]{Underlays: []Underlay{{Inputs: []Input{
+			{Source: File(importerPath), Imports: true, Destination: Keys("imported")},
+			{Source: File(filepath.Join(directory, "shared.yml")), Destination: Keys("direct")},
+		}}}},
+	)
+	if err == nil {
+		t.Fatal("the same physical source was accepted at two destinations in one group")
+	}
+	loadError, ok := err.(*LoadError)
+	if !ok || len(loadError.Diagnostics()) == 0 || loadError.Diagnostics()[0].Code != CodeImportRepeated {
+		t.Fatalf("load error = %#v", err)
+	}
+}

internal/engine/destination_integration_test.go

@@ -0,0 +1,463 @@
+package engine
+
+import (
+	"bytes"
+	"fmt"
+	"reflect"
+	"strings"
+	"testing"
+	"testing/fstest"
+)
+
+func TestLayeredDestinationInheritanceUsesFinalSiblingScopes(t *testing.T) {
+	t.Parallel()
+
+	loaded, err := LoadLayered(
+		Input{Source: Bytes("main", []byte("parent:\n  label: final\n  settings:\n    primary: {height: 4}\ncancelled:\n  extends: null\n  own: retained\n")), Destination: Keys("catalog", "entries")},
+		testSecretBinding(),
+		LayeredOptions[map[string]any]{Underlays: []Underlay{{Inputs: []Input{
+			{Source: Bytes("parent", []byte("parent:\n  label: lower\n  settings:\n    primary: {width: '10'}\n    secondary: {extends: primary}\ncancelled:\n  extends: parent\n  own: retained\n")), Destination: Keys("catalog", "entries")},
+			{Source: Bytes("child", []byte("child:\n  extends: parent\n  settings:\n    primary: {width: '20'}\n    secondary: {extends: primary}\n")), Destination: Keys("catalog", "entries")},
+		}}}},
+	)
+	if err != nil {
+		t.Fatalf("LoadLayered: %v", err)
+	}
+	result := testLoaded(loaded)
+	entries := layeredMap(t, layeredMap(t, result.Config, "catalog"), "entries")
+	parent := layeredMap(t, entries, "parent")
+	child := layeredMap(t, entries, "child")
+	parentSettings := layeredMap(t, parent, "settings")
+	childSettings := layeredMap(t, child, "settings")
+	if parent["label"] != "final" || child["label"] != "final" {
+		t.Fatalf("higher-tier parent was not inherited after precedence: parent=%#v child=%#v", parent, child)
+	}
+	if layeredMapValue(t, parentSettings, "secondary", "width") != "10" ||
+		fmt.Sprint(layeredMapValue(t, parentSettings, "secondary", "height")) != "4" ||
+		layeredMapValue(t, childSettings, "secondary", "width") != "20" ||
+		fmt.Sprint(layeredMapValue(t, childSettings, "secondary", "height")) != "4" {
+		t.Fatalf("nested sibling scopes were not resolved at their destinations: parent=%#v child=%#v", parentSettings, childSettings)
+	}
+	cancelled := layeredMap(t, entries, "cancelled")
+	if len(cancelled) != 1 || cancelled["own"] != "retained" {
+		t.Fatalf("higher-tier cancellation did not suppress inheritance: %#v", cancelled)
+	}
+	if _, ok := result.Metadata().Lookup(Keys("catalog", "entries", "child", inheritanceKey)); ok {
+		t.Fatal("effective child retained its extends directive")
+	}
+}
+
+func TestLayeredDestinationInheritanceDoesNotSearchOtherCollections(t *testing.T) {
+	t.Parallel()
+
+	_, err := LoadLayered(
+		Input{Source: Bytes("main", []byte("parent: {value: foreign}\n")), Destination: Keys("catalog", "other")},
+		testSecretBinding(),
+		LayeredOptions[map[string]any]{Underlays: []Underlay{{Inputs: []Input{{
+			Source:      Bytes("child", []byte("child: {extends: parent}\n")),
+			Destination: Keys("catalog", "entries"),
+		}}}}},
+	)
+	if got := groupedErrorCode(t, err); got != CodeInheritanceMissing {
+		t.Fatalf("cross-collection parent lookup error = %s, want %s", got, CodeInheritanceMissing)
+	}
+}
+
+func TestLayeredMountedVersionProtectionCoversInheritanceAndUpperTiers(t *testing.T) {
+	t.Parallel()
+
+	for _, test := range []struct {
+		name     string
+		body     string
+		rulePath Path
+	}{
+		{name: "inherited protected value", body: "parent: {version: v2}\nchild: {extends: parent}\n", rulePath: Keys("catalog", "entries", "child", "version")},
+		{name: "inherited protected ancestor", body: "parent: {schema: null}\nchild: {extends: parent}\n", rulePath: Keys("catalog", "entries", "child", "schema", "version")},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+			_, err := LoadLayered(
+				Input{Source: NoSource()}, testSecretBinding(),
+				LayeredOptions[map[string]any]{
+					Definition: Definition[map[string]any]{Version: &VersionRule{Path: test.rulePath, Check: func(Version, *Validation) error { return nil }}},
+					Underlays:  []Underlay{{Inputs: []Input{{Source: Bytes("underlay", []byte(test.body)), Destination: Keys("catalog", "entries")}}}},
+				},
+			)
+			if got := groupedErrorCode(t, err); got != CodeInheritanceVersion {
+				t.Fatalf("inheritance version protection code = %s", got)
+			}
+		})
+	}
+	t.Run("inheritance consumes a protected directive", func(t *testing.T) {
+		_, err := LoadLayered(
+			Input{Source: Bytes("main", []byte("parent: {value: inherited}\nchild: {extends: parent}\n")), Destination: Keys("catalog", "entries")},
+			testSecretBinding(),
+			LayeredOptions[map[string]any]{Definition: Definition[map[string]any]{Version: &VersionRule{
+				Path: Keys("catalog", "entries", "child", "extends"),
+				Check: func(version Version, _ *Validation) error {
+					if !version.Present || version.Text != "parent" {
+						t.Errorf("mounted protected directive value = %#v", version)
+					}
+					return nil
+				},
+			}}},
+		)
+		if got := groupedErrorCode(t, err); got != CodeInheritanceVersion {
+			t.Fatalf("consumed directive protection code = %s", got)
+		}
+	})
+	t.Run("inherited mapping ancestor without a version claim", func(t *testing.T) {
+		loaded, err := LoadLayered(
+			Input{Source: NoSource()}, testSecretBinding(),
+			LayeredOptions[map[string]any]{
+				Definition: Definition[map[string]any]{Version: &VersionRule{Path: Keys("catalog", "entries", "child", "schema", "version"), Check: func(Version, *Validation) error { return nil }}},
+				Underlays: []Underlay{{Inputs: []Input{{
+					Source: Bytes("underlay", []byte("parent: {schema: {name: ordinary}}\nchild: {extends: parent}\n")), Destination: Keys("catalog", "entries"),
+				}}}},
+			},
+		)
+		if err != nil {
+			t.Fatalf("nonclaiming inherited mapping ancestor was rejected: %v", err)
+		}
+		if got := layeredMapValue(t, testLoaded(loaded).Config, "catalog", "entries", "child", "schema", "name"); got != "ordinary" {
+			t.Fatalf("inherited non-version value = %#v", got)
+		}
+	})
+
+	for _, test := range []struct {
+		name string
+		body string
+	}{
+		{name: "overlay protected value", body: "catalog: {schema: {version: v2}}\n"},
+		{name: "overlay protected ancestor", body: "catalog: {schema: null}\n"},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+			filesystem := NewFilesystem("overlay", fstest.MapFS{"overlays/test.yml": &fstest.MapFile{Data: []byte(test.body)}})
+			_, err := LoadLayered(
+				Input{Source: Bytes("main", []byte("schema: {version: v1}\n")), Destination: Keys("catalog")},
+				testSecretBinding(),
+				LayeredOptions[map[string]any]{
+					Definition: Definition[map[string]any]{Version: &VersionRule{Path: Keys("catalog", "schema", "version"), Check: func(version Version, _ *Validation) error {
+						if !version.Present || version.Text != "v1" {
+							t.Errorf("mounted main version = %#v", version)
+						}
+						return nil
+					}}},
+					Overlay: "test", OverlayFilesystem: &FilesystemContext{Root: ".", BaseDir: ".", FS: &filesystem},
+				},
+			)
+			if got := groupedErrorCode(t, err); got != CodeOverlayVersion {
+				t.Fatalf("overlay version protection code = %s", got)
+			}
+		})
+	}
+
+	for _, test := range []struct {
+		name  string
+		path  Path
+		value any
+	}{
+		{name: "override protected value", path: Keys("catalog", "schema", "version"), value: "v2"},
+		{name: "override protected ancestor", path: Keys("catalog", "schema"), value: map[string]any{"version": "v2"}},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+			_, err := LoadLayered(
+				Input{Source: Bytes("main", []byte("schema: {version: v1}\n")), Destination: Keys("catalog")},
+				testSecretBinding(),
+				LayeredOptions[map[string]any]{
+					Definition: Definition[map[string]any]{Version: &VersionRule{Path: Keys("catalog", "schema", "version"), Check: func(Version, *Validation) error { return nil }}},
+					Overrides:  []Override{{Path: test.path, Value: test.value, Flag: "--config"}},
+				},
+			)
+			if got := groupedErrorCode(t, err); got != CodeOverrideVersion {
+				t.Fatalf("override version protection code = %s", got)
+			}
+		})
+	}
+
+	t.Run("unrelated inheritance under the protected mapping ancestor", func(t *testing.T) {
+		loaded, err := LoadLayered(
+			Input{Source: Bytes("main", []byte("schema: {version: v1}\nentries:\n  parent: {value: inherited}\n  child: {extends: parent}\n")), Destination: Keys("catalog")},
+			testSecretBinding(),
+			LayeredOptions[map[string]any]{Definition: Definition[map[string]any]{Version: &VersionRule{Path: Keys("catalog", "schema", "version"), Check: func(Version, *Validation) error { return nil }}}},
+		)
+		if err != nil {
+			t.Fatalf("unrelated mounted inheritance was rejected: %v", err)
+		}
+		child := layeredMapValue(t, testLoaded(loaded).Config, "catalog", "entries", "child", "value")
+		if child != "inherited" {
+			t.Fatalf("unrelated inheritance value = %#v", child)
+		}
+	})
+}
+
+type destinationDecodeProbe string
+
+var destinationDecodeProbeValues []string
+
+func (value *destinationDecodeProbe) UnmarshalText(text []byte) error {
+	destinationDecodeProbeValues = append(destinationDecodeProbeValues, string(text))
+	*value = destinationDecodeProbe(text)
+	return nil
+}
+
+func (value destinationDecodeProbe) MarshalText() ([]byte, error) {
+	return []byte(value), nil
+}
+
+type destinationLifecycleConfig struct {
+	Defaulted string `yaml:"defaulted"`
+	Tenant    struct {
+		Tagged     string                 `yaml:"tagged" configkit:"secret"`
+		Dynamic    string                 `yaml:"dynamic"`
+		Credential Secret                 `yaml:"credential"`
+		Derived    string                 `yaml:"derived"`
+		Decoded    destinationDecodeProbe `yaml:"decoded"`
+	} `yaml:"tenant"`
+}
+
+func TestLayeredDestinationLifecycleAndSensitiveInspectionUseFinalShape(t *testing.T) {
+	const (
+		oldTagged   = "SUPERSEDED-TAGGED-CANARY"
+		newTagged   = "CURRENT-TAGGED-CANARY"
+		oldDynamic  = "SUPERSEDED-DYNAMIC-CANARY"
+		newDynamic  = "CURRENT-DYNAMIC-CANARY"
+		credential  = "RESOLVED-CREDENTIAL-CANARY"
+		secretName  = "DESTINATION_SECRET_NAME"
+		decodeValue = "decoded-once"
+	)
+	type calls struct{ defaults, resolve, lookup, validate int }
+	newLoad := func(mounted bool, observed *calls) (*testResult[destinationLifecycleConfig], error) {
+		mainBody := "tagged: " + newTagged + "\ndynamic: " + newDynamic + "\ncredential: " + secretName + "\ndecoded: " + decodeValue + "\n"
+		underlayBody := "tagged: " + oldTagged + "\ndynamic: " + oldDynamic + "\ncredential: OLD_DESTINATION_SECRET_NAME\ndecoded: old\n"
+		if !mounted {
+			mainBody = "tenant:\n" + indentDestinationBody(mainBody)
+			underlayBody = "tenant:\n" + indentDestinationBody(underlayBody)
+		}
+		main := loadInput{source: Bytes("main", []byte(mainBody))}
+		underlay := loadInput{source: Bytes("underlay", []byte(underlayBody))}
+		if mounted {
+			main.destination = Keys("tenant")
+			underlay.destination = Keys("tenant")
+		}
+		definition := Definition[destinationLifecycleConfig]{
+			Defaults: func() destinationLifecycleConfig {
+				observed.defaults++
+				return destinationLifecycleConfig{Defaulted: "from-default"}
+			},
+			Resolve: func(configuration *destinationLifecycleConfig, resolution *Resolution) error {
+				observed.resolve++
+				configuration.Tenant.Derived = configuration.Tenant.Dynamic
+				resolution.Record(Keys("tenant", "derived"), ChangeNormalization, "derive from mounted input", Keys("tenant", "dynamic"))
+				return nil
+			},
+			Validate: func(configuration *destinationLifecycleConfig, _ *Validation) {
+				observed.validate++
+				if configuration.Tenant.Decoded != destinationDecodeProbe(decodeValue) || configuration.Tenant.Dynamic != newDynamic {
+					t.Errorf("validation saw a non-final mounted configuration: %#v", configuration.Tenant)
+				}
+			},
+			Secret: func(path Path) bool { return path.String() == "/tenant/dynamic" },
+		}
+		loaded, err := loadGroupedWithSecretLookup(loadRequest[destinationLifecycleConfig]{
+			main: main, underlays: []loadGroup{{inputs: []loadInput{underlay}}}, definition: definition,
+		}, testSecretBinding(), func(name string) (string, bool) {
+			observed.lookup++
+			if name != secretName {
+				return "", false
+			}
+			return credential, true
+		})
+		return testLoaded(loaded), err
+	}
+
+	var observed calls
+	destinationDecodeProbeValues = nil
+	mounted, err := newLoad(true, &observed)
+	if err != nil {
+		if loadError, ok := err.(*LoadError); ok {
+			t.Fatalf("mounted load: %#v", loadError.Diagnostics())
+		}
+		t.Fatalf("mounted load: %v", err)
+	}
+	if observed != (calls{defaults: 1, resolve: 1, lookup: 1, validate: 1}) {
+		t.Fatalf("mounted lifecycle counts = %#v", observed)
+	}
+	sawFinalDecode := false
+	for _, value := range destinationDecodeProbeValues {
+		if value == decodeValue {
+			sawFinalDecode = true
+		} else if value != "" {
+			t.Fatalf("decoder observed a non-final mounted value %q: %#v", value, destinationDecodeProbeValues)
+		}
+	}
+	if !sawFinalDecode {
+		t.Fatal("final mounted value was not decoded")
+	}
+	if mounted.Config.Defaulted != "from-default" || mounted.Config.Tenant.Tagged != newTagged || mounted.Config.Tenant.Dynamic != newDynamic ||
+		mounted.Config.Tenant.Derived != newDynamic || mounted.Config.Tenant.Decoded != destinationDecodeProbe(decodeValue) ||
+		mounted.Config.Tenant.Credential.Value() != credential {
+		t.Fatalf("mounted final configuration = %#v", mounted.Config)
+	}
+	for _, path := range []Path{Keys("tenant", "tagged"), Keys("tenant", "dynamic"), Keys("tenant", "derived")} {
+		if !mounted.Inspection.secrets[path.String()] {
+			t.Errorf("effective sensitivity missing at %s: %#v", path, mounted.Inspection.secrets)
+		}
+	}
+	for _, path := range []Path{Keys("tenant", "tagged"), Keys("tenant", "dynamic"), Keys("tenant", "derived")} {
+		explanation, ok := mounted.Explain(path)
+		if !ok || !explanation.Effective.Redacted {
+			t.Errorf("effective explanation at %s = %#v, %v", path, explanation, ok)
+			continue
+		}
+		for _, change := range explanation.History {
+			if strings.Contains(change.Before.YAML+change.After.YAML, oldTagged) ||
+				strings.Contains(change.Before.YAML+change.After.YAML, newTagged) ||
+				strings.Contains(change.Before.YAML+change.After.YAML, oldDynamic) ||
+				strings.Contains(change.Before.YAML+change.After.YAML, newDynamic) {
+				t.Errorf("classified history leaked a canary at %s: %#v", path, change)
+			}
+		}
+		var rendered bytes.Buffer
+		if err := mounted.WriteExplanation(&rendered, path); err != nil || strings.Contains(rendered.String(), "CANARY") {
+			t.Errorf("safe explanation at %s = %q, %v", path, rendered.String(), err)
+		}
+	}
+	var effective bytes.Buffer
+	if err := mounted.WriteEffective(&effective); err != nil {
+		t.Fatal(err)
+	}
+	for _, canary := range []string{oldTagged, newTagged, oldDynamic, newDynamic, credential} {
+		if strings.Contains(effective.String(), canary) {
+			t.Fatalf("effective rendering exposed %q: %s", canary, effective.String())
+		}
+	}
+	if serializedConfig := fmt.Sprintf("%#v", mounted.Config); strings.Contains(serializedConfig, credential) {
+		t.Fatalf("configuration formatting exposed the resolved credential: %s", serializedConfig)
+	}
+	for _, path := range []Path{Keys("tenant", "tagged"), Keys("tenant", "dynamic")} {
+		if history := fmt.Sprintf("%#v", mounted.Metadata().History(path)); strings.Contains(history, "CANARY") {
+			t.Fatalf("metadata history at %s exposed a canary: %s", path, history)
+		}
+	}
+
+	var authoredCalls calls
+	destinationDecodeProbeValues = nil
+	authored, err := newLoad(false, &authoredCalls)
+	if err != nil {
+		t.Fatalf("explicitly wrapped load: %v", err)
+	}
+	if authoredCalls != (calls{defaults: 1, resolve: 1, lookup: 1, validate: 1}) {
+		t.Fatalf("authored lifecycle counts = %#v", authoredCalls)
+	}
+	sawFinalDecode = false
+	for _, value := range destinationDecodeProbeValues {
+		if value == decodeValue {
+			sawFinalDecode = true
+		} else if value != "" {
+			t.Fatalf("authored decoder observed a non-final value %q: %#v", value, destinationDecodeProbeValues)
+		}
+	}
+	if !sawFinalDecode {
+		t.Fatal("final authored value was not decoded")
+	}
+	if !reflect.DeepEqual(mounted.Config, authored.Config) {
+		t.Fatalf("mounted config %#v differs from explicitly wrapped config %#v", mounted.Config, authored.Config)
+	}
+	differences, err := Diff(mounted.Inspection, authored.Inspection)
+	if err != nil || len(differences) != 0 {
+		t.Fatalf("mounted versus authored diff = %#v, %v", differences, err)
+	}
+}
+
+func TestLayeredDestinationDiffUsesBilateralSensitivity(t *testing.T) {
+	t.Parallel()
+
+	type config struct {
+		Tenant struct {
+			Dynamic string `yaml:"dynamic"`
+			Derived string `yaml:"derived"`
+		} `yaml:"tenant"`
+	}
+	load := func(value string, classify bool) *testResult[config] {
+		t.Helper()
+		loaded, err := loadGroupedWithSecretLookup(loadRequest[config]{
+			main: loadInput{source: Bytes("input", []byte("dynamic: "+value+"\n")), destination: Keys("tenant")},
+			definition: Definition[config]{
+				Resolve: func(configuration *config, resolution *Resolution) error {
+					configuration.Tenant.Derived = configuration.Tenant.Dynamic
+					resolution.Record(Keys("tenant", "derived"), ChangeNormalization, "derive from dynamic input", Keys("tenant", "dynamic"))
+					return nil
+				},
+				Secret: func(path Path) bool { return classify && path.String() == "/tenant/dynamic" },
+			},
+		}, testSecretBinding(), func(string) (string, bool) { return "", false })
+		if err != nil {
+			t.Fatalf("LoadLayered: %v", err)
+		}
+		return testLoaded(loaded)
+	}
+	left := load("LEFT-DIFF-CANARY", true)
+	right := load("RIGHT-DIFF-CANARY", false)
+	differences, err := Diff(left.Inspection, right.Inspection)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(differences) != 2 {
+		t.Fatalf("differences = %#v", differences)
+	}
+	seen := make(map[string]bool)
+	for _, difference := range differences {
+		path := difference.Path.String()
+		seen[path] = true
+		if !difference.Left.Redacted || !difference.Right.Redacted || !difference.HiddenChanged ||
+			strings.Contains(difference.Left.YAML+difference.Right.YAML, "DIFF-CANARY") {
+			t.Errorf("bilaterally classified difference at %s = %#v", path, difference)
+		}
+	}
+	for _, path := range []string{"/tenant/dynamic", "/tenant/derived"} {
+		if !seen[path] || !left.Inspection.secrets[path] || right.Inspection.secrets[path] {
+			t.Errorf("classification/difference at %s: seen=%v left=%v right=%v", path, seen[path], left.Inspection.secrets[path], right.Inspection.secrets[path])
+		}
+	}
+}
+
+func TestLayeredDestinationDecodeFailureReturnsNoResultOrLaterCallbacks(t *testing.T) {
+	t.Parallel()
+
+	type config struct {
+		Tenant struct {
+			Count int `yaml:"count"`
+		} `yaml:"tenant"`
+	}
+	calls := struct{ defaults, resolve, lookup, validate int }{}
+	loaded, err := loadGroupedWithSecretLookup(loadRequest[config]{
+		main: loadInput{source: Bytes("invalid", []byte("count: not-an-integer\n")), destination: Keys("tenant")},
+		definition: Definition[config]{
+			Defaults: func() config { calls.defaults++; return config{} },
+			Resolve:  func(*config, *Resolution) error { calls.resolve++; return nil },
+			Validate: func(*config, *Validation) { calls.validate++ },
+		},
+	}, testSecretBinding(), func(string) (string, bool) { calls.lookup++; return "", false })
+	if loaded != nil || err == nil {
+		t.Fatalf("mounted decode failure returned a usable result: %#v, %v", loaded, err)
+	}
+	if calls.defaults != 1 || calls.resolve != 0 || calls.lookup != 0 || calls.validate != 0 {
+		t.Fatalf("callbacks after mounted decode failure = %#v", calls)
+	}
+	if got := groupedErrorCode(t, err); got != CodeDecodeType {
+		t.Fatalf("mounted decode failure code = %s", got)
+	}
+}
+
+func indentDestinationBody(body string) string {
+	var result strings.Builder
+	for _, line := range strings.Split(strings.TrimSuffix(body, "\n"), "\n") {
+		result.WriteString("  ")
+		result.WriteString(line)
+		result.WriteByte('\n')
+	}
+	return result.String()
+}

internal/engine/destination_load_test.go

@@ -0,0 +1,118 @@
+package engine
+
+import (
+	"bytes"
+	"testing"
+)
+
+type destinationLoadConfig struct {
+	Main        map[string]string            `yaml:"main"`
+	Defaults    map[string]string            `yaml:"defaults"`
+	Collections map[string]map[string]string `yaml:"collections"`
+	Value       string                       `yaml:"value"`
+}
+
+func TestLayeredLoadPlacesNonImportMainAndUnderlayInputs(t *testing.T) {
+	t.Parallel()
+
+	destination := Keys("main")
+	main := Input{Source: Bytes("main", []byte("value: primary\n")), Destination: destination}
+	underlay := Input{Source: Bytes("defaults", []byte("value: fallback\n")), Destination: Keys("defaults")}
+	loaded, err := LoadLayered(main, testSecretBinding(), LayeredOptions[destinationLoadConfig]{
+		Underlays: []Underlay{{Inputs: []Input{underlay}}},
+	})
+	if err != nil {
+		t.Fatalf("LoadLayered: %v", err)
+	}
+	result := testLoaded(loaded)
+	if result.Config.Main["value"] != "primary" || result.Config.Defaults["value"] != "fallback" {
+		t.Fatalf("mounted configuration = %#v", result.Config)
+	}
+	sources := result.Sources()
+	if len(sources) != 2 || sources[0].Destination.String() != "/main" || sources[1].Destination.String() != "/defaults" {
+		t.Fatalf("source destinations = %#v", sources)
+	}
+
+	destination.segments[0].key = "caller mutation"
+	sources[0].Destination.segments[0].key = "record mutation"
+	if got := result.Sources()[0].Destination.String(); got != "/main" {
+		t.Fatalf("source destination was not independently owned: %q", got)
+	}
+}
+
+func TestLayeredLoadOmittedAndEmptyDestinationsKeepRootPlacement(t *testing.T) {
+	t.Parallel()
+
+	inputs := []Input{
+		{Source: Bytes("omitted", []byte("value: same\n"))},
+		{Source: Bytes("empty", []byte("value: same\n")), Destination: Keys()},
+	}
+	for _, input := range inputs {
+		loaded, err := LoadLayered(input, testSecretBinding(), LayeredOptions[destinationLoadConfig]{})
+		if err != nil {
+			t.Fatalf("LoadLayered: %v", err)
+		}
+		result := testLoaded(loaded)
+		if result.Config.Value != "same" {
+			t.Fatalf("root value = %q", result.Config.Value)
+		}
+		sources := result.Sources()
+		if len(sources) != 1 || sources[0].Destination.String() != "" {
+			t.Fatalf("root source destination = %#v", sources)
+		}
+	}
+}
+
+func TestLayeredLoadDistinguishesEmptyBodyFromNoSource(t *testing.T) {
+	t.Parallel()
+
+	loaded, err := LoadLayered(
+		Input{Source: NoSource(), Destination: Keys("absent")},
+		testSecretBinding(),
+		LayeredOptions[destinationLoadConfig]{Underlays: []Underlay{{Inputs: []Input{{
+			Source: Bytes("empty", []byte("{}\n")), Destination: Keys("collections", "one"),
+		}}}}},
+	)
+	if err != nil {
+		t.Fatalf("LoadLayered: %v", err)
+	}
+	result := testLoaded(loaded)
+	info, ok := result.Metadata().Lookup(Keys("collections", "one"))
+	if !ok || !info.Explicit || info.Origin.Layer != LayerUnderlay {
+		t.Fatalf("empty mounted mapping = %#v, %v", info, ok)
+	}
+	if _, ok := result.Metadata().Lookup(Keys("absent")); ok {
+		t.Fatal("NoSource materialized its destination")
+	}
+	sources := result.Sources()
+	if len(sources) != 1 || sources[0].Label != "empty" || sources[0].Destination.String() != "/collections/one" {
+		t.Fatalf("sources = %#v", sources)
+	}
+}
+
+func TestLayeredLoadPreflightsDestinationsBeforeReadingSources(t *testing.T) {
+	t.Parallel()
+
+	reader := bytes.NewBufferString("value: unused\n")
+	_, err := LoadLayered(
+		Input{Source: NoSource()},
+		testSecretBinding(),
+		LayeredOptions[destinationLoadConfig]{Underlays: []Underlay{{Inputs: []Input{{
+			Source: Reader("reader", reader), Destination: Keys("configkit"),
+		}}}}},
+	)
+	if err == nil {
+		t.Fatal("reserved destination was accepted")
+	}
+	if reader.Len() == 0 {
+		t.Fatal("source reader was consumed before destination preflight")
+	}
+	loadError, ok := err.(*LoadError)
+	if !ok || len(loadError.Diagnostics()) != 1 {
+		t.Fatalf("error = %#v", err)
+	}
+	diagnostic := loadError.Diagnostics()[0]
+	if diagnostic.Code != CodeOptionsInvalid || diagnostic.Path.String() != "/configkit" || diagnostic.Primary != nil {
+		t.Fatalf("destination diagnostic = %#v", diagnostic)
+	}
+}

internal/engine/destination_provenance_test.go

@@ -0,0 +1,181 @@
+package engine
+
+import (
+	"errors"
+	"io/fs"
+	"path"
+	"reflect"
+	"testing"
+)
+
+func TestLayeredDestinationsRetainOriginsHistoryAndDetachedRecords(t *testing.T) {
+	t.Parallel()
+
+	directory := t.TempDir()
+	sharedPath := writeImportFile(t, directory, "shared.yml", "section:\n  shared: lower\n  branch:\n    child: old\n    kept: retained\n")
+	shared := File(sharedPath)
+	load := func() (*Loaded[map[string]any], error) {
+		return LoadLayered(
+			Input{Source: NoSource()}, testSecretBinding(),
+			LayeredOptions[map[string]any]{Underlays: []Underlay{
+				{Inputs: []Input{
+					{Source: shared, Destination: Keys("catalog")},
+					{Source: Bytes("peer", []byte("section:\n  peer: present\n")), Destination: Keys("catalog")},
+				}},
+				{Inputs: []Input{{Source: shared, Destination: Keys("backup")}}},
+				{Inputs: []Input{{Source: Bytes("replacement", []byte("section:\n  branch: replaced\n")), Destination: Keys("catalog")}}},
+			}},
+		)
+	}
+	loaded, err := load()
+	if err != nil {
+		t.Fatalf("LoadLayered: %v, diagnostics %#v", err, err.(*LoadError).Diagnostics())
+	}
+	result := testLoaded(loaded)
+	metadata := result.Metadata()
+
+	container, ok := metadata.Lookup(Keys("catalog"))
+	if !ok || !container.Explicit || len(container.Origin.Locations) < 3 {
+		t.Fatalf("mounted container origin = %#v, %v", container, ok)
+	}
+	containerSources := make(map[string]bool)
+	for _, location := range container.Origin.Locations {
+		containerSources[location.SourceID] = true
+		if location.Line < 1 {
+			t.Fatalf("introduced container lacks its source-root fallback: %#v", location)
+		}
+	}
+	for _, sourceID := range []string{"source-1", "source-2", "source-4"} {
+		if !containerSources[sourceID] {
+			t.Fatalf("container contributors = %#v, missing %s", container.Origin.Locations, sourceID)
+		}
+	}
+
+	sharedField, ok := metadata.Lookup(Keys("catalog", "section", "shared"))
+	if !ok || len(sharedField.Origin.Locations) != 1 || sharedField.Origin.Locations[0].SourceID != "source-1" || sharedField.Origin.Locations[0].Line != 2 {
+		t.Fatalf("authored leaf origin = %#v, %v", sharedField, ok)
+	}
+	peerField, ok := metadata.Lookup(Keys("catalog", "section", "peer"))
+	if !ok || len(peerField.Origin.Locations) != 1 || peerField.Origin.Locations[0].SourceID != "source-2" {
+		t.Fatalf("peer leaf origin = %#v, %v", peerField, ok)
+	}
+	if _, ok := metadata.Lookup(Keys("catalog", "section", "branch", "child")); ok {
+		t.Fatal("replaced descendant remains effective")
+	}
+	removed := metadata.History(Keys("catalog", "section", "branch", "child"))
+	if len(removed) < 2 || removed[0].Origin.Locations[0].SourceID != "source-1" {
+		t.Fatalf("removed descendant history = %#v", removed)
+	}
+
+	backup, ok := metadata.Lookup(Keys("backup", "section", "shared"))
+	if !ok || len(backup.Origin.Locations) != 1 || backup.Origin.Locations[0].SourceID != "source-3" {
+		t.Fatalf("second-tier leaf origin = %#v, %v", backup, ok)
+	}
+	sources := result.Sources()
+	if len(sources) != 4 || sources[0].Path != sources[2].Path || sources[0].Destination.String() != "/catalog" || sources[2].Destination.String() != "/backup" {
+		t.Fatalf("same source in separate tiers = %#v", sources)
+	}
+	if sources[0].Layer != LayerUnderlay || sources[0].UnderlayIndex != 1 || sources[2].Layer != LayerUnderlay || sources[2].UnderlayIndex != 2 {
+		t.Fatalf("tier source records = %#v", sources)
+	}
+
+	other, err := load()
+	if err != nil {
+		t.Fatalf("independent load: %v", err)
+	}
+	differences, err := Diff(loaded.Inspection, other.Inspection)
+	if err != nil || len(differences) != 0 {
+		t.Fatalf("equivalent inspection diff = %#v, %v", differences, err)
+	}
+
+	sources[0].Destination.segments[0].key = "mutated"
+	sharedField.Origin.Locations[0].SourceID = "mutated"
+	removed[0].Path.segments[0].key = "mutated"
+	if got := result.Sources()[0].Destination.String(); got != "/catalog" {
+		t.Fatalf("source record copy changed after inspection: %q", got)
+	}
+	fresh, ok := result.Metadata().Lookup(Keys("catalog", "section", "shared"))
+	if !ok || fresh.Origin.Locations[0].SourceID != "source-1" {
+		t.Fatalf("effective origin changed after mutating returned records: %#v, %v", fresh, ok)
+	}
+	if got := result.Metadata().History(Keys("catalog", "section", "branch", "child")); len(got) < 2 || got[0].Path.String() != "/catalog/section/branch/child" {
+		t.Fatalf("historical path changed after mutating returned records: %#v", got)
+	}
+	if got := other.Inspection.sources[0].Destination.String(); got != "/catalog" {
+		t.Fatalf("independent load destination changed: %q", got)
+	}
+}
+
+func TestLayeredImportedInheritedValuesRetainResourceContexts(t *testing.T) {
+	t.Parallel()
+
+	type entry struct {
+		Extends  string `yaml:"extends"`
+		Resource string `yaml:"resource"`
+		Count    int    `yaml:"count"`
+	}
+	type config struct {
+		Catalog struct {
+			Entries map[string]entry `yaml:"entries"`
+		} `yaml:"catalog"`
+	}
+	directory := t.TempDir()
+	mainPath := writeImportFile(t, directory, "config/main.yml", "child:\n  extends: parent\n")
+	inputPath := writeImportFile(t, directory, "shared/input.yml", "configkit: {imports: [{path: parent.yml}]}\n")
+	writeImportFile(t, directory, "shared/parent.yml", "parent:\n  resource: icon.txt\n  count: 1\n")
+	writeImportFile(t, directory, "shared/icon.txt", "parent-resource")
+	var resolutionContext ResourceContext
+	loaded, err := LoadLayered(
+		Input{Source: File(mainPath), Destination: Keys("catalog", "entries")},
+		testSecretBinding(),
+		LayeredOptions[config]{
+			Underlays: []Underlay{{Inputs: []Input{{
+				Source: File(inputPath), Imports: true, Destination: Keys("catalog", "entries"),
+			}}}},
+			Definition: Definition[config]{Resolve: func(configuration *config, resolution *Resolution) error {
+				info, ok := resolution.InputInfo(Keys("catalog", "entries", "child", "resource"))
+				if !ok || len(info.Origin.Locations) != 1 || len(info.Origin.Inheritance) != 1 {
+					return errors.New("inherited resource lacks its source origin")
+				}
+				var found bool
+				resolutionContext, found = resolution.state.input.sourceContext(info.Origin.Locations[0].SourceID)
+				if !found || resolutionContext.BaseDir != "." || resolutionContext.FS == nil {
+					return errors.New("resolver could not find the declaring resource context")
+				}
+				data, err := fs.ReadFile(resolutionContext.FS, path.Join(resolutionContext.BaseDir, configuration.Catalog.Entries["child"].Resource))
+				if err != nil || string(data) != "parent-resource" {
+					return errors.New("resolver could not read the inherited relative resource")
+				}
+				return nil
+			}},
+		},
+	)
+	if err != nil {
+		t.Fatalf("LoadLayered: %v, diagnostics %#v", err, err.(*LoadError).Diagnostics())
+	}
+	result := testLoaded(loaded)
+	child := result.Config.Catalog.Entries["child"]
+	if child.Resource != "icon.txt" || child.Count != 1 || child.Extends != "" {
+		t.Fatalf("inherited child = %#v", child)
+	}
+	field, ok := result.Metadata().Lookup(Keys("catalog", "entries", "child", "resource"))
+	if !ok || len(field.Origin.Locations) != 1 || len(field.Origin.Inheritance) != 1 {
+		t.Fatalf("inherited resource origin = %#v, %v", field, ok)
+	}
+	context, ok := result.Inspection.SourceContext(field.Origin.Locations[0].SourceID)
+	if !ok || context.BaseDir != "." || context.FS == nil || resolutionContext.BaseDir != context.BaseDir {
+		t.Fatalf("completed resource contexts = %#v, %#v, %v", resolutionContext, context, ok)
+	}
+	data, err := fs.ReadFile(context.FS, path.Join(context.BaseDir, child.Resource))
+	if err != nil || string(data) != "parent-resource" {
+		t.Fatalf("completed source-relative resource = %q, %v", data, err)
+	}
+	if !reflect.DeepEqual(result.Config.Catalog.Entries["parent"], entry{Resource: "icon.txt", Count: 1}) {
+		t.Fatalf("surviving lower-tier parent = %#v", result.Config.Catalog.Entries["parent"])
+	}
+	for _, source := range result.Sources() {
+		if source.Layer == LayerUnderlay && source.Destination.String() != "/catalog/entries" {
+			t.Errorf("underlay destination = %#v", source)
+		}
+	}
+}

internal/engine/destination_test.go

@@ -0,0 +1,178 @@
+package engine
+
+import (
+	"errors"
+	"testing"
+
+	"gitea.maximumdirect.net/eric/ConfigKit/internal/document"
+)
+
+func TestNormalizeDestinationUsesLiteralMappingKeys(t *testing.T) {
+	t.Parallel()
+
+	parsed, err := ParsePath("/a~1b/0/~0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	normalized, err := normalizeDestination(parsed)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got, want := normalized.String(), "/a~1b/0/~0"; got != want {
+		t.Fatalf("normalized path = %q, want %q", got, want)
+	}
+	for index, want := range []string{"a/b", "0", "~"} {
+		segment := normalized.segments[index]
+		if segment.kind != pathSegmentKey || segment.key != want {
+			t.Fatalf("segment %d = %#v, want key %q", index, segment, want)
+		}
+	}
+
+	original := Keys("owned", "path")
+	owned, err := normalizeDestination(original)
+	if err != nil {
+		t.Fatal(err)
+	}
+	owned.segments[0].key = "changed"
+	if got := original.String(); got != "/owned/path" {
+		t.Fatalf("normalizing shared path storage mutated its input: %q", got)
+	}
+}
+
+func TestNormalizeDestinationRejectsIndicesAndReservedKeys(t *testing.T) {
+	t.Parallel()
+
+	for name, path := range map[string]Path{
+		"explicit index":   Keys("items").Index(0),
+		"negative index":   Keys("items").Index(-1),
+		"invalid path":     Path{invalid: true},
+		"configkit":        Keys("configkit"),
+		"extends":          Keys("extends"),
+		"nested configkit": Keys("outer", "configkit"),
+		"nested extends":   Keys("outer", "extends"),
+	} {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+			if _, err := normalizeDestination(path); !errors.Is(err, errInvalidDestination) {
+				t.Fatalf("normalizeDestination(%q) error = %v, want invalid destination", path.String(), err)
+			}
+		})
+	}
+
+	for _, key := range []string{"myextends", "configkit2", "", ".", "..", "../x", "a.b", "a/b", "~"} {
+		t.Run("ordinary key "+key, func(t *testing.T) {
+			t.Parallel()
+			if _, err := normalizeDestination(Keys(key)); err != nil {
+				t.Fatalf("normalizeDestination(%q): %v", key, err)
+			}
+		})
+	}
+}
+
+func TestPlaceDocumentWrapsEmptyMappingAndPreservesSourceCoordinates(t *testing.T) {
+	t.Parallel()
+
+	rootLocation := document.Location{SourceID: "source-a", Line: 1, Column: 1}
+	body := &document.Node{
+		Kind:     document.Mapping,
+		Location: document.Location{SourceID: "source-a", Line: 4, Column: 1},
+	}
+	path, placed, err := placeDocument(body, Keys("a", "b"), rootLocation, 2, 5)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got, want := path.String(), "/a/b"; got != want {
+		t.Fatalf("normalized destination = %q, want %q", got, want)
+	}
+	if placed == body || len(placed.Mapping) != 1 || placed.Mapping[0].Key != "a" {
+		t.Fatalf("outer destination mapping was not created: %#v", placed)
+	}
+	inner := placed.Mapping[0].Value
+	if inner.Kind != document.Mapping || len(inner.Mapping) != 1 || inner.Mapping[0].Key != "b" {
+		t.Fatalf("inner destination mapping was not created: %#v", inner)
+	}
+	if inner.Mapping[0].Value != body || len(body.Mapping) != 0 {
+		t.Fatal("placement mutated or copied the authored body")
+	}
+	if placed.Location != rootLocation || inner.Location != rootLocation || placed.Mapping[0].KeyLocation != rootLocation || placed.Mapping[0].ValueLocation != rootLocation {
+		t.Fatal("introduced structure did not use the source-root coordinate fallback")
+	}
+	if body.Location != (document.Location{SourceID: "source-a", Line: 4, Column: 1}) {
+		t.Fatalf("authored body location changed: %#v", body.Location)
+	}
+	if got, want := countInputNodes(placed), countInputNodes(body)+4; got != want {
+		t.Fatalf("placed node count = %d, want body count plus four synthetic nodes (%d)", got, want)
+	}
+}
+
+func TestPlaceDocumentPreservesAuthoredEntryCoordinates(t *testing.T) {
+	t.Parallel()
+
+	rootLocation := document.Location{SourceID: "source-b", Line: 1, Column: 1}
+	bodyLocation := document.Location{SourceID: "source-b", Line: 3, Column: 1}
+	keyLocation := document.Location{SourceID: "source-b", Line: 3, Column: 3}
+	valueLocation := document.Location{SourceID: "source-b", Line: 4, Column: 5}
+	value := &document.Node{Kind: document.String, Location: valueLocation, Text: "value"}
+	body := &document.Node{
+		Kind:     document.Mapping,
+		Location: bodyLocation,
+		Mapping: []document.Entry{{
+			Key:           "leaf",
+			KeyLocation:   keyLocation,
+			ValueLocation: valueLocation,
+			Value:         value,
+		}},
+	}
+	_, placed, err := placeDocument(body, Keys("mounted"), rootLocation, 2, 5)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if placed.Mapping[0].KeyLocation != rootLocation || placed.Mapping[0].ValueLocation != rootLocation {
+		t.Fatal("introduced destination entry did not use the source-root fallback")
+	}
+	if placed.Mapping[0].Value != body || body.Location != bodyLocation {
+		t.Fatal("placement changed the authored body node or location")
+	}
+	entry := body.Mapping[0]
+	if entry.KeyLocation != keyLocation || entry.ValueLocation != valueLocation || entry.Value != value || value.Location != valueLocation {
+		t.Fatal("placement changed authored entry or value coordinates")
+	}
+}
+
+func TestPlaceDocumentRootAndBounds(t *testing.T) {
+	t.Parallel()
+
+	body := &document.Node{
+		Kind: document.Mapping,
+		Mapping: []document.Entry{{
+			Key:   "leaf",
+			Value: &document.Node{Kind: document.String, Text: "value"},
+		}},
+	}
+	path, placed, err := placeDocument(body, Path{}, body.Location, 1, 3)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if path.String() != "" || placed != body {
+		t.Fatal("root placement must preserve the existing body")
+	}
+
+	destination := Keys("a", "b")
+	if !destinationWithinLimits(body, destination, 3, 7) {
+		t.Fatal("exact depth and node limits should admit the placed document")
+	}
+	if destinationWithinLimits(body, destination, 2, 7) {
+		t.Fatal("placement exceeding the depth limit was accepted")
+	}
+	if destinationWithinLimits(body, destination, 3, 6) {
+		t.Fatal("placement exceeding the node limit was accepted")
+	}
+	_, placed, err = placeDocument(body, destination, body.Location, 3, 6)
+	if !errors.Is(err, errDestinationLimit) || placed != nil {
+		t.Fatalf("bounded placement returned node %p and error %v", placed, err)
+	}
+	_, absent, err := placeDocument(nil, destination, document.Location{}, 0, 0)
+	if err != nil || absent != nil {
+		t.Fatalf("absent body should not consume placement limits: node %p, error %v", absent, err)
+	}
+}

internal/engine/destination_tiers_test.go

@@ -0,0 +1,347 @@
+package engine
+
+import (
+	"path/filepath"
+	"reflect"
+	"testing"
+	"testing/fstest"
+)
+
+func TestLayeredDestinationStrictCompositionBoundaries(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name     string
+		inputs   []Input
+		wantPath []string
+		want     any
+		alsoPath []string
+		alsoWant any
+	}{
+		{
+			name: "disjoint peers at one destination",
+			inputs: []Input{
+				{Source: Bytes("left", []byte("left: one\n")), Destination: Keys("application")},
+				{Source: Bytes("right", []byte("right: two\n")), Destination: Keys("application")},
+			},
+			wantPath: []string{"application", "right"},
+			want:     "two",
+			alsoPath: []string{"application", "left"},
+			alsoWant: "one",
+		},
+		{
+			name: "different destinations",
+			inputs: []Input{
+				{Source: Bytes("left", []byte("value: shared\n")), Destination: Keys("left")},
+				{Source: Bytes("right", []byte("value: shared\n")), Destination: Keys("right")},
+			},
+			wantPath: []string{"right", "value"},
+			want:     "shared",
+		},
+		{
+			name: "ancestor and descendant destinations",
+			inputs: []Input{
+				{Source: Bytes("parent", []byte("branch: {base: one}\n")), Destination: Keys("application")},
+				{Source: Bytes("child", []byte("leaf: two\n")), Destination: Keys("application", "branch")},
+			},
+			wantPath: []string{"application", "branch", "leaf"},
+			want:     "two",
+			alsoPath: []string{"application", "branch", "base"},
+			alsoWant: "one",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+			loaded, err := LoadLayered(Input{Source: NoSource()}, testSecretBinding(), LayeredOptions[map[string]any]{
+				Underlays: []Underlay{{Inputs: test.inputs}},
+			})
+			if err != nil {
+				t.Fatalf("LoadLayered: %v", err)
+			}
+			result := testLoaded(loaded)
+			if got := layeredMapValue(t, result.Config, test.wantPath...); got != test.want {
+				t.Fatalf("value at %v = %#v, want %#v", test.wantPath, got, test.want)
+			}
+			if len(test.alsoPath) != 0 {
+				if got := layeredMapValue(t, result.Config, test.alsoPath...); got != test.alsoWant {
+					t.Fatalf("value at %v = %#v, want %#v", test.alsoPath, got, test.alsoWant)
+				}
+			}
+		})
+	}
+
+	for _, test := range []struct {
+		name  string
+		left  string
+		right string
+	}{
+		{name: "equal values conflict", left: "value: same\n", right: "value: same\n"},
+		{name: "unequal values conflict", left: "value: left\n", right: "value: right\n"},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+			inputs := []Input{
+				{Source: Bytes("left", []byte(test.left)), Destination: Keys("application")},
+				{Source: Bytes("right", []byte(test.right)), Destination: Keys("application")},
+			}
+			loaded, err := LoadLayered(Input{Source: NoSource()}, testSecretBinding(), LayeredOptions[map[string]any]{
+				Underlays: []Underlay{{Inputs: inputs}},
+			})
+			if loaded != nil || groupedErrorCode(t, err) != CodeComposeConflict {
+				t.Fatalf("strict composition result = %#v, %v", loaded, err)
+			}
+		})
+	}
+
+	t.Run("strict conflict is not hidden by an upper override", func(t *testing.T) {
+		inputs := []Input{
+			{Source: Bytes("left", []byte("value: left\n")), Destination: Keys("application")},
+			{Source: Bytes("right", []byte("value: right\n")), Destination: Keys("application")},
+		}
+		loaded, err := LoadLayered(
+			Input{Source: Bytes("main", []byte("value: upper\n")), Destination: Keys("application")},
+			testSecretBinding(),
+			LayeredOptions[map[string]any]{Underlays: []Underlay{{Inputs: inputs}}},
+		)
+		if loaded != nil || groupedErrorCode(t, err) != CodeComposeConflict {
+			t.Fatalf("strict composition result = %#v, %v", loaded, err)
+		}
+	})
+}
+
+func TestLayeredDestinationMatchesExplicitlyWrappedInput(t *testing.T) {
+	t.Parallel()
+
+	load := func(input Input) map[string]any {
+		t.Helper()
+		loaded, err := LoadLayered(Input{Source: NoSource()}, testSecretBinding(), LayeredOptions[map[string]any]{
+			Underlays: []Underlay{{Inputs: []Input{input}}},
+		})
+		if err != nil {
+			t.Fatalf("LoadLayered: %v", err)
+		}
+		return testLoaded(loaded).Config
+	}
+
+	placed := load(Input{Source: Bytes("placed", []byte("field: value\n")), Destination: Keys("application")})
+	authored := load(Input{Source: Bytes("authored", []byte("application: {field: value}\n"))})
+	if !reflect.DeepEqual(placed, authored) {
+		t.Fatalf("placed configuration %#v differs from explicitly wrapped %#v", placed, authored)
+	}
+}
+
+func TestEmptyMountedMappingRetainsLowerChildren(t *testing.T) {
+	t.Parallel()
+
+	destination := Keys("collections", "weather")
+	loaded, err := LoadLayered(
+		Input{Source: Bytes("empty-main", []byte("{}\n")), Destination: destination},
+		testSecretBinding(),
+		LayeredOptions[map[string]any]{Underlays: []Underlay{{Inputs: []Input{{
+			Source: Bytes("lower", []byte("prompt: {title: retained}\n")), Destination: destination,
+		}}}}},
+	)
+	if err != nil {
+		t.Fatalf("LoadLayered: %v", err)
+	}
+	if got := layeredMapValue(t, testLoaded(loaded).Config, "collections", "weather", "prompt", "title"); got != "retained" {
+		t.Fatalf("lower child beneath empty mounted mapping = %#v, want retained", got)
+	}
+}
+
+func TestLayeredDestinationOverlayRetainsOrdinaryValueSemantics(t *testing.T) {
+	t.Parallel()
+
+	filesystem := NewFilesystem("bundle", fstest.MapFS{
+		"overlays/test.yml": &fstest.MapFile{Data: []byte("settings:\n  metadata:\n    version: overlay\n")},
+	})
+	loaded, err := LoadLayered(
+		Input{Source: Bytes("main", []byte("mapping: {shared: main}\nsequence: [9]\ncleared: null\nenabled: false\nmetadata: {version: main}\n")), Destination: Keys("settings")},
+		testSecretBinding(),
+		LayeredOptions[map[string]any]{
+			Underlays: []Underlay{{Inputs: []Input{{
+				Source:      Bytes("underlay", []byte("mapping: {retained: lower, shared: lower}\nsequence: [1, 2]\ncleared: {old: true}\nenabled: true\ncount: 7\nmetadata: {version: lower, label: retained}\n")),
+				Destination: Keys("settings"),
+			}}}},
+			Overlay:           "test",
+			OverlayFilesystem: &FilesystemContext{Root: ".", BaseDir: ".", FS: &filesystem},
+			Overrides:         []Override{{Path: Keys("settings", "count"), Value: 0, Flag: "--count"}},
+		},
+	)
+	if err != nil {
+		t.Fatalf("LoadLayered: %v", err)
+	}
+	result := testLoaded(loaded)
+	settings := layeredMap(t, result.Config, "settings")
+	mapping := layeredMap(t, settings, "mapping")
+	if mapping["retained"] != "lower" || mapping["shared"] != "main" {
+		t.Fatalf("recursive mapping overlay = %#v", mapping)
+	}
+	sequence, ok := settings["sequence"].([]any)
+	if !ok || len(sequence) != 1 || sequence[0] != int64(9) {
+		t.Fatalf("sequence overlay = %#v", settings["sequence"])
+	}
+	if value, present := settings["cleared"]; !present || value != nil {
+		t.Fatalf("explicit null = %#v, present %v", value, present)
+	}
+	if value, ok := settings["enabled"].(bool); !ok || value {
+		t.Fatalf("explicit false = %#v", settings["enabled"])
+	}
+	if value, ok := settings["count"].(int64); !ok || value != 0 {
+		t.Fatalf("explicit zero override = %#v", settings["count"])
+	}
+	metadata := layeredMap(t, settings, "metadata")
+	if metadata["version"] != "overlay" || metadata["label"] != "retained" {
+		t.Fatalf("version-only overlay = %#v", metadata)
+	}
+	if _, present := settings["settings"]; present {
+		t.Fatalf("upper tiers were incorrectly nested under the main destination: %#v", result.Config)
+	}
+}
+
+func TestLayeredDestinationChecksVersionOnceOnComposedMain(t *testing.T) {
+	t.Parallel()
+
+	type appConfig struct {
+		Version  int8   `yaml:"version"`
+		Count    int    `yaml:"count"`
+		Main     string `yaml:"main"`
+		Imported string `yaml:"imported"`
+		Lower    string `yaml:"lower"`
+	}
+	type config struct {
+		App appConfig `yaml:"app"`
+	}
+	filesystem := NewFilesystem("bundle", fstest.MapFS{
+		"main.yml":     &fstest.MapFile{Data: []byte("configkit: {imports: [{path: fragment.yml}]}\nversion: 6\ncount: 4\nmain: main\n")},
+		"fragment.yml": &fstest.MapFile{Data: []byte("imported: included\n")},
+	})
+	checks := 0
+	loaded, err := LoadLayered(
+		Input{Source: filesystem.File("main.yml"), Imports: true, Destination: Keys("app")},
+		testSecretBinding(),
+		LayeredOptions[config]{
+			Definition: Definition[config]{Version: &VersionRule{Path: Keys("app", "version"), Check: func(version Version, _ *Validation) error {
+				checks++
+				if !version.Present || version.Text != "6" {
+					t.Errorf("nested main version = %#v", version)
+				}
+				return nil
+			}}},
+			Underlays: []Underlay{{Inputs: []Input{{
+				Source: Bytes("lower", []byte("lower: underlay\n")), Destination: Keys("app"),
+			}}}},
+		},
+	)
+	if err != nil {
+		t.Fatalf("LoadLayered: %v", err)
+	}
+	result := testLoaded(loaded)
+	if checks != 1 {
+		t.Fatalf("version hook calls = %d, want 1", checks)
+	}
+	if result.Config.App.Version != 6 || result.Config.App.Count != 4 || result.Config.App.Main != "main" || result.Config.App.Imported != "included" || result.Config.App.Lower != "underlay" {
+		t.Fatalf("nested app = %#v", result.Config.App)
+	}
+}
+
+func TestLayeredDestinationVersionClaimsUsePlacedApplicationPaths(t *testing.T) {
+	t.Parallel()
+
+	rule := &VersionRule{Path: Keys("app", "schema", "version"), Check: func(Version, *Validation) error { return nil }}
+	for _, test := range []struct {
+		name      string
+		body      string
+		wantCode  Code
+		wantValue any
+	}{
+		{name: "underlay direct claim", body: "schema: {version: v2}\n", wantCode: CodeUnderlayVersion},
+		{name: "underlay ancestor claim", body: "schema: null\n", wantCode: CodeUnderlayVersion},
+		{name: "underlay mapping ancestor without claim", body: "schema: {name: ordinary}\n", wantValue: "ordinary"},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+			loaded, err := LoadLayered(
+				Input{Source: NoSource()},
+				testSecretBinding(),
+				LayeredOptions[map[string]any]{
+					Definition: Definition[map[string]any]{Version: rule},
+					Underlays: []Underlay{{Inputs: []Input{{
+						Source: Bytes("underlay", []byte(test.body)), Destination: Keys("app"),
+					}}}},
+				},
+			)
+			if test.wantCode != "" {
+				if loaded != nil || groupedErrorCode(t, err) != test.wantCode {
+					t.Fatalf("version claim result = %#v, %v", loaded, err)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("nonclaiming mapping ancestor was rejected: %v", err)
+			}
+			result := testLoaded(loaded)
+			if got := layeredMapValue(t, result.Config, "app", "schema", "name"); got != test.wantValue {
+				t.Fatalf("nested ordinary value = %#v", got)
+			}
+		})
+	}
+
+	for _, test := range []struct {
+		name     string
+		body     string
+		wantCode Code
+	}{
+		{name: "imported direct claim", body: "schema: {version: v2}\n", wantCode: CodeImportVersion},
+		{name: "imported ancestor claim", body: "schema: null\n", wantCode: CodeImportVersion},
+		{name: "imported mapping ancestor without claim", body: "schema: {name: ordinary}\n"},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+			directory := t.TempDir()
+			writeImportFile(t, directory, "main.yml", "configkit: {imports: [{path: fragment.yml}]}\n")
+			writeImportFile(t, directory, "fragment.yml", test.body)
+			loaded, err := LoadLayered(
+				Input{Source: NoSource()},
+				testSecretBinding(),
+				LayeredOptions[map[string]any]{
+					Definition: Definition[map[string]any]{Version: rule},
+					Underlays: []Underlay{{Inputs: []Input{{
+						Source: File(filepath.Join(directory, "main.yml")), Imports: true, Destination: Keys("app"),
+					}}}},
+				},
+			)
+			if test.wantCode != "" {
+				if loaded != nil || groupedErrorCode(t, err) != test.wantCode {
+					t.Fatalf("version claim result = %#v, %v", loaded, err)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("nonclaiming imported mapping ancestor was rejected: %v", err)
+			}
+			result := testLoaded(loaded)
+			if got := layeredMapValue(t, result.Config, "app", "schema", "name"); got != "ordinary" {
+				t.Fatalf("nested ordinary value = %#v", got)
+			}
+		})
+	}
+}
+
+func layeredMap(t *testing.T, value map[string]any, key string) map[string]any {
+	t.Helper()
+	result, ok := value[key].(map[string]any)
+	if !ok {
+		t.Fatalf("%q = %#v, want mapping", key, value[key])
+	}
+	return result
+}
+
+func layeredMapValue(t *testing.T, value map[string]any, keys ...string) any {
+	t.Helper()
+	for _, key := range keys[:len(keys)-1] {
+		value = layeredMap(t, value, key)
+	}
+	return value[keys[len(keys)-1]]
+}

internal/engine/diagnostic.go

@@ -85,15 +85,28 @@ func canonicalDiagnostics(diagnostics []Diagnostic) []Diagnostic {
 	for i := range canonical {
 		slices.SortFunc(canonical[i].Related, compareLocation)
 	}
-	slices.SortFunc(canonical, compareDiagnostic)
+	type orderedDiagnostic struct {
+		diagnostic Diagnostic
+		pointer    string
+	}
+	ordered := make([]orderedDiagnostic, len(canonical))
+	for i, diagnostic := range canonical {
+		ordered[i] = orderedDiagnostic{diagnostic: diagnostic, pointer: diagnostic.Path.String()}
+	}
+	slices.SortFunc(ordered, func(left, right orderedDiagnostic) int {
+		return compareDiagnosticWithPaths(left.diagnostic, right.diagnostic, left.pointer, right.pointer)
+	})
+	for i, item := range ordered {
+		canonical[i] = item.diagnostic
+	}
 	return canonical
 }
 
-func compareDiagnostic(left, right Diagnostic) int {
+func compareDiagnosticWithPaths(left, right Diagnostic, leftPath, rightPath string) int {
 	if order := compareOptionalLocation(left.Primary, right.Primary); order != 0 {
 		return order
 	}
-	if order := cmp.Compare(left.Path.String(), right.Path.String()); order != 0 {
+	if order := cmp.Compare(leftPath, rightPath); order != 0 {
 		return order
 	}
 	if order := cmp.Compare(left.Code, right.Code); order != 0 {

internal/engine/diagnostic_test.go

@@ -90,6 +90,26 @@ func TestDiagnosticsAreCanonicalAndDetached(t *testing.T) {
 	}
 }
 
+func TestCanonicalDiagnosticsSortEscapedPaths(t *testing.T) {
+	primary := &Location{SourceID: "source-1", Line: 1, Column: 1}
+	diagnostics := []Diagnostic{
+		{Code: "same", Severity: SeverityError, Path: Keys("a/b"), Message: "same", Primary: primary},
+		{Code: "same", Severity: SeverityError, Path: Keys("a~b"), Message: "same", Primary: primary},
+		{Code: "z", Severity: SeverityError, Path: Keys("same"), Message: "same", Primary: primary},
+		{Code: "a", Severity: SeverityError, Path: Keys("same"), Message: "same", Primary: primary},
+	}
+	canonical := canonicalDiagnostics(diagnostics)
+	want := []string{"/a~0b", "/a~1b", "/same", "/same"}
+	for i, diagnostic := range canonical {
+		if got := diagnostic.Path.String(); got != want[i] {
+			t.Fatalf("diagnostic[%d] path = %q, want %q", i, got, want[i])
+		}
+	}
+	if canonical[2].Code != "a" || canonical[3].Code != "z" {
+		t.Fatalf("same-path code order = %q, %q", canonical[2].Code, canonical[3].Code)
+	}
+}
+
 func TestWriteDiagnosticsEscapesControls(t *testing.T) {
 	t.Parallel()
 

internal/engine/diff.go

@@ -0,0 +1,98 @@
+package engine
+
+import (
+	"bytes"
+	"errors"
+	"io"
+
+	"gitea.maximumdirect.net/eric/ConfigKit/internal/document"
+	yamladapter "gitea.maximumdirect.net/eric/ConfigKit/internal/yaml"
+)
+
+var errDiffInspectionUnavailable = errors.New("configkit: diff inspection unavailable")
+var errDiffSnapshotUnavailable = errors.New("configkit: diff snapshot unavailable")
+
+// Difference describes one canonical changed region with safe snapshots.
+type Difference struct {
+	Path          Path
+	Left          ValueSnapshot
+	Right         ValueSnapshot
+	HiddenChanged bool
+}
+
+type diffRegion struct {
+	path  Path
+	left  *document.Node
+	right *document.Node
+}
+
+func prepareDiffRegions(left, right *Inspection) ([]diffRegion, error) {
+	if left == nil || left.final == nil || right == nil || right.final == nil {
+		return nil, errDiffInspectionUnavailable
+	}
+
+	deltas := compareConfigurationValues(left.final, right.final)
+	regions := make([]diffRegion, 0, len(deltas))
+	for _, delta := range deltas {
+		leftNode, leftPresent := documentAtPathWithLookup(left.final, delta.path, left.immutableLookup)
+		if !leftPresent {
+			leftNode = nil
+		}
+		rightNode, rightPresent := documentAtPathWithLookup(right.final, delta.path, right.immutableLookup)
+		if !rightPresent {
+			rightNode = nil
+		}
+		regions = append(regions, diffRegion{path: delta.path, left: leftNode, right: rightNode})
+	}
+	return regions, nil
+}
+
+// Diff compares the final frozen values retained by two successful inspections.
+// Values are serialized only after applying the combined sensitivity of both loads.
+func Diff(left, right *Inspection) ([]Difference, error) {
+	regions, err := prepareDiffRegions(left, right)
+	if err != nil {
+		return nil, err
+	}
+	sensitivity := newDiffSensitivity(left.secrets, right.secrets)
+	differences := make([]Difference, 0, len(regions))
+	for _, region := range regions {
+		paired, supported := preparePairedDiffSnapshot(region.left, region.right, region.path, sensitivity)
+		if !supported {
+			return nil, errDiffSnapshotUnavailable
+		}
+		leftSnapshot, err := serializeDiffSnapshot(paired.left, paired.leftRedacted)
+		if err != nil {
+			return nil, errDiffSnapshotUnavailable
+		}
+		rightSnapshot, err := serializeDiffSnapshot(paired.right, paired.rightRedacted)
+		if err != nil {
+			return nil, errDiffSnapshotUnavailable
+		}
+		differences = append(differences, Difference{
+			Path:          region.path,
+			Left:          leftSnapshot,
+			Right:         rightSnapshot,
+			HiddenChanged: paired.hiddenChanged,
+		})
+	}
+	return differences, nil
+}
+
+func serializeDiffSnapshot(node *document.Node, redacted bool) (ValueSnapshot, error) {
+	if node == nil {
+		return ValueSnapshot{}, nil
+	}
+	var output bytes.Buffer
+	if err := writeDiffDocument(&output, node); err != nil {
+		return ValueSnapshot{}, errDiffSnapshotUnavailable
+	}
+	return ValueSnapshot{Present: true, Redacted: redacted, YAML: output.String()}, nil
+}
+
+func writeDiffDocument(output io.Writer, node *document.Node) error {
+	if err := yamladapter.Write(output, node); err != nil {
+		return errDiffSnapshotUnavailable
+	}
+	return nil
+}

internal/engine/diff_hidden_test.go

@@ -0,0 +1,130 @@
+package engine
+
+import (
+	"testing"
+
+	"gitea.maximumdirect.net/eric/ConfigKit/internal/document"
+)
+
+func TestPreparePairedDiffSnapshotReportsWhollyMaskedChanges(t *testing.T) {
+	left := &document.Node{Kind: document.String, Text: "private-before"}
+	right := &document.Node{Kind: document.String, Text: "private-after"}
+	paired, supported := preparePairedDiffSnapshot(
+		left, right, Keys("credential"), newDiffSensitivity(nil, map[string]bool{"/credential": true}),
+	)
+	if !supported || !paired.hiddenChanged || !paired.leftRedacted || !paired.rightRedacted {
+		t.Fatalf("masked change = %#v, supported=%v", paired, supported)
+	}
+	assertDiffStringNode(t, paired.left, "[REDACTED]")
+	assertDiffStringNode(t, paired.right, "[REDACTED]")
+}
+
+func TestPreparePairedDiffSnapshotDetectsRawChangesBehindIdenticalMarkers(t *testing.T) {
+	left := parseCompositionDocument(t, "left", "token: old-canary\n")
+	right := parseCompositionDocument(t, "right", "token: new-canary\n")
+	paired, supported := preparePairedDiffSnapshot(
+		mappingValue(t, left, "token"), mappingValue(t, right, "token"), Keys("token"),
+		newDiffSensitivity(map[string]bool{"/token": true}, nil),
+	)
+	if !supported || !paired.hiddenChanged || paired.left.Text != paired.right.Text {
+		t.Fatalf("identically rendered masked values lost raw change: %#v, supported=%v", paired, supported)
+	}
+}
+
+func TestPreparePairedDiffSnapshotCombinesPublicAndHiddenChanges(t *testing.T) {
+	left := parseCompositionDocument(t, "left", "public: before\ntoken: old\n")
+	right := parseCompositionDocument(t, "right", "public: after\ntoken: new\n")
+	paired, supported := preparePairedDiffSnapshot(
+		left, right, Path{}, newDiffSensitivity(nil, map[string]bool{"/token": true}),
+	)
+	if !supported || !paired.hiddenChanged {
+		t.Fatalf("mixed public and hidden change = %#v, supported=%v", paired, supported)
+	}
+	assertDiffStringNode(t, mappingValue(t, paired.left, "public"), "before")
+	assertDiffStringNode(t, mappingValue(t, paired.right, "public"), "after")
+	assertDiffStringNode(t, mappingValue(t, paired.left, "token"), "[REDACTED]")
+	assertDiffStringNode(t, mappingValue(t, paired.right, "token"), "[REDACTED]")
+}
+
+func TestPreparePairedDiffSnapshotDoesNotFlagUnchangedMaskedValues(t *testing.T) {
+	left := parseCompositionDocument(t, "left", "public: before\ntoken: unchanged\n")
+	right := parseCompositionDocument(t, "right", "public: after\ntoken: unchanged\n")
+	regions, err := prepareDiffRegions(diffTestInspection(left), diffTestInspection(right))
+	if err != nil || len(regions) != 1 || regions[0].path.String() != "/public" {
+		t.Fatalf("changed regions = %#v, err = %v; want only /public", regions, err)
+	}
+	paired, supported := preparePairedDiffSnapshot(
+		left, right, Path{}, newDiffSensitivity(map[string]bool{"/token": true}, nil),
+	)
+	if !supported || !paired.leftRedacted || !paired.rightRedacted || paired.hiddenChanged {
+		t.Fatalf("unchanged masked values affected hidden-change state: %#v, supported=%v", paired, supported)
+	}
+
+	leftSequence := parseCompositionDocument(t, "left-sequence", "items: [unchanged, before]\n")
+	rightSequence := parseCompositionDocument(t, "right-sequence", "items: [unchanged, after]\n")
+	sequence, supported := preparePairedDiffSnapshot(
+		mappingValue(t, leftSequence, "items"), mappingValue(t, rightSequence, "items"), Keys("items"),
+		newDiffSensitivity(nil, map[string]bool{"/items/0": true}),
+	)
+	if !supported || !sequence.leftRedacted || !sequence.rightRedacted || sequence.hiddenChanged {
+		t.Fatalf("unchanged masked sequence member affected hidden-change state: %#v, supported=%v", sequence, supported)
+	}
+}
+
+func TestPreparePairedDiffSnapshotReportsMaskedAdditionAndRemoval(t *testing.T) {
+	value := &document.Node{Kind: document.String, Text: "private"}
+	tests := []struct {
+		name        string
+		left, right *document.Node
+		leftHidden  bool
+		rightHidden bool
+	}{
+		{name: "addition", right: value, rightHidden: true},
+		{name: "removal", left: value, leftHidden: true},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			paired, supported := preparePairedDiffSnapshot(
+				test.left, test.right, Keys("token"), newDiffSensitivity(nil, map[string]bool{"/token": true}),
+			)
+			if !supported || !paired.hiddenChanged || paired.leftRedacted != test.leftHidden || paired.rightRedacted != test.rightHidden {
+				t.Fatalf("masked presence change = %#v, supported=%v", paired, supported)
+			}
+			if test.left == nil && paired.left != nil || test.right == nil && paired.right != nil {
+				t.Fatalf("absence became a value: %#v", paired)
+			}
+		})
+	}
+}
+
+func TestPreparePairedDiffSnapshotReportsHiddenSequenceLengthChange(t *testing.T) {
+	left := parseCompositionDocument(t, "left", "items: [public]\n")
+	right := parseCompositionDocument(t, "right", "items: [public, private]\n")
+	paired, supported := preparePairedDiffSnapshot(
+		mappingValue(t, left, "items"), mappingValue(t, right, "items"), Keys("items"),
+		newDiffSensitivity(nil, map[string]bool{"/items/1": true}),
+	)
+	if !supported || !paired.hiddenChanged || paired.leftRedacted || !paired.rightRedacted {
+		t.Fatalf("masked sequence length change = %#v, supported=%v", paired, supported)
+	}
+	if len(paired.left.Sequence) != 1 || len(paired.right.Sequence) != 2 {
+		t.Fatalf("safe sequence lengths = %d, %d; want 1, 2", len(paired.left.Sequence), len(paired.right.Sequence))
+	}
+	assertDiffStringNode(t, paired.right.Sequence[1], "[REDACTED]")
+}
+
+func TestPreparePairedDiffSnapshotClassificationAloneDoesNotCreateHiddenChange(t *testing.T) {
+	left := parseCompositionDocument(t, "left", "token: same\n")
+	right := parseCompositionDocument(t, "right", "token: same\n")
+	regions, err := prepareDiffRegions(diffTestInspection(left), diffTestInspection(right))
+	if err != nil || len(regions) != 0 {
+		t.Fatalf("classification-independent changed regions = %#v, err = %v", regions, err)
+	}
+	paired, supported := preparePairedDiffSnapshot(
+		mappingValue(t, left, "token"), mappingValue(t, right, "token"), Keys("token"),
+		newDiffSensitivity(map[string]bool{"/token": true}, nil),
+	)
+	if !supported || !paired.leftRedacted || !paired.rightRedacted || paired.hiddenChanged {
+		t.Fatalf("classification alone reported hidden change: %#v, supported=%v", paired, supported)
+	}
+}

internal/engine/diff_operation_test.go

@@ -0,0 +1,282 @@
+package engine
+
+import (
+	"bytes"
+	"errors"
+	"strings"
+	"testing"
+
+	"gitea.maximumdirect.net/eric/ConfigKit/internal/document"
+)
+
+type diffIntegrationConfig struct {
+	Defaulted  string         `yaml:"defaulted"`
+	Dynamic    map[string]any `yaml:"dynamic"`
+	Credential Secret         `yaml:"credential" configkit:"secret"`
+	Derived    string         `yaml:"derived"`
+}
+
+type diffOptionalSecretConfig struct {
+	Optional *Secret `yaml:"optional" configkit:"secret"`
+}
+
+func TestDiffUsesFinalValuesAndDependencyDerivedSensitivity(t *testing.T) {
+	var resolveCalls int
+	options := Options[diffIntegrationConfig]{Definition: Definition[diffIntegrationConfig]{
+		Defaults: func() diffIntegrationConfig {
+			return diffIntegrationConfig{Defaulted: "from-default", Dynamic: map[string]any{"defaulted": "retained"}}
+		},
+		Resolve: func(configuration *diffIntegrationConfig, resolution *Resolution) error {
+			resolveCalls++
+			configuration.Derived = configuration.Dynamic["visible"].(string)
+			resolution.Record(Keys("derived"), ChangeNormalization, "derive from effective values", Keys("credential"))
+			return nil
+		},
+	}}
+	input := func(value string) Source {
+		return Bytes("effective.yml", []byte("dynamic: {visible: "+value+"}\ncredential: DIFF_ENGINE_SECRET\n"))
+	}
+	t.Setenv("DIFF_ENGINE_SECRET", "credential-left-canary")
+	left, err := testLoad(input("before"), options)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("DIFF_ENGINE_SECRET", "credential-right-canary")
+	right, err := testLoad(input("after"), options)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if left.Config.Defaulted != "from-default" || right.Config.Defaulted != "from-default" {
+		t.Fatalf("defaulted values = %q, %q", left.Config.Defaulted, right.Config.Defaulted)
+	}
+	if !left.Inspection.secrets["/credential"] || !left.Inspection.secrets["/derived"] ||
+		!right.Inspection.secrets["/credential"] || !right.Inspection.secrets["/derived"] {
+		t.Fatalf("typed or dependency-derived sensitivity was not retained: left=%#v right=%#v", left.Inspection.secrets, right.Inspection.secrets)
+	}
+	if node, present := documentAtPathWithLookup(left.Inspection.final, Keys("derived"), left.Inspection.immutableLookup); !present || node.Text != "before" {
+		t.Fatalf("left frozen derived value = %#v, present=%v", node, present)
+	}
+
+	differences, err := Diff(left.Inspection, right.Inspection)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(differences) != 2 || differences[0].Path.String() != "/derived" || differences[1].Path.String() != "/dynamic/visible" {
+		t.Fatalf("differences = %#v", differences)
+	}
+	if !differences[0].Left.Redacted || !differences[0].Right.Redacted || !differences[0].HiddenChanged ||
+		differences[0].Left.YAML != "'[REDACTED]'\n" || differences[0].Right.YAML != "'[REDACTED]'\n" {
+		t.Fatalf("dependency-derived difference = %#v", differences[0])
+	}
+	if differences[1].Left.Redacted || differences[1].Right.Redacted || differences[1].HiddenChanged ||
+		differences[1].Left.YAML != "before\n" || differences[1].Right.YAML != "after\n" {
+		t.Fatalf("public dynamic difference = %#v", differences[1])
+	}
+	for _, value := range differences {
+		if strings.Contains(value.Left.YAML+value.Right.YAML, "credential-") {
+			t.Fatal("diff snapshot exposed a resolved credential")
+		}
+	}
+
+	var effective bytes.Buffer
+	if err := left.Inspection.WriteEffective(&effective); err != nil {
+		t.Fatal(err)
+	}
+	if strings.Contains(effective.String(), "credential-left-canary") {
+		t.Fatal("standalone effective rendering exposed a credential after diff")
+	}
+	explanation, ok := left.Inspection.Explain(Keys("derived"))
+	if !ok || !explanation.Effective.Redacted || explanation.Effective.YAML != "'[REDACTED]'\n" {
+		t.Fatalf("explanation changed after diff: %#v, ok=%v", explanation, ok)
+	}
+	if _, ok := left.Inspection.Metadata().Lookup(Keys("dynamic", "visible")); !ok {
+		t.Fatal("metadata lookup failed after diff")
+	}
+	if resolveCalls != 2 {
+		t.Fatalf("resolution callbacks ran during diff: %d calls", resolveCalls)
+	}
+
+	// Returned records can be modified without affecting a later comparison.
+	differences[0].Path.segments[0].key = "changed-by-caller"
+	differences[0].Left.YAML = "changed-by-caller"
+	t.Setenv("DIFF_ENGINE_SECRET", "credential-after-load-canary")
+	repeated, err := Diff(left.Inspection, right.Inspection)
+	if err != nil || len(repeated) != 2 || repeated[0].Path.String() != "/derived" || repeated[0].Left.YAML != "'[REDACTED]'\n" {
+		t.Fatalf("repeated diff = %#v, err = %v", repeated, err)
+	}
+	if resolveCalls != 2 {
+		t.Fatalf("repeated diff reran resolution: %d calls", resolveCalls)
+	}
+
+	independent, err := testLoad(input("before"), options)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if resolveCalls != 3 {
+		t.Fatalf("independent load did not retain normal resolution behavior: %d calls", resolveCalls)
+	}
+	if _, err := Diff(left.Inspection, independent.Inspection); err != nil {
+		t.Fatalf("independent load comparison = %v", err)
+	}
+}
+
+func TestDiffUsesReferenceNamesAndFrozenSecretState(t *testing.T) {
+	loadReference := func(name string) *testResult[diffOptionalSecretConfig] {
+		t.Helper()
+		result, err := testLoad[diffOptionalSecretConfig](Bytes("secret-reference.yml", []byte("optional: "+name+"\n")))
+		if err != nil {
+			t.Fatal(err)
+		}
+		return result
+	}
+	t.Setenv("DIFF_ROTATING_SECRET", "first-credential-canary")
+	left := loadReference("DIFF_ROTATING_SECRET")
+	t.Setenv("DIFF_ROTATING_SECRET", "second-credential-canary")
+	right := loadReference("DIFF_ROTATING_SECRET")
+	t.Setenv("DIFF_ROTATING_SECRET", "changed-after-load-canary")
+	differences, err := Diff(left.Inspection, right.Inspection)
+	if err != nil || len(differences) != 0 {
+		t.Fatalf("credential rotation behind one reference = %#v, err = %v", differences, err)
+	}
+	if node, present := documentAtPathWithLookup(left.Inspection.final, Keys("optional"), left.Inspection.immutableLookup); !present || node.Text != "DIFF_ROTATING_SECRET" {
+		t.Fatalf("frozen reference = %#v, present=%v", node, present)
+	}
+	if node, present := documentAtPathWithLookup(right.Inspection.final, Keys("optional"), right.Inspection.immutableLookup); !present || node.Text != "DIFF_ROTATING_SECRET" {
+		t.Fatalf("right frozen reference = %#v, present=%v", node, present)
+	}
+
+	t.Setenv("DIFF_OTHER_SECRET", "other-credential-canary")
+	other := loadReference("DIFF_OTHER_SECRET")
+	differences, err = Diff(left.Inspection, other.Inspection)
+	if err != nil || len(differences) != 1 || differences[0].Path.String() != "/optional" {
+		t.Fatalf("reference-name change = %#v, err = %v", differences, err)
+	}
+	if !differences[0].Left.Present || !differences[0].Right.Present || !differences[0].Left.Redacted ||
+		!differences[0].Right.Redacted || !differences[0].HiddenChanged ||
+		differences[0].Left.YAML != "'[REDACTED]'\n" || differences[0].Right.YAML != "'[REDACTED]'\n" {
+		t.Fatalf("classified reference-name diff = %#v", differences[0])
+	}
+
+	absent, err := testLoad[diffOptionalSecretConfig](Bytes("absent-secret.yml", []byte("{}\n")))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if absent.Config.Optional != nil {
+		t.Fatalf("missing optional reference decoded as %#v", absent.Config.Optional)
+	}
+	if node, present := documentAtPathWithLookup(absent.Inspection.final, Keys("optional"), absent.Inspection.immutableLookup); !present || node.Kind != document.Null {
+		t.Fatalf("optional nil projection = %#v, present=%v", node, present)
+	}
+	differences, err = Diff(absent.Inspection, left.Inspection)
+	if err != nil || len(differences) != 1 || differences[0].Path.String() != "/optional" {
+		t.Fatalf("optional absence diff = %#v, err = %v", differences, err)
+	}
+	if !differences[0].Left.Present || !differences[0].Left.Redacted ||
+		!differences[0].Right.Present || !differences[0].Right.Redacted || !differences[0].HiddenChanged {
+		t.Fatalf("optional reference change snapshots = %#v", differences[0])
+	}
+	for _, value := range differences {
+		if strings.Contains(value.Left.YAML+value.Right.YAML, "credential-canary") {
+			t.Fatal("reference diff exposed a resolved credential")
+		}
+	}
+}
+
+func TestDiffProtectsHistoricalSensitiveRemovalAndReplacement(t *testing.T) {
+	type configuration struct {
+		Dynamic map[string]any `yaml:"dynamic"`
+	}
+	secretPath := Keys("dynamic", "token")
+	secretSelector := func(path Path) bool { return path.String() == secretPath.String() }
+	load := func(input string, resolve func(*configuration, *Resolution) error) *testResult[configuration] {
+		t.Helper()
+		result, err := testLoad(Bytes("historical-secret.yml", []byte(input)), Options[configuration]{Definition: Definition[configuration]{
+			Secret:  secretSelector,
+			Resolve: resolve,
+		}})
+		if err != nil {
+			t.Fatal(err)
+		}
+		return result
+	}
+
+	t.Run("removed historical value", func(t *testing.T) {
+		left := load("dynamic: {token: removed-canary}\n", func(configuration *configuration, resolution *Resolution) error {
+			delete(configuration.Dynamic, "token")
+			resolution.Record(secretPath, ChangeNormalization, "remove token")
+			return nil
+		})
+		right := load("dynamic: {token: current-canary}\n", nil)
+		if !left.Inspection.secrets[secretPath.String()] {
+			t.Fatal("removed historical selector was not retained")
+		}
+		if _, present := documentAtPathWithLookup(left.Inspection.final, secretPath, left.Inspection.immutableLookup); present {
+			t.Fatal("removed token remains in the effective left tree")
+		}
+		differences, err := Diff(left.Inspection, right.Inspection)
+		if err != nil || len(differences) != 1 || differences[0].Path.String() != secretPath.String() {
+			t.Fatalf("historical removal diff = %#v, err = %v", differences, err)
+		}
+		if differences[0].Left.Present || !differences[0].Right.Present || !differences[0].Right.Redacted || !differences[0].HiddenChanged {
+			t.Fatalf("historical removal snapshots = %#v", differences[0])
+		}
+		if strings.Contains(differences[0].Left.YAML+differences[0].Right.YAML, "canary") {
+			t.Fatal("historical removal diff exposed a sensitive value")
+		}
+	})
+
+	t.Run("replaced historical value", func(t *testing.T) {
+		left := load("dynamic: {token: original-canary}\n", func(configuration *configuration, resolution *Resolution) error {
+			configuration.Dynamic["token"] = "replacement-canary"
+			resolution.Record(secretPath, ChangeNormalization, "replace token")
+			return nil
+		})
+		right := load("dynamic: {token: other-canary}\n", nil)
+		if !left.Inspection.secrets[secretPath.String()] {
+			t.Fatal("replaced historical selector was not retained")
+		}
+		differences, err := Diff(left.Inspection, right.Inspection)
+		if err != nil || len(differences) != 1 || differences[0].Path.String() != secretPath.String() {
+			t.Fatalf("historical replacement diff = %#v, err = %v", differences, err)
+		}
+		if !differences[0].Left.Present || !differences[0].Right.Present || !differences[0].Left.Redacted ||
+			!differences[0].Right.Redacted || !differences[0].HiddenChanged {
+			t.Fatalf("historical replacement snapshots = %#v", differences[0])
+		}
+		if strings.Contains(differences[0].Left.YAML+differences[0].Right.YAML, "canary") {
+			t.Fatal("historical replacement diff exposed a sensitive value")
+		}
+	})
+}
+
+func TestDiffReturnsSafeErrorsWithoutRecords(t *testing.T) {
+	valid := diffTestInspection(&document.Node{Kind: document.String, Text: "safe"})
+	for _, test := range []struct {
+		name        string
+		left, right *Inspection
+	}{
+		{name: "nil left", right: valid},
+		{name: "nil right", left: valid},
+		{name: "missing final tree", left: &Inspection{}, right: valid},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			differences, err := Diff(test.left, test.right)
+			if differences != nil || err == nil || err != errDiffInspectionUnavailable || strings.Contains(err.Error(), "safe") {
+				t.Fatalf("differences, err = %#v, %v", differences, err)
+			}
+		})
+	}
+}
+
+func TestDiffSerializationErrorDoesNotExposeWriterDetails(t *testing.T) {
+	err := writeDiffDocument(diffErrorWriter{}, &document.Node{Kind: document.String, Text: "safe"})
+	if err != errDiffSnapshotUnavailable || strings.Contains(err.Error(), "CANARY") {
+		t.Fatalf("serialization error = %v", err)
+	}
+}
+
+type diffErrorWriter struct{}
+
+func (diffErrorWriter) Write([]byte) (int, error) {
+	return 0, errors.New("CANARY_WRITER_ERROR")
+}

internal/engine/diff_sensitivity.go

@@ -0,0 +1,48 @@
+package engine
+
+type diffSensitivity struct {
+	prefixes pathPrefixIndex
+	pointers []string
+}
+
+func newDiffSensitivity(left, right map[string]bool) *diffSensitivity {
+	sensitivity := &diffSensitivity{}
+	seen := make(map[string]struct{}, len(left)+len(right))
+	for _, classifications := range []map[string]bool{left, right} {
+		for pointer, classified := range classifications {
+			if !classified {
+				continue
+			}
+			if _, found := seen[pointer]; found {
+				continue
+			}
+			seen[pointer] = struct{}{}
+			id := len(sensitivity.pointers)
+			sensitivity.pointers = append(sensitivity.pointers, pointer)
+			sensitivity.prefixes.insert(pointer, id)
+		}
+	}
+	return sensitivity
+}
+
+func (sensitivity *diffSensitivity) isSensitiveAtOrAbove(pointer string) bool {
+	if sensitivity == nil {
+		return false
+	}
+	found := false
+	sensitivity.prefixes.visitAncestors(pointer, func(int) { found = true })
+	return found
+}
+
+func (sensitivity *diffSensitivity) hasStrictDescendant(pointer string) bool {
+	if sensitivity == nil {
+		return false
+	}
+	found := false
+	sensitivity.prefixes.visitDescendants(pointer, func(id int) {
+		if sensitivity.pointers[id] != pointer {
+			found = true
+		}
+	})
+	return found
+}

internal/engine/diff_sensitivity_test.go

@@ -0,0 +1,90 @@
+package engine
+
+import (
+	"maps"
+	"testing"
+)
+
+func TestDiffSensitivityCombinesClassificationsWithoutMutation(t *testing.T) {
+	left := map[string]bool{
+		"/a":                  true,
+		"/a/b":                true,
+		"/historical/removed": true,
+		"/cross~1key":         true,
+		"/literal~01slash":    true,
+		"/items/01":           true,
+		"/items/+1":           false,
+		"/false-left":         false,
+	}
+	right := map[string]bool{
+		"/a/b":         true,
+		"/right-only":  true,
+		"/false-right": false,
+	}
+	leftBefore, rightBefore := maps.Clone(left), maps.Clone(right)
+	sensitivity := newDiffSensitivity(left, right)
+
+	for _, test := range []struct {
+		pointer string
+		want    bool
+	}{
+		{pointer: "/a", want: true},
+		{pointer: "/a/b", want: true},
+		{pointer: "/a/b/c", want: true},
+		{pointer: "/ab", want: false},
+		{pointer: "/ab/c", want: false},
+		{pointer: "/historical/removed", want: true},
+		{pointer: "/historical/removed/child", want: true},
+		{pointer: "/historical", want: false},
+		{pointer: "/right-only", want: true},
+		{pointer: "/false-left", want: false},
+		{pointer: "/false-right", want: false},
+		{pointer: "/cross~1key", want: true},
+		{pointer: "/cross/key", want: false},
+		{pointer: "/literal~01slash", want: true},
+		{pointer: "/literal~1slash", want: false},
+		{pointer: "/items/01", want: true},
+		{pointer: "/items/1", want: false},
+		{pointer: "/items/+1", want: false},
+	} {
+		if got := sensitivity.isSensitiveAtOrAbove(test.pointer); got != test.want {
+			t.Errorf("isSensitiveAtOrAbove(%q) = %v, want %v", test.pointer, got, test.want)
+		}
+	}
+
+	for _, test := range []struct {
+		pointer string
+		want    bool
+	}{
+		{pointer: "", want: true},
+		{pointer: "/a", want: true},
+		{pointer: "/a/b", want: false},
+		{pointer: "/ab", want: false},
+		{pointer: "/historical", want: true},
+		{pointer: "/right-only", want: false},
+		{pointer: "/cross~1key", want: false},
+	} {
+		if got := sensitivity.hasStrictDescendant(test.pointer); got != test.want {
+			t.Errorf("hasStrictDescendant(%q) = %v, want %v", test.pointer, got, test.want)
+		}
+	}
+
+	if !maps.Equal(left, leftBefore) || !maps.Equal(right, rightBefore) {
+		t.Fatal("classification maps were modified")
+	}
+}
+
+func TestDiffSensitivityDistinguishesRootAndEmptyKey(t *testing.T) {
+	root := newDiffSensitivity(map[string]bool{"": true}, nil)
+	if !root.isSensitiveAtOrAbove("") || !root.isSensitiveAtOrAbove("/empty") ||
+		root.hasStrictDescendant("") {
+		t.Fatal("root classification did not remain distinct from strict descendants")
+	}
+
+	emptyKey := newDiffSensitivity(map[string]bool{"/": true}, nil)
+	if emptyKey.isSensitiveAtOrAbove("") || !emptyKey.isSensitiveAtOrAbove("/") ||
+		emptyKey.isSensitiveAtOrAbove("/other") || !emptyKey.hasStrictDescendant("") ||
+		emptyKey.hasStrictDescendant("/") {
+		t.Fatal("empty-key classification was treated as the root or an unrelated path")
+	}
+}

internal/engine/diff_snapshot.go

@@ -0,0 +1,195 @@
+package engine
+
+import (
+	"sort"
+
+	"gitea.maximumdirect.net/eric/ConfigKit/internal/document"
+)
+
+type pairedDiffSnapshot struct {
+	left             *document.Node
+	right            *document.Node
+	leftRedacted     bool
+	rightRedacted    bool
+	requiresFallback bool
+	hiddenChanged    bool
+}
+
+func preparePairedDiffSnapshot(left, right *document.Node, path Path, sensitivity *diffSensitivity) (pairedDiffSnapshot, bool) {
+	paired, supported := preparePairedDiffNodes(left, right, path, sensitivity)
+	if !supported || !paired.requiresFallback {
+		return paired, supported
+	}
+	return pairedDiffSnapshot{
+		left:          redactedDiffNode(left),
+		right:         redactedDiffNode(right),
+		leftRedacted:  left != nil,
+		rightRedacted: right != nil,
+		hiddenChanged: true,
+	}, true
+}
+
+func preparePairedDiffNodes(left, right *document.Node, path Path, sensitivity *diffSensitivity) (pairedDiffSnapshot, bool) {
+	if left == nil && right == nil {
+		return pairedDiffSnapshot{}, true
+	}
+	if sensitivity.isSensitiveAtOrAbove(path.String()) {
+		return pairedDiffSnapshot{
+			left:          redactedDiffNode(left),
+			right:         redactedDiffNode(right),
+			leftRedacted:  left != nil,
+			rightRedacted: right != nil,
+			hiddenChanged: !configurationValuesEqual(left, right),
+		}, true
+	}
+	if left != nil && right != nil && left.Kind != right.Kind {
+		if sensitivity.hasStrictDescendant(path.String()) {
+			return pairedDiffSnapshot{requiresFallback: true}, true
+		}
+		return pairedDiffSnapshot{left: left, right: right}, true
+	}
+
+	kind := document.Null
+	if left != nil {
+		kind = left.Kind
+	} else if right != nil {
+		kind = right.Kind
+	}
+	switch kind {
+	case document.Mapping:
+		return preparePairedDiffMapping(left, right, path, sensitivity)
+	case document.Sequence:
+		return preparePairedDiffSequence(left, right, path, sensitivity)
+	default:
+		return pairedDiffSnapshot{left: left, right: right}, true
+	}
+}
+
+func preparePairedDiffMapping(left, right *document.Node, path Path, sensitivity *diffSensitivity) (pairedDiffSnapshot, bool) {
+	leftEntries := diffMappingEntries(left)
+	rightEntries := diffMappingEntries(right)
+	keys := make([]string, 0, len(leftEntries)+len(rightEntries))
+	seen := make(map[string]struct{}, len(leftEntries)+len(rightEntries))
+	for key := range leftEntries {
+		seen[key] = struct{}{}
+		keys = append(keys, key)
+	}
+	for key := range rightEntries {
+		if _, found := seen[key]; found {
+			continue
+		}
+		keys = append(keys, key)
+	}
+	sort.Strings(keys)
+
+	var leftCopy, rightCopy *document.Node
+	if left != nil {
+		copy := *left
+		copy.Mapping = make([]document.Entry, 0, len(left.Mapping))
+		leftCopy = &copy
+	}
+	if right != nil {
+		copy := *right
+		copy.Mapping = make([]document.Entry, 0, len(right.Mapping))
+		rightCopy = &copy
+	}
+	redacted := pairedDiffSnapshot{}
+	for _, key := range keys {
+		leftEntry, leftPresent := leftEntries[key]
+		rightEntry, rightPresent := rightEntries[key]
+		var leftChild, rightChild *document.Node
+		if leftPresent {
+			leftChild = leftEntry.Value
+		}
+		if rightPresent {
+			rightChild = rightEntry.Value
+		}
+		child, supported := preparePairedDiffNodes(leftChild, rightChild, path.Key(key), sensitivity)
+		if !supported {
+			return pairedDiffSnapshot{}, false
+		}
+		if child.requiresFallback {
+			return pairedDiffSnapshot{requiresFallback: true}, true
+		}
+		if leftPresent {
+			leftEntry.Value = child.left
+			leftCopy.Mapping = append(leftCopy.Mapping, leftEntry)
+		}
+		if rightPresent {
+			rightEntry.Value = child.right
+			rightCopy.Mapping = append(rightCopy.Mapping, rightEntry)
+		}
+		redacted.leftRedacted = redacted.leftRedacted || child.leftRedacted
+		redacted.rightRedacted = redacted.rightRedacted || child.rightRedacted
+		redacted.hiddenChanged = redacted.hiddenChanged || child.hiddenChanged
+	}
+	redacted.left = leftCopy
+	redacted.right = rightCopy
+	return redacted, true
+}
+
+func preparePairedDiffSequence(left, right *document.Node, path Path, sensitivity *diffSensitivity) (pairedDiffSnapshot, bool) {
+	var leftCopy, rightCopy *document.Node
+	if left != nil {
+		copy := *left
+		copy.Sequence = make([]*document.Node, len(left.Sequence))
+		leftCopy = &copy
+	}
+	if right != nil {
+		copy := *right
+		copy.Sequence = make([]*document.Node, len(right.Sequence))
+		rightCopy = &copy
+	}
+	length := 0
+	if left != nil {
+		length = len(left.Sequence)
+	}
+	if right != nil && len(right.Sequence) > length {
+		length = len(right.Sequence)
+	}
+	result := pairedDiffSnapshot{left: leftCopy, right: rightCopy}
+	for index := 0; index < length; index++ {
+		var leftChild, rightChild *document.Node
+		if left != nil && index < len(left.Sequence) {
+			leftChild = left.Sequence[index]
+		}
+		if right != nil && index < len(right.Sequence) {
+			rightChild = right.Sequence[index]
+		}
+		child, supported := preparePairedDiffNodes(leftChild, rightChild, path.Index(index), sensitivity)
+		if !supported {
+			return pairedDiffSnapshot{}, false
+		}
+		if child.requiresFallback {
+			return pairedDiffSnapshot{requiresFallback: true}, true
+		}
+		if left != nil && index < len(left.Sequence) {
+			leftCopy.Sequence[index] = child.left
+		}
+		if right != nil && index < len(right.Sequence) {
+			rightCopy.Sequence[index] = child.right
+		}
+		result.leftRedacted = result.leftRedacted || child.leftRedacted
+		result.rightRedacted = result.rightRedacted || child.rightRedacted
+		result.hiddenChanged = result.hiddenChanged || child.hiddenChanged
+	}
+	return result, true
+}
+
+func diffMappingEntries(node *document.Node) map[string]document.Entry {
+	entries := make(map[string]document.Entry)
+	if node == nil {
+		return entries
+	}
+	for _, entry := range node.Mapping {
+		entries[entry.Key] = entry
+	}
+	return entries
+}
+
+func redactedDiffNode(node *document.Node) *document.Node {
+	if node == nil {
+		return nil
+	}
+	return &document.Node{Kind: document.String, Text: "[REDACTED]"}
+}

internal/engine/diff_snapshot_test.go

@@ -0,0 +1,351 @@
+package engine
+
+import (
+	"testing"
+
+	"gitea.maximumdirect.net/eric/ConfigKit/internal/document"
+)
+
+func TestPreparePairedDiffSnapshotRedactsAlignedMappingFromEitherSide(t *testing.T) {
+	left := parseCompositionDocument(t, "left", "credential: alpha\npublic: before\n")
+	right := parseCompositionDocument(t, "right", "credential: bravo\npublic: after\n")
+	sensitivity := newDiffSensitivity(map[string]bool{"/credential": true}, nil)
+
+	paired, supported := preparePairedDiffSnapshot(left, right, Path{}, sensitivity)
+	if !supported {
+		t.Fatal("compatible mappings were not supported")
+	}
+	if !paired.leftRedacted || !paired.rightRedacted {
+		t.Fatalf("redacted flags = %v, %v; want true on both sides", paired.leftRedacted, paired.rightRedacted)
+	}
+	assertDiffStringNode(t, mappingValue(t, paired.left, "credential"), "[REDACTED]")
+	assertDiffStringNode(t, mappingValue(t, paired.right, "credential"), "[REDACTED]")
+	assertDiffStringNode(t, mappingValue(t, paired.left, "public"), "before")
+	assertDiffStringNode(t, mappingValue(t, paired.right, "public"), "after")
+	assertDiffStringNode(t, mappingValue(t, left, "credential"), "alpha")
+	assertDiffStringNode(t, mappingValue(t, right, "credential"), "bravo")
+	if paired.left == left || paired.right == right || &paired.left.Mapping[0] == &left.Mapping[0] {
+		t.Fatal("safe mapping containers or entries share mutable storage with retained trees")
+	}
+}
+
+func TestPreparePairedDiffSnapshotPreservesSequencePositionsAndLengths(t *testing.T) {
+	left := parseCompositionDocument(t, "left", "items: [left-public, hidden, old-tail]\n")
+	right := parseCompositionDocument(t, "right", "items: [right-public, hidden, old-tail, extra]\n")
+	sensitivity := newDiffSensitivity(nil, map[string]bool{"/items/1": true})
+
+	paired, supported := preparePairedDiffSnapshot(
+		mappingValue(t, left, "items"), mappingValue(t, right, "items"), Keys("items"), sensitivity,
+	)
+	if !supported {
+		t.Fatal("compatible sequences were not supported")
+	}
+	if !paired.leftRedacted || !paired.rightRedacted {
+		t.Fatalf("redacted flags = %v, %v; want true on both sides", paired.leftRedacted, paired.rightRedacted)
+	}
+	if len(paired.left.Sequence) != 3 || len(paired.right.Sequence) != 4 {
+		t.Fatalf("sequence lengths = %d, %d; want 3, 4", len(paired.left.Sequence), len(paired.right.Sequence))
+	}
+	assertDiffStringNode(t, paired.left.Sequence[0], "left-public")
+	assertDiffStringNode(t, paired.right.Sequence[0], "right-public")
+	assertDiffStringNode(t, paired.left.Sequence[1], "[REDACTED]")
+	assertDiffStringNode(t, paired.right.Sequence[1], "[REDACTED]")
+	assertDiffStringNode(t, paired.right.Sequence[3], "extra")
+	assertDiffStringNode(t, mappingValue(t, left, "items").Sequence[1], "hidden")
+	if &paired.left.Sequence[0] == &mappingValue(t, left, "items").Sequence[0] {
+		t.Fatal("safe sequence shares mutable storage with retained tree")
+	}
+}
+
+func TestPreparePairedDiffSnapshotMasksSensitiveDescendantsOfAbsentSubtrees(t *testing.T) {
+	tests := []struct {
+		name        string
+		left, right string
+		absentSide  string
+	}{
+		{
+			name:       "removed subtree",
+			left:       "removed: {token: old-secret, public: retained}\n",
+			right:      "other: value\n",
+			absentSide: "right",
+		},
+		{
+			name:       "added subtree",
+			left:       "other: value\n",
+			right:      "added: {token: new-secret, public: retained}\n",
+			absentSide: "left",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			left := parseCompositionDocument(t, "left", test.left)
+			right := parseCompositionDocument(t, "right", test.right)
+			paired, supported := preparePairedDiffSnapshot(
+				mappingValueIfPresent(left, "removed", "added"),
+				mappingValueIfPresent(right, "removed", "added"),
+				Keys("subtree"),
+				newDiffSensitivity(map[string]bool{"/subtree/token": true}, nil),
+			)
+			if !supported {
+				t.Fatal("compatible subtree and absence were not supported")
+			}
+			if test.absentSide == "left" {
+				if paired.left != nil || paired.leftRedacted || !paired.rightRedacted {
+					t.Fatalf("paired absence/redaction = %#v", paired)
+				}
+				assertDiffStringNode(t, mappingValue(t, paired.right, "token"), "[REDACTED]")
+				assertDiffStringNode(t, mappingValue(t, paired.right, "public"), "retained")
+			} else {
+				if paired.right != nil || paired.rightRedacted || !paired.leftRedacted {
+					t.Fatalf("paired absence/redaction = %#v", paired)
+				}
+				assertDiffStringNode(t, mappingValue(t, paired.left, "token"), "[REDACTED]")
+				assertDiffStringNode(t, mappingValue(t, paired.left, "public"), "retained")
+			}
+		})
+	}
+}
+
+func TestPreparePairedDiffSnapshotMasksSelectedRootAndContainer(t *testing.T) {
+	tests := []struct {
+		name        string
+		left, right *document.Node
+		path        Path
+		selector    string
+	}{
+		{
+			name:     "root",
+			left:     parseCompositionDocument(t, "left", "token: old\n"),
+			right:    parseCompositionDocument(t, "right", "token: new\n"),
+			path:     Path{},
+			selector: "",
+		},
+		{
+			name:     "container",
+			left:     parseCompositionDocument(t, "left", "group: {public: old}\n"),
+			right:    parseCompositionDocument(t, "right", "group: {public: new}\n"),
+			path:     Keys("group"),
+			selector: "/group",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			paired, supported := preparePairedDiffSnapshot(
+				test.left, test.right, test.path,
+				newDiffSensitivity(map[string]bool{test.selector: true}, nil),
+			)
+			if !supported {
+				t.Fatal("selected nodes were not supported")
+			}
+			if !paired.leftRedacted || !paired.rightRedacted {
+				t.Fatalf("redacted flags = %v, %v; want true on both sides", paired.leftRedacted, paired.rightRedacted)
+			}
+			assertDiffStringNode(t, paired.left, "[REDACTED]")
+			assertDiffStringNode(t, paired.right, "[REDACTED]")
+		})
+	}
+}
+
+func TestPreparePairedDiffSnapshotDoesNotInterpretMarkerLookingInput(t *testing.T) {
+	left := parseCompositionDocument(t, "left", "label: '[REDACTED]'\n")
+	right := parseCompositionDocument(t, "right", "label: '[REDACTED]'\n")
+	paired, supported := preparePairedDiffSnapshot(
+		mappingValue(t, left, "label"), mappingValue(t, right, "label"), Keys("label"),
+		newDiffSensitivity(nil, nil),
+	)
+	if !supported {
+		t.Fatal("ordinary scalar values were not supported")
+	}
+	if paired.leftRedacted || paired.rightRedacted {
+		t.Fatalf("redacted flags = %v, %v; want false", paired.leftRedacted, paired.rightRedacted)
+	}
+	if paired.left != mappingValue(t, left, "label") || paired.right != mappingValue(t, right, "label") {
+		t.Fatal("unselected scalar nodes should remain borrowed immutable nodes")
+	}
+	assertDiffStringNode(t, paired.left, "[REDACTED]")
+	assertDiffStringNode(t, paired.right, "[REDACTED]")
+}
+
+func TestPreparePairedDiffSnapshotMasksSensitiveStructuralReplacements(t *testing.T) {
+	tests := []struct {
+		name        string
+		left, right string
+		path        Path
+		selector    string
+	}{
+		{
+			name:     "mapping to scalar",
+			left:     "changed: {token: old-secret, public: old}\n",
+			right:    "changed: new-scalar\n",
+			path:     Keys("changed"),
+			selector: "/changed/token",
+		},
+		{
+			name:     "mapping to scalar with historical-only descendant",
+			left:     "changed: {public: old}\n",
+			right:    "changed: new-scalar\n",
+			path:     Keys("changed"),
+			selector: "/changed/removed/secret",
+		},
+		{
+			name:     "scalar to mapping",
+			left:     "changed: old-scalar\n",
+			right:    "changed: {token: new-secret, public: new}\n",
+			path:     Keys("changed"),
+			selector: "/changed/token",
+		},
+		{
+			name:     "mapping to sequence with numeric paths",
+			left:     "changed: {'0': {token: old-secret}}\n",
+			right:    "changed: [{token: new-secret}]\n",
+			path:     Keys("changed"),
+			selector: "/changed/0/token",
+		},
+		{
+			name:     "sequence to mapping with numeric paths",
+			left:     "changed: [{token: old-secret}]\n",
+			right:    "changed: {'0': {token: new-secret}}\n",
+			path:     Keys("changed"),
+			selector: "/changed/0/token",
+		},
+		{
+			name:     "null to container",
+			left:     "changed: null\n",
+			right:    "changed: {token: new-secret}\n",
+			path:     Keys("changed"),
+			selector: "/changed/token",
+		},
+		{
+			name:     "container to null",
+			left:     "changed: {token: old-secret}\n",
+			right:    "changed: null\n",
+			path:     Keys("changed"),
+			selector: "/changed/token",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			leftRoot := parseCompositionDocument(t, "left", test.left)
+			rightRoot := parseCompositionDocument(t, "right", test.right)
+			left := mappingValue(t, leftRoot, test.path.segments[0].key)
+			right := mappingValue(t, rightRoot, test.path.segments[0].key)
+			paired, supported := preparePairedDiffSnapshot(
+				left, right, test.path, newDiffSensitivity(nil, map[string]bool{test.selector: true}),
+			)
+			assertWholeRegionFallback(t, paired, supported, left, right)
+		})
+	}
+}
+
+func TestPreparePairedDiffSnapshotMasksOriginalRegionForNestedSequenceMismatch(t *testing.T) {
+	leftRoot := parseCompositionDocument(t, "left", "items: [{branch: {token: old-secret, public: old}}]\n")
+	rightRoot := parseCompositionDocument(t, "right", "items: [{branch: new-scalar}]\n")
+	left := mappingValue(t, leftRoot, "items")
+	right := mappingValue(t, rightRoot, "items")
+	paired, supported := preparePairedDiffSnapshot(
+		left, right, Keys("items"), newDiffSensitivity(nil, map[string]bool{"/items/0/branch/token": true}),
+	)
+	assertWholeRegionFallback(t, paired, supported, left, right)
+}
+
+func TestPreparePairedDiffSnapshotKeepsPublicScalarsWithHistoricalDescendants(t *testing.T) {
+	leftRoot := parseCompositionDocument(t, "left", "changed: before\n")
+	rightRoot := parseCompositionDocument(t, "right", "changed: after\n")
+	left := mappingValue(t, leftRoot, "changed")
+	right := mappingValue(t, rightRoot, "changed")
+	paired, supported := preparePairedDiffSnapshot(
+		left, right, Keys("changed"), newDiffSensitivity(map[string]bool{"/changed/removed/secret": true}, nil),
+	)
+	if !supported || paired.leftRedacted || paired.rightRedacted || paired.hiddenChanged {
+		t.Fatalf("public scalar replacement = %#v, supported=%v", paired, supported)
+	}
+	assertDiffStringNode(t, paired.left, "before")
+	assertDiffStringNode(t, paired.right, "after")
+}
+
+func TestPreparePairedDiffSnapshotKeepsPublicContentAcrossAbsence(t *testing.T) {
+	right := parseCompositionDocument(t, "right", "branch: scalar\n")
+	paired, supported := preparePairedDiffSnapshot(
+		nil, right, Keys("added"), newDiffSensitivity(nil, map[string]bool{"/added/branch/secret": true}),
+	)
+	if !supported || paired.left != nil || paired.leftRedacted || paired.rightRedacted || paired.hiddenChanged {
+		t.Fatalf("public addition presence/redaction = %#v, supported=%v", paired, supported)
+	}
+	assertDiffStringNode(t, mappingValue(t, paired.right, "branch"), "scalar")
+}
+
+func TestPreparePairedDiffSnapshotPreservesPublicReplacementBesideSensitiveSibling(t *testing.T) {
+	left := parseCompositionDocument(t, "left", "child: before\n")
+	right := &document.Node{Kind: document.String, Text: "after"}
+	paired, supported := preparePairedDiffSnapshot(
+		mappingValue(t, left, "child"), right, Keys("public"),
+		newDiffSensitivity(nil, map[string]bool{"/private/token": true}),
+	)
+	if !supported || paired.left != mappingValue(t, left, "child") || paired.right != right || paired.leftRedacted || paired.rightRedacted {
+		t.Fatalf("unrelated classification changed public replacement: %#v, supported=%v", paired, supported)
+	}
+}
+
+func TestPreparePairedDiffSnapshotTargetsRedactionAcrossAbsence(t *testing.T) {
+	left := parseCompositionDocument(t, "left", "items: []\n")
+	right := parseCompositionDocument(t, "right", "items: [{token: new-secret, public: visible}]\n")
+	leftItems := mappingValue(t, left, "items")
+	rightItems := mappingValue(t, right, "items")
+	paired, supported := preparePairedDiffSnapshot(
+		leftItems, rightItems, Keys("items"), newDiffSensitivity(nil, map[string]bool{"/items/0/token": true}),
+	)
+	if !supported || paired.left == nil || paired.right == nil || paired.leftRedacted || !paired.rightRedacted {
+		t.Fatalf("targeted sequence redaction = %#v, supported=%v", paired, supported)
+	}
+	if len(paired.left.Sequence) != 0 || len(paired.right.Sequence) != 1 {
+		t.Fatalf("sequence lengths = %d, %d; want 0, 1", len(paired.left.Sequence), len(paired.right.Sequence))
+	}
+	assertDiffStringNode(t, mappingValue(t, paired.right.Sequence[0], "token"), "[REDACTED]")
+	assertDiffStringNode(t, mappingValue(t, paired.right.Sequence[0], "public"), "visible")
+}
+
+func assertWholeRegionFallback(t *testing.T, paired pairedDiffSnapshot, supported bool, left, right *document.Node) {
+	t.Helper()
+	if !supported {
+		t.Fatal("sensitive incompatible shape was not handled")
+	}
+	if !paired.hiddenChanged {
+		t.Fatal("fallback for a changed reported region did not mark hidden change")
+	}
+	if (left == nil) != (paired.left == nil) || (right == nil) != (paired.right == nil) {
+		t.Fatalf("fallback changed root presence: %#v", paired)
+	}
+	if left != nil {
+		assertDiffStringNode(t, paired.left, "[REDACTED]")
+		if !paired.leftRedacted {
+			t.Fatal("present left region was not marked redacted")
+		}
+	}
+	if right != nil {
+		assertDiffStringNode(t, paired.right, "[REDACTED]")
+		if !paired.rightRedacted {
+			t.Fatal("present right region was not marked redacted")
+		}
+	}
+}
+
+func mappingValueIfPresent(node *document.Node, keys ...string) *document.Node {
+	if node == nil {
+		return nil
+	}
+	for _, key := range keys {
+		for _, entry := range node.Mapping {
+			if entry.Key == key {
+				return entry.Value
+			}
+		}
+	}
+	return nil
+}
+
+func assertDiffStringNode(t *testing.T, node *document.Node, want string) {
+	t.Helper()
+	if node == nil || node.Kind != document.String || node.Text != want {
+		t.Fatalf("node = %#v, want string %q", node, want)
+	}
+}

internal/engine/diff_test.go

@@ -0,0 +1,144 @@
+package engine
+
+import (
+	"testing"
+
+	"gitea.maximumdirect.net/eric/ConfigKit/internal/document"
+)
+
+func TestPrepareDiffRegionsUsesCanonicalConfigurationComparison(t *testing.T) {
+	tests := []struct {
+		name  string
+		left  string
+		right string
+		want  []expectedDiffRegion
+	}{
+		{
+			name:  "mapping order is ignored for equal values",
+			left:  "first: 1\nsecond: true\n",
+			right: "second: true\nfirst: 1\n",
+		},
+		{
+			name:  "addition removal null and empty values",
+			left:  "removed: null\n",
+			right: "added: null\nempty_map: {}\nempty_sequence: []\n",
+			want: []expectedDiffRegion{
+				{path: "/added", rightKind: document.Null, rightPresent: true},
+				{path: "/empty_map", rightKind: document.Mapping, rightPresent: true},
+				{path: "/empty_sequence", rightKind: document.Sequence, rightPresent: true},
+				{path: "/removed", leftKind: document.Null, leftPresent: true},
+			},
+		},
+		{
+			name:  "scalar kinds and atomic sequences",
+			left:  "scalar: 1\nitems: [one, two]\n",
+			right: "scalar: '1'\nitems: [one, changed]\n",
+			want: []expectedDiffRegion{
+				{path: "/items", leftKind: document.Sequence, rightKind: document.Sequence, leftPresent: true, rightPresent: true},
+				{path: "/scalar", leftKind: document.Number, rightKind: document.String, leftPresent: true, rightPresent: true},
+			},
+		},
+		{
+			name:  "escaped empty and numeric mapping keys sort by pointer",
+			left:  `"": old` + "\n'0': old\n'01': old\n'a/b': old\n'a~b': old\n",
+			right: `"": new` + "\n'0': new\n'01': new\n'a/b': new\n'a~b': new\n",
+			want: []expectedDiffRegion{
+				{path: "/", leftKind: document.String, rightKind: document.String, leftPresent: true, rightPresent: true},
+				{path: "/0", leftKind: document.String, rightKind: document.String, leftPresent: true, rightPresent: true},
+				{path: "/01", leftKind: document.String, rightKind: document.String, leftPresent: true, rightPresent: true},
+				{path: "/a~0b", leftKind: document.String, rightKind: document.String, leftPresent: true, rightPresent: true},
+				{path: "/a~1b", leftKind: document.String, rightKind: document.String, leftPresent: true, rightPresent: true},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			leftRoot := parseCompositionDocument(t, "left", test.left)
+			rightRoot := parseCompositionDocument(t, "right", test.right)
+			regions, err := prepareDiffRegions(diffTestInspection(leftRoot), diffTestInspection(rightRoot))
+			if err != nil {
+				t.Fatal(err)
+			}
+			if len(regions) != len(test.want) {
+				t.Fatalf("regions = %#v, want %#v", regions, test.want)
+			}
+			for index, want := range test.want {
+				region := regions[index]
+				if region.path.String() != want.path {
+					t.Fatalf("region[%d].path = %q, want %q", index, region.path.String(), want.path)
+				}
+				assertDiffRegionNode(t, "left", region.left, want.leftPresent, want.leftKind)
+				assertDiffRegionNode(t, "right", region.right, want.rightPresent, want.rightKind)
+			}
+		})
+	}
+}
+
+func TestPrepareDiffRegionsHandlesRootReplacementAndBorrowsNodes(t *testing.T) {
+	leftRoot := &document.Node{Kind: document.String, Text: "before"}
+	rightRoot := &document.Node{Kind: document.Mapping, Mapping: []document.Entry{{
+		Key: "value", Value: &document.Node{Kind: document.Number, Text: "1"},
+	}}}
+	regions, err := prepareDiffRegions(diffTestInspection(leftRoot), diffTestInspection(rightRoot))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(regions) != 1 || regions[0].path.String() != "" || regions[0].left != leftRoot || regions[0].right != rightRoot {
+		t.Fatalf("root region = %#v", regions)
+	}
+
+	leftRoot = parseCompositionDocument(t, "left-child", "value: before\n")
+	rightRoot = parseCompositionDocument(t, "right-child", "value: after\n")
+	regions, err = prepareDiffRegions(diffTestInspection(leftRoot), diffTestInspection(rightRoot))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(regions) != 1 || regions[0].left != mappingValue(t, leftRoot, "value") || regions[0].right != mappingValue(t, rightRoot, "value") {
+		t.Fatalf("child nodes were not borrowed from the frozen trees: %#v", regions)
+	}
+}
+
+func TestPrepareDiffRegionsRejectsUnavailableInspections(t *testing.T) {
+	valid := diffTestInspection(&document.Node{Kind: document.String, Text: "safe"})
+	tests := []struct {
+		name        string
+		left, right *Inspection
+	}{
+		{name: "nil left", left: nil, right: valid},
+		{name: "nil right", left: valid, right: nil},
+		{name: "missing left tree", left: &Inspection{}, right: valid},
+		{name: "missing right tree", left: valid, right: &Inspection{}},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			regions, err := prepareDiffRegions(test.left, test.right)
+			if err == nil || regions != nil {
+				t.Fatalf("regions, err = %#v, %v", regions, err)
+			}
+		})
+	}
+}
+
+type expectedDiffRegion struct {
+	path                      string
+	leftKind, rightKind       document.Kind
+	leftPresent, rightPresent bool
+}
+
+func diffTestInspection(root *document.Node) *Inspection {
+	return &Inspection{final: root, immutableLookup: buildDocumentLookup(root)}
+}
+
+func assertDiffRegionNode(t *testing.T, side string, node *document.Node, wantPresent bool, wantKind document.Kind) {
+	t.Helper()
+	if !wantPresent {
+		if node != nil {
+			t.Fatalf("%s node = %#v, want absence", side, node)
+		}
+		return
+	}
+	if node == nil || node.Kind != wantKind {
+		t.Fatalf("%s node = %#v, want kind %v", side, node, wantKind)
+	}
+}

internal/engine/document_compare.go

@@ -24,12 +24,23 @@ type documentDelta struct {
 func compareConfigurationValues(before, after *document.Node) []documentDelta {
 	var deltas []documentDelta
 	compareConfigurationValue(before, after, Path{}, &deltas)
-	slices.SortFunc(deltas, func(left, right documentDelta) int {
-		if order := cmp.Compare(left.path.String(), right.path.String()); order != 0 {
+	type orderedDelta struct {
+		delta   documentDelta
+		pointer string
+	}
+	ordered := make([]orderedDelta, len(deltas))
+	for i, delta := range deltas {
+		ordered[i] = orderedDelta{delta: delta, pointer: delta.path.String()}
+	}
+	slices.SortFunc(ordered, func(left, right orderedDelta) int {
+		if order := cmp.Compare(left.pointer, right.pointer); order != 0 {
 			return order
 		}
-		return int(left.kind) - int(right.kind)
+		return int(left.delta.kind) - int(right.delta.kind)
 	})
+	for i, item := range ordered {
+		deltas[i] = item.delta
+	}
 	return deltas
 }
 

internal/engine/document_lookup.go

@@ -0,0 +1,54 @@
+package engine
+
+import "gitea.maximumdirect.net/eric/ConfigKit/internal/document"
+
+// documentLookup contains read-only mapping positions for a completed document.
+type documentLookup struct {
+	byNode map[*document.Node]map[string]int
+}
+
+func buildDocumentLookup(roots ...*document.Node) *documentLookup {
+	lookup := &documentLookup{byNode: make(map[*document.Node]map[string]int)}
+	visited := make(map[*document.Node]struct{})
+	var visit func(*document.Node)
+	visit = func(node *document.Node) {
+		if node == nil {
+			return
+		}
+		if _, ok := visited[node]; ok {
+			return
+		}
+		visited[node] = struct{}{}
+		switch node.Kind {
+		case document.Mapping:
+			entries := make(map[string]int, len(node.Mapping))
+			for index, entry := range node.Mapping {
+				if _, exists := entries[entry.Key]; !exists {
+					entries[entry.Key] = index
+				}
+				visit(entry.Value)
+			}
+			lookup.byNode[node] = entries
+		case document.Sequence:
+			for _, child := range node.Sequence {
+				visit(child)
+			}
+		}
+	}
+	for _, root := range roots {
+		visit(root)
+	}
+	return lookup
+}
+
+func (lookup *documentLookup) find(node *document.Node, key string) int {
+	if lookup == nil {
+		return -1
+	}
+	if entries := lookup.byNode[node]; entries != nil {
+		if index, ok := entries[key]; ok {
+			return index
+		}
+	}
+	return -1
+}

internal/engine/document_walk.go

@@ -31,6 +31,10 @@ func indexDocument(node *document.Node, path Path, index map[string]*document.No
 }
 
 func documentAtPath(root *document.Node, path Path) (*document.Node, bool) {
+	return documentAtPathWithLookup(root, path, nil)
+}
+
+func documentAtPathWithLookup(root *document.Node, path Path, lookup *documentLookup) (*document.Node, bool) {
 	if root == nil || !path.valid() {
 		return nil, false
 	}
@@ -41,17 +45,21 @@ func documentAtPath(root *document.Node, path Path) (*document.Node, bool) {
 			if segment.kind == pathSegmentIndex {
 				return nil, false
 			}
-			found := false
-			for _, entry := range current.Mapping {
-				if entry.Key == segment.key {
-					current = entry.Value
-					found = true
-					break
+			entryIndex := -1
+			if lookup != nil {
+				entryIndex = lookup.find(current, segment.key)
+			} else {
+				for index, entry := range current.Mapping {
+					if entry.Key == segment.key {
+						entryIndex = index
+						break
+					}
 				}
 			}
-			if !found {
+			if entryIndex < 0 || entryIndex >= len(current.Mapping) {
 				return nil, false
 			}
+			current = current.Mapping[entryIndex].Value
 		case document.Sequence:
 			index, ok := schemaIndex(segment)
 			if !ok || index >= len(current.Sequence) {

internal/engine/explain.go

@@ -40,7 +40,7 @@ func (r *Inspection) Explain(path Path) (Explanation, bool) {
 	if r == nil || r.final == nil || r.baseline == nil || !r.metadata.hasHistoricalPath(path) {
 		return Explanation{}, false
 	}
-	explanation := Explanation{Path: path.clone(), Effective: valueSnapshot(r.final, path, r.secrets)}
+	explanation := Explanation{Path: path.clone(), Effective: valueSnapshotWithLookup(r.final, path, r.secrets, r.immutableLookup)}
 	if info, ok := r.metadata.Lookup(path); ok {
 		explanation.Origin = cloneOrigin(info.Origin)
 	}
@@ -53,7 +53,7 @@ func (r *Inspection) Explain(path Path) (Explanation, bool) {
 	}
 	replayIndex := new(mappingIndex)
 	for _, application := range r.applications {
-		operationPath, relevant := applicationOperationPath(application, path)
+		operationPath, relevant := applicationOperationPath(application, path, r.immutableLookup)
 		var before ValueSnapshot
 		if relevant {
 			before = valueSnapshot(working, path, r.secrets)
@@ -69,7 +69,7 @@ func (r *Inspection) Explain(path Path) (Explanation, bool) {
 		explanation.History = append(explanation.History, ValueChange{
 			Before: before,
 			After:  after,
-			Origin: historyApplicationOrigin(application, operationPath),
+			Origin: historyApplicationOrigin(application, operationPath, r.immutableLookup),
 		})
 	}
 	appendInheritanceExplanation(&explanation, &working, path, r.inheritance, r.secrets)
@@ -78,20 +78,20 @@ func (r *Inspection) Explain(path Path) (Explanation, bool) {
 	// decoding applies them to the final input tree. Show that reconciliation
 	// explicitly, including canonical scalar conversions, before domain changes.
 	replayed, _ := documentAtPath(working, path)
-	decoded, _ := documentAtPath(r.input, path)
+	decoded, _ := documentAtPathWithLookup(r.input, path, r.immutableLookup)
 	if !configurationValuesEqual(replayed, decoded) {
 		origin := cloneOrigin(r.inputOrigins[path.String()])
 		origin.Operation = ChangeDecoding
 		explanation.History = append(explanation.History, ValueChange{
 			Before:  valueSnapshot(working, path, r.secrets),
-			After:   valueSnapshot(r.input, path, r.secrets),
+			After:   valueSnapshotWithLookup(r.input, path, r.secrets, r.immutableLookup),
 			Origin:  origin,
 			Reasons: []string{"applied retained defaults and canonical typed decoding"},
 		})
 	}
 
 	working = document.Clone(r.input)
-	for _, snapshot := range coalescedResolutionSnapshots(r.resolution) {
+	for _, snapshot := range r.resolutionReplay {
 		relevant := pathsIntersect(snapshot.change.Path, path)
 		var before ValueSnapshot
 		if relevant {

internal/engine/explain_test.go

@@ -10,6 +10,7 @@ import (
 	"path/filepath"
 	"reflect"
 	"strings"
+	"sync"
 	"testing"
 
 	"gitea.maximumdirect.net/eric/ConfigKit/internal/document"
@@ -520,3 +521,95 @@ func TestExplanationReplaysResolutionAdditionsAndOverlappingIntent(t *testing.T)
 		})
 	}
 }
+
+func TestExplanationReplayDescriptorsRemainDetachedAcrossQueries(t *testing.T) {
+	type config struct {
+		Count int `yaml:"count"`
+	}
+	result, err := testLoad(Bytes("resolution-explanation.yml", []byte("count: 1\n")), Options[config]{
+		Definition: Definition[config]{Resolve: func(value *config, resolution *Resolution) error {
+			value.Count = 2
+			resolution.Record(Keys("count"), ChangeNormalization, "normalized", Keys("count"))
+			return nil
+		}},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	first, ok := result.Explain(Keys("count"))
+	if !ok {
+		t.Fatal("missing explanation")
+	}
+	var firstResolution *ValueChange
+	for index := range first.History {
+		if first.History[index].Origin.Layer == LayerResolution {
+			firstResolution = &first.History[index]
+			break
+		}
+	}
+	if firstResolution == nil || len(firstResolution.Reasons) != 1 || len(firstResolution.Dependencies) != 1 {
+		t.Fatalf("resolution history = %#v", first.History)
+	}
+	firstResolution.Reasons[0] = "mutated"
+	firstResolution.Dependencies[0].segments[0].key = "mutated"
+
+	second, ok := result.Explain(Keys("count"))
+	if !ok {
+		t.Fatal("missing repeated explanation")
+	}
+	for _, change := range second.History {
+		if change.Origin.Layer == LayerResolution {
+			if !reflect.DeepEqual(change.Reasons, []string{"normalized"}) || len(change.Dependencies) != 1 || change.Dependencies[0].String() != "/count" {
+				t.Fatalf("repeated explanation observed caller mutation: %#v", change)
+			}
+			return
+		}
+	}
+	t.Fatalf("resolution change missing from repeated explanation: %#v", second.History)
+}
+
+func TestConcurrentReadOnlyInspectionQueries(t *testing.T) {
+	type config struct {
+		Group struct {
+			Value string `yaml:"value"`
+		} `yaml:"group"`
+	}
+	result, err := testLoad(Bytes("concurrent-inspection.yml", []byte("group: {value: input}\n")), Options[config]{
+		Definition: Definition[config]{Resolve: func(value *config, resolution *Resolution) error {
+			value.Group.Value = "resolved"
+			resolution.Record(Keys("group", "value"), ChangeNormalization, "normalized", Keys("group", "value"))
+			return nil
+		}},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	paths := []Path{Keys("group"), Keys("group", "value")}
+	var wait sync.WaitGroup
+	errors := make(chan string, 8)
+	for worker := 0; worker < cap(errors); worker++ {
+		wait.Add(1)
+		go func() {
+			defer wait.Done()
+			for iteration := 0; iteration < 8; iteration++ {
+				for _, path := range paths {
+					explanation, found := result.Explain(path)
+					if !found || !explanation.Effective.Present {
+						errors <- "missing effective explanation for " + path.String()
+						return
+					}
+					metadata := result.Metadata()
+					if _, found := metadata.Lookup(path); !found || len(metadata.History(path)) == 0 {
+						errors <- "missing metadata for " + path.String()
+						return
+					}
+				}
+			}
+		}()
+	}
+	wait.Wait()
+	close(errors)
+	for message := range errors {
+		t.Error(message)
+	}
+}

internal/engine/history.go

@@ -65,7 +65,7 @@ func cloneHistoryApplications(values []historyApplication) []historyApplication
 	return cloned
 }
 
-func applicationOperationPath(application historyApplication, query Path) (Path, bool) {
+func applicationOperationPath(application historyApplication, query Path, lookup *documentLookup) (Path, bool) {
 	if !application.path.valid() || application.value == nil {
 		return Path{}, false
 	}
@@ -80,7 +80,7 @@ func applicationOperationPath(application historyApplication, query Path) (Path,
 	}
 	for length := 1; length <= len(query.segments); length++ {
 		prefix := Path{segments: clonePathSegments(query.segments[:length], 0)}
-		node, present := documentAtPath(application.value, prefix)
+		node, present := documentAtPathWithLookup(application.value, prefix, lookup)
 		if !present {
 			return Path{}, false
 		}
@@ -91,7 +91,7 @@ func applicationOperationPath(application historyApplication, query Path) (Path,
 	return Path{}, false
 }
 
-func historyApplicationOrigin(application historyApplication, operationPath Path) Origin {
+func historyApplicationOrigin(application historyApplication, operationPath Path, lookup *documentLookup) Origin {
 	if application.origin.Layer != "" {
 		return cloneOrigin(application.origin)
 	}
@@ -100,7 +100,7 @@ func historyApplicationOrigin(application historyApplication, operationPath Path
 	if !ok {
 		return origin
 	}
-	if node, present := documentAtPath(application.value, relative); present {
+	if node, present := documentAtPathWithLookup(application.value, relative, lookup); present {
 		origin.Locations = []Location{publicLocation(node.Location)}
 	}
 	return origin
@@ -179,28 +179,50 @@ func mergeHistoryAtPath(root **document.Node, path Path, incoming *document.Node
 // intent into that event rather than replay a child assignment a second time.
 func coalescedResolutionSnapshots(snapshots []resolutionSnapshot) []resolutionSnapshot {
 	groups := make([]resolutionSnapshot, 0, len(snapshots))
+	reasons := make([]map[string]struct{}, 0, len(snapshots))
+	dependencies := make([]map[string]struct{}, 0, len(snapshots))
+	var coverage pathPrefixIndex
 	for _, snapshot := range snapshots {
-		merged := false
-		for i := range groups {
-			if !pathContains(groups[i].change.Path, snapshot.change.Path) {
-				continue
+		pointer := snapshot.change.Path.String()
+		groupIndex := -1
+		coverage.visitAncestors(pointer, func(id int) {
+			if groupIndex < 0 || id < groupIndex {
+				groupIndex = id
 			}
+		})
+		if groupIndex >= 0 {
+			group := &groups[groupIndex]
 			for _, reason := range snapshot.change.Reasons {
-				groups[i].change.Reasons = appendUniqueString(groups[i].change.Reasons, reason)
+				if _, found := reasons[groupIndex][reason]; !found {
+					reasons[groupIndex][reason] = struct{}{}
+					group.change.Reasons = append(group.change.Reasons, reason)
+				}
 			}
 			for _, dependency := range snapshot.change.Dependencies {
-				groups[i].change.Dependencies = appendUniquePath(groups[i].change.Dependencies, dependency)
+				dependencyPointer := dependency.String()
+				if _, found := dependencies[groupIndex][dependencyPointer]; !found {
+					dependencies[groupIndex][dependencyPointer] = struct{}{}
+					group.change.Dependencies = append(group.change.Dependencies, dependency.clone())
+				}
 			}
 			if snapshot.change.Origin.Operation == ChangeNormalization {
-				groups[i].change.Origin.Operation = ChangeNormalization
+				group.change.Origin.Operation = ChangeNormalization
 			}
-			merged = true
-			break
+			continue
 		}
-		if !merged {
-			snapshot.change = cloneChange(snapshot.change)
-			groups = append(groups, snapshot)
+		snapshot.change = cloneChange(snapshot.change)
+		groups = append(groups, snapshot)
+		reasonSet := make(map[string]struct{}, len(snapshot.change.Reasons))
+		for _, reason := range snapshot.change.Reasons {
+			reasonSet[reason] = struct{}{}
 		}
+		reasons = append(reasons, reasonSet)
+		dependencySet := make(map[string]struct{}, len(snapshot.change.Dependencies))
+		for _, dependency := range snapshot.change.Dependencies {
+			dependencySet[dependency.String()] = struct{}{}
+		}
+		dependencies = append(dependencies, dependencySet)
+		coverage.insert(pointer, len(groups)-1)
 	}
 	return groups
 }

internal/engine/imports.go

@@ -45,10 +45,11 @@ type importAccounting struct {
 }
 
 type importTraversal struct {
-	access     *filesystemAccess
-	accounting *importAccounting
-	limits     importLimits
-	rule       *VersionRule
+	access      *filesystemAccess
+	accounting  *importAccounting
+	limits      importLimits
+	rule        *VersionRule
+	destination Path
 
 	documents []*document.Node
 	sources   []SourceInfo
@@ -58,16 +59,16 @@ type importTraversal struct {
 }
 
 func loadImportedDocuments(source Source, context *FilesystemContext, main parsedSource, rule *VersionRule, limits importLimits) (*composedDocument, []SourceInfo, []Diagnostic) {
-	return loadImportedDocumentsTracked(source, context, main, rule, limits, &importAccounting{}, nil, nil)
+	return loadImportedDocumentsTracked(source, context, main, Path{}, rule, limits, &importAccounting{}, nil, nil)
 }
 
-func loadImportedDocumentsTracked(source Source, context *FilesystemContext, main parsedSource, rule *VersionRule, limits importLimits, accounting *importAccounting, visited map[resourceIdentity]importRoute, hostToken *namespaceToken) (*composedDocument, []SourceInfo, []Diagnostic) {
+func loadImportedDocumentsTracked(source Source, context *FilesystemContext, main parsedSource, destination Path, rule *VersionRule, limits importLimits, accounting *importAccounting, visited map[resourceIdentity]importRoute, hostToken *namespaceToken) (*composedDocument, []SourceInfo, []Diagnostic) {
 	if nativeContext(source, context) {
 		access, basePath, mainPath, diagnostic := nativeFilesystemAccess(source, context)
 		if diagnostic != nil {
 			return nil, sourceInfos(main.source), []Diagnostic{*diagnostic}
 		}
-		return loadImportedWithAccessTracked(access, basePath, mainPath, main, rule, limits, accounting, visited)
+		return loadImportedWithAccessTracked(access, basePath, mainPath, main, destination, rule, limits, accounting, visited)
 	}
 	rootPath, basePath, mainPath, diagnostic := importFilesystem(source, context, main)
 	if diagnostic != nil {
@@ -82,14 +83,14 @@ func loadImportedDocumentsTracked(source Source, context *FilesystemContext, mai
 	if hostToken != nil {
 		access.token = hostToken
 	}
-	return loadImportedWithAccessTracked(access, basePath, mainPath, main, rule, limits, accounting, visited)
+	return loadImportedWithAccessTracked(access, basePath, mainPath, main, destination, rule, limits, accounting, visited)
 }
 
 func loadImportedWithAccess(access *filesystemAccess, basePath, mainPath string, main parsedSource, rule *VersionRule, limits importLimits, accounting *importAccounting) (*composedDocument, []SourceInfo, []Diagnostic) {
-	return loadImportedWithAccessTracked(access, basePath, mainPath, main, rule, limits, accounting, nil)
+	return loadImportedWithAccessTracked(access, basePath, mainPath, main, Path{}, rule, limits, accounting, nil)
 }
 
-func loadImportedWithAccessTracked(access *filesystemAccess, basePath, mainPath string, main parsedSource, rule *VersionRule, limits importLimits, accounting *importAccounting, visited map[resourceIdentity]importRoute) (*composedDocument, []SourceInfo, []Diagnostic) {
+func loadImportedWithAccessTracked(access *filesystemAccess, basePath, mainPath string, main parsedSource, destination Path, rule *VersionRule, limits importLimits, accounting *importAccounting, visited map[resourceIdentity]importRoute) (*composedDocument, []SourceInfo, []Diagnostic) {
 	if !access.contains(basePath) || (mainPath != "" && !access.contains(mainPath)) {
 		_ = access.close()
 		return nil, sourceInfos(main.source), []Diagnostic{importDiagnostic(CodeImportOutsideRoot, "selected source and import base must stay inside the configuration root", nil)}
@@ -102,6 +103,7 @@ func loadImportedWithAccessTracked(access *filesystemAccess, basePath, mainPath
 		}
 	}
 	mainInfo := cloneSourceInfo(*main.source)
+	mainInfo.Destination = destination.clone()
 	if mainPath != "" {
 		mainInfo.Path = mainPath
 	}
@@ -118,9 +120,10 @@ func loadImportedWithAccessTracked(access *filesystemAccess, basePath, mainPath
 	accounting.nodes += countInputNodes(main.document)
 	state := importTraversal{
 		access: access, accounting: accounting, limits: limits, rule: rule,
-		documents: make([]*document.Node, 0, 1),
-		sources:   []SourceInfo{mainInfo},
-		active:    make(map[resourceIdentity]int), visited: visited,
+		destination: destination.clone(),
+		documents:   make([]*document.Node, 0, 1),
+		sources:     []SourceInfo{mainInfo},
+		active:      make(map[resourceIdentity]int), visited: visited,
 	}
 	if state.visited == nil {
 		state.visited = make(map[resourceIdentity]importRoute)
@@ -140,8 +143,17 @@ func loadImportedWithAccessTracked(access *filesystemAccess, basePath, mainPath
 	state.stack = append(state.stack, mainRoute)
 	body, declarations, diagnostics := splitImportDirectives(main.document)
 	if len(diagnostics) == 0 {
-		state.documents = append(state.documents, body)
-		diagnostics = state.walkDeclarations(basePath, declarations, 0)
+		_, placed, err := placeDocument(body, state.destination, body.Location, maxDocumentDepth, maxDocumentNodes)
+		placementNodes := destinationWrapperNodeCount(state.destination)
+		if err != nil {
+			diagnostics = []Diagnostic{sourceDiagnostic(CodeSourceLimitExceeded, main.source.ID, "configuration exceeds the source depth or node limit after destination placement")}
+		} else if accounting.nodes+placementNodes > limits.nodes {
+			diagnostics = []Diagnostic{importDiagnostic(CodeImportLimitExceeded, "configuration exceeds the aggregate node limit", nil)}
+		} else {
+			accounting.nodes += placementNodes
+			state.documents = append(state.documents, placed)
+			diagnostics = state.walkDeclarations(basePath, declarations, 0)
+		}
 	}
 
 	closeErr := access.close()
@@ -260,7 +272,7 @@ func (s *importTraversal) visitPath(basePath string, declaration importDeclarati
 		kind = SourceKindFilesystem
 		label = s.access.label + "/" + canonical
 	}
-	info := SourceInfo{ID: sourceID, Label: label, Path: canonical, Layer: LayerBase, Kind: kind, ImportedFrom: &location}
+	info := SourceInfo{ID: sourceID, Label: label, Path: canonical, Destination: s.destination.clone(), Layer: LayerBase, Kind: kind, ImportedFrom: &location}
 	if kind == SourceKindFilesystem {
 		info.namespace = s.access.token
 	}
@@ -291,7 +303,16 @@ func (s *importTraversal) visitPath(basePath string, declaration importDeclarati
 	if len(diagnostics) != 0 {
 		return diagnostics
 	}
-	if versionNode := fragmentVersionClaim(body, s.rule); versionNode != nil {
+	_, placed, err := placeDocument(body, s.destination, body.Location, maxDocumentDepth, maxDocumentNodes)
+	if err != nil {
+		return []Diagnostic{importDiagnostic(CodeImportLimitExceeded, "configuration exceeds the source depth or node limit after destination placement", &location)}
+	}
+	placementNodes := destinationWrapperNodeCount(s.destination)
+	if s.accounting.nodes+placementNodes > s.limits.nodes {
+		return []Diagnostic{importDiagnostic(CodeImportLimitExceeded, "configuration exceeds the aggregate node limit", &location)}
+	}
+	s.accounting.nodes += placementNodes
+	if versionNode := fragmentVersionClaim(placed, s.rule); versionNode != nil {
 		versionLocation := publicLocation(versionNode.Location)
 		return []Diagnostic{{
 			Code: CodeImportVersion, Severity: SeverityError, Path: s.rule.Path.clone(),
@@ -300,7 +321,7 @@ func (s *importTraversal) visitPath(basePath string, declaration importDeclarati
 	}
 
 	route := importRoute{canonical: canonical, locations: currentRoute.locations}
-	s.documents = append(s.documents, body)
+	s.documents = append(s.documents, placed)
 	s.active[identity] = len(s.stack)
 	s.visited[identity] = route
 	s.stack = append(s.stack, route)

internal/engine/inheritance_history.go

@@ -1,6 +1,57 @@
 package engine
 
-import "gitea.maximumdirect.net/eric/ConfigKit/internal/document"
+import (
+	"sort"
+
+	"gitea.maximumdirect.net/eric/ConfigKit/internal/document"
+)
+
+type inheritanceHistoryIndex struct {
+	paths pathPrefixIndex
+}
+
+func newInheritanceHistoryIndex(operations []inheritanceOperation) *inheritanceHistoryIndex {
+	if len(operations) == 0 {
+		return nil
+	}
+	index := &inheritanceHistoryIndex{}
+	for operationID, operation := range operations {
+		if operation.control != nil {
+			index.paths.insert(operation.control.path.String(), operationID)
+			continue
+		}
+		if operation.transfer != nil {
+			index.paths.insert(operation.transfer.to.String(), operationID)
+		}
+	}
+	return index
+}
+
+func (index *inheritanceHistoryIndex) matchingOperations(path Path, operations []inheritanceOperation) []inheritanceOperation {
+	if index == nil {
+		return operations
+	}
+	var ids []int
+	seen := make(map[int]struct{})
+	collect := func(id int) {
+		if _, found := seen[id]; found {
+			return
+		}
+		seen[id] = struct{}{}
+		ids = append(ids, id)
+	}
+	pointer := path.String()
+	index.paths.visitAncestors(pointer, collect)
+	index.paths.visitDescendants(pointer, collect)
+	sort.Ints(ids)
+	matching := make([]inheritanceOperation, 0, len(ids))
+	for _, id := range ids {
+		if id >= 0 && id < len(operations) {
+			matching = append(matching, operations[id])
+		}
+	}
+	return matching
+}
 
 // Retain source history at original paths. Structural operations are held once
 // per relationship and projected onto a requested destination path only when

internal/engine/inheritance_history_test.go

@@ -2,6 +2,7 @@ package engine
 
 import (
 	"bytes"
+	"reflect"
 	"strings"
 	"testing"
 
@@ -311,6 +312,51 @@ func TestInheritanceHistoryRetainsControlsAndDisplacedPaths(t *testing.T) {
 	}
 }
 
+func TestIndexedInheritanceHistoryMatchesOperationScan(t *testing.T) {
+	inspection, _ := inheritanceInspectionForTest(t,
+		parseCompositionDocument(t, "source-1", "parent: {branch: {detail: inherited, retained: present}}\n"),
+		parseCompositionDocument(t, "source-2", "child: {extends: parent, branch: replaced}\n"),
+		parseCompositionDocument(t, "source-3", "sibling: {extends: parent}\n"))
+	metadata := inspection.Metadata()
+	if len(metadata.inheritance) < 4 {
+		t.Fatalf("inheritance operations = %d, want multiple control and transfer scopes", len(metadata.inheritance))
+	}
+	queries := []Path{
+		Keys("child"),
+		Keys("child", inheritanceKey),
+		Keys("child", "branch", "detail"),
+		Keys("child", "branch"),
+		Keys("sibling", "branch", "detail"),
+		Path{},
+	}
+	for _, path := range queries {
+		if !metadata.hasHistoricalPath(path) {
+			continue
+		}
+		stored := metadata.history[path.String()]
+		want := historyWithInheritance(path, stored, metadata.inheritance)
+		if got := metadata.History(path); !reflect.DeepEqual(got, want) {
+			t.Errorf("indexed history for %s differs from operation scan:\n got: %#v\nwant: %#v", path, got, want)
+		}
+		unprepared := Metadata{history: metadata.history, historicalPaths: metadata.historicalPaths, inheritance: metadata.inheritance}
+		if got := unprepared.History(path); !reflect.DeepEqual(got, want) {
+			t.Errorf("unprepared history for %s differs from operation scan:\n got: %#v\nwant: %#v", path, got, want)
+		}
+	}
+
+	removed := Keys("child", "branch", "detail")
+	first := metadata.History(removed)
+	if len(first) == 0 || len(first[0].Path.segments) == 0 {
+		t.Fatalf("removed-path history = %#v", first)
+	}
+	first[0].Path.segments[0].key = "mutated"
+	second := cloneMetadata(metadata).History(removed)
+	want := historyWithInheritance(removed, metadata.history[removed.String()], metadata.inheritance)
+	if !reflect.DeepEqual(second, want) {
+		t.Fatalf("returned history mutation affected a repeated or cloned query:\n got: %#v\nwant: %#v", second, want)
+	}
+}
+
 func TestInheritanceHistoryPrecedesApplicationResolution(t *testing.T) {
 	inspection, _ := inheritanceInspectionForTest(t,
 		parseCompositionDocument(t, "source-1", "parent: {value: original}\nchild: {extends: parent}\n"))
@@ -324,6 +370,7 @@ func TestInheritanceHistoryPrecedesApplicationResolution(t *testing.T) {
 	replaceHistoryPath(&final, path, replacement)
 	inspection.final = final
 	inspection.resolution = []resolutionSnapshot{snapshot}
+	inspection.resolutionReplay = coalescedResolutionSnapshots(inspection.resolution)
 	inspection.metadata.history[path.String()] = append(inspection.metadata.history[path.String()], snapshot.change)
 	inspection.metadata.fields[path.String()] = FieldInfo{Explicit: true, Origin: snapshot.change.Origin}
 	history := inspection.Metadata().History(path)

internal/engine/inheritance_load.go

@@ -3,14 +3,28 @@ package engine
 import "gitea.maximumdirect.net/eric/ConfigKit/internal/document"
 
 func containsInheritanceDirective(root *document.Node) bool {
-	found := false
-	walkDocument(root, Path{}, func(path Path, _ *document.Node) {
-		if len(path.segments) != 0 && path.segments[len(path.segments)-1].kind == pathSegmentKey &&
-			path.segments[len(path.segments)-1].key == inheritanceKey {
-			found = true
+	var visit func(*document.Node) bool
+	visit = func(node *document.Node) bool {
+		if node == nil {
+			return false
 		}
-	})
-	return found
+		switch node.Kind {
+		case document.Mapping:
+			for _, entry := range node.Mapping {
+				if entry.Key == inheritanceKey || visit(entry.Value) {
+					return true
+				}
+			}
+		case document.Sequence:
+			for _, child := range node.Sequence {
+				if visit(child) {
+					return true
+				}
+			}
+		}
+		return false
+	}
+	return visit(root)
 }
 
 func inheritanceVersionDiagnostic(rule *VersionRule, expanded *inheritanceScope) *Diagnostic {
@@ -27,7 +41,7 @@ func inheritanceVersionDiagnostic(rule *VersionRule, expanded *inheritanceScope)
 			}
 		} else if operation.transfer != nil {
 			if relative, within := relativeHistoryPath(operation.transfer.to, rule.Path); within {
-				_, affected = documentAtPath(operation.parent, relative)
+				affected = fragmentVersionClaim(operation.parent, &VersionRule{Path: relative}) != nil
 			} else if pathContains(rule.Path, operation.transfer.to) {
 				affected = true
 			}

internal/engine/inheritance_origin.go

@@ -2,6 +2,7 @@ package engine
 
 import (
 	"slices"
+	"strconv"
 
 	"gitea.maximumdirect.net/eric/ConfigKit/internal/document"
 )
@@ -74,10 +75,44 @@ func copyInheritanceSubtree(target, incoming map[string]Origin, node *document.N
 	})
 }
 
+type inheritanceStepKey struct {
+	from      string
+	to        string
+	reference string
+	locations string
+}
+
+func inheritanceStepKeyForPaths(from, to, reference Path, locations []Location) inheritanceStepKey {
+	return inheritanceStepKey{
+		from: from.String(), to: to.String(), reference: reference.String(),
+		locations: inheritanceLocationsKey(locations),
+	}
+}
+
+func inheritanceLocationsKey(locations []Location) string {
+	encoded := strconv.AppendInt(nil, int64(len(locations)), 10)
+	encoded = append(encoded, ';')
+	for _, location := range locations {
+		encoded = strconv.AppendInt(encoded, int64(len(location.SourceID)), 10)
+		encoded = append(encoded, ':')
+		encoded = append(encoded, location.SourceID...)
+		encoded = append(encoded, ';')
+		encoded = strconv.AppendInt(encoded, int64(location.Line), 10)
+		encoded = append(encoded, ';')
+		encoded = strconv.AppendInt(encoded, int64(location.Column), 10)
+		encoded = append(encoded, ';')
+	}
+	return string(encoded)
+}
+
 // Materialize concrete steps only for an inspection record. The linked private
 // traces remain compact when one parent supplies many descendant values.
 func projectInheritanceSteps(origin Origin) []InheritanceStep {
 	steps := cloneInheritanceSteps(origin.Inheritance)
+	seen := make(map[inheritanceStepKey]struct{}, len(steps))
+	for _, step := range steps {
+		seen[inheritanceStepKeyForPaths(step.From, step.To, step.Reference, step.Locations)] = struct{}{}
+	}
 	for _, contributor := range origin.contributors {
 		var reverse []*inheritanceTrace
 		for link := contributor.trace; link != nil; link = link.previous {
@@ -91,17 +126,13 @@ func projectInheritanceSteps(origin Origin) []InheritanceStep {
 				continue
 			}
 			next := appendInheritancePath(transfer.to, relative)
-			step := InheritanceStep{
-				From: current.clone(), To: next.clone(), Reference: transfer.reference.clone(),
-				Locations: cloneLocations(transfer.locations),
-			}
-			if !slices.ContainsFunc(steps, func(existing InheritanceStep) bool {
-				return existing.From.String() == step.From.String() &&
-					existing.To.String() == step.To.String() &&
-					existing.Reference.String() == step.Reference.String() &&
-					slices.Equal(existing.Locations, step.Locations)
-			}) {
-				steps = append(steps, step)
+			key := inheritanceStepKeyForPaths(current, next, transfer.reference, transfer.locations)
+			if _, found := seen[key]; !found {
+				seen[key] = struct{}{}
+				steps = append(steps, InheritanceStep{
+					From: current.clone(), To: next.clone(), Reference: transfer.reference.clone(),
+					Locations: cloneLocations(transfer.locations),
+				})
 			}
 			current = next
 		}

internal/engine/inheritance_origin_test.go

@@ -2,6 +2,8 @@ package engine
 
 import (
 	"io/fs"
+	"reflect"
+	"slices"
 	"testing"
 	"testing/fstest"
 
@@ -85,6 +87,165 @@ func TestInheritedOriginsKeepSourcePathsPresenceAndIndependentReplacement(t *tes
 	}
 }
 
+func TestOriginMembershipPreservesLocationAndSourceCoverageRules(t *testing.T) {
+	location := Location{SourceID: "source", Line: 4, Column: 2}
+	otherCoordinates := location
+	otherCoordinates.Line++
+
+	container := Origin{
+		Layer:     LayerOverlay,
+		Operation: ChangeNormalization,
+		Locations: []Location{location},
+	}
+	if !originContainedBy(container, container) {
+		t.Fatal("identical location evidence was not contained")
+	}
+	coordinateDifference := container
+	coordinateDifference.Locations = []Location{otherCoordinates}
+	if originContainedBy(coordinateDifference, container) {
+		t.Fatal("location containment ignored differing coordinates")
+	}
+
+	parent := Keys("parent")
+	child := parent.Key("child")
+	change := Change{Path: parent, Origin: container}
+	descendantOrigin := Origin{
+		Layer:     container.Layer,
+		Operation: container.Operation,
+		Locations: []Location{otherCoordinates},
+	}
+	if !originRepresentedByChange(child, descendantOrigin, change) {
+		t.Fatal("descendant source coverage rejected matching SourceID with different coordinates")
+	}
+	descendantOrigin.Locations[0].SourceID = "another-source"
+	if originRepresentedByChange(child, descendantOrigin, change) {
+		t.Fatal("descendant source coverage accepted an unrecorded SourceID")
+	}
+
+	withContributor := container
+	withContributor.contributors = []inheritanceContributor{{source: parent, location: location}}
+	if originContainedBy(withContributor, container) {
+		t.Fatal("exact location containment ignored the contributor-empty mismatch")
+	}
+	if !originRepresentedByChange(child, withContributor, change) {
+		t.Fatal("descendant source coverage was conflated with contributor containment")
+	}
+}
+
+func TestProjectedInheritanceStepsMatchScanAndRetainOwnership(t *testing.T) {
+	sourcePath := Keys("source", "a/b", "01")
+	firstLocations := []Location{{SourceID: "first;:source", Line: -1, Column: 2}}
+	secondLocations := []Location{
+		{SourceID: "second:;source", Line: 3, Column: -4},
+		{SourceID: "", Line: -5, Column: 6},
+	}
+	firstTransfer := inheritanceTransfer{
+		from: Keys("source"), to: Keys("middle"), reference: Keys("middle", "extends"), locations: firstLocations,
+	}
+	secondTransfer := inheritanceTransfer{
+		from: Keys("middle"), to: Keys("target"), reference: Keys("target", "extends"), locations: secondLocations,
+	}
+	firstTrace := &inheritanceTrace{transfer: &firstTransfer}
+	chain := &inheritanceTrace{previous: firstTrace, transfer: &secondTransfer}
+	firstStep := InheritanceStep{
+		From: sourcePath, To: Keys("middle", "a/b", "01"), Reference: firstTransfer.reference, Locations: firstLocations,
+	}
+
+	duplicateFirstTransfer := firstTransfer
+	duplicateSecondTransfer := secondTransfer
+	duplicateChain := &inheritanceTrace{
+		previous: &inheritanceTrace{transfer: &duplicateFirstTransfer},
+		transfer: &duplicateSecondTransfer,
+	}
+	reversedLocations := []Location{secondLocations[1], secondLocations[0]}
+	reorderedSecondTransfer := secondTransfer
+	reorderedSecondTransfer.locations = reversedLocations
+	reorderedChain := &inheritanceTrace{
+		previous: &inheritanceTrace{transfer: &duplicateFirstTransfer},
+		transfer: &reorderedSecondTransfer,
+	}
+	origin := Origin{
+		Inheritance: []InheritanceStep{firstStep, firstStep},
+		contributors: []inheritanceContributor{
+			{source: sourcePath, trace: chain},
+			{source: sourcePath, trace: duplicateChain},
+			{source: sourcePath, trace: reorderedChain},
+			{source: sourcePath, trace: chain},
+		},
+	}
+
+	want := projectInheritanceStepsByScan(origin)
+	got := projectInheritanceSteps(origin)
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("projected steps differ from ordered scan:\n got: %#v\nwant: %#v", got, want)
+	}
+	if len(got) != 4 || got[0].From.String() != "/source/a~1b/01" || got[0].To.String() != "/middle/a~1b/01" ||
+		!reflect.DeepEqual(got[0], got[1]) || got[2].To.String() != "/target/a~1b/01" ||
+		!reflect.DeepEqual(got[2].Locations, secondLocations) || !reflect.DeepEqual(got[3].Locations, reversedLocations) {
+		t.Fatalf("unexpected duplicate/order/escape projection: %#v", got)
+	}
+
+	got[0].From.segments[0].key = "mutated"
+	got[2].Locations[0].SourceID = "mutated"
+	if repeated := projectInheritanceSteps(origin); !reflect.DeepEqual(repeated, want) {
+		t.Fatalf("returned steps mutated retained evidence:\n got: %#v\nwant: %#v", repeated, want)
+	}
+}
+
+func TestInheritanceLocationsKeyEncodesOrderedLengthPrefixedValues(t *testing.T) {
+	if inheritanceLocationsKey(nil) != inheritanceLocationsKey([]Location{}) {
+		t.Fatal("nil and empty location lists should encode equally")
+	}
+	values := [][]Location{
+		{{SourceID: "a;1;-2;", Line: -3, Column: 4}},
+		{{SourceID: "a", Line: 1, Column: -2}, {SourceID: ";1;-2;", Line: -3, Column: 4}},
+		{{SourceID: ";1;-2;", Line: -3, Column: 4}, {SourceID: "a", Line: 1, Column: -2}},
+		{{SourceID: "é", Line: -3, Column: 4}},
+		{{SourceID: "e", Line: -3, Column: 4}},
+	}
+	keys := make(map[string]int, len(values))
+	for index, locations := range values {
+		key := inheritanceLocationsKey(locations)
+		if previous, found := keys[key]; found {
+			t.Fatalf("location lists %d and %d encoded identically", previous, index)
+		}
+		keys[key] = index
+	}
+}
+
+func projectInheritanceStepsByScan(origin Origin) []InheritanceStep {
+	steps := cloneInheritanceSteps(origin.Inheritance)
+	for _, contributor := range origin.contributors {
+		var reverse []*inheritanceTrace
+		for link := contributor.trace; link != nil; link = link.previous {
+			reverse = append(reverse, link)
+		}
+		current := contributor.source
+		for index := len(reverse) - 1; index >= 0; index-- {
+			transfer := reverse[index].transfer
+			relative, ok := relativeHistoryPath(transfer.from, current)
+			if !ok {
+				continue
+			}
+			next := appendInheritancePath(transfer.to, relative)
+			step := InheritanceStep{
+				From: current.clone(), To: next.clone(), Reference: transfer.reference.clone(),
+				Locations: cloneLocations(transfer.locations),
+			}
+			if !slices.ContainsFunc(steps, func(existing InheritanceStep) bool {
+				return existing.From.String() == step.From.String() &&
+					existing.To.String() == step.To.String() &&
+					existing.Reference.String() == step.Reference.String() &&
+					slices.Equal(existing.Locations, step.Locations)
+			}) {
+				steps = append(steps, step)
+			}
+			current = next
+		}
+	}
+	return steps
+}
+
 func TestInheritedOriginsRetainChainsAndNestedDestinations(t *testing.T) {
 	first := parseCompositionDocument(t, "source-1", `first:
   enabled: false

internal/engine/inheritance_test.go

@@ -121,6 +121,24 @@ func TestSiblingInheritanceRejectsInvalidRelationships(t *testing.T) {
 	}
 }
 
+func TestLoadDetectsInvalidInheritanceInsideSequence(t *testing.T) {
+	input := []byte(`items:
+  - child: {extends: true}
+`)
+	result, err := testLoad[map[string]any](Bytes("nested-inheritance.yml", input), Options[map[string]any]{})
+	if result != nil || err == nil {
+		t.Fatalf("result, err = %#v, %v; want invalid nested inheritance", result, err)
+	}
+	loadError, ok := err.(*LoadError)
+	if !ok {
+		t.Fatalf("error type = %T, want *LoadError", err)
+	}
+	diagnostics := loadError.Diagnostics()
+	if len(diagnostics) != 1 || diagnostics[0].Code != CodeInheritanceInvalid || diagnostics[0].Path.String() != "/items/0/child/extends" {
+		t.Fatalf("diagnostics = %#v", diagnostics)
+	}
+}
+
 func TestSiblingInheritanceDetectsDeepCycleWithoutRecursiveDependencyWalk(t *testing.T) {
 	const count = 2048
 	entries := make([]document.Entry, count)

internal/engine/layered.go

@@ -2,11 +2,12 @@ package engine
 
 import "os"
 
-// Input selects one source and its independent import policy.
+// Input selects one source, its destination, and its independent import policy.
 type Input struct {
-	Source     Source
-	Imports    bool
-	Filesystem *FilesystemContext
+	Source      Source
+	Imports     bool
+	Filesystem  *FilesystemContext
+	Destination Path
 }
 
 // Underlay contains strictly composed contributions at one precedence tier.
@@ -32,7 +33,10 @@ func LoadLayered[T any](main Input, secrets SecretBinding, supplied ...LayeredOp
 		options = supplied[0]
 	}
 	request := loadRequest[T]{
-		main:       loadInput{source: main.Source, imports: main.Imports, filesystem: main.Filesystem},
+		main: loadInput{
+			source: main.Source, imports: main.Imports, filesystem: main.Filesystem,
+			destination: main.Destination.clone(),
+		},
 		definition: options.Definition, overlay: options.Overlay,
 		overlayFilesystem: options.OverlayFilesystem,
 		overrides:         append([]Override(nil), options.Overrides...),
@@ -43,6 +47,7 @@ func LoadLayered[T any](main Input, secrets SecretBinding, supplied ...LayeredOp
 		for inputIndex, input := range underlay.Inputs {
 			request.underlays[index].inputs[inputIndex] = loadInput{
 				source: input.Source, imports: input.Imports, filesystem: input.Filesystem,
+				destination: input.Destination.clone(),
 			}
 		}
 	}

internal/engine/load.go

@@ -84,7 +84,9 @@ type Inspection struct {
 	input            *document.Node
 	inputOrigins     map[string]Origin
 	final            *document.Node
+	immutableLookup  *documentLookup
 	resolution       []resolutionSnapshot
+	resolutionReplay []resolutionSnapshot
 	applications     []historyApplication
 	inheritance      []inheritanceOperation
 	secrets          map[string]bool
@@ -153,7 +155,7 @@ func executeLoadRequest[T any](request loadRequest[T], secrets SecretBinding, lo
 		mainOptions.Overlay = request.overlay
 	}
 
-	input, diagnostics := assembleBaseInputTracked(request.main.source, mainOptions, accounting, nil, nil)
+	input, diagnostics := assembleBaseInputTracked(request.main.source, mainOptions, request.main.destination, accounting, nil, nil)
 	accumulator.sources = input.sources
 	accumulator.add(diagnostics...)
 	if len(diagnostics) != 0 {

internal/engine/load_input.go

@@ -17,10 +17,10 @@ type assembledInput struct {
 }
 
 func assembleBaseInput[T any](source Source, options Options[T]) (assembledInput, []Diagnostic) {
-	return assembleBaseInputTracked(source, options, &importAccounting{}, nil, nil)
+	return assembleBaseInputTracked(source, options, Path{}, &importAccounting{}, nil, nil)
 }
 
-func assembleBaseInputTracked[T any](source Source, options Options[T], accounting *importAccounting, visited map[resourceIdentity]importRoute, hostToken *namespaceToken) (assembledInput, []Diagnostic) {
+func assembleBaseInputTracked[T any](source Source, options Options[T], destination Path, accounting *importAccounting, visited map[resourceIdentity]importRoute, hostToken *namespaceToken) (assembledInput, []Diagnostic) {
 	limits := defaultImportLimits()
 	parseLimits := defaultParseLimits()
 	parseLimits.source.remaining = limits.bytes - accounting.bytes
@@ -28,16 +28,28 @@ func assembleBaseInputTracked[T any](source Source, options Options[T], accounti
 	input := assembledInput{parsed: parsed, document: parsed.document}
 	if len(diagnostics) != 0 {
 		input.sources = sourceInfos(parsed.source)
+		setSourceDestinations(input.sources, destination)
+		// Mapping value issues already identify application content. Other early
+		// failures describe source syntax or access, not a placed value.
+		if source.kind == sourceMapping && source.mapIssue != nil && len(destination.segments) != 0 {
+			for index := range diagnostics {
+				relative := diagnostics[index].Path
+				segments := clonePathSegments(destination.segments, len(relative.segments))
+				diagnostics[index].Path = Path{segments: append(segments, relative.segments...)}
+			}
+		}
 		return input, diagnostics
 	}
 	if options.Imports {
-		input.composition, input.sources, diagnostics = loadImportedDocumentsTracked(source, options.Filesystem, parsed, options.Definition.Version, limits, accounting, visited, hostToken)
+		input.composition, input.sources, diagnostics = loadImportedDocumentsTracked(source, options.Filesystem, parsed, destination, options.Definition.Version, limits, accounting, visited, hostToken)
+		setSourceDestinations(input.sources, destination)
 		if len(diagnostics) != 0 {
 			return input, diagnostics
 		}
 		input.document = input.composition.root
 	} else {
 		input.sources = sourceInfos(parsed.source)
+		setSourceDestinations(input.sources, destination)
 		if options.Filesystem != nil && !activeOverlay(options.Overlay) {
 			if diagnostic := validateFilesystemContext(source, options.Filesystem, parsed); diagnostic != nil {
 				return input, []Diagnostic{*diagnostic}
@@ -48,7 +60,14 @@ func assembleBaseInputTracked[T any](source Source, options Options[T], accounti
 		if diagnostics := disabledDirectiveDiagnostics(input.document, Path{}); len(diagnostics) != 0 {
 			return input, diagnostics
 		}
-		if accounting.sources+1 > limits.sources || accounting.bytes+parsed.bytes > limits.bytes || accounting.nodes+countInputNodes(input.document) > limits.nodes {
+		_, placed, err := placeDocument(input.document, destination, input.document.Location, parseLimits.document.Depth, parseLimits.document.Nodes)
+		if err != nil {
+			return input, []Diagnostic{sourceDiagnostic(CodeSourceLimitExceeded, parsed.source.ID, "configuration exceeds the source depth or node limit after destination placement")}
+		}
+		input.document = placed
+		rawNodes := countInputNodes(parsed.document)
+		placementNodes := destinationWrapperNodeCount(destination)
+		if accounting.sources+1 > limits.sources || accounting.bytes+parsed.bytes > limits.bytes || accounting.nodes+rawNodes+placementNodes > limits.nodes {
 			return input, []Diagnostic{sourceDiagnostic(CodeSourceLimitExceeded, parsed.source.ID, "configuration exceeds the aggregate input limit")}
 		}
 		if diagnostic := registerAcquiredSource(source, options.Filesystem, parsed.source, visited, hostToken); diagnostic != nil {
@@ -56,7 +75,7 @@ func assembleBaseInputTracked[T any](source Source, options Options[T], accounti
 		}
 		accounting.sources++
 		accounting.bytes += parsed.bytes
-		accounting.nodes += countInputNodes(input.document)
+		accounting.nodes += rawNodes + placementNodes
 	}
 	if !activeOverlay(options.Overlay) || options.Imports {
 		contexts, diagnostic := contextsForAcquiredSources(source, options.Filesystem, parsed.source, input.sources)

internal/engine/load_metadata.go

@@ -157,15 +157,12 @@ func originRepresentedByChange(path Path, origin Origin, change Change) bool {
 	// A subtree replacement already records its descendants' contributions.
 	// Their coordinates differ from the container's, but their sources must be
 	// covered by the operation; matching only the precedence role is insufficient.
+	recordedSources := make(map[string]struct{}, len(change.Origin.Locations))
+	for _, recorded := range change.Origin.Locations {
+		recordedSources[recorded.SourceID] = struct{}{}
+	}
 	for _, location := range origin.Locations {
-		found := false
-		for _, recorded := range change.Origin.Locations {
-			if location.SourceID == recorded.SourceID {
-				found = true
-				break
-			}
-		}
-		if !found {
+		if _, found := recordedSources[location.SourceID]; !found {
 			return false
 		}
 	}
@@ -189,15 +186,12 @@ func originContainedBy(candidate, container Origin) bool {
 	if candidate.Layer != container.Layer || candidate.Operation != container.Operation {
 		return false
 	}
+	availableLocations := make(map[Location]struct{}, len(container.Locations))
+	for _, location := range container.Locations {
+		availableLocations[location] = struct{}{}
+	}
 	for _, location := range candidate.Locations {
-		found := false
-		for _, available := range container.Locations {
-			if location == available {
-				found = true
-				break
-			}
-		}
-		if !found {
+		if _, found := availableLocations[location]; !found {
 			return false
 		}
 	}
@@ -254,9 +248,10 @@ func cloneMetadata(metadata Metadata) Metadata {
 		return Metadata{}
 	}
 	cloned := Metadata{
-		fields:      make(map[string]FieldInfo, len(metadata.fields)),
-		history:     make(map[string][]Change, len(metadata.history)),
-		inheritance: append([]inheritanceOperation(nil), metadata.inheritance...),
+		fields:           make(map[string]FieldInfo, len(metadata.fields)),
+		history:          make(map[string][]Change, len(metadata.history)),
+		inheritance:      append([]inheritanceOperation(nil), metadata.inheritance...),
+		inheritanceIndex: metadata.inheritanceIndex,
 	}
 	cloned.effectivePaths = make(map[string]Path, len(metadata.effectivePaths))
 	for pointer, path := range metadata.effectivePaths {
@@ -280,8 +275,23 @@ func cloneMetadata(metadata Metadata) Metadata {
 }
 
 func applyResolutionMetadata(metadata *Metadata, resolved resolutionResult) {
-	for _, snapshot := range resolved.snapshots {
-		pointer := snapshot.change.Path.String()
+	finalPaths := make(map[string]*document.Node)
+	indexDocument(resolved.final, Path{}, finalPaths)
+	snapshotCoverage, snapshotPointers := newResolutionCoverageIndexFromSnapshots(resolved.snapshots)
+	var deltaCoverage pathPrefixIndex
+	snapshotIDs := make([]int, len(resolved.deltas))
+	for id, delta := range resolved.deltas {
+		if delta.path.valid() {
+			deltaCoverage.insert(delta.path.String(), id)
+		}
+		snapshotIDs[id] = -1
+		if snapshotID, ok := snapshotCoverage.deepestCoveringID(delta.path); ok {
+			snapshotIDs[id] = snapshotID
+		}
+	}
+
+	for snapshotID, snapshot := range resolved.snapshots {
+		pointer := snapshotPointers[snapshotID]
 		change := cloneChange(snapshot.change)
 		if info, ok := metadata.fields[pointer]; ok {
 			change.Previous = []Origin{cloneOrigin(info.Origin)}
@@ -290,52 +300,40 @@ func applyResolutionMetadata(metadata *Metadata, resolved resolutionResult) {
 		}
 		metadata.history[pointer] = append(metadata.history[pointer], change)
 	}
-	appendResolutionDescendantHistory(metadata, resolved)
-	for _, delta := range resolved.deltas {
-		record := coveringResolutionSnapshot(resolved.snapshots, delta.path)
-		if record == nil {
-			continue
-		}
-		for pointer, info := range metadata.fields {
-			path, err := ParsePath(pointer)
-			if err != nil || !pathContains(delta.path, path) {
-				continue
-			}
-			info.Origin = cloneOrigin(record.change.Origin)
-			metadata.fields[pointer] = info
-		}
-	}
-	refreshResolutionFields(metadata.fields, resolved.final, resolved.snapshots)
+
+	appendResolutionDescendantHistory(metadata, resolved.snapshots, snapshotPointers, finalPaths, &deltaCoverage, snapshotIDs)
+	applyResolutionFieldOrigins(metadata.fields, resolved.snapshots, &deltaCoverage, snapshotIDs)
+	refreshResolutionFields(metadata.fields, finalPaths, resolved.snapshots, snapshotCoverage)
 }
 
-func appendResolutionDescendantHistory(metadata *Metadata, resolved resolutionResult) {
-	finalPaths := make(map[string]*document.Node)
-	indexDocument(resolved.final, Path{}, finalPaths)
-	for _, delta := range resolved.deltas {
-		record := coveringResolutionSnapshot(resolved.snapshots, delta.path)
-		if record == nil {
+func appendResolutionDescendantHistory(metadata *Metadata, snapshots []resolutionSnapshot, snapshotPointers []string, finalPaths map[string]*document.Node, deltaIndex *pathPrefixIndex, snapshotIDs []int) {
+	allPointers := make(map[string]struct{}, len(metadata.history)+len(finalPaths))
+	for pointer := range metadata.history {
+		if _, err := ParsePath(pointer); err == nil {
+			allPointers[pointer] = struct{}{}
+		}
+	}
+	for pointer := range finalPaths {
+		allPointers[pointer] = struct{}{}
+	}
+	buckets := make([][]string, len(snapshotIDs))
+	for pointer := range allPointers {
+		deltaIndex.visitAncestors(pointer, func(deltaID int) {
+			snapshotID := snapshotIDs[deltaID]
+			if snapshotID < 0 || pointer == snapshotPointers[snapshotID] {
+				return
+			}
+			buckets[deltaID] = append(buckets[deltaID], pointer)
+		})
+	}
+	for deltaID, pointers := range buckets {
+		snapshotID := snapshotIDs[deltaID]
+		if snapshotID < 0 {
 			continue
 		}
-		affected := make(map[string]bool)
-		for pointer := range metadata.history {
-			if path, err := ParsePath(pointer); err == nil && pathContains(delta.path, path) {
-				affected[pointer] = true
-			}
-		}
-		for pointer := range finalPaths {
-			if path, err := ParsePath(pointer); err == nil && pathContains(delta.path, path) {
-				affected[pointer] = true
-			}
-		}
-		pointers := make([]string, 0, len(affected))
-		for pointer := range affected {
-			if pointer != record.change.Path.String() {
-				pointers = append(pointers, pointer)
-			}
-		}
 		slices.Sort(pointers)
 		for _, pointer := range pointers {
-			change := cloneChange(record.change)
+			change := cloneChange(snapshots[snapshotID].change)
 			if info, ok := metadata.fields[pointer]; ok {
 				change.Previous = []Origin{cloneOrigin(info.Origin)}
 			}
@@ -344,20 +342,33 @@ func appendResolutionDescendantHistory(metadata *Metadata, resolved resolutionRe
 	}
 }
 
-func coveringResolutionSnapshot(snapshots []resolutionSnapshot, path Path) *resolutionSnapshot {
-	var covering *resolutionSnapshot
-	for index := range snapshots {
-		snapshot := &snapshots[index]
-		if pathContains(snapshot.change.Path, path) && (covering == nil || len(snapshot.change.Path.segments) > len(covering.change.Path.segments)) {
-			covering = snapshot
+func applyResolutionFieldOrigins(fields map[string]FieldInfo, snapshots []resolutionSnapshot, deltaIndex *pathPrefixIndex, snapshotIDs []int) {
+	buckets := make([][]string, len(snapshotIDs))
+	for pointer := range fields {
+		if _, err := ParsePath(pointer); err != nil {
+			continue
+		}
+		deltaIndex.visitAncestors(pointer, func(deltaID int) {
+			if snapshotIDs[deltaID] >= 0 {
+				buckets[deltaID] = append(buckets[deltaID], pointer)
+			}
+		})
+	}
+	for deltaID, pointers := range buckets {
+		snapshotID := snapshotIDs[deltaID]
+		if snapshotID < 0 {
+			continue
+		}
+		origin := snapshots[snapshotID].change.Origin
+		for _, pointer := range pointers {
+			info := fields[pointer]
+			info.Origin = cloneOrigin(origin)
+			fields[pointer] = info
 		}
 	}
-	return covering
 }
 
-func refreshResolutionFields(fields map[string]FieldInfo, final *document.Node, snapshots []resolutionSnapshot) {
-	finalPaths := make(map[string]*document.Node)
-	indexDocument(final, Path{}, finalPaths)
+func refreshResolutionFields(fields map[string]FieldInfo, finalPaths map[string]*document.Node, snapshots []resolutionSnapshot, snapshotCoverage *resolutionCoverageIndex) {
 	for pointer := range fields {
 		if _, ok := finalPaths[pointer]; !ok {
 			delete(fields, pointer)
@@ -370,10 +381,8 @@ func refreshResolutionFields(fields map[string]FieldInfo, final *document.Node,
 			continue
 		}
 		origin := Origin{Layer: LayerResolution}
-		if path, err := ParsePath(pointer); err == nil {
-			if covering := coveringResolutionSnapshot(snapshots, path); covering != nil {
-				origin = cloneOrigin(covering.change.Origin)
-			}
+		if snapshotID, ok := snapshotCoverage.deepestCoveringPointerID(pointer); ok {
+			origin = cloneOrigin(snapshots[snapshotID].change.Origin)
 		}
 		fields[pointer] = FieldInfo{Null: node.Kind == document.Null, Origin: origin}
 	}

internal/engine/load_request.go

@@ -17,9 +17,10 @@ type loadRequest[T any] struct {
 }
 
 type loadInput struct {
-	source     Source
-	imports    bool
-	filesystem *FilesystemContext
+	source      Source
+	imports     bool
+	filesystem  *FilesystemContext
+	destination Path
 }
 
 type loadGroup struct{ inputs []loadInput }
@@ -27,12 +28,23 @@ type loadGroup struct{ inputs []loadInput }
 func loadGroupedWithSecretLookup[T any](request loadRequest[T], secrets SecretBinding, lookup secretLookup) (*Loaded[T], error) {
 	request.ordinary = false
 	var diagnostics []Diagnostic
+	if normalized, err := normalizeDestination(request.main.destination); err != nil {
+		diagnostics = append(diagnostics, invalidDestinationDiagnostic(request.main.destination))
+	} else {
+		request.main.destination = normalized
+	}
 	_, mainDiagnostics := selectOptions(request.main.source, []Options[T]{{
 		Definition: request.definition, Imports: request.main.imports, Filesystem: request.main.filesystem,
 	}})
 	diagnostics = append(diagnostics, mainDiagnostics...)
-	for _, group := range request.underlays {
-		for _, input := range group.inputs {
+	for groupIndex := range request.underlays {
+		for inputIndex := range request.underlays[groupIndex].inputs {
+			input := &request.underlays[groupIndex].inputs[inputIndex]
+			if normalized, err := normalizeDestination(input.destination); err != nil {
+				diagnostics = append(diagnostics, invalidDestinationDiagnostic(input.destination))
+			} else {
+				input.destination = normalized
+			}
 			_, inputDiagnostics := selectOptions(input.source, []Options[T]{{Imports: input.imports, Filesystem: input.filesystem}})
 			diagnostics = append(diagnostics, inputDiagnostics...)
 		}
@@ -134,7 +146,7 @@ func acquireUnderlayGroup(group loadGroup, index int, rule *VersionRule, account
 	var contexts map[string]ResourceContext
 	for _, contribution := range group.inputs {
 		options := Options[struct{}]{Imports: contribution.imports, Filesystem: contribution.filesystem, Definition: Definition[struct{}]{Version: rule}}
-		acquired, diagnostics := assembleBaseInputTracked(contribution.source, options, accounting, visited, hostToken)
+		acquired, diagnostics := assembleBaseInputTracked(contribution.source, options, contribution.destination, accounting, visited, hostToken)
 		for _, source := range acquired.sources {
 			source.Layer = LayerUnderlay
 			source.UnderlayIndex = index

internal/engine/load_result.go

@@ -98,6 +98,11 @@ func publishLoadResult[T any](schema *schemaDescriptor, definition Definition[T]
 	final, applications, resolutionSnapshots := resolved.final, resolved.applications, resolved.snapshots
 	finalizeMetadataPaths(&metadata, final, applications, decoded.baseline, decoded.final)
 	secrets := classifySecretPaths(schema, definition.Secret, metadata, final, applications, decoded.baseline, decoded.final)
+	retainedTrees := make([]*document.Node, 0, len(applications)+2)
+	retainedTrees = append(retainedTrees, decoded.final, final)
+	for _, application := range applications {
+		retainedTrees = append(retainedTrees, application.value)
+	}
 	inspection := &Inspection{
 		metadata:         metadata,
 		sources:          cloneSourceInfos(accumulator.sources),
@@ -107,7 +112,9 @@ func publishLoadResult[T any](schema *schemaDescriptor, definition Definition[T]
 		input:            decoded.final,
 		inputOrigins:     cloneOriginIndex(decoded.origins),
 		final:            final,
+		immutableLookup:  buildDocumentLookup(retainedTrees...),
 		resolution:       resolutionSnapshots,
+		resolutionReplay: coalescedResolutionSnapshots(resolutionSnapshots),
 		applications:     applications,
 		inheritance:      inheritanceOperations(resolved.inheritance),
 		secrets:          secrets,

internal/engine/metadata.go

@@ -9,20 +9,18 @@ import (
 // Metadata provides detached effective presence/origin and chronological history
 // queries for a load. Its zero value contains no paths.
 type Metadata struct {
-	effectivePaths  map[string]Path
-	historicalPaths map[string][]Path
-	fields          map[string]FieldInfo
-	history         map[string][]Change
-	inheritance     []inheritanceOperation
+	effectivePaths   map[string]Path
+	historicalPaths  map[string][]Path
+	fields           map[string]FieldInfo
+	history          map[string][]Change
+	inheritance      []inheritanceOperation
+	inheritanceIndex *inheritanceHistoryIndex
 }
 
 // Lookup returns information for an effective path. Unknown and invalid paths
 // return false.
 func (m Metadata) Lookup(path Path) (FieldInfo, bool) {
-	if !path.valid() || !matchesPathShape(path, m.effectivePaths[path.String()]) {
-		return FieldInfo{}, false
-	}
-	info, ok := m.fields[path.String()]
+	info, ok := m.effectiveField(path)
 	if !ok {
 		return FieldInfo{}, false
 	}
@@ -34,10 +32,23 @@ func (m Metadata) Lookup(path Path) (FieldInfo, bool) {
 // IsExplicit reports whether a surviving input contribution, including one
 // inherited from a sibling, explicitly defined path.
 func (m Metadata) IsExplicit(path Path) bool {
-	info, ok := m.Lookup(path)
+	info, ok := m.effectiveField(path)
 	return ok && info.Explicit
 }
 
+func (m Metadata) effectiveField(path Path) (FieldInfo, bool) {
+	if !path.valid() {
+		return FieldInfo{}, false
+	}
+	pointer := path.String()
+	candidate, ok := m.effectivePaths[pointer]
+	if !ok || !matchesPathShape(path, candidate) {
+		return FieldInfo{}, false
+	}
+	info, ok := m.fields[pointer]
+	return info, ok
+}
+
 // History returns detached definition, inheritance, and resolution records for path. A record's
 // Path can be an ancestor when that container operation replaced or removed path.
 // Removed historical paths can have history even though Lookup returns false.
@@ -47,7 +58,11 @@ func (m Metadata) History(path Path) []Change {
 		return nil
 	}
 	history := m.history[path.String()]
-	return historyWithInheritance(path, history, m.inheritance)
+	operations := m.inheritance
+	if m.inheritanceIndex != nil {
+		operations = m.inheritanceIndex.matchingOperations(path, m.inheritance)
+	}
+	return historyWithInheritance(path, history, operations)
 }
 
 // HistoricalPaths returns the paths observed during loading, including effective
@@ -79,11 +94,14 @@ func (m Metadata) HistoricalPaths() []Path {
 // Textual pointers are lookup keys, but explicit key/index kinds remain part of
 // the query. Candidate paths are constructed from actual document containers.
 func matchesPathShape(query, candidate Path) bool {
-	if !query.valid() || query.String() != candidate.String() || len(query.segments) != len(candidate.segments) {
+	if !query.valid() || len(query.segments) != len(candidate.segments) {
 		return false
 	}
 	for i, segment := range query.segments {
 		actual := candidate.segments[i]
+		if !pathTokenSpellingEqual(segment, actual) {
+			return false
+		}
 		if actual.kind == pathSegmentIndex {
 			index, ok := schemaIndex(segment)
 			if !ok || index != actual.index {
@@ -109,10 +127,9 @@ func (m Metadata) hasHistoricalPath(path Path) bool {
 }
 
 func finalizeMetadataPaths(m *Metadata, final *document.Node, applications []historyApplication, earlier ...*document.Node) {
-	m.effectivePaths = effectivePathIndex(final)
+	m.effectivePaths = make(map[string]Path)
 	m.historicalPaths = make(map[string][]Path)
-	add := func(path Path, _ *document.Node) {
-		pointer := path.String()
+	addHistorical := func(path Path, pointer string) {
 		for _, prior := range m.historicalPaths[pointer] {
 			if matchesPathShape(path, prior) {
 				return
@@ -120,7 +137,14 @@ func finalizeMetadataPaths(m *Metadata, final *document.Node, applications []his
 		}
 		m.historicalPaths[pointer] = append(m.historicalPaths[pointer], path.clone())
 	}
-	walkDocument(final, Path{}, add)
+	walkDocument(final, Path{}, func(path Path, _ *document.Node) {
+		pointer := path.String()
+		m.effectivePaths[pointer] = path.clone()
+		addHistorical(path, pointer)
+	})
+	add := func(path Path, _ *document.Node) {
+		addHistorical(path, path.String())
+	}
 	for _, tree := range earlier {
 		walkDocument(tree, Path{}, add)
 	}
@@ -142,6 +166,7 @@ func finalizeMetadataPaths(m *Metadata, final *document.Node, applications []his
 			walkDocument(operation.effective, operation.transfer.to, add)
 		}
 	}
+	m.inheritanceIndex = newInheritanceHistoryIndex(m.inheritance)
 }
 
 // effectivePathIndex records document-derived paths with their contextual segment

internal/engine/metadata_test.go

@@ -47,6 +47,60 @@ func TestMetadataHistoricalPaths(t *testing.T) {
 	}
 }
 
+func TestMetadataPathIndexesOwnIndependentSegments(t *testing.T) {
+	t.Parallel()
+
+	final := parseDocumentForDecode(t, "service: {workers: [1]}\n")
+	var metadata Metadata
+	finalizeMetadataPaths(&metadata, final, nil)
+	pointer := "/service/workers/0"
+	effective := metadata.effectivePaths[pointer]
+	historical := metadata.historicalPaths[pointer]
+	if effective.String() != pointer || len(historical) != 1 || historical[0].String() != pointer {
+		t.Fatalf("path indexes = %#v, %#v", effective, historical)
+	}
+
+	effective.segments[0].key = "effective"
+	if historical[0].String() != pointer {
+		t.Fatal("effective path mutation changed historical path")
+	}
+	historical[0].segments[2].index = 1
+	if effective.String() != "/effective/workers/0" {
+		t.Fatal("historical path mutation changed effective path")
+	}
+}
+
+func TestMetadataPathIndexesRetainDistinctHistoricalShapes(t *testing.T) {
+	t.Parallel()
+
+	final := parseDocumentForDecode(t, "shape: [replacement]\n")
+	earlier := parseDocumentForDecode(t, "shape: {'0': base}\n")
+	var metadata Metadata
+	// Repeated trees must not add duplicate shapes to the historical index.
+	finalizeMetadataPaths(&metadata, final, nil, earlier, earlier, final)
+	keyPath := Keys("shape", "0")
+	indexPath := Keys("shape").Index(0)
+	pointer := indexPath.String()
+	if !reflect.DeepEqual(metadata.effectivePaths[pointer], indexPath) {
+		t.Fatal("effective index does not reflect the final sequence")
+	}
+	historical := metadata.historicalPaths[pointer]
+	if len(historical) != 2 {
+		t.Fatalf("historical shapes = %#v, want one key and one index", historical)
+	}
+	for _, want := range []Path{keyPath, indexPath} {
+		found := false
+		for _, path := range historical {
+			if reflect.DeepEqual(path, want) {
+				found = true
+			}
+		}
+		if !found || !metadata.hasHistoricalPath(want) {
+			t.Fatalf("historical index lost shape %#v", want)
+		}
+	}
+}
+
 func TestHistoricalPathsExposeHiddenBaseOwnershipWithoutResolvingBaseSecrets(t *testing.T) {
 	t.Setenv("CONFIGKIT_HISTORY_UNUSED_PROD_KEY", "")
 	t.Setenv("CONFIGKIT_HISTORY_TEST_KEY", "synthetic-test-key")
@@ -231,6 +285,75 @@ func TestResolutionInputKeepsDetachedEntryMetadata(t *testing.T) {
 	}
 }
 
+func TestMetadataIsExplicitAgreesWithLookup(t *testing.T) {
+	t.Parallel()
+
+	type entry struct {
+		Kept    string `yaml:"kept"`
+		Set     string `yaml:"set"`
+		Enabled bool   `yaml:"enabled"`
+		Count   int    `yaml:"count"`
+	}
+	type config struct {
+		Nested   entry            `yaml:"nested"`
+		Nullable *string          `yaml:"nullable"`
+		Nodes    map[string]entry `yaml:"nodes"`
+	}
+
+	input := []byte(`nested: {set: configured, enabled: false, count: 0}
+nullable: null
+nodes:
+  base: {enabled: false, count: 0}
+  copy: {extends: base}
+`)
+	result, err := testLoad(Bytes("metadata-presence.yml", input), Options[config]{Definition: Definition[config]{
+		Defaults: func() config {
+			return config{
+				Nested: entry{Kept: "default", Set: "default", Enabled: true, Count: 7},
+				Nodes:  map[string]entry{"copy": {Kept: "node default"}},
+			}
+		},
+	}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	metadata := result.Metadata()
+	tests := []struct {
+		name          string
+		path          Path
+		wantExplicit  bool
+		wantNull      bool
+		wantInherited bool
+	}{
+		{name: "default", path: Keys("nested", "kept")},
+		{name: "direct input", path: Keys("nested", "set"), wantExplicit: true},
+		{name: "explicit false", path: Keys("nested", "enabled"), wantExplicit: true},
+		{name: "explicit zero", path: Keys("nested", "count"), wantExplicit: true},
+		{name: "explicit null", path: Keys("nullable"), wantExplicit: true, wantNull: true},
+		{name: "inherited input", path: Keys("nodes", "copy", "enabled"), wantExplicit: true, wantInherited: true},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			info, found := metadata.Lookup(test.path)
+			if !found {
+				t.Fatalf("Lookup(%s) did not find an effective path", test.path)
+			}
+			if got := metadata.IsExplicit(test.path); got != info.Explicit || got != test.wantExplicit {
+				t.Fatalf("IsExplicit(%s) = %v, Lookup explicit = %v, want %v", test.path, got, info.Explicit, test.wantExplicit)
+			}
+			if info.Null != test.wantNull {
+				t.Fatalf("Lookup(%s).Null = %v, want %v", test.path, info.Null, test.wantNull)
+			}
+			if inherited := len(info.Origin.Inheritance) != 0; inherited != test.wantInherited {
+				t.Fatalf("Lookup(%s) inherited = %v, want %v", test.path, inherited, test.wantInherited)
+			}
+		})
+	}
+	if result.Config.Nested.Enabled || result.Config.Nested.Count != 0 || result.Config.Nullable != nil {
+		t.Fatalf("explicit values changed during loading: %#v", result.Config)
+	}
+}
+
 func TestQueriesRespectActualHistoricalAndEffectiveContainers(t *testing.T) {
 	result, err := testLoad[map[string]any](Bytes("base", []byte("items: [1]\nm: {'0': 2}\nx: 3\nretired: {child: 4}\n")), Options[map[string]any]{Overrides: []Override{{Path: Keys("retired"), Value: "removed", Flag: "--retired"}}})
 	if err != nil {

internal/engine/overlay.go

@@ -131,9 +131,24 @@ func previousOrigins(origin Origin) []Origin {
 func displacedOrigins(node *document.Node, origins map[string]Origin, path Path) []displacedDefinition {
 	var displaced []displacedDefinition
 	collectDisplacedOrigins(&displaced, node, origins, path, Origin{})
-	slices.SortFunc(displaced, func(left, right displacedDefinition) int {
-		return strings.Compare(left.path.String(), right.path.String())
+	return sortDisplacedDefinitions(displaced)
+}
+
+func sortDisplacedDefinitions(displaced []displacedDefinition) []displacedDefinition {
+	type orderedDefinition struct {
+		definition displacedDefinition
+		pointer    string
+	}
+	ordered := make([]orderedDefinition, len(displaced))
+	for i, definition := range displaced {
+		ordered[i] = orderedDefinition{definition: definition, pointer: definition.path.String()}
+	}
+	slices.SortFunc(ordered, func(left, right orderedDefinition) int {
+		return strings.Compare(left.pointer, right.pointer)
 	})
+	for i, item := range ordered {
+		displaced[i] = item.definition
+	}
 	return displaced
 }
 

internal/engine/overlay_test.go

@@ -117,3 +117,26 @@ func TestOwnedOverlayKeepsCompositeContributorsAndAcquiredInputs(t *testing.T) {
 		t.Fatal("working tree mutation changed an acquired input")
 	}
 }
+
+func TestDisplacedOriginsSortEscapedPointers(t *testing.T) {
+	input := parseCompositionDocument(t, "source-1", `values:
+  z: old
+  a/b: slash
+  a~b: tilde
+  nested: {x: old}
+`)
+	composed, diagnostics := composeDocuments(input)
+	if len(diagnostics) != 0 {
+		t.Fatal(diagnostics)
+	}
+	displaced := displacedOrigins(composed.root, composed.origins, Path{})
+	want := []string{"", "/values", "/values/a~0b", "/values/a~1b", "/values/nested", "/values/nested/x", "/values/z"}
+	if len(displaced) != len(want) {
+		t.Fatalf("displaced definitions = %d, want %d", len(displaced), len(want))
+	}
+	for i, definition := range displaced {
+		if got := definition.path.String(); got != want[i] {
+			t.Fatalf("displaced[%d] path = %q, want %q", i, got, want[i])
+		}
+	}
+}

internal/engine/override.go

@@ -50,12 +50,16 @@ func prepareOverrides(base *composedDocument, sources []SourceInfo, overrides []
 	}
 
 	seen := make(map[string]int, len(overrides))
-	pathAccepted := make([]bool, len(overrides))
+	var acceptedPaths pathPrefixIndex
+	var baseLookup *documentLookup
+	if len(overrides) != 0 {
+		baseLookup = buildDocumentLookup(base.root)
+	}
 	var usedBytes int64
 	usedNodes := 0
 	for index, override := range overrides {
 		location := &Location{SourceID: prepared[index].source.ID}
-		if issue := validateOverridePath(override.Path, base.root); issue != nil {
+		if issue := validateOverridePath(override.Path, base.root, baseLookup); issue != nil {
 			issue.Primary = location
 			diagnostics = append(diagnostics, *issue)
 			continue
@@ -70,7 +74,7 @@ func prepareOverrides(base *composedDocument, sources []SourceInfo, overrides []
 			continue
 		}
 		seen[pointer] = index
-		if conflicting := overlappingOverride(overrides[:index], pathAccepted[:index], override.Path); conflicting >= 0 {
+		if conflicting, overlaps := acceptedPaths.earliestIntersectingID(pointer); overlaps {
 			diagnostics = append(diagnostics, Diagnostic{
 				Code: CodeOverrideOverlap, Severity: SeverityError, Path: override.Path.clone(),
 				Message: "configuration override paths overlap", Primary: location,
@@ -92,7 +96,7 @@ func prepareOverrides(base *composedDocument, sources []SourceInfo, overrides []
 			})
 			continue
 		}
-		pathAccepted[index] = true
+		acceptedPaths.insert(pointer, index)
 
 		builder := valueBuilder{sourceID: prepared[index].source.ID, active: make(map[valueVisit]bool)}
 		value, issue := builder.build(override.Value, override.Path, len(override.Path.segments))
@@ -150,7 +154,7 @@ func validOverrideLabel(label string) bool {
 	return true
 }
 
-func validateOverridePath(path Path, root *document.Node) *Diagnostic {
+func validateOverridePath(path Path, root *document.Node, lookup *documentLookup) *Diagnostic {
 	if !path.valid() || len(path.segments) == 0 {
 		return &Diagnostic{Code: CodeOverrideInvalidPath, Severity: SeverityError, Path: path.clone(), Message: "configuration override path must be a valid non-root mapping path"}
 	}
@@ -165,7 +169,7 @@ func validateOverridePath(path Path, root *document.Node) *Diagnostic {
 		if current.Kind != document.Mapping {
 			return &Diagnostic{Code: CodeOverrideInvalidPath, Severity: SeverityError, Path: path.clone(), Message: "configuration override path traverses a non-mapping value"}
 		}
-		position := documentEntryIndex(current.Mapping, segment.key)
+		position := lookup.find(current, segment.key)
 		if index == len(path.segments)-1 {
 			continue
 		}
@@ -178,15 +182,6 @@ func validateOverridePath(path Path, root *document.Node) *Diagnostic {
 	return nil
 }
 
-func overlappingOverride(previous []Override, valid []bool, path Path) int {
-	for index, override := range previous {
-		if valid[index] && (pathContains(override.Path, path) || pathContains(path, override.Path)) {
-			return index
-		}
-	}
-	return -1
-}
-
 func pathContainsDirective(path Path) bool {
 	for _, segment := range path.segments {
 		if segment.key == directiveKey {

internal/engine/override_apply.go

@@ -1,9 +1,6 @@
 package engine
 
 import (
-	"slices"
-	"strings"
-
 	"gitea.maximumdirect.net/eric/ConfigKit/internal/document"
 )
 
@@ -86,26 +83,28 @@ func applyPreparedOverride(result *composedDocument, override preparedOverride,
 }
 
 func affectedOverrideOrigins(existing, incoming *document.Node, origins map[string]Origin, path Path, index *mappingIndex) []displacedDefinition {
-	displaced := []displacedDefinition{{path: path.clone(), origin: cloneOrigin(origins[path.String()])}}
-	if existing.Kind == document.Mapping && incoming.Kind == document.Mapping {
-		for _, entry := range incoming.Mapping {
-			position := index.find(existing, entry.Key)
-			if position < 0 {
-				continue
-			}
-			childPath := path.Key(entry.Key)
-			childExisting := existing.Mapping[position].Value
-			if childExisting.Kind == document.Mapping && entry.Value.Kind == document.Mapping {
-				displaced = append(displaced, affectedOverrideOrigins(childExisting, entry.Value, origins, childPath, index)...)
-			} else {
-				displaced = append(displaced, displacedOrigins(childExisting, origins, childPath)...)
-			}
-		}
-	} else {
-		displaced = displacedOrigins(existing, origins, path)
-	}
-	slices.SortFunc(displaced, func(left, right displacedDefinition) int {
-		return strings.Compare(left.path.String(), right.path.String())
-	})
-	return displaced
+	var displaced []displacedDefinition
+	collectAffectedOverrideOrigins(&displaced, existing, incoming, origins, path, index)
+	return sortDisplacedDefinitions(displaced)
+}
+
+func collectAffectedOverrideOrigins(displaced *[]displacedDefinition, existing, incoming *document.Node, origins map[string]Origin, path Path, index *mappingIndex) {
+	if existing.Kind != document.Mapping || incoming.Kind != document.Mapping {
+		collectDisplacedOrigins(displaced, existing, origins, path, Origin{})
+		return
+	}
+	*displaced = append(*displaced, displacedDefinition{path: path.clone(), origin: cloneOrigin(origins[path.String()])})
+	for _, entry := range incoming.Mapping {
+		position := index.find(existing, entry.Key)
+		if position < 0 {
+			continue
+		}
+		childPath := path.Key(entry.Key)
+		childExisting := existing.Mapping[position].Value
+		if childExisting.Kind == document.Mapping && entry.Value.Kind == document.Mapping {
+			collectAffectedOverrideOrigins(displaced, childExisting, entry.Value, origins, childPath, index)
+		} else {
+			collectDisplacedOrigins(displaced, childExisting, origins, childPath, Origin{})
+		}
+	}
 }

internal/engine/override_test.go

@@ -206,6 +206,132 @@ func TestOverrideValidationRejectsPathsOverlapValuesAndProtectedTargets(t *testi
 	}
 }
 
+func TestOverrideOverlapIndexPreservesFirstAcceptedSource(t *testing.T) {
+	type config struct {
+		Nested map[string]any `yaml:"nested"`
+	}
+	base := Bytes("override-overlap.yml", []byte("nested: {}\n"))
+	_, err := testLoad(base, Options[config]{Overrides: []Override{
+		{Path: Keys("nested"), Value: map[string]any{}, Flag: "--nested"},
+		{Path: Keys("nested", "first"), Value: "one", Flag: "--first"},
+		{Path: Keys("nested", "second"), Value: "two", Flag: "--second"},
+	}})
+	if err == nil {
+		t.Fatal("load succeeded with overlapping overrides")
+	}
+	var loadErr *LoadError
+	if !errors.As(err, &loadErr) {
+		t.Fatalf("error = %T %v, want *LoadError", err, err)
+	}
+	diagnostics := loadErr.Diagnostics()
+	var conflicts []Diagnostic
+	for _, diagnostic := range diagnostics {
+		if diagnostic.Code == CodeOverrideOverlap {
+			conflicts = append(conflicts, diagnostic)
+		}
+	}
+	if len(conflicts) != 2 {
+		t.Fatalf("overlap diagnostics = %#v, want two conflicts", diagnostics)
+	}
+	for index, path := range []string{"/nested/first", "/nested/second"} {
+		if conflicts[index].Path.String() != path || len(conflicts[index].Related) != 1 || conflicts[index].Related[0].SourceID != "source-2" {
+			t.Fatalf("conflict[%d] = %#v, want path %q related to first CLI source", index, conflicts[index], path)
+		}
+	}
+}
+
+func TestOverrideOverlapIndexIncludesAcceptedPathWithInvalidValue(t *testing.T) {
+	type config struct {
+		Nested map[string]any `yaml:"nested"`
+	}
+	base := Bytes("override-value-overlap.yml", []byte("nested: {}\n"))
+	_, err := testLoad(base, Options[config]{Overrides: []Override{
+		{Path: Keys("nested"), Value: time.Second, Flag: "--nested"},
+		{Path: Keys("nested", "child"), Value: "value", Flag: "--child"},
+	}})
+	if err == nil {
+		t.Fatal("load succeeded with an invalid value and overlapping path")
+	}
+	var loadErr *LoadError
+	if !errors.As(err, &loadErr) {
+		t.Fatalf("error = %T %v, want *LoadError", err, err)
+	}
+	var invalidValue, overlap bool
+	for _, diagnostic := range loadErr.Diagnostics() {
+		switch diagnostic.Code {
+		case CodeOverrideInvalidValue:
+			invalidValue = diagnostic.Path.String() == "/nested"
+		case CodeOverrideOverlap:
+			overlap = diagnostic.Path.String() == "/nested/child" && len(diagnostic.Related) == 1 && diagnostic.Related[0].SourceID == "source-2"
+		}
+	}
+	if !invalidValue || !overlap {
+		t.Fatalf("diagnostics = %#v, want invalid parent value and child overlap related to its source", loadErr.Diagnostics())
+	}
+}
+
+func TestRejectedOverridePathDoesNotCauseOverlap(t *testing.T) {
+	type config struct {
+		Scalar string `yaml:"scalar"`
+	}
+	base := Bytes("override-rejected-overlap.yml", []byte("scalar: value\n"))
+	_, err := testLoad(base, Options[config]{Overrides: []Override{
+		{Path: Keys("scalar", "child"), Value: "invalid", Flag: "--child"},
+		{Path: Keys("scalar"), Value: "valid", Flag: "--scalar"},
+	}})
+	if err == nil {
+		t.Fatal("load succeeded with a path traversing a scalar")
+	}
+	var loadErr *LoadError
+	if !errors.As(err, &loadErr) {
+		t.Fatalf("error = %T %v, want *LoadError", err, err)
+	}
+	diagnostics := loadErr.Diagnostics()
+	if len(diagnostics) != 1 || diagnostics[0].Code != CodeOverrideInvalidPath || diagnostics[0].Path.String() != "/scalar/child" {
+		t.Fatalf("diagnostics = %#v, want only the invalid descendant path", diagnostics)
+	}
+}
+
+func TestVersionRejectedOverridePathDoesNotCauseOverlap(t *testing.T) {
+	type config struct {
+		Nested map[string]any `yaml:"nested"`
+	}
+	base := Bytes("override-version-overlap.yml", []byte("nested: {}\n"))
+	version := &VersionRule{Path: Keys("nested", "locked"), Check: func(Version, *Validation) error { return nil }}
+	_, err := testLoad(base, Options[config]{
+		Definition: Definition[config]{Version: version},
+		Overrides: []Override{
+			{Path: Keys("nested"), Value: map[string]any{}, Flag: "--nested"},
+			{Path: Keys("nested", "other"), Value: "allowed", Flag: "--other"},
+		},
+	})
+	if err == nil {
+		t.Fatal("load succeeded despite an override of a schema-version ancestor")
+	}
+	var loadErr *LoadError
+	if !errors.As(err, &loadErr) {
+		t.Fatalf("error = %T %v, want *LoadError", err, err)
+	}
+	diagnostics := loadErr.Diagnostics()
+	if len(diagnostics) != 1 || diagnostics[0].Code != CodeOverrideVersion || diagnostics[0].Path.String() != "/nested" {
+		t.Fatalf("diagnostics = %#v, want only the protected ancestor path", diagnostics)
+	}
+}
+
+func TestEscapedOverrideKeysStayDistinctFromMultipleSegments(t *testing.T) {
+	type config struct {
+		Nested map[string]any `yaml:"nested"`
+	}
+	base := Bytes("override-escaped-keys.yml", []byte("nested: {}\n"))
+	_, err := testLoad(base, Options[config]{Overrides: []Override{
+		{Path: Keys("nested", "a/b"), Value: "single key", Flag: "--single"},
+		{Path: Keys("nested", "a", "b"), Value: "nested key", Flag: "--nested"},
+	}})
+	if err != nil {
+		t.Fatalf("load rejected distinct escaped path tokens: %v", err)
+	}
+}
+
 func TestOverrideCannotReplaceSchemaVersionAncestor(t *testing.T) {
 	type schemaConfig struct {
 		Version string `yaml:"version"`
@@ -271,6 +397,43 @@ func TestOverrideEqualReplacementStillAppearsInHistory(t *testing.T) {
 	}
 }
 
+func TestAffectedOverrideOriginsSortEscapedPointers(t *testing.T) {
+	existingInput := parseCompositionDocument(t, "source-1", `values:
+  z: old
+  a/b: slash
+  a~b: tilde
+  nested: {x: old}
+`)
+	existing, diagnostics := composeDocuments(existingInput)
+	if len(diagnostics) != 0 {
+		t.Fatal(diagnostics)
+	}
+	incoming := parseCompositionDocument(t, "source-2", `values:
+  z: new
+  a/b: new
+  a~b: new
+  nested: {x: new}
+`)
+	existingValues, ok := documentAtPath(existing.root, Keys("values"))
+	if !ok {
+		t.Fatal("existing values mapping is missing")
+	}
+	incomingValues, ok := documentAtPath(incoming, Keys("values"))
+	if !ok {
+		t.Fatal("incoming values mapping is missing")
+	}
+	displaced := affectedOverrideOrigins(existingValues, incomingValues, existing.origins, Keys("values"), &mappingIndex{})
+	want := []string{"/values", "/values/a~0b", "/values/a~1b", "/values/nested", "/values/nested/x", "/values/z"}
+	if len(displaced) != len(want) {
+		t.Fatalf("displaced definitions = %d, want %d", len(displaced), len(want))
+	}
+	for i, definition := range displaced {
+		if got := definition.path.String(); got != want[i] {
+			t.Fatalf("displaced[%d] path = %q, want %q", i, got, want[i])
+		}
+	}
+}
+
 func TestOverrideAggregateLimitsFailBeforeApplication(t *testing.T) {
 	base, diagnostics := composeDocuments(&document.Node{Kind: document.Mapping})
 	if len(diagnostics) != 0 {

internal/engine/path.go

@@ -86,7 +86,20 @@ func (p Path) String() string {
 		return ""
 	}
 
+	// Include each separator and the extra byte introduced by escaping a token.
+	// Use stack storage for sizing indexes without allocating another string.
+	size := len(p.segments)
+	var indexText [20]byte
+	for _, segment := range p.segments {
+		if segment.kind == pathSegmentIndex {
+			size += len(strconv.AppendInt(indexText[:0], int64(segment.index), 10))
+		} else {
+			size += len(segment.key) + strings.Count(segment.key, "~") + strings.Count(segment.key, "/")
+		}
+	}
+
 	var b strings.Builder
+	b.Grow(size)
 	for _, segment := range p.segments {
 		b.WriteByte('/')
 		if segment.kind == pathSegmentIndex {
@@ -115,6 +128,33 @@ func clonePathSegments(segments []pathSegment, extra int) []pathSegment {
 	return cloned
 }
 
+func pathTokenSpellingEqual(left, right pathSegment) bool {
+	switch {
+	case left.kind == pathSegmentIndex && right.kind == pathSegmentIndex:
+		return left.index == right.index
+	case left.kind == pathSegmentIndex:
+		return pathIndexSpellingEqual(left.index, right.key)
+	case right.kind == pathSegmentIndex:
+		return pathIndexSpellingEqual(right.index, left.key)
+	default:
+		return left.key == right.key
+	}
+}
+
+func pathIndexSpellingEqual(index int, token string) bool {
+	var scratch [20]byte
+	spelling := strconv.AppendInt(scratch[:0], int64(index), 10)
+	if len(spelling) != len(token) {
+		return false
+	}
+	for i, character := range spelling {
+		if character != token[i] {
+			return false
+		}
+	}
+	return true
+}
+
 func escapePathToken(token string) string {
 	token = strings.ReplaceAll(token, "~", "~0")
 	return strings.ReplaceAll(token, "/", "~1")

internal/engine/path_prefix.go

@@ -0,0 +1,138 @@
+package engine
+
+type pathPrefixIndex struct {
+	root pathPrefixNode
+}
+
+type pathPrefixNode struct {
+	children   map[string]*pathPrefixNode
+	ids        []int
+	minimumID  int
+	hasMinimum bool
+}
+
+func (node *pathPrefixNode) includeID(id int) {
+	if !node.hasMinimum || id < node.minimumID {
+		node.minimumID = id
+		node.hasMinimum = true
+	}
+}
+
+func (index *pathPrefixIndex) insert(pointer string, id int) {
+	node := &index.root
+	node.includeID(id)
+	visitCanonicalPointerTokens(pointer, func(token string) bool {
+		if node.children == nil {
+			node.children = make(map[string]*pathPrefixNode)
+		}
+		child := node.children[token]
+		if child == nil {
+			child = &pathPrefixNode{}
+			node.children[token] = child
+		}
+		node = child
+		node.includeID(id)
+		return true
+	})
+	node.ids = append(node.ids, id)
+}
+
+func (index *pathPrefixIndex) visitAncestors(pointer string, visit func(int)) {
+	node := &index.root
+	for _, id := range node.ids {
+		visit(id)
+	}
+	visitCanonicalPointerTokens(pointer, func(token string) bool {
+		child := node.children[token]
+		if child == nil {
+			return false
+		}
+		node = child
+		for _, id := range node.ids {
+			visit(id)
+		}
+		return true
+	})
+}
+
+func (index *pathPrefixIndex) visitDescendants(pointer string, visit func(int)) {
+	root := index.nodeAt(pointer)
+	if root == nil {
+		return
+	}
+	var walk func(*pathPrefixNode)
+	walk = func(node *pathPrefixNode) {
+		for _, id := range node.ids {
+			visit(id)
+		}
+		for _, child := range node.children {
+			walk(child)
+		}
+	}
+	walk(root)
+}
+
+func (index *pathPrefixIndex) earliestIntersectingID(pointer string) (int, bool) {
+	bestID, found := 0, false
+	consider := func(id int) {
+		if !found || id < bestID {
+			bestID = id
+			found = true
+		}
+	}
+	node := &index.root
+	for _, id := range node.ids {
+		consider(id)
+	}
+	complete := visitCanonicalPointerTokens(pointer, func(token string) bool {
+		child := node.children[token]
+		if child == nil {
+			return false
+		}
+		node = child
+		for _, id := range node.ids {
+			consider(id)
+		}
+		return true
+	})
+	if complete && node.hasMinimum {
+		consider(node.minimumID)
+	}
+	return bestID, found
+}
+
+func (index *pathPrefixIndex) nodeAt(pointer string) *pathPrefixNode {
+	node := &index.root
+	complete := visitCanonicalPointerTokens(pointer, func(token string) bool {
+		child := node.children[token]
+		if child == nil {
+			return false
+		}
+		node = child
+		return true
+	})
+	if !complete {
+		return nil
+	}
+	return node
+}
+
+func visitCanonicalPointerTokens(pointer string, visit func(string) bool) bool {
+	if pointer == "" {
+		return true
+	}
+	start := 1
+	for {
+		end := start
+		for end < len(pointer) && pointer[end] != '/' {
+			end++
+		}
+		if !visit(pointer[start:end]) {
+			return false
+		}
+		if end == len(pointer) {
+			return true
+		}
+		start = end + 1
+	}
+}

internal/engine/path_prefix_test.go

@@ -0,0 +1,81 @@
+package engine
+
+import (
+	"slices"
+	"strings"
+	"testing"
+)
+
+func TestPathPrefixIndexMatchesPointerScans(t *testing.T) {
+	entries := []struct {
+		pointer string
+		id      int
+	}{
+		{pointer: "", id: 12},
+		{pointer: "/", id: 9},
+		{pointer: "/a", id: 6},
+		{pointer: "/a", id: 2},
+		{pointer: "/a/b", id: 4},
+		{pointer: "/a/b/c", id: 0},
+		{pointer: "/a/bc", id: 10},
+		{pointer: "/a~1b", id: 3},
+		{pointer: "/a~0b", id: 1},
+		{pointer: "/a~01b", id: 5},
+		{pointer: "/items/0", id: 8},
+		{pointer: "/items/01", id: 7},
+		{pointer: "/items/+1", id: 11},
+	}
+	var index pathPrefixIndex
+	for _, entry := range entries {
+		index.insert(entry.pointer, entry.id)
+	}
+	queries := []string{
+		"", "/", "/a", "/a/b", "/a/b/c", "/a/b/c/d", "/a/bc", "/a/bc/d",
+		"/a~1b", "/a~0b", "/a~01b", "/items", "/items/0", "/items/01", "/items/1", "/missing",
+	}
+	for _, query := range queries {
+		gotAncestors := make([]int, 0)
+		index.visitAncestors(query, func(id int) { gotAncestors = append(gotAncestors, id) })
+		wantAncestors := make([]int, 0)
+		gotDescendants := make([]int, 0)
+		wantDescendants := make([]int, 0)
+		wantEarliest, foundEarliest := 0, false
+		for _, entry := range entries {
+			if pointerContainsByString(entry.pointer, query) {
+				wantAncestors = append(wantAncestors, entry.id)
+			}
+			if pointerContainsByString(query, entry.pointer) {
+				wantDescendants = append(wantDescendants, entry.id)
+			}
+			if pointerContainsByString(entry.pointer, query) || pointerContainsByString(query, entry.pointer) {
+				if !foundEarliest || entry.id < wantEarliest {
+					wantEarliest, foundEarliest = entry.id, true
+				}
+			}
+		}
+		index.visitDescendants(query, func(id int) { gotDescendants = append(gotDescendants, id) })
+		if !slices.Equal(sortedPrefixIDs(gotAncestors), sortedPrefixIDs(wantAncestors)) {
+			t.Errorf("ancestors(%q) = %v, want %v", query, sortedPrefixIDs(gotAncestors), sortedPrefixIDs(wantAncestors))
+		}
+		if !slices.Equal(sortedPrefixIDs(gotDescendants), sortedPrefixIDs(wantDescendants)) {
+			t.Errorf("descendants(%q) = %v, want %v", query, sortedPrefixIDs(gotDescendants), sortedPrefixIDs(wantDescendants))
+		}
+		gotEarliest, gotFound := index.earliestIntersectingID(query)
+		if gotEarliest != wantEarliest || gotFound != foundEarliest {
+			t.Errorf("earliestIntersectingID(%q) = %d, %v, want %d, %v", query, gotEarliest, gotFound, wantEarliest, foundEarliest)
+		}
+	}
+}
+
+func pointerContainsByString(container, descendant string) bool {
+	if container == "" {
+		return true
+	}
+	return descendant == container || strings.HasPrefix(descendant, container+"/")
+}
+
+func sortedPrefixIDs(ids []int) []int {
+	result := slices.Clone(ids)
+	slices.Sort(result)
+	return result
+}

internal/engine/path_test.go

@@ -1,6 +1,9 @@
 package engine
 
-import "testing"
+import (
+	"strconv"
+	"testing"
+)
 
 func TestPathRoundTripsSemanticKeys(t *testing.T) {
 	t.Parallel()
@@ -36,6 +39,73 @@ func TestPathRoundTripsSemanticKeys(t *testing.T) {
 	if got := Keys("items").Index(12).Key("name").String(); got != "/items/12/name" {
 		t.Fatalf("indexed path = %q", got)
 	}
+	maximum := int(^uint(0) >> 1)
+	for _, index := range []int{100, maximum, -1, -maximum - 1} {
+		want := "/items/" + strconv.Itoa(index)
+		if got := Keys("items").Index(index).String(); got != want {
+			t.Fatalf("indexed path = %q, want %q", got, want)
+		}
+	}
+}
+
+func TestPathContainmentMatchesPointerSpelling(t *testing.T) {
+	parse := func(pointer string) Path {
+		path, err := ParsePath(pointer)
+		if err != nil {
+			t.Fatalf("ParsePath(%q) error = %v", pointer, err)
+		}
+		return path
+	}
+	maximum := int(^uint(0) >> 1)
+	minimum := -maximum - 1
+	paths := []Path{
+		{},
+		Keys(""),
+		Keys("a"),
+		Keys("ab"),
+		Keys("a", "b"),
+		Keys("a/b"),
+		Keys("a~1b"),
+		Keys("~"),
+		Keys("0"),
+		Keys("01"),
+		Keys("+1"),
+		Keys("items").Index(0),
+		Keys("items").Index(maximum),
+		Keys("items").Index(minimum),
+		parse("/"),
+		parse("/a~1b"),
+		parse("/a~01b"),
+		parse("/~0"),
+		parse("/0"),
+		parse("/01"),
+		parse("/+1"),
+		parse("/items/0"),
+		parse("/items/" + strconv.Itoa(maximum)),
+		parse("/items/" + strconv.Itoa(minimum)),
+		Path{}.Index(-1),
+	}
+	for _, container := range paths {
+		for _, descendant := range paths {
+			got := pathContains(container, descendant)
+			want := pathContainsByPointer(container, descendant)
+			if got != want {
+				t.Errorf("pathContains(%q, %q) = %v, want %v", container.String(), descendant.String(), got, want)
+			}
+		}
+	}
+}
+
+func pathContainsByPointer(container, descendant Path) bool {
+	if !container.valid() || !descendant.valid() || len(container.segments) > len(descendant.segments) {
+		return false
+	}
+	prefix := container.String()
+	if prefix == "" {
+		return true
+	}
+	value := descendant.String()
+	return value == prefix || len(value) > len(prefix) && value[:len(prefix)] == prefix && value[len(prefix)] == '/'
 }
 
 func TestPathPreservesSegmentIntentAndImmutability(t *testing.T) {

internal/engine/projection_test.go

@@ -357,6 +357,21 @@ func TestCompareDocumentTreesTracksSemanticChanges(t *testing.T) {
 	}
 }
 
+func TestCompareConfigurationValuesSortEscapedPointers(t *testing.T) {
+	before := parseCompositionDocument(t, "before", `values: {z: old, 'a/b': old, 'a~b': old, nested: {x: old}}`)
+	after := parseCompositionDocument(t, "after", `values: {z: new, 'a/b': new, 'a~b': new, nested: {x: new}}`)
+	deltas := compareConfigurationValues(before, after)
+	want := []string{"/values/a~0b", "/values/a~1b", "/values/nested/x", "/values/z"}
+	if len(deltas) != len(want) {
+		t.Fatalf("deltas = %#v", deltas)
+	}
+	for i, delta := range deltas {
+		if got := delta.path.String(); got != want[i] {
+			t.Fatalf("delta[%d] path = %q, want %q", i, got, want[i])
+		}
+	}
+}
+
 func mustSchemaFor[T any](t *testing.T) *schemaDescriptor {
 	t.Helper()
 	schema, issue := testBuildSchema(reflect.TypeFor[T]())

internal/engine/records.go

@@ -186,6 +186,7 @@ type SourceInfo struct {
 	ID            string
 	Label         string
 	Path          string
+	Destination   Path
 	Layer         Layer
 	Kind          SourceKind
 	UnderlayIndex int
@@ -260,6 +261,7 @@ func cloneLocations(locations []Location) []Location {
 
 func cloneSourceInfo(source SourceInfo) SourceInfo {
 	source.ImportedFrom = cloneLocation(source.ImportedFrom)
+	source.Destination = source.Destination.clone()
 	return source
 }
 

internal/engine/resolution.go

@@ -26,6 +26,37 @@ type resolutionRecord struct {
 	reasons        []string
 	dependencies   []Path
 	helperExpected *document.Node
+	reasonSet      map[string]struct{}
+	dependencySet  map[string]struct{}
+}
+
+func (record *resolutionRecord) addReason(reason string) {
+	if record.reasonSet == nil {
+		record.reasonSet = make(map[string]struct{}, len(record.reasons)+1)
+		for _, existing := range record.reasons {
+			record.reasonSet[existing] = struct{}{}
+		}
+	}
+	if _, found := record.reasonSet[reason]; found {
+		return
+	}
+	record.reasonSet[reason] = struct{}{}
+	record.reasons = append(record.reasons, reason)
+}
+
+func (record *resolutionRecord) addDependency(path Path) {
+	pointer := path.String()
+	if record.dependencySet == nil {
+		record.dependencySet = make(map[string]struct{}, len(record.dependencies)+1)
+		for _, existing := range record.dependencies {
+			record.dependencySet[existing.String()] = struct{}{}
+		}
+	}
+	if _, found := record.dependencySet[pointer]; found {
+		return
+	}
+	record.dependencySet[pointer] = struct{}{}
+	record.dependencies = append(record.dependencies, path.clone())
 }
 
 type resolutionSnapshot struct {
@@ -207,9 +238,9 @@ func (state *resolutionState) addRecord(path Path, kind ChangeKind, reason strin
 	if kind == ChangeNormalization {
 		record.kind = ChangeNormalization
 	}
-	record.reasons = appendUniqueString(record.reasons, reason)
+	record.addReason(reason)
 	for _, dependency := range dependencies {
-		record.dependencies = appendUniquePath(record.dependencies, dependency)
+		record.addDependency(dependency)
 	}
 	if expected != nil {
 		record.helperExpected = document.Clone(expected)
@@ -272,14 +303,17 @@ func runResolution[T any](configuration *T, resolver func(*T, *Resolution) error
 	}
 	deltas := compareConfigurationValues(decoded.final, after)
 	ordered := orderedResolutionRecords(state.records)
+	coverage := newResolutionCoverageIndexFromRecords(ordered)
+	beforeLookup := buildDocumentLookup(decoded.final)
+	afterLookup := buildDocumentLookup(after)
 	for _, delta := range deltas {
-		if coveringResolutionRecord(ordered, delta.path) == nil {
+		if _, ok := coverage.deepestCoveringID(delta.path); !ok {
 			state.addDiagnostic(CodeResolveUnrecordedChange, delta.path, "application resolution changed a value without a covering record")
 		}
 	}
 	for _, record := range ordered {
-		_, beforePresent := documentAtPath(decoded.final, record.path)
-		afterNode, afterPresent := documentAtPath(after, record.path)
+		_, beforePresent := documentAtPathWithLookup(decoded.final, record.path, beforeLookup)
+		afterNode, afterPresent := documentAtPathWithLookup(after, record.path, afterLookup)
 		if !beforePresent && !afterPresent {
 			state.addDiagnostic(CodeResolveInvalidRecord, record.path, "resolution record does not identify an existing or removed value")
 			continue
@@ -294,8 +328,8 @@ func runResolution[T any](configuration *T, resolver func(*T, *Resolution) error
 
 	snapshots := make([]resolutionSnapshot, 0, len(ordered))
 	for _, record := range ordered {
-		beforeNode, _ := documentAtPath(decoded.final, record.path)
-		afterNode, _ := documentAtPath(after, record.path)
+		beforeNode, _ := documentAtPathWithLookup(decoded.final, record.path, beforeLookup)
+		afterNode, _ := documentAtPathWithLookup(after, record.path, afterLookup)
 		snapshots = append(snapshots, resolutionSnapshot{
 			change: Change{
 				Path:         record.path.clone(),
@@ -313,52 +347,82 @@ func runResolution[T any](configuration *T, resolver func(*T, *Resolution) error
 }
 
 func orderedResolutionRecords(records map[string]*resolutionRecord) []*resolutionRecord {
-	ordered := make([]*resolutionRecord, 0, len(records))
-	for _, record := range records {
-		ordered = append(ordered, record)
+	type orderedRecord struct {
+		record  *resolutionRecord
+		pointer string
 	}
-	slices.SortFunc(ordered, func(left, right *resolutionRecord) int {
-		return strings.Compare(left.path.String(), right.path.String())
+	ordered := make([]orderedRecord, 0, len(records))
+	for _, record := range records {
+		ordered = append(ordered, orderedRecord{record: record, pointer: record.path.String()})
+	}
+	slices.SortFunc(ordered, func(left, right orderedRecord) int {
+		return strings.Compare(left.pointer, right.pointer)
 	})
-	return ordered
+	result := make([]*resolutionRecord, len(ordered))
+	for i, item := range ordered {
+		result[i] = item.record
+	}
+	return result
 }
 
-func coveringResolutionRecord(records []*resolutionRecord, path Path) *resolutionRecord {
-	var covering *resolutionRecord
-	for _, record := range records {
-		if pathContains(record.path, path) && (covering == nil || len(record.path.segments) > len(covering.path.segments)) {
-			covering = record
+type resolutionCoverageIndex struct {
+	prefix pathPrefixIndex
+	depths []int
+}
+
+func newResolutionCoverageIndexFromRecords(records []*resolutionRecord) *resolutionCoverageIndex {
+	index := &resolutionCoverageIndex{depths: make([]int, len(records))}
+	for id, record := range records {
+		index.depths[id] = len(record.path.segments)
+		if record.path.valid() {
+			index.prefix.insert(record.path.String(), id)
 		}
 	}
-	return covering
+	return index
+}
+
+func newResolutionCoverageIndexFromSnapshots(snapshots []resolutionSnapshot) (*resolutionCoverageIndex, []string) {
+	index := &resolutionCoverageIndex{depths: make([]int, len(snapshots))}
+	pointers := make([]string, len(snapshots))
+	for id, snapshot := range snapshots {
+		path := snapshot.change.Path
+		index.depths[id] = len(path.segments)
+		pointers[id] = path.String()
+		if path.valid() {
+			index.prefix.insert(pointers[id], id)
+		}
+	}
+	return index, pointers
+}
+
+func (index *resolutionCoverageIndex) deepestCoveringID(path Path) (int, bool) {
+	if !path.valid() {
+		return 0, false
+	}
+	return index.deepestCoveringPointerID(path.String())
+}
+
+func (index *resolutionCoverageIndex) deepestCoveringPointerID(pointer string) (int, bool) {
+	bestID, bestDepth, found := 0, -1, false
+	index.prefix.visitAncestors(pointer, func(id int) {
+		depth := index.depths[id]
+		if !found || depth > bestDepth || (depth == bestDepth && id < bestID) {
+			bestID, bestDepth, found = id, depth, true
+		}
+	})
+	return bestID, found
 }
 
 func pathContains(container, descendant Path) bool {
 	if !container.valid() || !descendant.valid() || len(container.segments) > len(descendant.segments) {
 		return false
 	}
-	if container.String() == "" {
-		return true
-	}
-	prefix := container.String()
-	value := descendant.String()
-	return value == prefix || strings.HasPrefix(value, prefix+"/")
-}
-
-func appendUniqueString(values []string, value string) []string {
-	if !slices.Contains(values, value) {
-		return append(values, value)
-	}
-	return values
-}
-
-func appendUniquePath(paths []Path, path Path) []Path {
-	for _, existing := range paths {
-		if existing.String() == path.String() {
-			return paths
+	for i, segment := range container.segments {
+		if !pathTokenSpellingEqual(segment, descendant.segments[i]) {
+			return false
 		}
 	}
-	return append(paths, path.clone())
+	return true
 }
 
 func clonePaths(paths []Path) []Path {

internal/engine/resolution_index_test.go

@@ -0,0 +1,247 @@
+package engine
+
+import (
+	"reflect"
+	"slices"
+	"testing"
+
+	"gitea.maximumdirect.net/eric/ConfigKit/internal/document"
+)
+
+func TestCoalescedResolutionSnapshotsMatchOrderedScan(t *testing.T) {
+	parsedDependency := parseOverrideTestPath(t, "/dependencies/item")
+	snapshots := []resolutionSnapshot{
+		{change: Change{Path: Keys("a", "b"), Reasons: []string{"child", "shared", "child"}, Dependencies: []Path{Keys("dependencies", "item")}, Origin: Origin{Operation: ChangeDerivedDefault}}},
+		{change: Change{Path: Keys("a", "c"), Reasons: []string{"other"}, Dependencies: []Path{Keys("other")}, Origin: Origin{Operation: ChangeDerivedDefault}}},
+		{change: Change{Path: Keys("a"), Reasons: []string{"parent"}, Dependencies: []Path{Keys("parent")}, Origin: Origin{Operation: ChangeDerivedDefault}}},
+		{change: Change{Path: Keys("a", "b", "grand"), Reasons: []string{"deep", "shared"}, Dependencies: []Path{parsedDependency, Keys("deep")}, Origin: Origin{Operation: ChangeDerivedDefault}}},
+		{change: Change{Path: Path{}, Reasons: []string{"root"}, Origin: Origin{Operation: ChangeDerivedDefault}}},
+		{change: Change{Path: Keys("outside"), Reasons: []string{"root child"}, Origin: Origin{Operation: ChangeDerivedDefault}}},
+		{change: Change{Path: Keys("a", "b", "normalization"), Reasons: []string{"normalized"}, Origin: Origin{Operation: ChangeNormalization}}},
+		{change: Change{Path: Keys("a", "none"), Reasons: []string{"parent child"}, Origin: Origin{Operation: ChangeDerivedDefault}}},
+	}
+	want := coalescedResolutionSnapshotsByScan(snapshots)
+	got := coalescedResolutionSnapshots(snapshots)
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("coalesced snapshots differ from ordered scan:\n got: %#v\nwant: %#v", got, want)
+	}
+	if len(got) != 4 || got[0].change.Origin.Operation != ChangeNormalization ||
+		!reflect.DeepEqual(got[0].change.Reasons, []string{"child", "shared", "child", "deep", "normalized"}) ||
+		len(got[0].change.Dependencies) != 2 || got[3].change.Path.String() != "" {
+		t.Fatalf("coalesced ordering or unions changed: %#v", got)
+	}
+}
+
+func coalescedResolutionSnapshotsByScan(snapshots []resolutionSnapshot) []resolutionSnapshot {
+	groups := make([]resolutionSnapshot, 0, len(snapshots))
+	for _, snapshot := range snapshots {
+		merged := false
+		for i := range groups {
+			if !pathContainsByPointer(groups[i].change.Path, snapshot.change.Path) {
+				continue
+			}
+			for _, reason := range snapshot.change.Reasons {
+				groups[i].change.Reasons = appendUniqueStringByScan(groups[i].change.Reasons, reason)
+			}
+			for _, dependency := range snapshot.change.Dependencies {
+				groups[i].change.Dependencies = appendUniquePathByPointer(groups[i].change.Dependencies, dependency)
+			}
+			if snapshot.change.Origin.Operation == ChangeNormalization {
+				groups[i].change.Origin.Operation = ChangeNormalization
+			}
+			merged = true
+			break
+		}
+		if !merged {
+			snapshot.change = cloneChange(snapshot.change)
+			groups = append(groups, snapshot)
+		}
+	}
+	return groups
+}
+
+func appendUniqueStringByScan(values []string, value string) []string {
+	if !slices.Contains(values, value) {
+		return append(values, value)
+	}
+	return values
+}
+
+func appendUniquePathByPointer(paths []Path, path Path) []Path {
+	for _, existing := range paths {
+		if existing.String() == path.String() {
+			return paths
+		}
+	}
+	return append(paths, path.clone())
+}
+
+func TestResolutionDependencyMembershipMatchesPointerSpelling(t *testing.T) {
+	parse := func(pointer string) Path {
+		path, err := ParsePath(pointer)
+		if err != nil {
+			t.Fatalf("ParsePath(%q) error = %v", pointer, err)
+		}
+		return path
+	}
+	paths := []Path{
+		Keys("a/b"), parse("/a~1b"),
+		Keys("a~1b"), parse("/a~01b"),
+		Keys("items").Index(0), parse("/items/0"), Keys("items", "0"),
+		Keys("items", "01"), parse("/items/01"),
+		Keys("-1"), parse("/-1"),
+		Keys("a", "b"), Keys("a/b"),
+	}
+	var record resolutionRecord
+	var want []Path
+	for _, path := range paths {
+		record.addDependency(path)
+		want = appendUniquePathByPointer(want, path)
+	}
+	if !reflect.DeepEqual(record.dependencies, want) {
+		t.Fatalf("resolution dependencies = %#v, want %#v", record.dependencies, want)
+	}
+}
+
+func TestResolutionCoverageIndexMatchesOrderedScan(t *testing.T) {
+	paths := []Path{
+		Keys("group"),
+		Keys("group", "field"),
+		Keys("group", "field"),
+		Keys("group", "field", "nested"),
+		Keys("other"),
+	}
+	records := make([]*resolutionRecord, len(paths))
+	snapshots := make([]resolutionSnapshot, len(paths))
+	for id, path := range paths {
+		records[id] = &resolutionRecord{path: path}
+		snapshots[id] = resolutionSnapshot{change: Change{Path: path}}
+	}
+	snapshotIndex, pointers := newResolutionCoverageIndexFromSnapshots(snapshots)
+	for id, pointer := range pointers {
+		if pointer != paths[id].String() {
+			t.Errorf("snapshot pointer %d = %q, want %q", id, pointer, paths[id].String())
+		}
+	}
+	queries := []Path{
+		Path{},
+		Keys("group"),
+		Keys("group", "field"),
+		Keys("group", "field", "nested", "leaf"),
+		Keys("group", "missing"),
+		Keys("other", "child"),
+		Keys("group").Index(-1),
+	}
+	for _, test := range []struct {
+		name  string
+		index *resolutionCoverageIndex
+	}{
+		{"records", newResolutionCoverageIndexFromRecords(records)},
+		{"snapshots", snapshotIndex},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			for _, query := range queries {
+				wantID, wantDepth, wantFound := 0, -1, false
+				for id, candidate := range paths {
+					if pathContainsByPointer(candidate, query) && (!wantFound || len(candidate.segments) > wantDepth) {
+						wantID, wantDepth, wantFound = id, len(candidate.segments), true
+					}
+				}
+				gotID, gotFound := test.index.deepestCoveringID(query)
+				if gotID != wantID || gotFound != wantFound {
+					t.Errorf("deepestCoveringID(%s) = %d, %v; want %d, %v", query.String(), gotID, gotFound, wantID, wantFound)
+				}
+			}
+		})
+	}
+}
+
+func TestDocumentLookupMatchesPathScan(t *testing.T) {
+	name := &document.Node{Kind: document.String, Text: "item"}
+	sequence := &document.Node{Kind: document.Sequence, Sequence: []*document.Node{
+		{Kind: document.String, Text: "zero"},
+		{Kind: document.Mapping, Mapping: []document.Entry{{Key: "name", Value: name}}},
+	}}
+	root := &document.Node{Kind: document.Mapping, Mapping: []document.Entry{
+		{Key: "0", Value: &document.Node{Kind: document.String, Text: "numeric key"}},
+		{Key: "01", Value: &document.Node{Kind: document.String, Text: "leading zero key"}},
+		{Key: "items", Value: sequence},
+	}}
+	applicationRoot := &document.Node{Kind: document.Mapping, Mapping: []document.Entry{
+		{Key: "shared", Value: sequence},
+		{Key: "application", Value: &document.Node{Kind: document.Mapping, Mapping: []document.Entry{{Key: "value", Value: &document.Node{Kind: document.String, Text: "application"}}}}},
+	}}
+	lookup := buildDocumentLookup(root, applicationRoot)
+	paths := []Path{
+		Path{},
+		Keys("0"),
+		Keys("01"),
+		Keys("items"),
+		Keys("items").Index(0),
+		Keys("items").Index(1).Key("name"),
+		Keys("items").Index(2),
+		Keys("items").Key("name"),
+		Keys("missing"),
+		Keys("items").Index(-1),
+		(Path{}).Index(0),
+	}
+	for _, path := range paths {
+		wantNode, wantFound := documentAtPath(root, path)
+		gotNode, gotFound := documentAtPathWithLookup(root, path, lookup)
+		if gotNode != wantNode || gotFound != wantFound {
+			t.Errorf("indexed lookup %s = (%p, %v), want (%p, %v)", path.String(), gotNode, gotFound, wantNode, wantFound)
+		}
+	}
+	for _, path := range []Path{Path{}, Keys("shared"), Keys("shared").Index(1).Key("name"), Keys("application", "value")} {
+		wantNode, wantFound := documentAtPath(applicationRoot, path)
+		gotNode, gotFound := documentAtPathWithLookup(applicationRoot, path, lookup)
+		if gotNode != wantNode || gotFound != wantFound {
+			t.Errorf("indexed application lookup %s = (%p, %v), want (%p, %v)", path.String(), gotNode, gotFound, wantNode, wantFound)
+		}
+	}
+}
+
+func TestApplyResolutionMetadataPreservesOverlappingDeltaOrder(t *testing.T) {
+	oldOrigin := Origin{Layer: LayerBase}
+	parentOrigin := Origin{Layer: LayerResolution, Operation: ChangeNormalization}
+	childOrigin := Origin{Layer: LayerResolution, Operation: ChangeDerivedDefault}
+	leaf := &document.Node{Kind: document.String, Text: "value"}
+	final := &document.Node{Kind: document.Mapping, Mapping: []document.Entry{{
+		Key: "group",
+		Value: &document.Node{Kind: document.Mapping, Mapping: []document.Entry{{
+			Key:   "item",
+			Value: &document.Node{Kind: document.Mapping, Mapping: []document.Entry{{Key: "leaf", Value: leaf}}},
+		}}},
+	}}}
+	metadata := &Metadata{
+		fields:  map[string]FieldInfo{"/group/item/leaf": {Origin: oldOrigin}},
+		history: make(map[string][]Change),
+	}
+	resolved := resolutionResult{
+		final:  final,
+		deltas: []documentDelta{{path: Keys("group")}, {path: Keys("group", "item")}},
+		snapshots: []resolutionSnapshot{
+			{change: Change{Path: Keys("group"), Origin: parentOrigin}},
+			{change: Change{Path: Keys("group", "item"), Origin: childOrigin}},
+		},
+	}
+
+	applyResolutionMetadata(metadata, resolved)
+
+	field := metadata.fields["/group/item/leaf"]
+	if field.Origin.Operation != childOrigin.Operation {
+		t.Fatalf("final leaf origin operation = %q, want %q", field.Origin.Operation, childOrigin.Operation)
+	}
+	changes := metadata.history["/group/item/leaf"]
+	if len(changes) != 2 {
+		t.Fatalf("leaf history has %d entries, want 2: %#v", len(changes), changes)
+	}
+	if changes[0].Origin.Operation != parentOrigin.Operation || changes[1].Origin.Operation != childOrigin.Operation {
+		t.Fatalf("leaf history operations = %q, %q; want %q, %q", changes[0].Origin.Operation, changes[1].Origin.Operation, parentOrigin.Operation, childOrigin.Operation)
+	}
+	for index, change := range changes {
+		if len(change.Previous) != 1 || change.Previous[0].Layer != oldOrigin.Layer {
+			t.Errorf("leaf history[%d] Previous = %#v, want original origin", index, change.Previous)
+		}
+	}
+}

internal/engine/resolution_test.go

@@ -122,6 +122,11 @@ func TestResolutionPreservesExplicitNullAndZeroWhileReplacingAbsentBaseline(t *t
 func TestResolutionCoalescesEqualAndRepeatedHelperIntent(t *testing.T) {
 	t.Parallel()
 
+	parsedOther, err := ParsePath("/other")
+	if err != nil {
+		t.Fatal(err)
+	}
+
 	type config struct {
 		Value int `yaml:"value"`
 		Other int `yaml:"other"`
@@ -130,8 +135,9 @@ func TestResolutionCoalescesEqualAndRepeatedHelperIntent(t *testing.T) {
 		Defaults: func() config { return config{Value: 5} },
 		Resolve: func(configuration *config, resolution *Resolution) error {
 			Default(resolution, Keys("value"), &configuration.Value, 5, "equal derived intent", Keys("other"))
-			Default(resolution, Keys("value"), &configuration.Value, 7, "updated derived intent", Keys("other"))
+			Default(resolution, Keys("value"), &configuration.Value, 7, "updated derived intent", parsedOther)
 			Normalize(resolution, Keys("value"), &configuration.Value, 7, "canonicalized value", Keys("other"))
+			Normalize(resolution, Keys("value"), &configuration.Value, 7, "updated derived intent", parsedOther)
 			return nil
 		},
 	}})
@@ -206,6 +212,31 @@ func TestResolutionSequenceReplacementUpdatesDescendantOrigins(t *testing.T) {
 	}
 }
 
+func TestOrderedResolutionRecordsSortEscapedPointers(t *testing.T) {
+	parsedIndex, err := ParsePath("/items/0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	records := map[string]*resolutionRecord{
+		"tilde":  {path: Keys("a~b")},
+		"slash":  {path: Keys("a/b")},
+		"nested": {path: Keys("a", "b")},
+		"index":  {path: Keys("items").Index(0)},
+		"parsed": {path: parsedIndex},
+		"last":   {path: Keys("z")},
+	}
+	ordered := orderedResolutionRecords(records)
+	want := []string{"/a/b", "/a~0b", "/a~1b", "/items/0", "/items/0", "/z"}
+	if len(ordered) != len(want) {
+		t.Fatalf("ordered records = %d, want %d", len(ordered), len(want))
+	}
+	for i, record := range ordered {
+		if got := record.path.String(); got != want[i] {
+			t.Fatalf("record[%d] path = %q, want %q", i, got, want[i])
+		}
+	}
+}
+
 func TestResolutionRejectsUnrecordedAndMismatchedMutations(t *testing.T) {
 	t.Parallel()
 

internal/engine/secret.go

@@ -9,17 +9,10 @@ type secretDependency struct {
 
 func classifySecretPaths(schema *schemaDescriptor, predicate func(Path) bool, metadata Metadata, final *document.Node, applications []historyApplication, projections ...*document.Node) map[string]bool {
 	paths := make(map[string]Path)
-	finalPaths := make(map[string]*document.Node)
-	indexDocument(final, Path{}, finalPaths)
-	for pointer := range finalPaths {
-		addSecretPath(paths, pointer)
-	}
 	for _, application := range applications {
-		applicationPaths := make(map[string]*document.Node)
-		indexDocument(application.value, application.path, applicationPaths)
-		for pointer := range applicationPaths {
-			addSecretPath(paths, pointer)
-		}
+		walkDocument(application.value, application.path, func(path Path, _ *document.Node) {
+			addSecretPath(paths, path.String())
+		})
 	}
 	var dependencies []secretDependency
 	for pointer, history := range metadata.history {
@@ -65,16 +58,19 @@ func classifySecretPaths(schema *schemaDescriptor, predicate func(Path) bool, me
 	}
 
 	secret := make(map[string]bool)
-	for _, tree := range append(projections, final) {
-		projected := make(map[string]*document.Node)
-		indexDocument(tree, Path{}, projected)
-		for pointer, node := range projected {
+	classifyProjection := func(tree *document.Node) {
+		walkDocument(tree, Path{}, func(path Path, node *document.Node) {
+			pointer := path.String()
 			addSecretPath(paths, pointer)
 			if node.Sensitive {
 				secret[pointer] = true
 			}
-		}
+		})
 	}
+	for _, tree := range projections {
+		classifyProjection(tree)
+	}
+	classifyProjection(final)
 	for pointer, path := range paths {
 		if root, ok := schemaSecretRoot(schema, path); ok {
 			secret[root.String()] = true
@@ -83,49 +79,29 @@ func classifySecretPaths(schema *schemaDescriptor, predicate func(Path) bool, me
 			secret[pointer] = true
 		}
 	}
-	for {
-		changed := false
-		for _, dependency := range dependencies {
-			if secretIntersectsPath(paths, secret, dependency.dependency) && !secret[dependency.target.String()] {
-				secret[dependency.target.String()] = true
-				changed = true
-			}
-		}
-		for _, link := range inherited {
-			if pathIsSecret(secret, link.dependency) && !secret[link.target.String()] {
-				secret[link.target.String()] = true
-				changed = true
-			}
-			if pathIsSecret(secret, link.target) && !secret[link.dependency.String()] {
-				secret[link.dependency.String()] = true
-				changed = true
-			}
-		}
-		if !changed {
-			return secret
-		}
-	}
+	return closeSecretDependencies(paths, secret, dependencies, inherited)
 }
 
 func addSecretPath(paths map[string]Path, pointer string) {
+	if existing, found := paths[pointer]; found && existing.valid() {
+		// Accumulator keys already match their paths' canonical spelling. History
+		// can install typed segments, which still need the parsed replacement.
+		parsed := true
+		for _, segment := range existing.segments {
+			if segment.kind != pathSegmentParsed {
+				parsed = false
+				break
+			}
+		}
+		if parsed {
+			return
+		}
+	}
 	if path, err := ParsePath(pointer); err == nil {
 		paths[pointer] = path
 	}
 }
 
-func secretIntersectsPath(paths map[string]Path, secret map[string]bool, candidate Path) bool {
-	for pointer := range secret {
-		classified, ok := paths[pointer]
-		if !ok {
-			continue
-		}
-		if pathContains(classified, candidate) || pathContains(candidate, classified) {
-			return true
-		}
-	}
-	return false
-}
-
 func schemaSecretRoot(schema *schemaDescriptor, path Path) (Path, bool) {
 	if schema == nil || schema.root == nil || !path.valid() {
 		return Path{}, false

internal/engine/secret_classification_test.go

@@ -0,0 +1,79 @@
+package engine
+
+import "testing"
+
+func TestSecretPathCollectionKeepsParsedContributions(t *testing.T) {
+	for _, pointer := range []string{"", "/", "/records/0", "/records/a~1b~0/01"} {
+		t.Run(pointer, func(t *testing.T) {
+			paths := make(map[string]Path)
+			for repeat := 0; repeat < 3; repeat++ {
+				addSecretPath(paths, pointer)
+				path, found := paths[pointer]
+				if !found || !path.valid() || path.String() != pointer {
+					t.Fatalf("collected path = %#v, found %v; want %q", path, found, pointer)
+				}
+				for _, segment := range path.segments {
+					if segment.kind != pathSegmentParsed {
+						t.Fatalf("collected path %q retained a typed segment: %#v", pointer, segment)
+					}
+				}
+			}
+		})
+	}
+}
+
+func TestSecretClassificationParsesTypedHistoryAfterNumericShapeChanges(t *testing.T) {
+	tests := []struct {
+		name       string
+		earlier    string
+		final      string
+		historical Path
+	}{
+		{"mapping to sequence", "items: {'0': old}", "items: [new]", Keys("items", "0")},
+		{"sequence to mapping", "items: [old]", "items: {'0': new}", Keys("items").Index(0)},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			earlier := parseCompositionDocument(t, "earlier", test.earlier)
+			final := parseCompositionDocument(t, "final", test.final)
+			pointer := test.historical.String()
+			metadata := Metadata{history: map[string][]Change{pointer: {{Path: test.historical}}}}
+			seen := false
+			classified := classifySecretPaths(nil, func(path Path) bool {
+				if path.String() != pointer {
+					return false
+				}
+				seen = true
+				for _, segment := range path.segments {
+					if segment.kind != pathSegmentParsed {
+						t.Fatalf("predicate received typed history after final projection: %#v", path)
+					}
+				}
+				return true
+			}, metadata, final, []historyApplication{{value: earlier}}, earlier)
+			if !seen || !classified[pointer] {
+				t.Fatalf("historical/final numeric path was not classified: %#v", classified)
+			}
+		})
+	}
+}
+
+func TestSecretPredicateReceivesDetachedHistoricalPath(t *testing.T) {
+	path := Keys("records").Key("1")
+	metadata := Metadata{history: map[string][]Change{
+		path.String(): {{Path: path}},
+	}}
+	seen := false
+	classified := classifySecretPaths(nil, func(candidate Path) bool {
+		if candidate.String() != path.String() {
+			return false
+		}
+		seen = true
+		candidate.segments[0].key = "changed"
+		return true
+	}, metadata, nil, nil)
+
+	if !seen || !classified[path.String()] || classified["/changed/1"] {
+		t.Fatalf("classification after predicate mutation = %#v, predicate called: %v", classified, seen)
+	}
+}

internal/engine/secret_propagation.go

@@ -0,0 +1,69 @@
+package engine
+
+type secretTrigger struct {
+	target   string
+	ordinary bool
+}
+
+func closeSecretDependencies(paths map[string]Path, sensitive map[string]bool, dependencies, inherited []secretDependency) map[string]bool {
+	result := make(map[string]bool, len(sensitive))
+	queue := make([]string, 0, len(sensitive))
+	for pointer, classified := range sensitive {
+		if classified {
+			result[pointer] = true
+			queue = append(queue, pointer)
+		}
+	}
+
+	var triggers pathPrefixIndex
+	triggerValues := make([]secretTrigger, 0, len(dependencies)+2*len(inherited))
+	insert := func(dependency Path, target string, ordinary bool) {
+		if ordinary && !dependency.valid() {
+			return
+		}
+		id := len(triggerValues)
+		triggerValues = append(triggerValues, secretTrigger{target: target, ordinary: ordinary})
+		triggers.insert(dependency.String(), id)
+	}
+	for _, dependency := range dependencies {
+		insert(dependency.dependency, dependency.target.String(), true)
+	}
+	for _, link := range inherited {
+		insert(link.dependency, link.target.String(), false)
+		insert(link.target, link.dependency.String(), false)
+	}
+
+	fired := make([]bool, len(triggerValues))
+	activate := func(id int) {
+		if fired[id] {
+			return
+		}
+		fired[id] = true
+		target := triggerValues[id].target
+		if !result[target] {
+			result[target] = true
+			queue = append(queue, target)
+		}
+	}
+	for head := 0; head < len(queue); head++ {
+		pointer := queue[head]
+		if classified, ok := paths[pointer]; ok && classified.valid() {
+			triggers.visitAncestors(classified.String(), func(id int) {
+				if triggerValues[id].ordinary {
+					activate(id)
+				}
+			})
+			triggers.visitDescendants(classified.String(), func(id int) {
+				if triggerValues[id].ordinary {
+					activate(id)
+				}
+			})
+		}
+		triggers.visitDescendants(pointer, func(id int) {
+			if !triggerValues[id].ordinary {
+				activate(id)
+			}
+		})
+	}
+	return result
+}

internal/engine/secret_propagation_test.go

@@ -0,0 +1,147 @@
+package engine
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestSecretDependencyClosureMatchesFixedPointScan(t *testing.T) {
+	tests := []struct {
+		name            string
+		paths           map[string]Path
+		seed            map[string]bool
+		dependencies    []secretDependency
+		inherited       []secretDependency
+		wantSensitivity map[string]bool
+	}{
+		{
+			name:  "forward reverse chains and cycles",
+			paths: secretPaths(Keys("input"), Keys("derived"), Keys("output"), Keys("cycle")),
+			seed:  secretSet(Keys("input")),
+			dependencies: []secretDependency{
+				{dependency: Keys("input"), target: Keys("derived")},
+				{dependency: Keys("derived"), target: Keys("output")},
+				{dependency: Keys("output"), target: Keys("cycle")},
+				{dependency: Keys("cycle"), target: Keys("derived")},
+				{dependency: Keys("input"), target: Keys("derived")},
+			},
+		},
+		{
+			name:  "ordinary ancestor descendant and root relations",
+			paths: secretPaths(Path{}, Keys("branch", "leaf"), Keys("parent", "child")),
+			seed:  secretSet(Keys("branch", "leaf"), Keys("parent")),
+			dependencies: []secretDependency{
+				{dependency: Keys("branch"), target: Keys("from-descendant")},
+				{dependency: Keys("parent", "child"), target: Keys("from-ancestor")},
+				{dependency: Path{}, target: Keys("from-root")},
+			},
+		},
+		{
+			name:  "unindexed seed only activates inherited relations",
+			paths: secretPaths(Keys("ordinary"), Keys("copy")),
+			seed:  secretSet(Keys("untracked")),
+			dependencies: []secretDependency{
+				{dependency: Keys("untracked"), target: Keys("ordinary")},
+			},
+			inherited: []secretDependency{
+				{dependency: Keys("untracked"), target: Keys("copy")},
+			},
+			wantSensitivity: map[string]bool{"/copy": true, "/ordinary": false},
+		},
+		{
+			name:  "inheritance direction root escapes and numeric spellings",
+			paths: secretPaths(Path{}, Keys("a/b", "01"), Keys("source", "value")),
+			seed:  secretSet(Path{}),
+			dependencies: []secretDependency{
+				{dependency: Keys("a/b", "01"), target: Keys("ordinary-copy")},
+			},
+			inherited: []secretDependency{
+				{dependency: Keys("a/b", "01"), target: Keys("destination", "01")},
+				{dependency: Keys("source"), target: Keys("destination")},
+			},
+		},
+		{
+			name:  "inherited links do not trigger from classified descendants",
+			paths: secretPaths(Keys("parent", "secret", "nested")),
+			seed:  secretSet(Keys("parent", "secret", "nested")),
+			inherited: []secretDependency{
+				{dependency: Keys("parent", "secret"), target: Keys("child", "secret")},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			want := referenceSecretDependencyClosure(test.paths, test.seed, test.dependencies, test.inherited)
+			got := closeSecretDependencies(test.paths, test.seed, test.dependencies, test.inherited)
+			if !reflect.DeepEqual(got, want) {
+				t.Fatalf("closure = %#v, want %#v", got, want)
+			}
+			for pointer, sensitive := range test.wantSensitivity {
+				if got[pointer] != sensitive {
+					t.Errorf("sensitivity at %q = %v, want %v", pointer, got[pointer], sensitive)
+				}
+			}
+		})
+	}
+}
+
+func referenceSecretDependencyClosure(paths map[string]Path, seed map[string]bool, dependencies, inherited []secretDependency) map[string]bool {
+	secret := make(map[string]bool, len(seed))
+	for pointer, classified := range seed {
+		if classified {
+			secret[pointer] = true
+		}
+	}
+	for {
+		changed := false
+		for _, dependency := range dependencies {
+			if referenceSecretIntersectsPath(paths, secret, dependency.dependency) && !secret[dependency.target.String()] {
+				secret[dependency.target.String()] = true
+				changed = true
+			}
+		}
+		for _, link := range inherited {
+			if pathIsSecret(secret, link.dependency) && !secret[link.target.String()] {
+				secret[link.target.String()] = true
+				changed = true
+			}
+			if pathIsSecret(secret, link.target) && !secret[link.dependency.String()] {
+				secret[link.dependency.String()] = true
+				changed = true
+			}
+		}
+		if !changed {
+			return secret
+		}
+	}
+}
+
+func referenceSecretIntersectsPath(paths map[string]Path, secret map[string]bool, candidate Path) bool {
+	for pointer := range secret {
+		classified, ok := paths[pointer]
+		if !ok {
+			continue
+		}
+		if pathContains(classified, candidate) || pathContains(candidate, classified) {
+			return true
+		}
+	}
+	return false
+}
+
+func secretPaths(paths ...Path) map[string]Path {
+	result := make(map[string]Path, len(paths))
+	for _, path := range paths {
+		result[path.String()] = path
+	}
+	return result
+}
+
+func secretSet(paths ...Path) map[string]bool {
+	result := make(map[string]bool, len(paths))
+	for _, path := range paths {
+		result[path.String()] = true
+	}
+	return result
+}

internal/engine/snapshot.go

@@ -12,7 +12,11 @@ import (
 // Snapshot projection is the shared redaction boundary for effective YAML
 // and explanation values. It borrows frozen trees and returns a detached tree.
 func valueSnapshot(root *document.Node, path Path, secrets map[string]bool) ValueSnapshot {
-	node, present := documentAtPath(root, path)
+	return valueSnapshotWithLookup(root, path, secrets, nil)
+}
+
+func valueSnapshotWithLookup(root *document.Node, path Path, secrets map[string]bool, lookup *documentLookup) ValueSnapshot {
+	node, present := documentAtPathWithLookup(root, path, lookup)
 	if !present {
 		return ValueSnapshot{}
 	}

layered.go

@@ -2,13 +2,17 @@ package configkit
 
 import "gitea.maximumdirect.net/eric/ConfigKit/internal/engine"
 
-// Input selects one source, whether its imports are enabled, and any explicit
-// filesystem context. A zero Source is invalid; use NoSource() for an omitted
-// main input. Sources keep their documented reuse and reader ownership rules.
+// Input selects one source, its application destination, whether its imports are
+// enabled, and any explicit filesystem context. A zero Source is invalid; use
+// NoSource() for an omitted main input. Sources keep their documented reuse and
+// reader ownership rules.
 type Input struct {
-	Source     Source
-	Imports    bool
-	Filesystem *FilesystemContext
+	Source Source
+	// Destination selects the mapping path where Source and its imported
+	// application contributions are placed. Its zero value keeps root placement.
+	Destination Path
+	Imports     bool
+	Filesystem  *FilesystemContext
 }
 
 // Underlay contains inputs that must compose strictly within one tier. Tiers
@@ -46,7 +50,7 @@ func LoadLayered[T any](main Input, supplied ...LayeredOptions[T]) (*Result[T],
 func toEngineInput(input Input) engine.Input {
 	return engine.Input{
 		Source: input.Source.toEngine(), Imports: input.Imports,
-		Filesystem: toEngineFilesystemContext(input.Filesystem),
+		Filesystem: toEngineFilesystemContext(input.Filesystem), Destination: toEnginePath(input.Destination),
 	}
 }