Record the remaining context consolidation gap

README.md

@@ -9,7 +9,7 @@ ConfigKit's simple `Load` accepts one strict YAML source (or explicit
 defaults-only input). `LoadLayered` additionally combines explicit lower-priority
 source groups with an independently selected main input. Sources can be host
 files, native `fs.FS` files, labeled bytes or readers, or snapshotted mappings.
-Enabled path and glob imports compose strictly within their group; precedence
+Enabled explicit imports compose strictly within their group; precedence
 between groups combines mappings recursively. Both entry points return a complete,
 validated configuration with detached metadata and safe diagnostics.
 Applications may perform audited defaulting and normalization through a resolver,
@@ -17,7 +17,8 @@ then report domain errors and warnings through read-only semantic validation. Se
 tags and a path predicate drive deterministic redacted effective YAML. Typed secret
 references resolve environment names before validation, and explicit
 secrets-directory bootstrap is available as a separate startup operation. Explicit
-CLI override records apply above overlays. Value explanation is available through
+CLI override records apply after inheritance and typed decoding, before application
+resolution. Value explanation is available through
 detached structured records and deterministic redacted output. Built-in
 `extends` relationships let a mapping inherit from a named sibling during the
 same load, retaining explicit presence and source/derivation history. The root
@@ -26,12 +27,28 @@ the [configuration contract](docs/config.md#effective-configuration-diffs) and
 [consumer guide](docs/consumers/README.md#effective-configuration-diffs) describe
 its safe changed-region records and maintained workflows.
 
-Sources can also be explicitly placed as sequence items, and definitions can
-register selected sequences to append records with distinct string IDs during
-strict composition. Higher-priority sequences still replace lower-priority
-sequences as whole values. See the [sequence contract](docs/config.md#strict-document-composition),
-[maintained prompt example](docs/consumers/README.md#identified-prompt-sequences),
-and [ADR 0014](docs/adr/0014-sequence-placement-and-composition.md).
+Sources can also be explicitly placed as sequence items. Configuration
+declarations and application registrations can give selected sequences scalar
+identities and choose how they combine across precedence and inheritance.
+Strict peers combine distinct records, while higher-priority collections can
+replace, append, or upsert whole records. See the
+[sequence contract](docs/config.md#strict-document-composition),
+[maintained catalog examples](docs/consumers/README.md#identified-prompt-sequences),
+and [ADR 0017](docs/adr/0017-collection-sequence-policy.md).
+
+Imports are also explicit: a source may name files, search declared directories,
+or select files with path globs. Applications can set load-wide import defaults
+while keeping declaration-specific exceptions. Files are acquired in authored
+declaration order; dependency-ready composition uses a shared stable scheduler.
+ConfigKit does not search conventional application paths implicitly. See the
+[import contract](docs/config.md#explicit-imports), [consumer examples](docs/consumers/README.md),
+and [ADR 0015](docs/adr/0015-shared-dependency-ready-ordering.md) and
+[ADR 0016](docs/adr/0016-independent-import-controls.md).
+
+Main-file discovery is explicit too: applications choose and order `Search`
+descriptions and pass `SearchConfig` to the existing load APIs. See the
+[discovery contract](docs/config.md#configuration-discovery), [consumer guide](docs/consumers/README.md#explicit-main-file-discovery),
+and [ADR 0019](docs/adr/0019-explicit-configuration-discovery.md).
 
 ```go
 type Config struct {
@@ -67,12 +84,13 @@ mappings combine, while overlapping non-mapping definitions are errors. Between
 precedence tiers, mappings combine recursively, retaining omitted lower-priority
 children; other values replace lower-priority values. The main document and its
 imports form one strictly composed tier. Explicit underlay groups sit below it
-and above typed defaults; a selected overlay and explicit CLI overrides sit
-above it. The [configuration contract](docs/config.md#strict-document-composition)
-owns the detailed combination rules and input-specific constraints. At
-definition-registered paths only, strict composition can append records with
-distinct explicit IDs; ordinary and unregistered sequences keep their conflict
-or whole-value replacement behavior.
+and above typed defaults; a selected overlay applies before inheritance, while
+explicit CLI overrides apply after decoding and before application resolution.
+The [configuration contract](docs/config.md#strict-document-composition) owns
+the detailed combination rules and input-specific constraints. Declared or
+registered collections combine distinct identified records within strict tiers
+and use their selected operation at precedence boundaries; other sequences keep
+their strict-conflict and whole-value-replacement behavior.
 
 The [architecture goals](docs/policy/architecture.md#success-criteria) explain
 these priorities and how genuine new needs can justify extending the shared

conversion.go

@@ -43,12 +43,69 @@ func toEngineLocations(values []Location) []engine.Location {
 	return result
 }
 func fromEngineSourceInfo(value engine.SourceInfo) SourceInfo {
-	return SourceInfo{ID: value.ID, Label: value.Label, Path: value.Path, Destination: fromEnginePath(value.Destination), PlacementMode: PlacementMode(engine.SourceInfoPlacementModeForFacade(value)), DestinationUnresolved: engine.SourceInfoDestinationUnresolvedForFacade(value), Layer: Layer(value.Layer), Kind: SourceKind(value.Kind), UnderlayIndex: value.UnderlayIndex, ImportedFrom: fromEngineLocationPointer(value.ImportedFrom), VersionCheck: fromEngineSourceVersionCheck(value.VersionCheck)}
+	return SourceInfo{
+		ID: value.ID, Label: value.Label, Path: value.Path, Destination: fromEnginePath(value.Destination),
+		PlacementMode:         PlacementMode(engine.SourceInfoPlacementModeForFacade(value)),
+		DestinationUnresolved: engine.SourceInfoDestinationUnresolvedForFacade(value),
+		Layer:                 Layer(value.Layer), Kind: SourceKind(value.Kind), UnderlayIndex: value.UnderlayIndex,
+		ImportedFrom: fromEngineLocationPointer(value.ImportedFrom), VersionCheck: fromEngineSourceVersionCheck(value.VersionCheck),
+		ImportSelections: fromEngineImportSelections(engine.SourceInfoImportSelectionsForFacade(value)),
+	}
 }
-func toEngineSourceInfo(value SourceInfo) engine.SourceInfo {
-	result := engine.SourceInfo{ID: value.ID, Label: value.Label, Path: value.Path, Destination: toEnginePath(value.Destination), Layer: engine.Layer(value.Layer), Kind: engine.SourceKind(value.Kind), UnderlayIndex: value.UnderlayIndex, ImportedFrom: toEngineLocationPointer(value.ImportedFrom), VersionCheck: toEngineSourceVersionCheck(value.VersionCheck)}
-	return engine.SourceInfoWithPlacement(result, uint8(value.PlacementMode), value.DestinationUnresolved)
+func fromEngineImportSelections(values []engine.ImportSelectionForFacade) []ImportSelection {
+	if values == nil {
+		return nil
+	}
+	result := make([]ImportSelection, len(values))
+	for index, value := range values {
+		result[index] = ImportSelection{
+			Path: fromEnginePath(value.Path), Location: fromEngineLocation(value.Location),
+			Selector: ImportSelector(value.Selector), Outcome: ImportSelectionOutcome(value.Outcome),
+		}
+	}
+	return result
 }
+
+func toEngineOverrides(values []Override) []engine.Override {
+	if values == nil {
+		return nil
+	}
+	result := make([]engine.Override, len(values))
+	for index, value := range values {
+		result[index] = engine.Override{
+			Path: toEnginePath(value.Path), Value: value.Value, Flag: value.Flag,
+		}
+	}
+	return result
+}
+
+func toEngineImportDefaults(value ImportDefaults) engine.ImportDefaults {
+	return engine.ImportDefaults{
+		Required:  cloneImportDefaultBool(value.Required),
+		Follow:    cloneImportDefaultBool(value.Follow),
+		Hidden:    cloneImportDefaultBool(value.Hidden),
+		Recursive: cloneImportDefaultBool(value.Recursive),
+		Pattern:   cloneImportDefaultStrings(value.Pattern),
+	}
+}
+
+func cloneImportDefaultBool(value *bool) *bool {
+	if value == nil {
+		return nil
+	}
+	cloned := *value
+	return &cloned
+}
+
+func cloneImportDefaultStrings(values []string) []string {
+	if values == nil {
+		return nil
+	}
+	cloned := make([]string, len(values))
+	copy(cloned, values)
+	return cloned
+}
+
 func fromEngineSourceVersionCheck(value *engine.SourceVersionCheck) *SourceVersionCheck {
 	if value == nil {
 		return nil
@@ -59,16 +116,6 @@ func fromEngineSourceVersionCheck(value *engine.SourceVersionCheck) *SourceVersi
 		Location: fromEngineLocationPointer(value.Location), Redacted: value.Redacted,
 	}
 }
-func toEngineSourceVersionCheck(value *SourceVersionCheck) *engine.SourceVersionCheck {
-	if value == nil {
-		return nil
-	}
-	return &engine.SourceVersionCheck{
-		Path:     toEnginePath(value.Path),
-		Version:  engine.Version{Present: value.Version.Present, Null: value.Version.Null, Text: value.Version.Text},
-		Location: toEngineLocationPointer(value.Location), Redacted: value.Redacted,
-	}
-}
 func fromEngineOrigin(value engine.Origin) Origin {
 	result := Origin{Layer: Layer(value.Layer), Locations: fromEngineLocations(value.Locations), Operation: ChangeKind(value.Operation)}
 	if value.Inheritance != nil {
@@ -82,19 +129,6 @@ func fromEngineOrigin(value engine.Origin) Origin {
 	}
 	return result
 }
-func toEngineOrigin(value Origin) engine.Origin {
-	result := engine.Origin{Layer: engine.Layer(value.Layer), Locations: toEngineLocations(value.Locations), Operation: engine.ChangeKind(value.Operation)}
-	if value.Inheritance != nil {
-		result.Inheritance = make([]engine.InheritanceStep, len(value.Inheritance))
-		for index, step := range value.Inheritance {
-			result.Inheritance[index] = engine.InheritanceStep{
-				From: toEnginePath(step.From), To: toEnginePath(step.To), Reference: toEnginePath(step.Reference),
-				Locations: toEngineLocations(step.Locations),
-			}
-		}
-	}
-	return result
-}
 func fromEngineDiagnostic(value engine.Diagnostic) Diagnostic {
 	return Diagnostic{Code: Code(value.Code), Severity: Severity(value.Severity), Path: fromEnginePath(value.Path), Message: value.Message, Primary: fromEngineLocationPointer(value.Primary), Related: fromEngineLocations(value.Related)}
 }

discovery.go

@@ -0,0 +1,90 @@
+package configkit
+
+import "gitea.maximumdirect.net/eric/ConfigKit/internal/engine"
+
+// Search is an immutable ordered description of possible host-file inputs.
+// It is consumed only when passed to SearchConfig and used by a load.
+type Search struct{ value engine.Search }
+
+// FilenameGroup selects filenames in order for a directory search.
+// Construct groups with NamedFilenames, GenericFilenames, or CustomFilenames.
+type FilenameGroup struct{ value engine.FilenameGroup }
+
+// SearchOptions controls whether a search must select a file.
+type SearchOptions struct {
+	// Required reports a missing-source error if the complete search is exhausted.
+	Required bool
+}
+
+// DirectorySearchOptions selects the filename groups used by SearchDirectory.
+type DirectorySearchOptions struct {
+	// Filenames concatenates groups in order. A nil slice uses Named then Generic;
+	// a non-nil empty slice selects no filenames.
+	Filenames []FilenameGroup
+}
+
+// NamedFilenames selects <application>.yml followed by <application>.yaml.
+func NamedFilenames() FilenameGroup { return FilenameGroup{value: engine.NamedFilenames()} }
+
+// GenericFilenames selects config.yml, config.yaml, main.yml, and main.yaml.
+func GenericFilenames() FilenameGroup { return FilenameGroup{value: engine.GenericFilenames()} }
+
+// CustomFilenames selects literal filename components in the supplied order.
+// Names cannot be empty or contain a directory component.
+func CustomFilenames(names ...string) FilenameGroup {
+	return FilenameGroup{value: engine.CustomFilenames(names...)}
+}
+
+// SearchDirectory describes a search within directory. Omitted options or a nil
+// Filenames slice uses Named then Generic groups. Explicitly empty Filenames
+// selects no names and does not resolve the directory base.
+func SearchDirectory(directory string, supplied ...DirectorySearchOptions) Search {
+	options := make([]engine.DirectorySearchOptions, len(supplied))
+	for index, option := range supplied {
+		if option.Filenames == nil {
+			continue
+		}
+		options[index].Filenames = make([]engine.FilenameGroup, len(option.Filenames))
+		for groupIndex, group := range option.Filenames {
+			options[index].Filenames[groupIndex] = group.value
+		}
+	}
+	return Search{value: engine.SearchDirectory(directory, options...)}
+}
+
+// Paths describes literal host-file candidates in the supplied order.
+func Paths(paths ...string) Search { return Search{value: engine.Paths(paths...)} }
+
+// Searches concatenates descriptions in order and snapshots their entries.
+func Searches(searches ...Search) Search {
+	values := make([]engine.Search, len(searches))
+	for index, search := range searches {
+		values[index] = search.value
+	}
+	return Search{value: engine.Searches(values...)}
+}
+
+// UnixSystemDirectories describes the conventional Unix system directories.
+// Loading on an unsupported platform fails if this preset is reached.
+func UnixSystemDirectories() Search { return Search{value: engine.UnixSystemDirectories()} }
+
+// UserConfigDirectory describes searches rooted at the Go user-config directory.
+func UserConfigDirectory() Search { return Search{value: engine.UserConfigDirectory()} }
+
+// HomeDirectory describes searches rooted at the Go home directory.
+func HomeDirectory() Search { return Search{value: engine.HomeDirectory()} }
+
+// WorkingDirectory describes application-named files in the current directory.
+func WorkingDirectory() Search { return Search{value: engine.WorkingDirectory()} }
+
+// SearchConfig creates a source that selects the first matching host file when
+// consumed by Load or LoadLayered. Without Required, exhausting the search uses
+// the absent-input lifecycle. Description and option errors are reported while
+// loading.
+func SearchConfig(application string, search Search, supplied ...SearchOptions) Source {
+	options := make([]engine.SearchOptions, len(supplied))
+	for index, option := range supplied {
+		options[index] = engine.SearchOptions{Required: option.Required}
+	}
+	return Source{value: engine.SearchConfig(application, search.value, options...)}
+}

docs/adr/0005-explicit-overrides-and-safe-explanation.md

@@ -1,6 +1,8 @@
 # ADR 0005: Record explicit CLI overrides and safe value explanation
 
-Status: accepted
+Status: Partially superseded by
+[ADR 0018](0018-cli-after-structural-resolution.md) for override-before-decoding
+ordering. The remaining ownership and safe explanation decisions remain accepted.
 
 Date: 2026-09-06
 

docs/adr/0007-source-backed-underlays.md

@@ -2,7 +2,9 @@
 
 ## Status
 
-Proposed draft for review. Completed planning and remediation records are
+Proposed draft for review; its whole-sequence precedence replacement rule is
+superseded by [ADR 0017](0017-collection-sequence-policy.md). The remainder
+retains its proposed status. Completed planning and remediation records are
 preserved in Git history at `b604aa1` under `docs/roadmap/`; the
 [configuration contract](../config.md#layered-loading) owns current behavior.
 

docs/adr/0009-sibling-inheritance.md

@@ -2,8 +2,14 @@
 
 ## Status
 
-Accepted and implemented. The [configuration contract](../config.md#sibling-inheritance)
-owns current behavior. The completed implementation plan is preserved in Git
+Partially superseded by [ADR 0017](0017-collection-sequence-policy.md) for
+sequence combination and the addition of identified-sequence sibling scopes,
+and [ADR 0018](0018-cli-after-structural-resolution.md) for CLI-before-inheritance
+ordering. Existing mapping-sibling scopes and the remaining ownership and
+inspection decisions remain accepted.
+
+The [configuration contract](../config.md#sibling-inheritance) owns implemented
+behavior. The completed implementation plan is preserved in Git
 history at `83c59ea`.
 
 ## Date

docs/adr/0014-sequence-placement-and-composition.md

@@ -2,8 +2,12 @@
 
 ## Status
 
-Accepted and implemented. The [configuration contract](../config.md#strict-document-composition)
-defines current behavior, and the [consumer guide](../consumers/README.md#identified-prompt-sequences)
+Partially superseded by [ADR 0017](0017-collection-sequence-policy.md) for
+identity ownership and sequence combination. Explicit source placement remains
+accepted.
+
+The [configuration contract](../config.md#strict-document-composition)
+defines implemented behavior, and the [consumer guide](../consumers/README.md#identified-prompt-sequences)
 shows the maintained example. The completed roadmap, implementation plan, and
 resolved remediation record are preserved in Git history at `008d2ba` under
 `docs/roadmap/`; see the [development guide](../development.md) for retrieval

docs/adr/0015-shared-dependency-ready-ordering.md

@@ -0,0 +1,68 @@
+# ADR 0015: Share Dependency-Ready Ordering Across Imports and Inheritance
+
+## Status
+
+Accepted. Implemented behavior is described in the
+[configuration contract](../config.md#explicit-imports) and
+[internal import overview](../internal/imports.md).
+
+## Date
+
+2026-10-19
+
+## Context
+
+Imports and sibling inheritance both resolve relationships between configuration
+contributions. Their existing resolvers use different traversal rules, making
+ordering depend on which mechanism expresses a dependency. Ordering affects
+sequence contributions, provenance, and diagnostics, so a consistent rule is
+part of ConfigKit's configuration model.
+
+The resolvers also serve distinct purposes. Imports strictly compose sources;
+inheritance overlays a child on its resolved parent after source assembly.
+Item-local contributions and nested inheritance introduce scope boundaries that
+resolution must preserve.
+
+## Decision
+
+ConfigKit owns one shared dependency-ready scheduler for imports and sibling
+inheritance. Both resolvers use Kahn's algorithm with a stable ordering key,
+selecting the smallest currently eligible node after its dependencies have
+completed. The shared scheduler owns eligibility, deterministic tie-breaking,
+and dependency-cycle identification. Each resolver owns construction of its
+dependency relationships and application of its domain operations.
+
+Apply the common scheduling rule within the scopes where dependencies are
+available. Complete item-local contributions before item placement and resolve
+enclosing inheritance before relationships in the resulting nested scopes.
+Source discovery supplies the import graph; the scheduler determines resolution
+order.
+
+Strict composition, inheritance overlay, and precedence tiers retain their
+existing ownership and meanings under [ADR 0001](0001-separate-composition-and-overlay.md).
+The lifecycle and scope decisions in
+[ADR 0009](0009-sibling-inheritance.md) continue to govern inheritance. Import
+admission retains its cycle and repeated-source rules.
+
+## Alternatives Considered
+
+- **Deterministic depth-first postorder.** Keeps dependency branches together,
+  but gives traversal branch selection an additional role in ordering.
+- **Dependency rounds.** Groups nodes by readiness rounds, but delays newly
+  eligible nodes until the current round finishes.
+- **Descending longest-path depth.** Prioritizes the furthest dependencies,
+  but adds distance from the root as an ordering policy.
+- **Separate resolver algorithms.** Allows local specialization, but leaves
+  consumers and maintainers with different rules for analogous dependencies.
+
+## Consequences
+
+Both resolvers follow one deterministic ordering model and share responsibility
+for maintaining that model. Resolver-specific scopes, combination semantics,
+and source-admission rules remain explicit at their integration boundaries.
+
+Independent branches may interleave as nodes become eligible. Adopting this
+rule changes existing traversal-dependent sequence positions and reporting
+order, requiring coordinated review of source assembly, provenance, and
+inheritance behavior. The configuration contract owns the implemented ordering
+details.

docs/adr/0016-independent-import-controls.md

@@ -0,0 +1,83 @@
+# ADR 0016: Separate Import Selection, Traversal, and Presence Requirements
+
+## Status
+
+Accepted. Implemented behavior is described in the
+[configuration contract](../config.md#explicit-imports), the
+[public API declarations](../../lifecycle.go), and the
+[internal import overview](../internal/imports.md).
+
+## Date
+
+2026-10-19
+
+## Context
+
+Consumers assemble configurations from named files and collections whose layout
+varies between installations. Simple imports should require little setup, while
+larger collections need control over discovery, recursion, filtering, and
+required contributions. Combining those choices implicitly makes declarations
+harder to interpret and pushes source-selection work into applications.
+
+Discovery can also reach a candidate through overlapping searches or encounter
+different names for one canonical source. Selection and source admission need
+distinct identities to support useful search unions while preserving ConfigKit's
+existing source-integrity rules.
+
+## Decision
+
+ConfigKit owns import discovery and selection within its source-loading
+lifecycle. Support explicit files, directory searches, and path globs as
+distinct selection forms. Keep traversal, filename filtering, and presence
+requirements independently expressible. Discovery determines the selected
+contributions; the shared scheduler in
+[ADR 0015](0015-shared-dependency-ready-ordering.md) determines their resolution
+order.
+
+Use optional-by-default imports with explicit requiredness controls. Selected
+sources remain subject to ConfigKit's validity, containment, resource, and
+composition contracts. This applies the library's
+[simplicity and defaults principles](../policy/architecture.md#simplicity-defaults-and-explicit-controls)
+to import absence while retaining meaningful errors for invalid contributions.
+
+Applications own their selected import defaults. Authored declaration values
+take precedence over application defaults, which take precedence over library
+defaults. Each declaration resolves applicable controls independently,
+including declarations in imported sources. This gives applications a shared
+baseline while preserving explicit choices in individual declarations.
+
+Keep declaration-local candidate identity separate from canonical source
+identity. Search unions coalesce repeated candidate paths within a source
+namespace before symlink resolution; filename filtering uses the selected or
+discovered name. Source admission continues to use canonical identity and the
+existing repeated-source rules. Distinct aliases retain their separate
+inclusion routes.
+
+## Alternatives Considered
+
+- **Use path globs for all discovery.** Offers one selection form, but makes
+  collection traversal depend on path-pattern structure and complicates
+  independently controlling recursion and filename filtering.
+- **Offer only explicit files and directory searches.** Reduces the selector
+  vocabulary, but moves wildcard directory selection into repeated declarations
+  or application-side discovery.
+- **Require every import by default.** Detects absent contributions immediately,
+  but requires repeated opt-outs for installations with optional components.
+- **Make application settings override authored declarations.** Provides central
+  enforcement, but prevents declarations from expressing local exceptions.
+- **Deduplicate selections globally by canonical source identity.** Coalesces
+  aliases and separate inclusion routes, but changes the existing repeated-source
+  contract and obscures independently authored contributions.
+
+## Consequences
+
+Consumers can express simple imports and more selective collection searches
+through the same loading lifecycle. Applications choose defaults and validate
+their required effective configuration; ConfigKit owns consistent selection,
+source admission, composition, and inspection.
+
+Optional absence can conceal misspelled selectors, so requiredness and
+inspection provide explicit ways to detect and explain missing contributions.
+Declaration-local deduplication requires the loader to preserve candidate
+identity alongside canonical source identity. The configuration and public API
+contracts own the implemented behavior.

docs/adr/0017-collection-sequence-policy.md

@@ -0,0 +1,143 @@
+# ADR 0017: Define Identity and Merge Rules for Each Collection
+
+## Status
+
+Accepted.
+
+This supersedes the decisions about who declares identity and how
+sequences combine in [ADR 0014](0014-sequence-placement-and-composition.md),
+and the rule that inheritance always replaces sequences in
+[ADR 0009](0009-sibling-inheritance.md). It also extends that ADR's sibling
+scopes to identified sequences. Existing mapping-sibling scopes and source
+placement continue to apply. It supersedes the whole-sequence
+precedence replacement rule in the proposed
+[ADR 0007](0007-source-backed-underlays.md).
+
+## Date
+
+2026-10-22
+
+## Context
+
+ConfigKit can load separate files as records in a sequence. Applications can
+register an identity key so records with different identities combine and
+duplicates fail. However, a higher configuration layer or an inheriting mapping
+currently replaces the whole sequence. Applications that need to extend a
+catalog across layers must write their own merging code and keep source and
+history information consistent with its results.
+
+Configuration authors need to choose how records are identified and whether a
+layer adds records, updates records, or replaces the collection. Applications
+also need a way to require unique identities in the final loaded configuration.
+These rules must work consistently for imported records, inline sequences,
+overlays, and inheritance.
+
+Records in a sequence may also share settings. Authors need to reuse those
+settings through inheritance while keeping each record's own identity.
+
+## Decision
+
+ConfigKit manages identity and merge rules for each collection during loading.
+Configuration files can declare those rules for imported and inline sequences,
+including sequences in selected overlays. Applications can require a particular
+identity definition, and configuration declarations must agree with it. Source
+placement determines where each contribution enters the configuration.
+
+Keep the distinction between contributions at the same priority and overrides
+from a higher layer, as established in
+[ADR 0001](0001-separate-composition-and-overlay.md). Within one tier, records
+with distinct identities combine; duplicate identities and conflicting
+declarations fail. Determine the applicable rules before combining those
+contributions, including any identity established in lower tiers.
+
+Across layers, support three operations: replace the whole sequence, append
+records while rejecting duplicate identities, or replace whole records by
+identity (`upsert`). Source layering and sibling inheritance use the same
+operations. For inheritance, the rules at the inheriting destination determine
+which operation applies.
+
+An identified sequence is also a sibling scope for inheritance. A record may
+inherit from one other record in the same sequence, selected by its complete
+identity. Each record supplies its own identity before inheritance. The child
+keeps that identity and combines its settings with the parent's other fields,
+using the existing mapping and collection rules. Parents remain ordinary records
+subject to normal validation.
+
+Resolve these relationships after source assembly, using the same dependency
+ordering as mapping-sibling inheritance. Resolve nested relationships at each
+inheriting destination. Preserve the assembled sequence order. Whole-record
+upsert keeps its existing meaning; inheritance then uses the records that remain.
+Typed defaults, CLI overrides, and application resolution follow the lifecycle
+in [ADR 0018](0018-cli-after-structural-resolution.md).
+
+An explicitly selected operation remains in effect at its destination until a
+higher layer changes it. When no explicit operation applies, use upsert if an
+identity definition is available; otherwise replace the whole sequence. Authors
+can declare identity and an operation before supplying any records. Keep source
+acquisition order separate from layer priority and the dependency ordering
+established by [ADR 0015](0015-shared-dependency-ready-ordering.md).
+
+Rules declared inside a record belong to that record. Retaining the record
+retains its local rules; replacing it discards them. Replacing a whole collection
+can discard its previous YAML identity definition, while application requirements
+still apply. Inheritance can copy collection identity, but the inheriting
+destination chooses its operation. Application registrations continue to govern
+the paths where they were registered. The same ownership rules apply to
+declarations made before a sequence exists.
+
+Check YAML-declared identity when combining collections during source assembly
+and inheritance. Application registrations also require the final loaded
+sequences to satisfy their identity rules, including after typed defaults, CLI
+overrides, and application resolution. This guarantee checks sequences that
+exist; the application schema and validation decide whether a collection must
+exist and which value types are allowed. The guarantee applies when loading
+completes, rather than to every intermediate callback state or changes made by
+the caller afterward.
+
+Preserve explicit presence, source attribution, history, sensitivity, and
+resource context through these operations, following
+[ADR 0003](0003-preserve-presence-and-resolution-history.md). Typed defaults,
+CLI assignments, and application resolution keep their own rules for changing
+values. The public API provides registration and inspection; the implementation
+chooses how to store and track collection rules internally.
+
+## Alternatives Considered
+
+- **Keep identity application-owned and always replace sequences across layers.**
+  Keeps the current design small, but reusable catalogs require application
+  changes or custom merging code.
+- **Put merge rules on each import.** Keeps the rules beside the imported source,
+  but inline sequences and overlays need a separate way to declare them. It also
+  makes rules for a collection spread across several imports harder to reconcile.
+- **Merge individual fields of records with matching identities.** Allows partial
+  record updates, but adds rules for field conflicts and retained values.
+  Replacing the whole record makes the update's scope clear.
+- **Keep inheritance limited to mapping siblings.** Keeps parent lookup simpler,
+  but authors of sequence records must duplicate shared settings or applications
+  must implement inheritance themselves. Collection identity provides a way to
+  select a parent within the existing loading process.
+- **Check every YAML identity again at the end of loading.** Gives YAML declarations
+  authority over values changed by defaults, CLI assignments, and application
+  resolution. This extends the lifetime of those declarations; application
+  registration provides that final guarantee when needed.
+
+## Consequences
+
+Consumers can build and customize catalogs in one load while retaining useful
+inspection information. Configuration authors choose how collections combine
+within application requirements. Duplicate identities among contributions at
+the same priority remain errors.
+
+Existing registered collections use upsert across layers by default unless an
+explicit operation selects otherwise. Correct loading now requires tracking
+which declarations still apply as records are replaced, copied, or moved to new
+positions. Lower-tier identity must be available before combining higher-tier
+contributions.
+
+Record inheritance also requires parent lookup by identity and checking for
+missing parents and cycles. Copied settings retain the same source, history,
+and sensitivity information as mapping-sibling inheritance.
+
+The [configuration contract](../config.md#strict-document-composition) defines
+declaration syntax, identity comparison, omission and empty-value behavior, and
+diagnostics for the implemented feature.

docs/adr/0018-cli-after-structural-resolution.md

@@ -0,0 +1,84 @@
+# ADR 0018: Apply CLI Overrides After Inheritance and Decoding
+
+## Status
+
+Accepted.
+
+This supersedes the rule that CLI overrides apply before decoding in
+[ADR 0005](0005-explicit-overrides-and-safe-explanation.md) and the
+rule that they apply before inheritance in [ADR 0009](0009-sibling-inheritance.md).
+Their remaining ownership, inheritance scope, and safe inspection decisions
+continue to apply.
+
+## Date
+
+2026-10-22
+
+## Context
+
+Explicit command-line values are the operator's highest-priority input. If they
+apply before inheritance, a sequence supplied as a replacement could gain
+inherited records afterward. Its final contents would then differ from the
+operator's assignment.
+
+The application also needs these values when it fills missing settings,
+normalizes values, or computes derived settings. ConfigKit needs a clear loading
+order that preserves both CLI precedence and the application's role in resolving
+the final configuration.
+
+## Decision
+
+ConfigKit uses this loading order:
+
+1. Combine sources within tiers and apply precedence between layers.
+2. Resolve sibling inheritance, apply typed defaults, and decode the configuration
+   into the application's types.
+3. Apply explicit CLI overrides and check them against the application schema.
+4. Run application resolution using the overridden configuration.
+5. Look up effective secret references, validate the final configuration, and
+   return it.
+
+CLI overrides are the highest-priority input to application resolution. A CLI
+sequence replaces the whole sequence; mappings combine recursively. Collection
+merge rules apply during the earlier source and inheritance steps. Inheritance
+and typed defaulting do not run again after CLI overrides.
+
+Keep track of which values were explicitly supplied and which CLI input supplied
+them. Applications continue to parse command-line arguments; ConfigKit applies
+and validates the overrides and makes their effects inspectable. Reject
+structural directives in override paths and values, so instructions such as
+inheritance relationships remain part of source processing.
+
+Application resolution keeps its existing rules for defaults and recorded
+changes under [ADR 0003](0003-preserve-presence-and-resolution-history.md).
+It receives CLI values together with their presence and source information.
+Defaults that only fill missing settings preserve explicit CLI values.
+Application normalization and derived-value calculations can still change them,
+with those changes recorded. Secret lookup and final validation use the resulting
+configuration.
+
+## Alternatives Considered
+
+- **Apply CLI overrides before inheritance.** Preserves existing ordering, but
+  later merging needs special handling to preserve CLI replacement intent while
+  still combining ordinary source contributions.
+- **Apply CLI overrides after inheritance but before typed decoding.** Allows an
+  override to fix a source value that would otherwise fail decoding, but leaves
+  typed defaulting after the operator's assignment. Completing defaulting and
+  decoding first gives CLI overrides an already resolved configuration to modify.
+- **Apply CLI overrides after application resolution.** Applies assignments after
+  the application's changes, but derived settings still reflect earlier values
+  unless resolution runs again.
+
+## Consequences
+
+CLI overrides change a configuration whose inheritance and typed defaults are
+already resolved. The application can then derive settings from the operator's
+values. The final values, source information, history, and sensitivity handling
+must remain consistent throughout loading.
+
+CLI input can no longer add or cancel inheritance relationships or bypass an
+earlier error in source assembly or inheritance. It also cannot fix a value that
+fails the earlier decoding step. Semantic validation still runs after overrides
+and application resolution. The [configuration contract](../config.md#explicit-cli-overrides)
+and [consumer guidance](../consumers/README.md) describe this behavior.

docs/adr/0019-explicit-configuration-discovery.md

@@ -0,0 +1,68 @@
+# ADR 0019: Keep Configuration Discovery Explicit and Inside Loading
+
+## Status
+
+Accepted.
+
+## Date
+
+2026-10-24
+
+## Context
+
+Applications often need a small ordered convention for choosing a main
+configuration file. Keeping that choice entirely in each application repeats
+path selection and file-loading plumbing. Moving the convention into ConfigKit
+without an explicit declaration would make ordinary loads search paths that a
+consumer did not choose, obscuring both precedence and filesystem access.
+
+ConfigKit already owns synchronous source acquisition, parsing, composition,
+decoding, validation, and inspection. A selected host file can therefore enter
+that lifecycle as the existing file source, preserving its source identity,
+resource context, and diagnostics. Optional exhaustion can use the same absent
+main lifecycle as an explicitly absent source.
+
+## Decision
+
+Consumers choose and order the main-file conventions they want to use. They may
+describe literal paths, directory filename groups, and supported directory
+presets, and may mark the complete search as required. Search descriptions are
+explicit inputs to loading; no preset or convention is activated implicitly.
+
+During synchronous loading, ConfigKit resolves the description to one real host
+file or to absence before parsing. The selected file follows the existing source
+acquisition and processing rules. A selected-file access, parse, version,
+composition, decode, or validation failure is terminal and does not resume the
+search. Optional exhaustion shares the absent-main lifecycle; required
+exhaustion reports a missing-source diagnostic. No candidate-attempt history is
+added to public metadata.
+
+This keeps convention choice with applications while moving repeated selection
+and loading plumbing into the library's established lifecycle. It preserves
+explicit control, ordinary source behavior, and complete-on-return ownership.
+
+## Alternatives Considered
+
+- **Keep all search and fallback loading in each application.** This preserves
+  consumer ownership but repeats the file-selection and load coordination that
+  ConfigKit already owns, and risks divergent handling of selected-file errors.
+- **Search conventional locations implicitly during every load.** This reduces
+  setup, but activates filesystem access and precedence the consumer did not
+  select and makes ordinary source behavior less predictable.
+- **Return candidate paths for the application to load one by one.** This keeps
+  selection outside the load lifecycle and encourages repeated complete loads,
+  potentially rerunning defaults, callbacks, and validation during fallback.
+
+## Consequences
+
+The public search description must be immutable and root-owned, with private
+engine conversion and selection. The contract documents candidate ordering,
+selection, exhaustion, context, and provenance; the API declaration documents
+the public symbols. Dynamic bases and file availability are observed when each
+load consumes the description. Applications remain responsible for selecting
+conventions and for their schema and domain requirements.
+
+The [configuration contract](../config.md) owns implemented behavior, and the
+[component overview](../internal/overview.md) describes implementation ownership.
+The completed implementation plan and remediation record are preserved in Git
+history at `0369111` under `docs/roadmap/`.

docs/config.md

@@ -12,6 +12,7 @@ ConfigKit exposes opaque sources through these constructors:
 | Constructor | Current contract |
 | --- | --- |
 | `File(path)` | Requires a nonempty path, opens a regular file for each consumption, and closes only the library-owned file handle. Missing, inaccessible, unreadable, directory, and other nonregular inputs fail. |
+| `SearchConfig(application, search, options...)` | Creates an explicit, reusable search source. Loading selects one host file or follows the absent-input lifecycle when an optional search is exhausted. |
 | `NewFilesystem(label, filesystem).File(name)` | Borrows a caller-owned `fs.FS` under a safe nonempty display label. `name` must be a non-root slash-relative `fs.ValidPath`. Each load reopens the selected regular file; copies of the `Filesystem` preserve namespace identity. Separate constructors create separate namespaces even for the same label or filesystem. |
 | `Bytes(label, data)` | Requires a nonempty, non-secret diagnostic label and snapshots bytes during construction. Later caller mutation cannot affect the source. |
 | `Reader(label, input)` | Requires a nonempty, non-secret label and non-nil reader. The reader is claimed once across all copies of the source, consumed but never closed, and cannot be reused. |
@@ -28,6 +29,79 @@ Keys are sorted for stable provenance, integer decimal spelling stays exact, and
 cycles or unsupported types are rejected without exposing values. Mapping input
 uses the same directive and version rules as YAML, not CLI override restrictions.
 
+### Configuration discovery
+
+Discovery is opt-in. Construct `Search` from literal `Paths`, directory searches,
+or the supported directory presets, then pass it to `SearchConfig`. Search
+descriptions are immutable and reusable; each load resolves dynamic directories
+and checks current candidate files again. `Searches` is ordered concatenation.
+It preserves the supplied description order and does not deduplicate candidates.
+
+`NamedFilenames` selects `<application>.yml`, then `<application>.yaml`.
+`GenericFilenames` selects `config.yml`, `config.yaml`, `main.yml`, then
+`main.yaml`. `SearchDirectory` defaults to `[Named, Generic]` when options are
+omitted or `Filenames` is nil. A non-nil empty filename list contributes no
+candidates and does not resolve its directory. `CustomFilenames` supplies
+literal single filename components; it does not expand application-name
+placeholders. An application slug is required only when a selected directory or
+filename group uses it. Literal custom paths are not expanded for `~`, variables,
+or wildcards; relative paths are resolved from the working directory at load time.
+The zero `Search`, `Searches()`, `Paths()`, and an empty custom filename group
+contribute no candidates. An explicitly supplied empty path or filename is
+invalid. Slugs and custom filenames must be usable single host filename
+components; ConfigKit preserves their case and spelling.
+
+Search expansion is ordered concatenation. For each directory search, ConfigKit
+tries its filename groups and names before advancing to the next directory.
+When multiple directories use the same filename list, candidates follow the
+directory-first Cartesian product: every filename in one directory is tried
+before the next directory. Explicit file candidates stay at their declared
+positions among directory searches.
+
+The presets expand to these ordered directories and filename groups:
+
+| Preset | Directory, in order | Filename groups |
+| --- | --- | --- |
+| `UnixSystemDirectories` | `/usr/local/etc/<application>`, `/etc/<application>` | Named, then Generic |
+| `UnixSystemDirectories` | `/etc` | Named only |
+| `UserConfigDirectory` | Go user-config directory / `<application>` | Named, then Generic |
+| `UserConfigDirectory` | Go user-config directory | Named only |
+| `HomeDirectory` | Go home directory / `.<application>` | Named, then Generic |
+| `HomeDirectory` | Go home directory | Named only |
+| `WorkingDirectory` | Current working directory | Named only |
+
+The Unix system preset is supported on aix, android, darwin, dragonfly, freebsd,
+hurd, illumos, ios, linux, netbsd, openbsd, and solaris; reaching it on another
+platform is an option error. Other presets use Go's user-config, home, and
+working-directory helpers. A reached
+directory-helper error terminates selection. Bases for later searches are not
+resolved after an earlier candidate is selected. Missing candidates continue;
+the first existing candidate is selected and then follows ordinary file loading
+rules. Errors while acquiring or processing a selected file are terminal and do
+not resume the search.
+
+Searches are optional by default. Exhaustion uses the same absent-main lifecycle
+as `NoSource()`: there is no main document, source record, source ID, or explicit
+presence contribution. Imports may be enabled but there are no main declarations
+to traverse. Defaults, version checks, overlays, CLI overrides, resolution, and
+validation retain their normal lifecycle. `SearchOptions{Required: true}` makes
+exhaustion an error; it does not change candidate or selected-file error handling.
+
+For an ordinary active overlay after optional exhaustion, provide an explicit
+filesystem context. A host context with only `Root` is sufficient; ConfigKit
+loads the overlay at its normal root-relative location and does not infer a root
+from attempted search directories. The same root-only context can accompany a
+search that selects a file: the selected file determines its base and must be
+inside `Root`. A selected host file rejects an explicit `BaseDir` or native
+filesystem context. Invalid context fails without resuming selection. Layered
+overlays keep their independent `OverlayFilesystem` requirement.
+
+When a search selects a file, inspection reports that actual file with ordinary
+source IDs, paths, placement, metadata origins, and resource context. Missing
+candidates create no records. `SearchConfig` can be used as the main source of
+ordinary or layered loading, including an underlay input, and does not add a new
+precedence tier.
+
 Each source is limited to 8 MiB. A load using imports or an active overlay is limited
 to 64 MiB across all accepted sources, 1,024 accepted sources, 64 active import
 edges, and 1,000,000 input nodes in aggregate. Glob expansion separately permits
@@ -52,10 +126,11 @@ preserves already validated secret state without rereading the environment.
 The current lifecycle is:
 
 ```text
-validate options → parse the selected source → traverse/compose enabled imports
+validate options → parse the selected source → extract source controls and
+  traverse/strictly compose enabled imports
   → build schema → check the optional application version → apply a selected overlay
-  → apply explicit CLI overrides → expand sibling inheritance
-  → create and clone defaults → strictly decode
+  → expand sibling inheritance
+  → create and clone defaults → strictly decode → apply explicit CLI overrides
   → recorded application resolution
   → resolve typed secret references → semantic validation → classify secrets
   → snapshot configuration and metadata
@@ -68,17 +143,23 @@ contributes no source, and continues through defaults, decode, and projection. A
 missing file remains an error; it is never interpreted as no input.
 
 `Options` accepts the application definition, ordinary-source `Destination` and
-`PlacementMode`, explicit path and glob imports, one selected overlay, filesystem
+`PlacementMode`, explicit imports, one selected overlay, filesystem
 context, explicit CLI overrides, and shared source-version controls. The definition
-may register strict sequence composition paths through
-`SequenceCompositions`. Its zero-valued placement mode places the source mapping
+may register sequence identities through `Definition.SequenceIdentities`. Its
+zero-valued placement mode places the source mapping
 at the destination; `sequence-item` explicitly wraps the mapping as one item at a
 non-root destination. Unknown modes, invalid destinations, and invalid or
 conflicting sequence registrations fail before source acquisition. Overlay and
-CLI coordinates remain rooted at the application root. `NoSource` rejects
-imports, active overlays, and filesystem context as invalid combinations but
-accepts overrides. Input containing a reserved `configkit` mapping key is rejected
-while imports are disabled.
+CLI coordinates remain rooted at the application root. Ordinary `Load` recognizes
+source-root collection declarations whether or not imports are enabled; an
+`imports` declaration still requires imports to be enabled. `NoSource` may enable
+imports, but it has no main declarations to traverse. It accepts an explicit
+filesystem context: a host context requires an absolute existing `Root` and may
+omit `BaseDir` to use that root as its internal import base; a native context
+requires its namespace, `BaseDir`, and `Root`. Supplied context is validated even
+when imports are disabled. An active ordinary overlay requires this explicit
+context. `NoSource` accepts overrides and remains absent rather than contributing
+an empty document.
 
 Every source, options, schema, version, defaults, decode, resolution, or validation
 failure returns a nil result and a `*LoadError`. Successful results contain caller-owned `Config`, detached
@@ -128,26 +209,34 @@ nothing. Underlay groups are listed from lowest to highest priority. Repeating
 a file within one group remains an import/repetition error; the same reusable
 source may be selected again in another tier.
 
-ConfigKit acquires and composes the main input first, constructs the schema,
-and checks the optional application version from the main tier only. Underlay
-roots cannot claim that version path (`underlay.version`); imported fragments
-retain `import.version` protection. It then acquires and composes underlay
-groups in order, recursively combines the groups, and applies the main tier,
-one selected overlay, and explicit CLI overrides. Scalar, sequence, and null
-definitions replace lower values between tiers; mappings combine recursively.
-Syntax and strict-composition errors inside a tier cannot be masked by a
-higher-priority tier. Defaults, typed decoding, resolution, secret lookup,
-validation, and publication run once on the final assembled input.
+ConfigKit acquires the main input first and constructs the schema. It then
+acquires and strictly composes underlay groups from lowest to highest priority,
+passing each group's accumulated lower collection policy into the next group.
+Each group is applied once as a precedence tier. The main tier is then composed
+with the accumulated underlay policy, and the optional application version is
+checked against that composed main tier only. Underlay roots cannot claim that
+version path (`underlay.version`); imported fragments retain `import.version`
+protection. ConfigKit then applies the selected overlay and resolves inheritance.
+Scalar, sequence, and null definitions replace lower values between tiers unless
+a collection policy defines the sequence operation; mappings combine recursively.
+After successful defaults and typed decoding, CLI overrides are applied to that
+typed configuration before application resolution. Syntax, strict-composition,
+inheritance, and decoding errors cannot be masked by a CLI override. Resolution,
+secret lookup, validation, and publication run once on the resulting values.
 
 An active layered overlay requires `LayeredOptions.OverlayFilesystem` explicitly,
 independent of the main source's namespace. Its name and root-relative lookup
 follow the selected-overlay rules below; inactive overlays ignore the context.
 The same path in a different filesystem namespace is not a repeated file.
-Ordinary `Load` continues to infer its selected-overlay context from its source.
+Ordinary `Load` infers overlay context from sources that provide one; with
+`NoSource`, it requires the explicit `Options.Filesystem` context.
 
 Source IDs follow acquisition order—main and its depth-first imports, then each
 underlay tier's inputs and depth-first imports, then overlay and CLI—even though
-history follows precedence order. Source `Layer` describes precedence while
+history follows precedence order. Default main-version checking happens after
+underlay composition because the main tier inherits the accumulated collection
+policy. Enabled per-source version checks retain acquisition order and source
+local headers. Source `Layer` describes precedence while
 `Kind` describes acquisition. Underlay records use `LayerUnderlay` and a
 one-based `UnderlayIndex` giving their original tier position; all other records
 have index zero. Explicit empty groups and `NoSource` consume no source ID.
@@ -213,28 +302,55 @@ is recorded in [ADR 0011](adr/0011-input-destinations.md) and
 
 Any input mapping may declare `extends: name` to inherit from the mapping named
 `name` among its immediate siblings. Names are exact keys, including the empty
-string; lookup does not search ancestor or unrelated scopes. The document root
-and a sequence-element mapping have no sibling namespace for their own string
-relationship, though mappings nested inside them can have one. An `extends`
+string; lookup does not search ancestor or unrelated scopes. A mapping inside a
+sequence can also participate in record inheritance when that sequence has an
+effective identity declaration from `configkit.sequences` or an application
+registration. In that case, `extends` is a mapping containing exactly the
+sequence's identity fields, with scalar values; lookup is limited to that final
+sequence. The document root and a sequence-element mapping without an effective
+identity declaration have no sibling namespace for non-null string
+relationships, though mappings nested inside them can have one. An `extends`
 value of null cancels a relationship without looking up a parent. Other value
-types, missing or non-mapping parents, and cycles fail the load with value-free
-diagnostics.
+types, incomplete or extra reference fields, missing parents, and cycles fail
+the load with value-free diagnostics.
+
+Within each mapping sibling scope or identified sequence, direct definitions
+resolve by dependency readiness. A parent is resolved before a child; among
+currently eligible definitions, the lexically smallest canonical semantic
+pointer is selected, including newly eligible definitions as soon as their
+parent completes. This ordering governs inheritance operations and their
+history, controls, and transfers. It does not reorder mappings or sequence
+records in the resulting configuration.
 
 `extends` is reserved structural input across ordinary and layered loads, every
 source kind, imports, selected overlays, and explicit CLI overrides. It is
 consumed before typed decoding and need not appear in the application's Go
 types. Applications previously using `extends` as an ordinary YAML field must
 rename that key and its field. No collection registration or keyword setup is
-required.
+required for mapping-sibling relationships; identified-sequence relationships
+require effective identity fields for that collection.
 
 ConfigKit completes strict composition within tiers and precedence assembly
-between tiers before resolving relationships. An omitted `extends` retains a
-lower-priority relationship; `extends: null` cancels it while preserving the
-child's own settings. Superseded references are historical evidence, not active
-relationships to validate. Each child recursively overlays its own settings
-over its resolved parent: explicit zero, false, empty string, sequence, and
-null values replace inherited values, while mappings combine recursively.
-The child retains its key. All effective relationships resolve, including
+between tiers before resolving relationships. Only records that survive that
+assembly participate in identified-sequence lookup: an upserted parent supplies
+its final record, a replaced parent is unavailable, and a higher replacement
+without `extends` supersedes a lower relationship. An omitted `extends` retains
+a lower-priority mapping-sibling relationship; an identified record's effective
+directive depends on the record that survives assembly. `extends: null` cancels
+a relationship while preserving the child's own settings. Superseded references
+are historical evidence, not active relationships to validate. Each child
+recursively overlays its own settings over its resolved parent: explicit zero,
+false, empty string, and
+null values replace inherited values, while mappings combine recursively. For
+identified records, the child's identity fields and their origins remain its
+own; parent identity fields do not contribute to the payload.
+Sequences at collection destinations use the shared collection operation with
+the parent as lower input and the child as higher input. The destination's
+explicit mode applies; otherwise a copied identity selects upsert and an
+unkeyed destination replaces. A parent's explicit mode does not move to a
+different destination. Sequences outside collection destinations remain atomic
+replacements.
+All effective relationships resolve, including
 entries the application may never select for execution. Partial parent
 definitions undergo normal typed decoding and application-owned validation,
 not a special structural exemption.
@@ -416,20 +532,22 @@ the descendant can therefore retain history after `Lookup` stops reporting it as
 effective. Equal-valued input is still an explicit base definition, while a derived
 value for absent input remains non-explicit.
 
-Appending registered records during strict composition assigns each contribution
-its assembled sequence index in history. A later precedence tier that supplies a
-sequence records replacement at the sequence path; history does not imply
-identity-based merging across tiers.
+Strict composition assigns contributed records their assembled sequence positions
+in history. Across tiers, history follows the selected
+[collection operation](#strict-document-composition), including append and
+whole-record upsert. Incoming contributions use their assigned positions, and
+replaced payload remains available as historical evidence.
 
 A mapping assembled from the selected file and imports has one composite base origin
-whose locations retain source traversal order. A mapping also visited by an overlay
-has an overlay-layer composite origin with the lower contributing locations followed
-by the overlay location; an empty mapping is still an explicit container even though
-it contributes no children. Resolution origins are synthetic: they have layer
+whose locations follow [scoped assembly order](#explicit-imports), not source-record
+acquisition order. A mapping also visited by an overlay has an overlay-layer
+composite origin with the lower contributing locations followed by the overlay
+location; an empty mapping is still an explicit container even though it contributes
+no children. Resolution origins are synthetic: they have layer
 `resolution`, no fabricated file location, and a `derived_default` or `normalization`
 operation. Reasons and dependency paths retain first occurrence order with duplicates
-removed. Source records remain ordered as selected source, depth-first imports, the
-selected overlay, then synthetic CLI records in supplied order.
+removed. Source records and IDs retain [acquisition order](#explicit-imports),
+including the underlay ordering described in [layered loading](#layered-loading).
 
 Inheritance adds no acquired source or precedence layer. `Origin.Inheritance`
 lists concrete transfers from contributor paths through destinations, with
@@ -492,29 +610,34 @@ historical path. Its effective value and each chronological before/after value a
 `ValueSnapshot` records containing deterministic YAML text rather than mutable Go or
 parser values. `Present=false` with empty YAML means absence or deletion; explicit
 null is present and renders as `null`. The history starts with the canonical typed
-application-default or Go-zero baseline, then includes only relevant base sources in
-traversal order, the selected overlay, supplied CLI records, and audited net
-resolution operations. Structural inheritance events appear after source replay
-and before typed reconciliation, including consumed or canceled `extends` input
-and equal-valued child replacements. Overlapping parent/child resolution records
+application-default or Go-zero baseline, followed by relevant underlay and main-tier
+contributions in precedence order, the selected overlay, and structural inheritance
+events. Typed defaulting and decoding reconcile that source history before supplied
+CLI records and audited net resolution operations. Within each strict tier, replay follows
+[scoped assembly order](#explicit-imports), not source-record acquisition order.
+Inheritance events include consumed or canceled `extends` input and equal-valued
+child replacements. Overlapping parent/child resolution records
 are rendered
 as one net subtree event with combined reasons and dependencies, rather than
 pretending that the recorded assignments ran in lexical order. Explicit equal
-writes remain visible. When input replay
-differs from the final typed input, a `ChangeDecoding` event records the transition
-before domain resolution. Its origin retains the decoded path's source/default
-attribution; its reason identifies static-default retention and canonical decoding.
-This built-in inspection operation is not accepted by `Resolution.Record`.
+writes remain visible. When structural replay differs from the pre-CLI typed input,
+a `ChangeDecoding` event records retained defaults and canonical decoding. CLI
+contributions then retain their raw input representation while effective and
+resolution values use the typed projection. This built-in inspection operation is
+not accepted by `Resolution.Record`.
 
 Base, overlay, and CLI history preserves the policy-validated input representation,
 including a superseded value that could not have decoded into the final Go field.
 Baseline, effective, and resolution values use canonical typed projection. A
 decoding event bridges replayed input and canonical typed values, so intermediate
 null/scalar replacements cannot incorrectly imply permanent default removal. Mapping
-queries reconstruct each source or override contribution, while sequences remain
-atomic: a descendant history identifies its presence before and after the containing
-sequence replacement without implying element-wise merging. Removed paths remain
-explainable; unknown and malformed paths return false.
+queries reconstruct each source or override contribution. A sequence snapshot
+represents the collection at that point in replay, and sequence diffs remain
+atomic. Descendant queries describe their presence and values before and after
+containing sequence operations. Combination follows the
+[collection operation tables](#strict-document-composition); upsert replaces
+matching records in full. Removed paths remain explainable; unknown and malformed
+paths return false.
 
 Every snapshot applies the same historical tag, predicate, and recorded-dependency
 sensitivity closure as effective rendering before YAML is exposed. A redacted scalar
@@ -601,13 +724,15 @@ must resolve to a nonempty value. Secret references work in typed structs, maps,
 pointers, slices, and arrays. A dynamic `any` value does not establish secret
 semantics and cannot contain `Secret`; applications must use a typed slot.
 
-ConfigKit resolves only the effective names after recorded application resolution
-and before semantic validation. Each unique name is read with `os.LookupEnv` once
-per load. Validation can inspect the credential through the deliberately named
-`Value()` accessor and distinguish success with `IsResolved()`. Later loads read
-the environment again, and cloned defaults are rebuilt from names so a previously
-resolved result cannot retain a stale credential. `Load` never writes to the
-environment.
+ConfigKit resolves only the effective names after CLI assignment and recorded
+application resolution, and before semantic validation. CLI overrides may supply
+or replace a typed secret reference; lookup uses that effective name and retains
+its effective source location for diagnostics. Each unique name is read with
+`os.LookupEnv` once per load. Validation can inspect the credential through the
+deliberately named `Value()` accessor and distinguish success with `IsResolved()`.
+Later loads read the environment again, and cloned defaults are rebuilt from names
+so a previously resolved result cannot retain a stale credential. `Load` never
+writes to the environment.
 
 Credential bytes are held only in the per-load lookup state and the trusted returned
 configuration, and are returned only by `Value`. Secret formatting uses a safe
@@ -671,18 +796,19 @@ files when appropriate; ConfigKit stores no implicit global report.
 
 ### Recorded application resolution
 
-An optional `Definition.Resolve` callback runs after successful typed decoding. It
-receives the working configuration and a per-load `Resolution` context. The context's
+An optional `Definition.Resolve` callback runs after successful defaults, typed
+decoding, and explicit CLI assignment. It receives the working configuration and a
+per-load `Resolution` context. The context's
 `IsExplicit` query uses surviving input presence, so explicit false, zero, empty, and
 null are never confused with absence or static defaults.
 
 `Resolution.InputInfo(path)` returns detached effective metadata from the fixed
-decoded entry state, before application resolution runs. It includes retained static
-defaults, preserves explicit null, and uses the same exact semantic path matching as
-`Metadata.Lookup`; missing, malformed, and key/index-shape-mismatched paths return
-false without diagnostics. Its `Explicit` value agrees with `IsExplicit` for every
-found entry path. Resolution changes, additions, removals, and moves do not alter
-this entry view.
+post-decode entry state, including explicit CLI overrides, before application
+resolution runs. It includes retained static defaults, preserves explicit null, and
+uses the same exact semantic path matching as `Metadata.Lookup`; missing,
+malformed, and key/index-shape-mismatched paths return false without diagnostics.
+Its `Explicit` value agrees with `IsExplicit` for every found entry path. Resolution
+changes, additions, removals, and moves do not alter this entry view.
 
 `Resolution.Source(id)` returns a detached record for an already acquired source in
 the same load: the main source, imports, selected overlay, and supplied CLI records
@@ -757,8 +883,11 @@ live services as a substitute for configuration validation.
 
 ## Strict document composition
 
-ConfigKit strictly composes parsed base documents when `Options.Imports` is true.
-Application defaults do not participate in this operation.
+Ordinary `Load` applies strict document composition to its parsed source scope;
+`Options.Imports` adds imported documents as peers in that scope. Application
+defaults do not participate. With imports disabled, the single source still has
+its controls extracted and any declared or registered collection identity is
+validated, but there are no imported peers to combine.
 
 | Existing node | Incoming node | Result |
 | --- | --- | --- |
@@ -769,54 +898,147 @@ Application defaults do not participate in this operation.
 | Any other pair of present nodes | Any other pair of present nodes | `compose.conflict` |
 
 Every non-mapping overlap is a conflict, even when values are equal, except for
-sequence/sequence contributions at a registered sequence-composition path. Nulls
-remain atomic conflicts. Unregistered sequences conflict when repeated and are
-never joined by index. Disjoint entries under shared mappings compose, making
-stable keyed mappings the natural representation for independently contributed
-entries.
+sequence/sequence contributions at a destination with effective identity from an
+application registration, a current YAML `key` declaration, or retained lower
+policy. Nulls remain atomic conflicts.
+Sequences without effective identity conflict when repeated and are never joined
+by index. Disjoint entries under shared mappings compose, making stable keyed
+mappings the natural representation for independently contributed entries.
 
-`Definition.SequenceCompositions` registers literal mapping paths and one literal
-`IdentityField` for sequences that should compose independently authored records.
-Registration paths follow input-destination key rules: parsed numeric tokens are
-literal mapping keys, explicit index segments and reserved `configkit` or
-mapping-valued `extends` segments are invalid, and the root registration is
-harmless and unused. The identity field is one literal string key; neither the
-field name nor identity strings are normalized.
-At each registered path, every actual sequence contribution in a strict tier is
-validated, including a singleton contribution: each record must be a mapping with
-a present string identity field. Distinct exact identity strings append in source
-and list order; duplicate identities conflict even if the records are otherwise
-equal or disjoint. Empty identity strings are valid. Malformed records produce
-`compose.invalid`; duplicate identities produce `compose.conflict`, with the
-sequence container and source locations identifying a duplicate without exposing
-identity values. Missing paths and non-sequence values do not fail by themselves.
-Identical registrations coalesce; conflicting registrations at one path and
-invalid registration paths produce `options.invalid`. Unused and root registrations
-are allowed and have no effect.
+`Definition.SequenceIdentities` contains registrations created by
+`SequenceIdentityAt` or `SequenceIdentityMatching`. The exact form accepts a
+mapping-only `Path`; the matching form accepts literal-key and any-mapping-key
+segments created by `SequenceLiteralKey` and `SequenceAnyMappingKey`. A literal
+`"*"` key is distinct from the wildcard constructor. Parsed numeric path tokens
+remain literal mapping keys; explicit index segments and reserved `configkit` or
+mapping-valued `extends` segments are invalid. The root selector is harmless under
+the mapping-root schema. Selector segments consume one mapping level and match a
+complete destination; an any-mapping-key segment matches exactly one key, not an
+arbitrary prefix or suffix. Each registration requires one or more literal,
+direct field names; compound field sets are normalized as sets, and field names
+are not otherwise normalized. The same field-set and scalar-equality rules apply
+to YAML `key` declarations.
 
-Registration changes strict composition only. Each underlay group and the main
-tier has independent duplicate-identity state. Precedence assembly is unchanged:
-a present higher-priority sequence replaces the lower sequence as one value,
-including at a registered path. Overlays, CLI overrides, defaults, inheritance,
-and application resolution do not run the registered identity check. The accepted
-rationale is recorded in [ADR 0014](adr/0014-sequence-placement-and-composition.md).
-The [maintained prompt catalog](consumers/README.md#identified-prompt-sequences)
-shows item path and glob imports, helper-supplied identity, and main-tier
-replacement of a lower-priority sequence.
+At each selected path, records must provide every effective identity field as a
+scalar string, number, boolean, or explicit null. Field names form a set, so
+order and repetition do not affect compound identity. The type-tagged tuple
+preserves category distinctions: strings compare exactly, including empty
+strings; numbers, booleans, and null remain distinct categories. Finite numbers
+compare by exact mathematical value, so `1`, `1.0`, and `1e0` are equal, as are
+`0` and `-0`, without floating-point rounding. Distinct tuples append in source
+and list order; duplicate tuples conflict even when records are otherwise equal
+or disjoint. Malformed records produce `compose.invalid`; duplicate identities
+produce `compose.conflict`, with paths and source locations identifying a
+duplicate without exposing identity values. Missing paths and non-sequence values
+do not fail by themselves. Equivalent overlapping registrations coalesce.
+Incompatible overlaps and invalid registrations produce `options.invalid` before
+source acquisition. Unused and root registrations are allowed and have no effect.
+
+Registrations provide identity for strict composition, sequence operations,
+inheritance lookup, and final validation. Dynamic selectors apply at concrete
+strict-composition, inheritance, and final-result destinations without requiring
+the application to enumerate mapping keys. Each strict tier has independent
+duplicate-identity state among its peers; layered precedence and inheritance
+then apply the collection operation described below.
+
+Final registration checks run in both ordinary and layered loads after effective
+secret lookup and before application semantic validation. They examine actual
+final typed sequences, including values introduced by defaults, CLI, or recorded
+resolution; they do not require path existence or sequence shape. Diagnostics
+use concrete collection and item paths and available source locations, without
+exposing identity or credential values. The guarantee ends when loading publishes
+successfully and does not cover later caller mutations.
+YAML-only identity is enforced during structural composition, precedence, and
+identified inheritance; it carries no final-result guarantee after typed
+defaults, CLI, or application resolution. Applications that need that guarantee
+register the identity constraint.
+The [maintained catalog examples](consumers/README.md#identified-prompt-sequences)
+show strict peers, precedence operations, inheritance, dynamic destinations, and
+the distinction between YAML-only declarations and application registrations.
 When an enabled source-version mode is selected, declarations are checked in each
 source's own coordinates before placement and composition. Accepted non-main
 headers are consumed before strict composition and cannot supply a registered
 record identity. Final typed decoding and application validation still run on the
 completed configuration.
 
+Ordinary sources, layered inputs, and selected overlays may declare collection
+behavior under `configkit.sequences` at the document root. Each entry has a
+required literal `destination` and may specify `key` as one string or a nonempty
+list of strings, plus a `mode` of `replace`, `append`, or `upsert`. These
+controls are removed before application decoding. A declaration destination is
+relative to that source's placement, so a mounted fragment's declaration is
+mounted with its values. Declarations from strict peers must agree on identity
+fields and on any explicitly supplied mode; omission expresses no mode
+preference. They apply even when the declaring source has no value at that
+destination: a key validates an existing retained sequence or remains pending
+until records arrive, while a mode-only declaration affects later combinations
+without recombining earlier tiers. A key supplies the identity used by `append`
+and `upsert` and is checked against any application registration.
+
+Strict peers at an identified destination first combine distinct records in
+source and list order. Duplicate identities among peers or within one
+contribution fail under every mode. After strict composition, precedence and
+inheritance use one operation for the assembled incoming collection:
+
+| Mode | Behavior at source-precedence and inheritance boundaries |
+| --- | --- |
+| `replace` | Replace the complete lower sequence with the assembled higher sequence. |
+| `append` | Retain lower records and append higher records; duplicate identities fail. |
+| `upsert` | Replace matching records in full at their lower positions, retain unmatched lower records, and append new identities. |
+
+Upsert replaces the complete matched record; it does not recursively merge
+record fields. Append and upsert require identity. With no explicit mode in the
+current tier, an explicit lower mode persists; if none exists, effective identity
+selects upsert and its absence selects replace. Inferred modes do not persist.
+Explicit modes persist at their destination until changed by a higher explicit
+mode, independently of YAML identity lifetime. A declaration alone does not
+clear or recombine a collection.
+
+The presence and value kind at a precedence or inheritance boundary determine
+whether a collection changes:
+
+| Higher contribution | `replace` | `append` / `upsert` |
+| --- | --- | --- |
+| Absent | Leave the lower value unchanged. | Leave the lower value unchanged. |
+| Explicit `[]` | Clear the sequence. | Contribute no records. |
+| Explicit null or another non-sequence value | Replace the lower value, subject to application schema. | Error; the operation requires a sequence. |
+
+An absent lower value can be initialized by an incoming sequence under any mode.
+A present lower null or other non-sequence value is not absence: append and
+upsert cannot combine with it. An empty sequence still requires a valid mode and
+identity where applicable. Null used as an identity component inside a record is
+distinct from null used as the collection value.
+
+Declarations govern ordinary strict source composition, including loads with
+imports disabled, and each strict scope in layered loading. Before composing a
+higher tier's peers, ConfigKit makes applicable lower identity and explicit mode
+available; after peer composition, the tier applies its resolved operation
+against the lower collection. Selected overlays use the same collection policy
+after the base source graph is composed. During mapping-sibling inheritance, a
+parent's YAML identity can follow its collection to the child destination, while
+the parent's explicit operation stays at the parent destination. The child
+destination selects its operation; absent one, effective identity implies
+upsert and its absence implies replace. Whole-sequence replacement discards
+lower YAML identity and uses the replacing scope's key declaration, if any;
+without one, the collection is unkeyed unless an application registration still
+supplies identity. Replacement discards policies owned by removed records, while
+an independently declared explicit mode and application registration remain
+applicable. Item-local
+policies follow their owning records: retaining a record retains its rules, while
+whole-record upsert replacement discards the displaced record's rules. Matching
+identity or reusing an index does not transfer them. These policies do not change
+CLI behavior: CLI sequence assignments replace whole sequences after decoding.
+A root `configkit.imports` declaration still requires `Options.Imports`;
+`NoSource` has no declaration scope.
+
 An empty mapping contributes no child definitions. Two empty mappings compose, and
 an empty mapping neither clears nor conflicts with another mapping's children.
 Shared mapping containers retain all contributing value locations as their composite
-base origin. A conflict reports the first claim as its primary location and every
-remaining claim as related locations, in deterministic source and declaration
-traversal order. Traversal order never authorizes replacement. Composition clones
-the resulting tree and its ordered claim records rather than mutating or aliasing an
-input document.
+base origin. A conflict reports the first claim in
+[scoped assembly order](#explicit-imports) as its primary location and every
+remaining claim as related locations in the same order. Assembly order never
+authorizes replacement. Composition clones the resulting tree and its ordered
+claim records rather than mutating or aliasing an input document.
 
 ## Selected overlays
 
@@ -827,13 +1049,21 @@ Every other name resolves only to `<configuration-root>/overlays/<name>.yml`, wi
 no extension fallback, case normalization, inheritance between overlay files,
 or overlay stack. A selected missing overlay is an error.
 
+With `NoSource`, the main input stays absent and the explicit filesystem context
+supplies the overlay root. The overlay is recorded as the first acquired source
+when no other source exists. Host contexts may use the root-only form described
+under [single-source loading](#single-source-loading); native contexts retain
+their complete namespace, base, and root requirements.
+
 The overlay is a separately policy-validated YAML mapping. It is loaded after the
 base import graph is composed and its schema version is checked, but before defaults
 and typed decoding. Overlay bytes, nodes, and source records count toward the same
 aggregate limits as base inputs. Its canonical path must remain within the configured
 root and must not duplicate a file already present in the base graph.
 
-Overlay is intentionally distinct from strict composition:
+Collection destinations follow the
+[collection operation and presence rules](#strict-document-composition) above.
+The following table describes ordinary overlay behavior elsewhere:
 
 | Existing lower node | Incoming overlay node | Result |
 | --- | --- | --- |
@@ -842,18 +1072,24 @@ Overlay is intentionally distinct from strict composition:
 | Mapping | Mapping | Recurse by mapping key |
 | Any other pair of present nodes | Any other pair of present nodes | Replace the entire lower node |
 
-Scalars, sequences, and null are atomic. Thus an overlay sequence replaces rather
-than extends a base sequence, `[]` clears it, null is an explicit replacement, and
-cross-kind replacement is allowed when the final application schema accepts it.
+Under these ordinary rules, scalars, sequences, and null are atomic. An overlay
+sequence replaces rather than extends a base sequence, `[]` clears it, null is an
+explicit replacement, and cross-kind replacement is allowed when the final
+application schema accepts it.
 Replacing a subtree removes all displaced descendants from effective presence and
 origin data; history retains the displaced definitions and identifies the parent
 replacement. Surviving overlay paths have overlay origins, while recursively shared
 mapping containers retain their contributing locations.
 
-An overlay may not contain `configkit` anywhere, contribute the configured schema
-version, or replace an ancestor of that version with a scalar or null. These rules
-apply even if the supplied version text would be unchanged. Overlays cannot mask a
-base parse, composition, or version failure because those checks run first.
+An overlay may contain only root `configkit.sequences` declarations; overlay
+imports and nested directives are rejected. Sequence declarations are removed
+before application decoding. At declared or registered sequence destinations,
+`replace`, `append`, and `upsert` use the same identity and policy rules as source
+composition. Other overlay sequences remain atomic replacements. An overlay may
+not contribute the configured schema version or replace an ancestor of that
+version with a scalar or null. These rules apply even if the supplied version
+text would be unchanged. Overlays cannot mask a base parse, composition, or
+version failure because those checks run first.
 
 ## Explicit CLI overrides
 
@@ -865,10 +1101,16 @@ must never contain the raw argument or configured value. General environment
 variable overlays are an explicit non-goal: environment access is reserved for
 typed secret references.
 
-Overrides apply after the selected overlay and before typed defaults/decoding, so
-the input precedence is application defaults < composed base < selected overlay <
-CLI. Recorded resolution, typed secret lookup, and semantic validation follow the
-effective override tree. Overrides also work with `NoSource`.
+Overrides are prepared after source assembly and inheritance, then assigned after
+typed defaults and decoding and before application resolution. The order is:
+defaults and decoded sources < CLI < application resolution. A CLI mapping
+recursively overlays the decoded mapping; a CLI sequence replaces the complete
+decoded sequence regardless of source collection operations. Inheritance and
+typed defaulting do not run again after CLI assignment. Earlier parsing,
+composition, inheritance, and decoding failures remain errors even if an override
+would replace the failing value. Recorded resolution, typed secret lookup, and
+semantic validation use the effective post-override values. Overrides also work
+with `NoSource`.
 
 Values are converted directly into ConfigKit's owned tree without YAML parsing or
 string coercion. Supported values are `nil`, built-in strings and booleans, all
@@ -879,7 +1121,8 @@ false, and zero remain intentional; empty sequences replace whole lists; and map
 values recursively overlay existing mappings. Map keys are sorted canonically and
 sequence order is preserved.
 
-All records are detached and validated before any is applied. Root and explicit
+All records are detached and validated before any is applied. They cannot create
+`configkit` or `extends` controls. Root and explicit
 sequence-index paths are invalid; parsed numeric tokens remain mapping keys. A path
 may create missing mapping ancestors but cannot traverse an existing scalar, null,
 or sequence. Duplicate and ancestor/descendant-overlapping records are rejected.
@@ -896,8 +1139,12 @@ unsupported types, nonfinite floats, and limit excesses fail with safe `override
 diagnostics. Diagnostics and provenance identify the safe `Flag` source, never raw
 arguments or values.
 
-Override origins are explicit CLI origins. History retains replaced base/overlay
-definitions and records equal-value replacements as well as structural changes.
+Override origins are explicit CLI origins. Resolution receives CLI values with
+their explicit-presence and source information. Absence-based defaults preserve
+those values, while recorded normalization and derivation may change them. History
+retains replaced source definitions and records equal-value replacements as well
+as structural changes. Secret lookup and validation use post-resolution values
+with their effective source locations.
 Caller-owned maps and slices are snapshotted during loading and must not be mutated
 concurrently with the call. The executable `ExampleOverride` shows translating a
 parser's explicit-set state into records while preserving an explicitly supplied
@@ -905,16 +1152,22 @@ zero.
 
 ## Explicit imports
 
-Imports are opt-in. With `Options.Imports` enabled, a document may reserve its root
-`configkit` mapping for an `imports` sequence. ConfigKit removes that mapping before
-application decoding. Each sequence item is a mapping with exactly one nonempty
-string `path` or `glob`, an optional boolean `optional`, and an optional
-`destination` sequence of strings. Every destination string is one literal
-mapping key and follows the input-destination validation rules above; quote
-numeric-looking keys so YAML reads them as strings. Null, scalar destinations,
-and non-string members are `import.invalid`, as are all other unsupported shapes
-and fields. A `configkit` key below the root is invalid. With imports disabled,
-any occurrence remains `import.disabled`.
+Imports are opt-in. With `Options.Imports` enabled, a document may use its root
+`configkit` mapping for `imports` and `sequences` controls. Ordinary `Load` may use
+`sequences` without enabling imports, but an `imports` field still requires
+`Options.Imports`. ConfigKit removes recognized root controls before application
+decoding. Each imports sequence item is a mapping with exactly one `path`,
+`dir`, or `glob` selector. `path` and `dir` accept a string or a list of strings;
+`glob` accepts one path pattern string. The optional `required` boolean controls
+whether an empty selection or a missing named path is an error. Its default is
+false, so missing imports are absent unless `required: true` is specified. The
+removed `optional` field is invalid. `destination` is an optional sequence of
+strings. Every destination string is one literal mapping key and follows the
+input-destination validation rules above; quote numeric-looking keys so YAML
+reads them as strings. Null, scalar destinations, and non-string members are
+`import.invalid`, as are all other unsupported shapes and fields. A `configkit`
+key below the root is invalid. With imports disabled, root imports and nested
+`configkit` keys remain `import.disabled`.
 
 The directive key is `configkit`, not the `_configkit` spelling used in v0.1.0.
 There is no legacy alias: `_configkit` is ordinary application data, subject to
@@ -923,38 +1176,107 @@ directive keys in root files and imported fragments, and rename any application
 fields previously named `configkit` to avoid the newly reserved key.
 
 Path declarations use slash-separated relative paths. Absolute paths and network
-URLs are invalid. Each path resolves from its declaring file's canonical directory,
-and files are traversed depth-first in declaration order: a file contributes its own
-body before its imports. Order stabilizes source records and diagnostics but never
-permits replacement. Required missing paths fail; `optional: true` suppresses only
-target nonexistence, not invalid paths, containment failures, directories,
-permissions, parse errors, or composition errors.
+URLs are invalid. Each path resolves from its declaring file's canonical directory.
+An empty `path: []` selects nothing; it succeeds even when `required: true` because
+there are no named targets to be missing. A nonempty required path list verifies
+every named target, including targets later excluded from selection.
+
+Directory declarations search the listed literal directory roots. Missing roots
+contribute no candidates; supplied inaccessible or invalid roots fail. `pattern`
+accepts one basename pattern or a list, matching filenames only. Omission selects
+all filenames; an explicit empty list selects none. `exclude` accepts one basename
+pattern or a list and removes matching final candidates. Patterns use Go's
+case-sensitive `path.Match` grammar. `recursive` enables descendant traversal;
+`depth` is valid only when recursion is effective, with direct files at depth 1 and
+depth 0 or omission meaning unlimited traversal subject to library budgets.
+`follow` controls discovered symlink entries and `hidden` controls discovered
+names beginning with a dot. Both default to true. Explicit roots retain their
+normal access behavior.
 
 Glob declarations use the slash-based Go `path.Match` grammar: `*`, `?`, character
-classes, and backslash escapes are supported, while recursive `**` syntax is invalid.
-Backslashes escape pattern characters rather than acting as directory separators.
-ConfigKit validates the complete pattern before filesystem traversal, walks only
-directories selected by preceding segments, and reads wildcard directories in
-bounded batches. Every examined entry consumes the separate visit budget, including
-nonmatches. Matches are sorted lexicographically by slash-relative spelling within
-each declaration before depth-first source traversal. A required zero-match glob is
-`import.missing`; `optional: true` suppresses only zero matches. Invalid patterns,
-walk failures, matched directories, invalid documents, escapes, and repeated targets
-remain errors. Final candidates are bounded by the remaining source limit before
-their contents are accumulated.
+classes, and backslash escapes are supported, while recursive `**` syntax is
+invalid. Backslashes escape pattern characters rather than acting as directory
+separators. ConfigKit validates the complete pattern before filesystem traversal,
+walks only directories selected by preceding segments, and reads wildcard
+directories in bounded batches. Every examined entry consumes the separate visit
+budget, including nonmatches. Literal components are explicit path components;
+`follow` and `hidden` filter only wildcard-discovered entries. `exclude` filters
+final candidate basenames.
 
-Each path or glob declaration may include `placement: mapping` or
+`Options.ImportDefaults` and `LayeredOptions.ImportDefaults` provide one
+application-owned load-wide policy for enabled imports in the main source,
+underlays, and transitive imports; they do not apply to selected overlays or
+discover sources by themselves. Each applicable field resolves independently:
+an explicit declaration value wins, then the application default, then the
+library default (`required: false`, `follow: true`, `hidden: true`,
+`recursive: false`, and unrestricted filenames). A declaration's `pattern`
+replaces rather than extends the default pattern. Nil `Pattern` leaves directory
+filenames unrestricted; a non-nil empty slice selects none. Defaults do not make
+a field applicable to selectors that do not support it, and load calls snapshot
+the supplied pointers and slice before source acquisition.
+
+A source's `configkit.sequences` declarations apply independently of import
+enablement; a `configkit.imports` declaration still requires `Options.Imports`.
+Sequence identities can be supplied either by these YAML declarations or by
+application registrations. The [strict composition contract](#strict-document-composition)
+defines their agreement, operation, and lifetime rules.
+
+Acquisition visits declarations in authored order and each declaration's selected
+paths in namespace-path lexical order, preserving source-record and version-callback
+order. Ordinary mapping contributions in a main tier are assembled dependency-first:
+ConfigKit selects the lexically smallest stable source key among the contributions
+whose imports are complete. Independent branches may interleave, and the main body
+may be assembled after its imports. Sequence-item contributions in that tier are
+nodes in the same schedule; each selected item first assembles its own strict
+mapping scope, with helpers before the bodies that import them. Those local scopes
+do not use application collection policies and are not flattened into the outer
+schedule. Item positions and diagnostic paths follow the resulting assembly order.
+Each underlay group likewise acquires its inputs before dependency-ready assembly
+in one strict scope. Independent groups remain separate precedence tiers; at a
+declared or registered destination, the assembled higher sequence uses the
+resolved collection operation against the lower sequence. Other sequences retain
+whole-value replacement between tiers. Assembly order never permits replacement.
+
+Acquisition order and resolution order serve different purposes: acquisition
+assigns source records and callback order, while the shared scheduler determines
+composition order among currently dependency-ready contributions. Inheritance
+uses the same eligibility rule within each destination-local sibling scope; it
+does not reorder the authored output mapping. The private namespace and stable-key
+construction is described in the [import implementation overview](internal/imports.md).
+
+An empty selection is allowed by default. `required: true` makes an empty directory
+or glob selection fail with `import.missing`; it also makes missing named paths
+fail. Requiredness does not suppress invalid paths, containment failures,
+directories selected as files, permissions, parse errors, or composition errors.
+
+For inspection, `SourceInfo.ImportSelections` records one outcome for each
+completed optional declaration whose entire selected set is empty. The record is
+attached to its declaring source, keeps the declaration path local to that source,
+identifies the declaration mapping (including its `SourceID`) and selector, and
+uses outcome `none`. Records remain in declaration order and are available
+through the existing result, load
+error, and callback source snapshots. They do not enumerate candidates, explain
+why a path was absent, or describe partial omissions. Empty `path: []` succeeds
+regardless of requiredness: it produces a `none` record when effectively optional,
+and no record when effectively required. Snapshots detach the record paths and
+slices.
+
+Each declaration may include `placement: mapping` or
 `placement: sequence-item`. Omission means `mapping` for that declaration,
 including every match of a glob; placement is not inherited. Sequence-item
 placement requires a nonempty effective destination and wraps the imported
 mapping as one element of a sequence there. It does not split source sequences
-or infer identity fields. Repeated sequences still conflict unless their path is
-registered through `Definition.SequenceCompositions`; registration does not
-change placement or precedence behavior. Sequence records retain source
-locations through placement and history; indexes describe their assembled
-positions while source coordinates continue to identify the declaring files.
-Header/version policy and final application validation retain their existing
-owners and timing; sequence registration is a strict-composition rule only.
+or infer identity fields. Repeated sequences combine only when the destination
+has an applicable YAML identity declaration or application registration; source
+placement remains independent of collection identity and operation. Sequence
+records retain source locations through placement and history; indexes describe
+their assembled positions while source coordinates continue to identify the
+declaring files.
+Header/version policy retains its existing owner and timing. Application
+registrations also enforce identity on the final effective typed configuration;
+YAML-only declarations are enforced at structural combination and inheritance
+boundaries. The [configuration contract](#strict-document-composition) defines
+these validation boundaries.
 
 An item import first opens a local mapping scope. Its body and ordinary helper
 imports compose within that record. An omitted helper destination or
@@ -964,8 +1286,8 @@ the record's `id`. An explicit nested `sequence-item` import creates a sequence
 inside the record, and its placement is independent of the enclosing item.
 At the record root, an item import must name a nonempty nested destination.
 Physical paths continue to resolve from the file that declares each import.
-An actual empty mapping contributes an empty item, while an optional unmatched
-path or glob contributes nothing.
+An actual empty mapping contributes an empty item, while an unmatched declaration
+with default or explicit `required: false` contributes nothing.
 
 For host files, the configuration root defaults to the selected file's canonical
 directory. A host file may supply `FilesystemContext.Root` to widen that root but
@@ -984,8 +1306,13 @@ ConfigKit canonicalizes symlinks,
 checks containment with relative paths, and opens the canonical root-relative target
 through a library-owned root handle. Contained relative or absolute symlink targets
 are accepted; escapes are rejected. Canonical paths define identity, so hard links at
-distinct paths remain distinct sources. Native filesystems use slash-path operations
-and their own symlink behavior; imports stay in their selected namespace and root.
+distinct paths remain distinct sources. Native filesystems use slash-path
+operations. Where the supplied `fs.FS` implements `fs.ReadLinkFS`, ConfigKit uses
+that capability to inspect and resolve discovered links; otherwise it follows
+the filesystem's ordinary `fs.FS` behavior. ConfigKit does not require every
+native filesystem to expose link inspection, and native filesystem behavior is
+not a general sandbox guarantee. Imports stay in their selected namespace and
+root.
 
 An active-stack repeat is `import.cycle` and reports the complete cycle's import
 sites. A previously visited canonical path is `import.repeated` and reports both

docs/consumers/README.md

@@ -6,6 +6,30 @@ applications. Consumers still own their configuration structs, defaults, semanti
 validation, schema-version policy, CLI parsing, runtime matching and conversion,
 resource checks, remote acquisition, and service initialization.
 
+## Choosing a loading entry point
+
+- Use [`Load`](../../lifecycle.go) with one source for an ordinary configuration.
+  [`SearchConfig`](../../discovery.go) is also a source, so its explicit
+  discovery result can be passed to `Load` or used as the main input to
+  [`LoadLayered`](../../layered.go).
+- Use `LoadLayered` when inputs must be composed in underlay groups before the
+  main source. Each [`Input`](../../layered.go) owns its source, filesystem,
+  destination, and import choice. The overlay filesystem context is selected
+  independently in [`LayeredOptions`](../../layered.go).
+- Load-wide rules belong to [`Options`](../../lifecycle.go) or
+  [`LayeredOptions`](../../layered.go): the application definition (including
+  version policy), import defaults, and explicit overrides. These do not turn
+  on imports or discovery by themselves. See the
+  [configuration contract](../config.md#layered-loading) and
+  [discovery contract](../config.md#configuration-discovery) for exact rules.
+
+The root [README example](../../README.md) shows the small `Load` path.
+[`layered.go`](../../examples/consumers/layered.go) demonstrates the bundled
+file and layered cases. For import-focused adoption, see the
+[prompt catalog](../../examples/consumers/prompt_catalog.go); for explicit
+discovery composed with sequences, see the
+[sequence catalog](../../examples/consumers/sequence_catalog.go).
+
 The maintained [`examples/consumers`](../../examples/consumers) package demonstrates
 sanitized shapes using only ConfigKit and the Go standard library:
 
@@ -21,7 +45,7 @@ sanitized shapes using only ConfigKit and the Go standard library:
 | Named presets | One-load sibling inheritance, explicit false, nested destination resolution, and source/derivation inspection | Choosing and executing a preset |
 | Effective configuration diff | Same-type frozen effective comparisons for two selected files or base-versus-overlay impact | Source/options selection and consumer-owned safe presentation |
 | Shared source-version checks | One `Definition.Version` policy for accepted declarations across participating source documents, with optional or required declarations and sanitized evidence | Choosing which declarations the application accepts; final assembled schema and domain validation |
-| Identified prompt sequences | Explicit item path/glob imports, helper-supplied IDs, reusable single-field registration, and main-tier replacement of a lower-priority collection | Prompt meaning and final domain validation |
+| Sequence catalogs | Declared collection operations, record inheritance, typed CLI and resolution, inspection, exact and wildcard application registrations | Catalog meaning and final domain validation |
 
 The YAML under [`testdata`](../../examples/consumers/testdata) is loaded by the
 executable examples and ordinary tests. It contains no private application data,
@@ -55,6 +79,39 @@ both without redefining their syntax. ConfigKit overlays are configuration overl
 they do not select or replace an application's LLM, model, pipeline, report, or
 execution profile concepts.
 
+## Explicit main-file discovery
+
+Applications choose the search conventions and their precedence, then pass the
+resulting `SearchConfig` source to the same `Load` or `LoadLayered` entry point.
+For example, the maintained sequence catalog puts a caller-selected file before
+a custom directory fallback while keeping its underlay and overlay choices
+independent. See [`sequence_catalog.go`](../../examples/consumers/sequence_catalog.go)
+and its [behavior tests](../../examples/consumers/sequence_catalog_test.go), plus
+the [working-directory executable example](../../examples/consumers/discovery_test.go).
+Together, the root-owned [discovery API](../../discovery.go) and [configuration
+discovery contract](../config.md#configuration-discovery) define ordered
+concatenation, directory-first Cartesian expansion, optional exhaustion, and
+selected-file behavior. [ADR 0019](../adr/0019-explicit-configuration-discovery.md)
+records why discovery is explicitly selected.
+
+## Import defaults and selection inspection
+
+`Options.ImportDefaults` and `LayeredOptions.ImportDefaults` apply one
+load-wide policy to enabled main, underlay, and transitive imports. Each field
+is resolved independently: a declaration's explicit value wins, then the
+application default, then the library default. `Required`, `Follow`, `Hidden`,
+and `Recursive` use nil pointers for unspecified values. `Pattern` applies to
+directory searches: nil leaves filenames unrestricted, while a non-nil empty
+slice selects no files. A declaration's own `pattern` replaces the application
+default. The defaults do not enable imports or change selected-overlay behavior.
+
+`Result.Sources`, `LoadError.Sources`, and `Resolution.Source` expose each
+declaring source's `ImportSelections`. These records identify the source-local
+declaration path, its authored location and selector, and the `none` outcome;
+they do not include candidate names or a guessed reason for absence. Returned
+records are detached snapshots. The [configuration contract](../config.md#explicit-imports)
+owns selector applicability and exact absence semantics.
+
 ## Shared source-version checks
 
 [`LoadVersionedService`](../../examples/consumers/source_version.go) demonstrates
@@ -166,21 +223,35 @@ import, source-location, and ownership behavior.
 
 ## Identified prompt sequences
 
-[`LoadPromptCatalog`](../../examples/consumers/prompt_catalog.go) uses one
-definition registration for the literal `prompts` path and `id` field. Its main
-file imports one prompt by path and others by glob, placing each source as an
-item. A nested ordinary helper import supplies an item's ID. The main tier
-strictly appends the distinct records in contribution order; its completed
-sequence replaces the lower-priority default collection as one value.
+[`LoadPromptCatalog`](../../examples/consumers/prompt_catalog.go) shows the
+smaller import-focused adoption path: a registered `prompts.id` identity,
+directory and glob selection, a helper import that supplies an item's ID, and
+resource lookup through the effective source context. Its executable examples
+and tests are in
+[`prompt_catalog_test.go`](../../examples/consumers/prompt_catalog_test.go), with
+complete [catalog](../../examples/consumers/testdata/prompt-catalog/config.yml)
+and [required-file](../../examples/consumers/testdata/prompt-catalog/simple.yml)
+fixtures.
 
-The example's `validatePromptCatalog` remains application-owned. It checks that
-prompt names and message lists satisfy this consumer's requirements after
-ConfigKit has composed, projected, and decoded the configuration. It does not
-add recursive record merging, identity-based overlay, or final uniqueness checks
-after defaults and resolution. See the [strict composition contract](../config.md#strict-document-composition),
-[import syntax](../config.md#explicit-imports), and
-[ADR 0014](../adr/0014-sequence-placement-and-composition.md) for the exact
-boundaries.
+[`LoadSequenceCatalog`](../../examples/consumers/sequence_catalog.go) integrates
+an underlay declaration, imported main fragments, identified-record inheritance,
+selected overlay `append`, `upsert`, and `replace`, a typed CLI override, and
+recorded application resolution. Its tests and runnable example demonstrate
+stable output order, whole-record upsert, provenance/history inspection,
+resource lookup for inherited records, and secret-safe explanation in
+[`sequence_catalog_test.go`](../../examples/consumers/sequence_catalog_test.go).
+[`LoadNamespacedMapCatalog`](../../examples/consumers/sequence_catalog.go) adds
+an exact root registration and a wildcard namespace registration, showing that
+each concrete sequence has an independent identity scope. The same tests show
+that a YAML identity declaration without an application registration does not
+create final-result identity enforcement.
+
+The examples keep prompt meaning and domain checks in the consuming application.
+The [configuration contract](../config.md#strict-document-composition) owns
+declaration, identity, operation, ownership, and final-validation semantics;
+[sibling inheritance](../config.md#sibling-inheritance) defines record
+relationships, and the [CLI contract](../config.md#explicit-cli-overrides) owns
+override ordering.
 
 Known module catalogs should use canonical object entries with a module identifier
 and typed options. A small union struct is sufficient when the available option

docs/development.md

@@ -59,6 +59,11 @@ Accepted decisions:
 - [Keep the public facade root-owned](adr/0006-public-facade.md)
 - [Compare frozen effective configuration snapshots](adr/0010-effective-configuration-diff.md)
 - [Place inputs at literal application mapping paths](adr/0011-input-destinations.md)
+- [Share dependency-ready ordering](adr/0015-shared-dependency-ready-ordering.md)
+- [Separate import selection controls](adr/0016-independent-import-controls.md)
+- [Define identity and merge rules for each collection](adr/0017-collection-sequence-policy.md)
+- [Apply CLI overrides after inheritance and decoding](adr/0018-cli-after-structural-resolution.md)
+- [Keep main-file discovery explicit and composable](adr/0019-explicit-configuration-discovery.md)
 
 For cross-cutting changes, follow every applicable row. Completed implementation
 and remediation plans are preserved in Git history at `cb5b435`; use current
@@ -131,12 +136,13 @@ Current behavior belongs to the configuration contract's
 [input destinations](config.md#input-destinations),
 [imports](config.md#explicit-imports), and
 [shared source-version checks](config.md#shared-source-version-checks) sections.
-Explicit sequence-item placement and registered strict composition are owned by
-the [strict composition](config.md#strict-document-composition) and
-[imports](config.md#explicit-imports) sections. The
-[maintained prompt catalog](consumers/README.md#identified-prompt-sequences)
-shows the current consumer boundary, and [ADR 0014](adr/0014-sequence-placement-and-composition.md)
-records the decision.
+Explicit sequence-item placement, collection operations, identity registration,
+and final registered-identity validation are owned by the
+[strict composition](config.md#strict-document-composition) section;
+[imports](config.md#explicit-imports) owns acquisition and scheduling. The
+[maintained sequence catalog](consumers/README.md#identified-prompt-sequences)
+shows the consumer boundary, and [ADR 0017](adr/0017-collection-sequence-policy.md)
+records the collection decision.
 
 The completed sequence-composition roadmap, implementation plan, and resolved
 remediation record are preserved in Git history at `008d2ba` under
@@ -148,6 +154,44 @@ git show 008d2ba:docs/roadmap/implementation.md
 git show 008d2ba:docs/roadmap/remediation.md
 ```
 
+The completed import-discovery roadmap, implementation plan, and resolved
+remediation record are preserved in Git history at `5747ec4` under
+`docs/roadmap/`. For example:
+
+```sh
+git show 5747ec4:docs/roadmap/imports.md
+git show 5747ec4:docs/roadmap/implementation.md
+git show 5747ec4:docs/roadmap/remediation.md
+```
+
+The subsequent import-integration audit and completed remediation record are
+preserved at `6903c9e:docs/roadmap/remediation.md`; retrieve them with
+`git show 6903c9e:docs/roadmap/remediation.md`.
+
+The completed sequence-identity/collection-policy roadmap and implementation
+plan are preserved in Git history at `d0a605a`:
+
+```sh
+git show d0a605a:docs/roadmap/sequences.md
+git show d0a605a:docs/roadmap/implementation.md
+```
+
+Current behavior belongs to the configuration contract's
+[strict composition](config.md#strict-document-composition),
+[sibling inheritance](config.md#sibling-inheritance), and
+[CLI overrides](config.md#explicit-cli-overrides) sections.
+The completed remediation record, including the algorithm-audit findings, is
+preserved at `ea46001:docs/roadmap/remediation.md`.
+
+The completed configuration-discovery roadmap, implementation plan, and
+remediation record are preserved in Git history at `0369111`, for example
+`git show 0369111:docs/roadmap/remediation.md`. Current behavior belongs to
+[configuration discovery](config.md#configuration-discovery); the public
+[discovery declarations](../discovery.go) own the Go API.
+
+The [consolidation roadmap](roadmap/consolidation.md) owns the current refactoring
+proposal and the associated complexity-audit findings.
+
 Potential enhancements are tracked in [future features](roadmap/future.md).
 
 Install the Go version required by `go.mod` or a compatible newer toolchain.
@@ -196,14 +240,17 @@ code changes. Use the component overview to find the corresponding implementatio
 | Task | Behavioral test owners | Focused command |
 | --- | --- | --- |
 | YAML syntax, diagnostics, parser limits | [Adapter tests](../internal/yaml/parse_test.go), [source translation](../internal/engine/parse_test.go) | `go test ./internal/yaml` and `go test ./internal/engine -run '^TestParseSource'` |
-| File/reader access, imports, globs, containment | [Sources](../internal/engine/source_test.go), [FIFO](../internal/engine/source_fifo_test.go), [imports](../internal/engine/imports_test.go), [relative destinations](../internal/engine/destination_import_test.go), [globs](../internal/engine/glob_test.go) | `go test ./internal/engine -run 'Source\|Import\|Glob\|Filesystem\|Nonregular\|RegularFile'` |
+| File/reader access, imports, globs, containment | [Import internals](internal/imports.md), [source acquisition](../internal/engine/source_test.go), [FIFO](../internal/engine/source_fifo_test.go), [import traversal](../internal/engine/imports_test.go), [import evidence](../internal/engine/import_evidence_test.go), [relative destinations](../internal/engine/destination_import_test.go), [globs](../internal/engine/glob_test.go) | `go test ./internal/engine -run 'Source\|Import\|Glob\|Filesystem\|Nonregular\|RegularFile'` |
+| Explicit main-file discovery and absent-input loading | [Candidate selection](../internal/engine/discovery_test.go), [load integration](../internal/engine/discovery_load_test.go), [public facade](../facade_discovery_test.go), and maintained [catalog](../examples/consumers/sequence_catalog_test.go) and [preset](../examples/consumers/discovery_test.go) examples | `go test ./internal/engine -run 'Discovery|Search'`, `go test . -run 'Search'`, and `go test ./examples/consumers -run 'WorkingDirectoryPreset|SequenceCatalog'` |
+| Import defaults, empty-selection evidence, and dependency-ready ordering | [Defaults and facade evidence](../facade_import_defaults_test.go), [engine import evidence](../internal/engine/import_evidence_test.go), [scheduler](../internal/engine/dependency_order_test.go), [scheduling integrations](../internal/engine/imports_test.go) | `go test ./internal/engine -run 'Import|ScheduleDependencies|Inheritance'`, `go test . -run 'ImportDefaults|FacadeImport'`, and `go test ./examples/consumers` |
 | Native filesystem and mapping sources | [Native acquisition](../internal/engine/native_filesystem_test.go), [filesystem facade](../facade_filesystem_test.go), [mapping facade](../facade_mapping_test.go) | `go test ./internal/engine -run 'NativeFilesystem'` and `go test . -run 'TestFacade'` |
 | Composition, selected overlays, CLI precedence | [Composition](../internal/engine/compose_test.go), [overlay](../internal/engine/overlay_test.go), [selected overlays](../internal/engine/selected_overlay_test.go), [overrides](../internal/engine/override_test.go) | `go test ./internal/engine -run 'Compose\|Overlay\|Override'` |
-| Sibling inheritance, provenance, history, sensitivity | [Expansion](../internal/engine/inheritance_test.go), [destination scopes](../internal/engine/inheritance_walk_test.go), [origins](../internal/engine/inheritance_origin_test.go), [history](../internal/engine/inheritance_history_test.go), [secrets](../internal/engine/inheritance_secret_test.go), [public loading](../facade_inheritance_test.go) | `go test ./internal/engine -run 'Inheritance\|Inherited'` and `go test . -run '^TestFacadeInheritance\|^TestFacadeInheritedSecrets'` |
+| Sequence identity, declarations, and operations | [Identity](../internal/engine/sequence_identity_test.go), [registrations](../internal/engine/sequence_registration_test.go), [declarations](../internal/engine/sequence_declaration_test.go), [combination](../internal/engine/sequence_combine_test.go), [final facade validation](../facade_final_sequence_identity_test.go), and [consumer catalog](../examples/consumers/sequence_catalog_test.go) | `go test ./internal/engine -run 'Sequence\|Collection'`, `go test . -run 'SequenceIdentity\|SequenceRegistration'`, and `go test ./examples/consumers` |
+| Sibling inheritance, provenance, history, sensitivity | [Implementation flow](internal/overview.md#implementation-flow), [expansion](../internal/engine/inheritance_test.go), [destination scopes](../internal/engine/inheritance_walk_test.go), [origins](../internal/engine/inheritance_origin_test.go), [history](../internal/engine/inheritance_history_test.go), [secrets](../internal/engine/inheritance_secret_test.go), [public loading](../facade_inheritance_test.go) | `go test ./internal/engine -run 'Inheritance\|Inherited'` and `go test . -run '^TestFacadeInheritance\|^TestFacadeInheritedSecrets'` |
 | Layered loading and source equivalence | [Grouped lifecycle](../internal/engine/load_request_test.go), [layered facade](../facade_layered_test.go), [equivalence](../facade_equivalence_test.go) | `go test ./internal/engine -run '^TestGrouped'`, `go test . -run '^TestFacadeLayered'`, and `go test . -run '^TestEquivalentSourceForms'` |
 | Input and relative-import destinations, mounted sources, and source ownership | [Destination engine tests](../internal/engine/destination_test.go), [tier tests](../internal/engine/destination_tiers_test.go), [import traversal and version tests](../internal/engine/destination_import_test.go), [accounting tests](../internal/engine/destination_accounting_test.go), [lifecycle inspection tests](../internal/engine/destination_import_lifecycle_test.go), [public source/error tests](../facade_destination_test.go), [resource contexts](../facade_resource_context_test.go), and [consumer examples](../examples/consumers/destinations_test.go) | `go test ./internal/engine -run 'Destination|Import|Glob|Mounted'`, `go test . -run 'Destination|Import|SourceContext|FacadeMounted'`, and `go test ./examples/consumers` |
 | Shared source-version modes and evidence | [Engine source-version tests](../internal/engine/source_version_test.go), [public facade tests](../facade_source_version_mode_test.go), and [consumer example tests](../examples/consumers/layered_test.go) | `go test ./internal/engine -run 'SourceVersion'`, `go test . -run 'SourceVersion'`, and `go test ./examples/consumers` |
-| Schema, defaults, projection, cloning | [Schema](../internal/engine/schema_test.go), [decoding](../internal/engine/decode_test.go), [projection](../internal/engine/projection_test.go) | `go test ./internal/engine -run 'Schema\|Decode\|Projection\|Clone\|Inline\|CompareDocument'` |
+| Schema, defaults, projection, cloning | [Implementation flow](internal/overview.md#implementation-flow), [schema](../internal/engine/schema_test.go), [decoding](../internal/engine/decode_test.go), [projection and typed cloning](../internal/engine/projection_test.go), [deferred clone review](roadmap/future.md#4-clone-traversal-review) | `go test ./internal/engine -run 'Schema\|Decode\|Projection\|Clone\|Inline\|CompareDocument'` |
 | Lifecycle, resolution, validation, callback ownership | [Loading](../internal/engine/load_test.go), [resolution](../internal/engine/resolution_test.go), [validation](../internal/engine/validation_test.go), [ownership](../internal/engine/callback_ownership_test.go), [independence](../internal/engine/independence_test.go) | `go test ./internal/engine -run 'Load\|Resolution\|Validation\|Validator\|Hook\|Callback\|Parallel'` |
 | Paths, metadata, provenance | [Paths](../internal/engine/path_test.go), [metadata](../internal/engine/metadata_test.go), [provenance](../internal/engine/provenance_test.go) | `go test ./internal/engine -run 'Path\|Metadata\|Provenance\|Queries'` |
 | Passive resource contexts | [Engine contexts](../internal/engine/resource_context_test.go), [public contexts](../facade_resource_context_test.go) | `go test ./internal/engine -run 'Resource'` and `go test . -run 'SourceContext'` |
@@ -211,6 +258,7 @@ code changes. Use the component overview to find the corresponding implementatio
 | Effective configuration diff | [Engine comparison and masking tests](../internal/engine/diff_test.go), [engine operation tests](../internal/engine/diff_operation_test.go), [root facade tests](../facade_diff_test.go), and [consumer examples](../examples/consumers/diff_test.go) | `go test ./internal/engine -run 'Diff|Explain|History|Secret|Independent'`, `go test . -run 'Diff|FacadeInspection|PublicFacadeBoundary|DependencyImportBoundary'`, `go test ./examples/consumers`, and `go test . -run '^ExampleDiff$'` |
 | Consumer examples and migration fixtures | [Consumer tests](../examples/consumers/consumers_test.go), [native, layered, and ordinary relative-import examples](../examples/consumers/layered_test.go), [mounted collection examples](../examples/consumers/destinations_test.go), [API examples](../example_test.go) | `go test ./examples/consumers` and `go test . -run '^Example'` |
 | Assembly and layered scaling evidence | [Assembly benchmarks](../internal/engine/assembly_bench_test.go), [layered benchmarks](../internal/engine/underlay_bench_test.go) | `go test ./internal/engine -run '^$' -bench '^BenchmarkUnderlay' -benchmem`; repeat with `^BenchmarkCompose` and `^BenchmarkOverlay` |
+| Identified-sequence scaling evidence | [Mixed-upsert benchmark](../internal/engine/sequence_combine_bench_test.go) | `go test ./internal/engine -run '^$' -bench '^BenchmarkSequenceMixedUpsert$' -benchmem` |
 | Inheritance scaling evidence | [Expansion benchmarks](../internal/engine/inheritance_bench_test.go) | `go test ./internal/engine -run '^$' -bench '^BenchmarkInheritance' -benchmem` |
 | Documentation links and dependency isolation | [Link checks](../documentation_test.go), [import boundary](../import_boundary_test.go), [public boundary](../public_boundary_test.go) | `go test . -run 'TestLocalDocumentationLinks\|TestDependencyImportBoundary\|TestPublicFacadeBoundary'` |
 | Development check behavior | [Development checker test](../development_check_test.go) | `go test . -run '^TestDevelopmentCheckHandlesFilenamesAndStopsOnFailure$'` |

docs/internal/imports.md

@@ -0,0 +1,98 @@
+# Import Discovery and Scheduling Internals
+
+The [configuration contract](../config.md#explicit-imports) owns selector syntax,
+defaults, requiredness, placement, inspection evidence, and observable ordering.
+This note records implementation flow and private identities for maintainers.
+
+## Discovery and acquisition
+
+Each source's root directive is parsed into presence-aware declarations and
+resolved against load-wide defaults. `acquisition.go` owns shared acquisition
+policy, load accounting, and per-tier accounting; `import_acquisition.go` owns
+reading candidate bytes, declaration traversal, and import admission. Candidate
+selection in `import_selection.go` preserves a normalized
+namespace path separately from canonical access identity: overlapping roots
+coalesce the same candidate spelling in that namespace, while aliases reached
+through distinct spellings retain separate inclusion routes for admission.
+Directory searches walk each distinct normalized root once, apply all filename
+patterns to discovered names, and form a set union of matching candidates across
+overlapping roots. Exclusions are applied as set difference after discovery and
+candidate normalization. They do not suppress discovery or resource errors.
+
+Directory traversal tracks canonical directories on the active traversal path.
+It adds an identity when descending and removes it when the frame is popped, so
+only a back-edge to an active directory is a traversal cycle; a later alias is
+not mistaken for one. This is separate from import dependency-cycle detection.
+For host sources, discovery uses rooted `Lstat` and canonical containment.
+`filesystem_context.go` owns resolved access facts and live access setup; the
+acquisition operation closes its live handles before composition. Native sources
+use `fs.ReadLinkFS` inspection when supplied; otherwise traversal follows the
+capabilities and behavior of the provided `fs.FS`, without claiming a general
+sandbox guarantee. `source_context.go` derives passive resource contexts from
+resolved sources for later caller-owned reads; those records do not retain live
+acquisition handles.
+
+Acquisition remains authored: declarations are visited in source order and each
+selected candidate set in namespace-path lexical order. This preserves source
+records, IDs, source-local version checks, and callback ordering. The acquired
+inclusion graph is retained separately from composition scopes so cycles that
+cross item boundaries remain detectable. Source discovery does not itself choose
+sequence assembly order.
+
+## Stable keys and scheduling
+
+The shared scheduler compares immutable tuples component by component using Go's
+bytewise string order; if one tuple is a prefix of another, the shorter tuple
+sorts first. The import key is
+`(namespace-kind, namespace-anchor, resource-kind, resource-path)`:
+
+- Namespace kind is `host` or `native`. Host resource paths are canonical
+  absolute paths rendered with slash separators; native paths retain their
+  namespace-relative identity.
+- Anchors come from explicit input positions, not discovery order: main is
+  `(0,0)` and underlay/input positions are `(group+1,input+1)`, each encoded as
+  fixed-width decimal. Host accesses in one scheduled tier share its host anchor.
+  A native filesystem namespace uses its earliest explicit selecting position
+  in that tier. Filesystem tokens distinguish namespace equality, not sort order,
+  so separately constructed filesystems with the same label remain distinct.
+- Resource kind is `file` or `synthetic`. A synthetic root uses its explicit
+  input anchor and an empty resource path rather than a display label or token
+  address.
+
+Inheritance keys are
+`("definition", scope-pointer, definition-pointer)`, where both pointers use
+canonical escaped semantic path spelling. Source IDs are not part of the key.
+
+Both integrations use the same Kahn scheduler: it deduplicates dependency edges,
+keeps currently ready nodes in a min-heap, and selects the smallest ready key
+after every completion. Its scheduling cost is `O(E + V log V)` time and
+`O(V + E)` additional memory, excluding key construction, tuple copying, and
+tuple comparisons. On a stalled graph, deterministic DFS over the residual graph
+returns a closed cycle rotated to its smallest key; blocked dependents are not
+reported as cycle members.
+
+Import composition schedules a main tier or one underlay group as a single
+strict-scope graph. Applicable collection declarations are gathered for the
+scope before peer composition, including identity inherited from lower tiers.
+Identified peer sequences then combine distinct records in assembled source and
+list order; after the strict scope completes, layered assembly applies the
+resolved collection operation against the lower value, as defined by the
+[configuration contract](../config.md#strict-document-composition). Item
+contributions own nested local strict-mapping scopes; their helpers complete
+before the item is placed in its outer scope. Inheritance uses the same
+ready-node rule inside each sibling mapping scope, while preserving the authored
+mapping order in its output.
+These scopes do not flatten into one global graph, and independent precedence
+tiers remain separate.
+
+The owners are [`acquisition.go`](../../internal/engine/acquisition.go),
+[`import_selection.go`](../../internal/engine/import_selection.go),
+[`import_acquisition.go`](../../internal/engine/import_acquisition.go),
+[`directory_walk.go`](../../internal/engine/directory_walk.go),
+[`import_graph.go`](../../internal/engine/import_graph.go),
+[`import_projection.go`](../../internal/engine/import_projection.go),
+[`dependency_order.go`](../../internal/engine/dependency_order.go), and
+[`inheritance_schedule.go`](../../internal/engine/inheritance_schedule.go).
+Their focused behavior is covered by import-selection, acquisition, scheduler,
+and scheduling integration tests under `internal/engine`; see the
+[development test map](../development.md#task-to-test-map).

docs/internal/overview.md

@@ -7,14 +7,22 @@ private state; public signatures and fields do not expose engine types.
 
 Implemented component owners:
 
-- `internal/engine` owns host and native-filesystem source acquisition,
-  grouped strict composition, recursive precedence assembly, per-input mapping
-  and sequence-item placement, definition-registered distinct-ID sequence
-  composition within strict tiers, and immediate-parent-relative import
-  placement within that assembly. Higher-priority sequences replace lower
-  sequences as whole values. The engine also owns destination-local sibling
-  inheritance before typed decoding, plus shared source-version checking with
-  sanitized declaration evidence.
+- `internal/engine` owns host and native-filesystem source acquisition and
+  explicitly selected configuration discovery. A search resolves once during
+  shared acquisition; the selected concrete file or absent-input state then
+  follows the existing composition, metadata, and resource-context lifecycle.
+  It also owns grouped strict composition, recursive precedence assembly,
+  per-input mapping and sequence-item placement, YAML collection declarations
+  and operations for identified sequences, and application identity registrations for strict
+  composition, inheritance, and final validation. It applies the selected
+  collection operation at precedence boundaries and owns dependency-ready,
+  destination-local inheritance before typed decoding. CLI assignment follows
+  inheritance and decoding, before application resolution. The engine also owns
+  shared source-version checking with sanitized declaration evidence.
+  Explicit import discovery supports declared paths, directory searches, and
+  globs; load-wide defaults and source-local empty-selection evidence cross the
+  root facade without changing acquisition order. Import and inheritance
+  resolution share dependency-ready scheduling within their composition scopes.
   It retains each source's effective placement alongside physical source
   identity and owns schema
   inspection, lifecycle coordination, callback auditing,
@@ -26,9 +34,9 @@ Implemented component owners:
   or records. Callback wrappers pass only live engine context during a callback;
   `Result.Config` is detached and its private inspection remains frozen
   independently.
-- Root conversion files explicitly cross the path, record, callback, secret, and
-  error boundaries. There are no public aliases, anonymous engine embeddings, or
-  public engine bridge methods.
+- Root conversion files explicitly cross the path, record, callback, secret,
+  search-description, and error boundaries. There are no public aliases,
+  anonymous engine embeddings, or public engine bridge methods.
 - Root `Diff` and `Difference` provide the public comparison boundary and
   convert detached engine records to root-owned paths and snapshots; consumer
   examples own presentation of the safe changed regions.
@@ -48,13 +56,16 @@ these constraints and rejects exported aliases, fields, or signatures involving
 internal types.
 
 The [configuration contract](../config.md) owns implemented YAML and lifecycle
-semantics, including [input destinations](../config.md#input-destinations),
+semantics, including
+[configuration discovery](../config.md#configuration-discovery),
+[input destinations](../config.md#input-destinations),
 [shared source-version checks](../config.md#shared-source-version-checks), and
 [effective configuration diffs](../config.md#effective-configuration-diffs).
 The [strict composition contract](../config.md#strict-document-composition)
-owns sequence placement, registration, replacement, and history behavior; the
-[consumer guide](../consumers/README.md#identified-prompt-sequences) shows the
-maintained example.
+owns sequence declarations, identity, operations, ownership, and final
+validation; [CLI overrides](../config.md#explicit-cli-overrides) own override
+ordering. The [consumer guide](../consumers/README.md#identified-prompt-sequences)
+links maintained workflow examples.
 The [consumer adoption guide](../consumers/README.md) owns application guidance.
 The [architecture policy](../policy/architecture.md) owns contributor
 boundaries; [ADR 0006](../adr/0006-public-facade.md) records the facade decision
@@ -67,4 +78,67 @@ post-assembly structural operation. [ADR 0012](../adr/0012-relative-import-desti
 records the relative-import extension; [ADR 0013](../adr/0013-shared-source-version-checks.md)
 records the source-version decision.
 [ADR 0014](../adr/0014-sequence-placement-and-composition.md) records explicit
-sequence placement and composition.
+sequence placement and composition. [ADR 0015](../adr/0015-shared-dependency-ready-ordering.md)
+records the shared dependency-ready ordering decision; [ADR
+0016](../adr/0016-independent-import-controls.md) records the independent
+selection controls. [ADR 0017](../adr/0017-collection-sequence-policy.md) and
+[ADR 0018](../adr/0018-cli-after-structural-resolution.md) record collection
+operations and CLI ordering. [ADR 0019](../adr/0019-explicit-configuration-discovery.md)
+records explicit main-file discovery. The [import internals](imports.md)
+document candidate and namespace identities, discovery and scheduling, and the
+bounded algorithms.
+
+## Implementation flow
+
+The root facade converts caller-owned values into engine-owned requests. The
+ordinary and grouped entry points share a normalized `loadRequest`: see
+[`lifecycle.go`](../../lifecycle.go), [`layered.go`](../../layered.go), and
+[`load_request.go`](../../internal/engine/load_request.go). Load-wide definition,
+version, default-import, and override policy stays distinct from each input's
+source, filesystem, destination, and import settings.
+
+[`acquisition.go`](../../internal/engine/acquisition.go) defines acquisition
+policy and load-wide and per-tier accounting state. Each input is acquired under
+that policy; grouped requests retain acquired underlay scopes until their tier is
+composed in [`load_request.go`](../../internal/engine/load_request.go). Live
+filesystem access handles are confined to acquisition and closed there. Resolved
+filesystem facts used to authorize access are separate from passively retained
+resource contexts: see
+[`filesystem_context.go`](../../internal/engine/filesystem_context.go) and
+[`source_context.go`](../../internal/engine/source_context.go).
+
+Import responsibilities are split across candidate selection and path
+normalization in [`import_selection.go`](../../internal/engine/import_selection.go),
+source reading and traversal admission in
+[`import_acquisition.go`](../../internal/engine/import_acquisition.go),
+directory walking in [`directory_walk.go`](../../internal/engine/directory_walk.go),
+dependency graph scheduling in [`import_graph.go`](../../internal/engine/import_graph.go),
+and projection of acquired evidence into final source coordinates in
+[`import_projection.go`](../../internal/engine/import_projection.go). The
+[import internals](imports.md) page describes the boundaries and identities.
+
+After acquisition handles are closed, grouped composition and inheritance run on
+the retained ordered documents. `inheritance.go` coordinates traversal and
+[`inheritance_schedule.go`](../../internal/engine/inheritance_schedule.go) applies
+dependency-ready templates;
+[`inheritance_prepare.go`](../../internal/engine/inheritance_prepare.go)
+prepares child and parent inputs,
+[`inheritance_combine.go`](../../internal/engine/inheritance_combine.go)
+returns the combined value with its origin, policy, sequence, and diagnostic
+evidence, and [`inheritance_finalize.go`](../../internal/engine/inheritance_finalize.go)
+accounts for and finalizes the result. Projection and schema work have separate
+operation owners: [`value_operation.go`](../../internal/engine/value_operation.go)
+holds per-operation state, [`projection.go`](../../internal/engine/projection.go)
+builds projected values, [`schema.go`](../../internal/engine/schema.go) owns
+descriptor caching and type policy, and
+[`schema_fields.go`](../../internal/engine/schema_fields.go) owns ordinary and
+inline field assembly. [`decode.go`](../../internal/engine/decode.go) consumes
+those descriptors for typed decoding.
+
+Behavioral ownership follows the same handoffs: imports and grouped lifetimes are
+covered by `imports_test.go`, `load_request_test.go`, and focused source,
+discovery, and destination tests; inheritance by the inheritance test files;
+reflection behavior by `schema_test.go`, `projection_test.go`, and
+`decode_test.go`. The [development test map](../development.md#task-to-test-map)
+links focused commands. Typed clone extraction remains deferred in
+[`future.md`](../roadmap/future.md#4-clone-traversal-review).

docs/policy/architecture.md

@@ -2,7 +2,7 @@
 
 **Base Policy Version:** 1.3
 
-**Last Updated**: 2026-10-16
+**Last Updated**: 2026-10-22
 
 **Upstream Source:** [Standard Repository Policies](https://gitea.maximumdirect.net/eric/policy/src/commit/d84a38ebab26f048cafbe59a2246700c35d29843/docs/policy/architecture.md)
 
@@ -32,6 +32,12 @@ structure as implemented when its changes land.
 Constraints must reflect deliberately selected requirements and decisions.
 Do not promote incidental implementation choices into architectural invariants.
 
+The implemented collection-policy and CLI-ordering constraints below reflect
+accepted [ADR 0017](../adr/0017-collection-sequence-policy.md) and
+[ADR 0018](../adr/0018-cli-after-structural-resolution.md). The configuration
+contract owns their current behavior; these architectural constraints describe
+the system boundaries and guarantees that guide changes to that behavior.
+
 ## Success Criteria
 
 ConfigKit prioritizes a coherent configuration model: consistency and
@@ -91,13 +97,59 @@ boundaries, and keep simple consumers independent of optional composition
 features. The [consumer adoption guide](../consumers/README.md) demonstrates the
 implemented surface against representative simple and complex shapes.
 
+## Simplicity, Defaults, And Explicit Controls
+
+These principles apply throughout ConfigKit: to configuration syntax, the public
+Go API, defaults, and feature design. Evaluate their effects on both configuration
+authors and consuming applications.
+
+**Keep straightforward workflows straightforward.** Common configuration
+workflows should require little configuration text and minimal API setup.
+Support more demanding workflows through explicit, composable options, without
+requiring simple consumers to understand or configure those options.
+
+**Prefer simple, permissive defaults with explicit controls.** Choose predictable
+defaults that minimize required setup and accommodate valid configurations
+without unnecessary restrictions. Provide selectable options for workflows that
+need additional capabilities, narrower behavior, or stronger requirements.
+
+Measure simplicity by what consumers must understand and maintain, including
+configuration text and application-side plumbing. Concise syntax is useful, but
+hidden inference and interacting meanings can make a shorter declaration harder
+to understand. Prefer explicitness where it makes behavior more predictable.
+A terse configuration format that requires substantial application-side
+infrastructure does not satisfy the simplicity principle.
+
+Define what permissiveness means for each behavior. Allowing an optional
+contribution to be absent or accepting valid inputs without an unnecessary
+filename restriction can reduce required setup. Invalid declarations, ambiguous
+composition, and unreadable selected sources must still produce meaningful
+errors under the applicable contracts. Permissiveness does not authorize silent
+recovery from invalid supplied configuration or weaken configuration integrity.
+
+Options should express coherent choices with understandable purposes and fit
+ConfigKit's shared configuration model. Support powerful controls when they
+serve concrete needs; these principles do not require a switch for every
+implementation behavior or conceivable consumer preference.
+
+Defaults require judgment when simplicity and permissiveness pull in different
+directions. Broader discovery can accommodate more layouts while increasing the
+implicit search scope. Evaluate such tradeoffs explicitly; these principles do
+not mechanically select the broadest behavior for every option. Changes to
+existing defaults remain subject to compatibility review, and proposed behavior
+remains in the roadmap until implemented.
+
 ## Responsibility Boundaries
 
 ConfigKit owns configuration input processing and the coordination of decoding,
 resolution, validation, and inspection. Applications own their configuration
 types, field meanings, defaults, normalization, semantic validation, and schema
-version policy. Applications also own main-file search conventions, CLI wiring,
-remote acquisition, runtime initialization, and resource checks.
+version policy. Applications choose and order their main-file search conventions;
+ConfigKit provides explicitly selected search descriptions that resolve during
+loading. Applications also own CLI wiring, remote acquisition, runtime
+initialization, and resource checks. See the [configuration discovery
+contract](../config.md#configuration-discovery) and [ADR
+0019](../adr/0019-explicit-configuration-discovery.md).
 
 The engine applies each input's mapping destination within the existing source
 assembly, applies immediate-parent-relative YAML destinations to imports, and
@@ -109,8 +161,18 @@ placement, and [ADR 0012](../adr/0012-relative-import-destinations.md) records
 the import extension.
 
 Library code must not depend on consuming applications or initialize their
-runtime resources. It must not perform implicit network access, discover
-application-specific paths, or change process-global state during ordinary `Load`.
+runtime resources. It must not perform implicit network access, implicitly
+discover application-specific paths, or change process-global state during
+ordinary `Load`.
+Import discovery is available only through declarations in selected sources:
+explicit `path`, `dir`, and `glob` selectors may search their declared scope, but
+ConfigKit does not search conventional application paths unless the application
+explicitly supplies a discovery description, and it never discovers a main
+configuration file implicitly. Imports and sibling inheritance share
+dependency-ready scheduling within their existing scopes; acquisition order and
+precedence-tier boundaries remain distinct. The [configuration contract](../config.md#explicit-imports)
+owns observable behavior; [ADR 0015](../adr/0015-shared-dependency-ready-ordering.md)
+and [ADR 0016](../adr/0016-independent-import-controls.md) record the decisions.
 The explicit secrets-directory bootstrap is a narrow, opt-in exception: applications
 invoke it during startup, and it reports writes, skips and partial failures. It
 must never run implicitly as part of configuration loading.
@@ -133,6 +195,29 @@ The [configuration contract](../config.md#completion-and-resource-lifetime) owns
 the precise completion and ownership behavior. The proposed decision record is
 [ADR 0008](../adr/0008-complete-on-return-loading.md).
 
+### Accepted Processing Order
+
+Complete source composition and precedence, including selected overlays, before
+sibling inheritance. Then apply typed defaults and decode the configuration.
+Apply explicit CLI overrides to that configuration and check their types before
+running application resolution. Effective secret lookup and final validation
+follow resolution, before publication. [ADR 0018](../adr/0018-cli-after-structural-resolution.md)
+records this ordering.
+
+CLI overrides are the highest-priority input to application resolution. Supplied
+sequences replace whole sequences, and mappings combine recursively. Inheritance
+and typed defaulting do not run again after CLI application. CLI paths and values
+must not introduce structural directives; earlier source, inheritance, and
+decoding failures remain errors even if a CLI assignment would replace the value.
+Semantic validation assesses the final configuration after overrides and resolution.
+
+Applications own flag parsing and domain resolution. ConfigKit owns override
+application, validation, and source attribution. Resolution receives CLI values
+with their explicit-presence and source information. Absence-based defaults
+preserve explicit values; recorded normalization and derivation can still change
+them. Typed defaults and application resolution retain their own assignment
+semantics, independently of collection operations during source assembly.
+
 ## Public API And Dependency Direction
 
 Keep one small, coherent public surface for the supported lifecycle. Simple
@@ -161,41 +246,44 @@ framework on this library.
 
 ## Configuration Integrity
 
-Within a configuration tier, independent contributions use strict composition:
-shared mappings combine recursively, while overlapping non-mapping definitions
-are conflicts, including equal values, except that sequences at explicitly
-registered paths append records with distinct present string identities. Between
-precedence tiers, intentional overlay combines mappings recursively, retains
-omitted lower-priority children,
-and replaces other present values according to the existing overlay rules.
-Tier precedence is explicit; traversal order within a tier establishes stable
-reporting, not permission to override. The distinction and its rationale are
-recorded in [ADR 0001](../adr/0001-separate-composition-and-overlay.md).
-
-Sequence-item placement and sequence registration are explicit source and
-definition controls; registration does not change precedence replacement. The
-[configuration contract](../config.md#strict-document-composition) defines the
-behavior, [ADR 0014](../adr/0014-sequence-placement-and-composition.md) records
-the decision, and the [consumer guide](../consumers/README.md#identified-prompt-sequences)
-shows the implemented subset. This feature does not authorize arbitrary
-configurable merge strategies.
+Within a configuration tier, independent contributions use strict composition.
+Shared mappings combine recursively. Sequences with an applicable identity
+combine distinct records and reject duplicate identities, including equal
+records. Other overlapping non-mapping values remain conflicts, including equal
+values. Conflicting identity or operation declarations among peers also fail.
+Traversal order establishes stable reporting and record order; it does not grant
+precedence to peers. [ADR 0001](../adr/0001-separate-composition-and-overlay.md)
+records the distinction between strict composition and intentional overrides.
 
 The main document and its imports form a strictly composed tier. Explicit
-underlay groups compose strictly within each group, then combine recursively
-from lowest to highest beneath the main tier. Source acquisition kind does not
-determine its precedence role. Input-specific constraints, including CLI path
-rules and opt-in version ownership, remain part of the configuration contract. Consistent combination
-semantics do not require identical acquisition or lifetime behavior from every
-source kind.
+underlay groups compose strictly within each group, then combine from lowest to
+highest beneath the main tier. Between tiers, mappings combine recursively and
+retain omitted lower-priority children. Sequence values follow collection policy;
+other present values retain the established replacement rules. Source acquisition
+kind does not determine precedence. Input-specific constraints, including version
+ownership and path protections, remain part of the configuration contract.
+Consistent combination semantics do not require identical acquisition or lifetime
+behavior from every source kind.
 
-After source precedence is complete, built-in sibling `extends` relationships
-resolve structurally in the same parser-independent representation, using the
-existing recursive overlay rules. This adds neither an acquired source nor a
-consumer registration mechanism. Enclosing relationships precede nested
-destination-local resolution; typed defaults, application resolution, and
-secret lookup retain their existing lifecycle roles. The [configuration
-contract](../config.md#sibling-inheritance) owns the exact syntax and presence
-rules, and [ADR 0009](../adr/0009-sibling-inheritance.md) records the rationale.
+Built-in sibling `extends` relationships resolve after source precedence in the
+parser-independent document representation. Preserve existing mapping-sibling
+scopes and allow an identified sequence to provide a sibling scope for its
+records. A record may inherit from one parent in that sequence, selected by
+complete identity. The child supplies and keeps its own identity while inheriting
+the parent's other settings. Parents remain ordinary records subject to normal
+validation.
+
+Use the shared dependency ordering and preserve assembled sequence order.
+Resolve enclosing relationships before nested destination-local relationships.
+Mappings combine recursively; sequences use the inheriting collection's policy.
+Whole-record upsert replaces records during combination; explicit inheritance
+uses the records that remain. Inheritance remains built-in and creates no
+acquired source.
+[ADR 0009](../adr/0009-sibling-inheritance.md) records the
+original scope and continuing ownership decisions, with sequence combination
+and identified-sequence inheritance defined by
+[ADR 0017](../adr/0017-collection-sequence-policy.md) and CLI ordering by
+[ADR 0018](../adr/0018-cli-after-structural-resolution.md).
 
 ConfigKit must define supported YAML semantics explicitly rather than inherit
 parser defaults. Processing order and diagnostics must be deterministic for the
@@ -204,13 +292,14 @@ configuration. Do not run application hooks on invalid typed configuration.
 
 User-controlled precedence is application defaults, ordered underlays, composed
 main input, selected overlay, then explicitly supplied CLI overrides.
-Applications own flag parsing; ConfigKit owns overlay semantics and provenance.
-Domain resolution follows these
-inputs and must remain recorded, not become a hidden override channel.
+This priority order is distinct from processing order: typed defaults are applied
+at decoding, and application resolution follows CLI input under the lifecycle
+rules above.
 
-Preserve node-based composition until the effective input is ready for typed
-decoding. Preserve presence and source information through processing. Ordinary Go zero
-values must not be used to infer whether input was absent. Final configuration,
+Preserve node-based composition through source assembly and inheritance until
+typed decoding. Preserve presence and source information through later CLI and
+application-resolution changes as well. Ordinary Go zero values must not be used
+to infer whether input was absent. Final configuration,
 metadata, and effective inspection must agree, including application resolution
 changes; see [ADR 0003](../adr/0003-preserve-presence-and-resolution-history.md).
 Safe historical values and an explanation renderer are part of the implemented contract,
@@ -227,6 +316,72 @@ comparison and disclosure behavior, the [component overview](../internal/overvie
 owns implementation responsibility, and [ADR 0010](../adr/0010-effective-configuration-diff.md)
 records the accepted decision.
 
+## Collection Identity And Combination
+
+ConfigKit owns a common collection policy for imported records, inline sequences,
+selected overlays, and sibling inheritance. Configuration authors may declare
+identity and combination rules; applications may register authoritative identity
+constraints. Configuration declarations must agree with application constraints.
+Keep source placement explicit and separate from policy, retaining the placement
+decision in [ADR 0014](../adr/0014-sequence-placement-and-composition.md).
+[ADR 0017](../adr/0017-collection-sequence-policy.md) owns the rationale for
+collection policy and its relationship to application authority.
+
+Gather declarations for the relevant destination and source or item-local scope
+before strict composition. Applicable identity from accumulated lower tiers must
+be available when composing higher-tier peers. Higher-tier declarations cannot
+repair invalid lower-tier composition. Preserve the distinction between source
+acquisition, dependency-ready scheduling within scopes, and precedence order.
+
+Strictly compose each tier's contributions before applying one operation for the
+collection against its lower value. Support whole-sequence replacement,
+duplicate-rejecting append, and whole-record replacement by identity (`upsert`).
+Append and upsert require identity; do not infer it from record fields or position.
+Duplicate identities among peers fail under every mode. Source precedence and
+inheritance use the same operations and deterministic ordering rules. Whole-record
+upsert replaces the matching record's fields together; recursive record merging
+and unkeyed sequence concatenation are outside this operation model.
+
+An explicit mode persists at its applicable destination until a higher explicit
+mode changes it. With no explicit mode, effective identity selects upsert and
+its absence selects whole-sequence replacement. Inferred defaults do not become
+persistent instructions. The inheriting destination chooses its operation; copying
+a parent collection does not automatically copy its mode to that destination.
+
+Track YAML identity and explicit modes according to their separate lifetimes.
+Actual whole-value replacement discards lower YAML identity while preserving
+application constraints and any new identity declaration. Item-local policies
+belong to their records: retaining a record retains its rules, and discarding it
+discards those rules. Policies independently applicable at a destination remain
+in effect. Inheritance can copy YAML identity subject to agreement and replacement
+rules; application registrations continue to constrain their registered paths.
+Numeric positions alone do not establish policy ownership.
+
+Allow declarations without accompanying records. A key declaration validates a
+retained sequence immediately or remains pending in its owning scope when no
+sequence exists. A mode-only declaration affects later combinations without
+recombining earlier tiers. Neither declaration alone clears a collection, and
+declaring replace alone does not authorize changing a retained collection's
+identity. These rules do not independently impose path-existence or shape
+requirements.
+
+Enforce YAML identity during source composition, precedence, and identified
+inheritance operations. Application registrations additionally constrain final
+effective sequences after defaults, CLI overrides, and application resolution.
+The application schema and validation own existence, nullability, and allowed
+shape. The final identity guarantee covers actual sequences on successful load;
+it does not cover every intermediate callback state or later caller mutations.
+YAML-only declarations carry no such final guarantee through defaults, CLI
+assignments, or application resolution.
+
+Preserve source attribution, presence, history, sensitivity, and resource context
+as records survive, move, or are replaced. Identity diagnostics use paths and
+available origin information without exposing identity values. The guarantee
+requires no new mutation-history system or exact reconstruction of causes for
+records supplied by defaults or callbacks. Exact identity equality, declaration
+syntax, presence cases, and operation tables belong in the
+[configuration contract](../config.md#strict-document-composition).
+
 ## Ownership And Confidentiality
 
 Returned configuration and metadata must not share mutable state across loads.

docs/releases/v0.10.0.md

@@ -0,0 +1,77 @@
+# ConfigKit v0.10.0
+
+This minor release adds explicit, composable discovery of a configuration file.
+Applications choose the search conventions and their order; ConfigKit selects one
+file during loading and returns the final configuration with its normal metadata.
+Optional searches that find no file share the expanded `NoSource()` lifecycle.
+
+## Changes
+
+- Add `SearchConfig`, immutable `Search` and `FilenameGroup` descriptions, and
+  search-wide requiredness through `SearchOptions`. Compose explicit `Paths`,
+  custom `SearchDirectory` descriptions, and built-in Unix system, user-config,
+  home, or working-directory presets with `Searches`. See the
+  [public declarations](../../discovery.go) and
+  [discovery contract](../config.md#configuration-discovery).
+- Expand searches in supplied order, trying a directory's filename groups before
+  moving to the next directory. Named and generic groups provide conventional
+  YAML filenames; custom groups provide literal names. Directory searches
+  distinguish omitted filename selection from an explicitly empty selection.
+  Constructors perform no filesystem access, and each load observes current
+  directory bases and file availability.
+- Select the first existing candidate. Access errors and failures while loading
+  the selected file terminate the load rather than trying another configuration.
+  Selected files retain physical source identity, placement, provenance, imports,
+  and relative-resource context. Discovery works with ordinary loading and
+  layered inputs, including underlays, without adding a precedence tier.
+- Permit enabled imports with an absent main input: there are no main import
+  declarations to traverse, while actual underlay sources retain normal imports.
+  Support ordinary selected overlays with an absent main and explicit filesystem
+  context, including a root-only host context. Layered overlays retain their
+  independent `OverlayFilesystem` requirement. See
+  [single-source loading](../config.md#single-source-loading) and
+  [layered loading](../config.md#layered-loading).
+- Preserve ordinary file-context behavior after discovery and include the
+  failing candidate's file identity in access diagnostics. Use Go's
+  platform-aware Windows component rules and native drive-root-relative path
+  resolution. Isolate user-config tests according to the host Go conventions.
+
+## Compatibility and upgrade
+
+Existing explicit source constructors and loading APIs remain available.
+`File(path)` remains an exclusive selection that fails for a missing file;
+discovery is activated only by explicitly supplying `SearchConfig`.
+
+Searches are optional by default. Set `SearchOptions{Required: true}` when the
+application must find a file. An exhausted optional search contributes no main
+document or source record; application version checks, defaults, resolution,
+and validation still run under their existing rules and may reject incomplete
+configuration. A selected overlay is still required to exist.
+
+The former `NoSource()` rejections of enabled imports and explicit filesystem
+context are relaxed. An active ordinary overlay with no main file now loads
+when explicit context is supplied. Applications that relied on those combinations
+being rejected should review their option handling. Selected host files derive
+their own base directory; do not supply an explicit `BaseDir` or native filesystem
+context for a search that selects a host file.
+
+Applications may replace their own fallback-loading loops with the new search
+descriptions. The maintained [consumer examples](../consumers/README.md#explicit-main-file-discovery)
+show simple preset selection and custom-first discovery alongside existing
+configuration tiers. Composition, collection operations, inheritance, CLI
+precedence, and the complete-on-return ownership model retain their existing
+semantics.
+
+Select this version and rebuild:
+
+```sh
+go get gitea.maximumdirect.net/eric/ConfigKit@v0.10.0
+```
+
+The consumer minimum remains Go 1.26.0. Release validation uses Go 1.26.10.
+The YAML dependency remains `go.yaml.in/yaml/v4 v4.0.0-rc.6`, and the maintainer
+tool remains ReleaseKit v0.4.1. Linux amd64 and arm64 remain release-validated
+targets; macOS remains best-effort. Publication follows the existing
+[release procedure](../release.md).
+
+[COPYRIGHT](https://gitea.maximumdirect.net/eric/ConfigKit/src/tag/v0.10.0/COPYRIGHT) | [LICENSE](https://gitea.maximumdirect.net/eric/ConfigKit/src/tag/v0.10.0/LICENSE) | [ATTRIBUTION](https://gitea.maximumdirect.net/eric/ConfigKit/src/tag/v0.10.0/docs/oss/attribution.md)

docs/releases/v0.9.0.md

@@ -0,0 +1,111 @@
+# ConfigKit v0.9.0
+
+This minor release expands import selection, adds author-declared collection
+identity and operations, and supports inheritance between identified records.
+It also moves CLI assignments after inheritance and typed decoding. These changes
+include breaking API and configuration behavior changes from v0.8.0; review the
+migration guidance below before upgrading.
+
+## Changes
+
+- Extend imports with named-file and directory lists, directory filename patterns,
+  exclusions, recursion and depth controls, and explicit hidden-file and symlink
+  discovery controls. Add `ImportDefaults` to ordinary and layered options, with
+  authored declarations taking precedence over application defaults. Imports are
+  optional by default. `SourceInfo.ImportSelections` exposes completed optional
+  declarations that selected no sources. See the
+  [import contract](../config.md#explicit-imports) and
+  [consumer guidance](../consumers/README.md#import-defaults-and-selection-inspection).
+- Use shared dependency-ready ordering for import composition and sibling
+  inheritance. Dependencies complete before dependents, with deterministic
+  selection among currently eligible contributions. Source acquisition and
+  callback order remain separate from assembly order. See the
+  [ordering decision](../adr/0015-shared-dependency-ready-ordering.md).
+- Add root `configkit.sequences` declarations for collection identity and
+  `replace`, `append`, or `upsert` operations, including in selected overlays.
+  Strict peers combine distinct identities and reject duplicates; precedence
+  and inheritance apply the destination's collection operation. Upsert replaces
+  a whole matching record at its retained position. Identity supports compound
+  field sets and scalar strings, numbers, booleans, and null. See the
+  [collection contract](../config.md#strict-document-composition).
+- Add `Definition.SequenceIdentities`, exact `SequenceIdentityAt` registrations,
+  and dynamic `SequenceIdentityMatching` selectors. Application registrations
+  govern structural collection operations and check existing matching final
+  typed sequences, including values from defaults, CLI assignments, and
+  application resolution. YAML-only declarations govern structural operations
+  without adding that final-result check.
+- Support record inheritance within an identified sequence using an `extends`
+  mapping containing the parent's complete identity. The child retains its own
+  identity, relationships use surviving assembled records, and output sequence
+  order is preserved. See [sibling inheritance](../config.md#sibling-inheritance)
+  and the maintained [sequence catalog](../consumers/README.md#identified-prompt-sequences).
+- Apply explicit CLI overrides to the decoded configuration before application
+  resolution. Mappings retain omitted fields and their presence metadata;
+  sequences replace whole lists independently of collection operations. See the
+  [CLI contract](../config.md#explicit-cli-overrides).
+- Correct native import alias and contained-symlink handling, source-version
+  path projection, and provenance/history through collection movement,
+  replacement, inheritance, and CLI assignment. Reduce repeated scans,
+  accumulated policy copying, and sparse-projection storage during construction.
+
+## Compatibility and upgrade
+
+This pre-v1 minor release intentionally changes the v0.8.0 contracts:
+
+1. **Migrate import requiredness.** The YAML `optional` field is removed and is
+   rejected. Replace `optional: true` with `required: false`; omission is equivalent
+   when the application does not default imports to required. Replace
+   `optional: false` with `required: true`. Imports that previously relied on
+   implicit requiredness now need `required: true`, or an application
+   `ImportDefaults.Required` default set to true. Review discovery filters:
+   `follow` and `hidden` default to true, and directory searches select all
+   filenames unless a pattern is supplied.
+2. **Replace sequence registrations.** `SequenceComposition` and
+   `Definition.SequenceCompositions` are removed without compatibility aliases.
+   For a previous registration at `prompts` using `id`, use:
+
+   ```go
+   rules.SequenceIdentities = []configkit.SequenceIdentity{
+       configkit.SequenceIdentityAt(configkit.Keys("prompts"), "id"),
+   }
+   ```
+
+   These registrations now also enforce identity in final typed sequences. Fix
+   missing or duplicate identities introduced by defaults, CLI assignments, or
+   application resolution. Registration does not require a collection to exist
+   or determine its allowed shape; schema and application validation retain
+   those responsibilities.
+3. **Review collection precedence and ordering.** An identified collection now
+   defaults to upsert across layers and inheritance when no explicit mode
+   applies, rather than unconditional whole-sequence replacement. Declare
+   `mode: replace` at the relevant destination where replacement is intended.
+   With append or upsert, `[]` contributes no records and does not clear the
+   collection; null is invalid. Use `mode: replace` with `[]` to clear it.
+   An explicit mode persists at its destination until changed; a parent's mode
+   does not transfer to a different inheriting destination. Unidentified
+   sequences retain strict peer conflicts and whole-value precedence
+   replacement. Dependency-ready assembly can change sequence positions and
+   diagnostic or history order compared with the former traversal order.
+4. **Review CLI recovery and inheritance assumptions.** CLI overrides can no
+   longer repair values that fail earlier decoding, bypass source or inheritance
+   errors, or add or cancel inheritance relationships. Supply structural
+   directives in source configuration. Application resolution still receives
+   explicit CLI values and may record subsequent normalization or derivation.
+5. **Update affected Go literals and diagnostic handling.** Use keyed literals
+   for expanded option and source-information structs. Collection validation adds
+   `CodeSequenceInvalid` (`sequence.invalid`) and `CodeSequenceConflict`
+   (`sequence.conflict`); update diagnostic handling where applicable.
+
+Select this version and rebuild:
+
+```sh
+go get gitea.maximumdirect.net/eric/ConfigKit@v0.9.0
+```
+
+The consumer minimum remains Go 1.26.0. The YAML dependency remains
+`go.yaml.in/yaml/v4 v4.0.0-rc.6`, and the maintainer tool dependency remains
+ReleaseKit v0.4.1. Linux amd64 and arm64 remain release-validated targets;
+macOS remains best-effort. Publication follows the existing
+[release procedure](../release.md).
+
+[COPYRIGHT](https://gitea.maximumdirect.net/eric/ConfigKit/src/tag/v0.9.0/COPYRIGHT) | [LICENSE](https://gitea.maximumdirect.net/eric/ConfigKit/src/tag/v0.9.0/LICENSE) | [ATTRIBUTION](https://gitea.maximumdirect.net/eric/ConfigKit/src/tag/v0.9.0/docs/oss/attribution.md)

docs/roadmap/consolidation.md

@@ -0,0 +1,481 @@
+# ConfigKit Consolidation Toward 1.0
+
+Status: selected target state; implementation pending. This document defines the
+refactor's scope and rationale; it does not authorize a release. The scope
+questions are settled. The [implementation plan](implementation.md) owns the
+concrete steps, sequencing, and implementation progress.
+
+## Purpose
+
+Consolidate the machinery introduced by recent import, collection, inheritance,
+and discovery work so ConfigKit is easier to understand, maintain, and adopt
+before its public contracts become stable. Success means fewer independently
+maintained paths through the same behavior, clearer state ownership, and concise
+consumer workflows. Reducing a function's line count is useful only when it
+serves those outcomes.
+
+The review considered public API consolidation as well as internal extraction.
+The settled public direction retains the existing simple and layered loading APIs,
+consolidates their private translation and acquisition machinery, and removes
+unused reverse inspection conversions. No public signature or configuration
+semantic change is planned in this effort. This is an assessment of the reviewed
+consumer workflows, not a requirement to preserve every beta API in perpetuity.
+
+## Evidence And Baseline
+
+Reviewed worktree: `c9574ef`, immediately after the `v0.10.0` release at `5959537`.
+This document replaces the earlier `complexity.md` roadmap and `remediation.md`
+audit record. Their recommendations and relevant evidence are incorporated here;
+the original documents remain available in Git history:
+
+```sh
+git show fbaaaf1:docs/roadmap/complexity.md
+git show fbaaaf1:docs/roadmap/remediation.md
+```
+
+The earlier roadmap reviewed `7a83704f43ef9870db33661231cdff5d6ee502f7`, before
+discovery. The audit reviewed `5959537d1adc2516e7f7e8881df72b707ec48c3f`, including
+implemented discovery. The consolidation review checked their recommendations
+against that newer baseline and also considered the public API.
+
+This review inspected the current public load/input/discovery declarations and
+maintained consumer examples, the shared request executor and acquisition flow,
+import parsing and selection, inheritance execution, reflective projection and
+cloning, schema field construction, and filesystem-context derivation. Graph
+caller traces and text-reference checks confirmed the unused reverse conversion
+chain. This was source review, not a new runtime correctness or performance audit.
+Neither this review nor the audit established a runtime correctness defect.
+
+### Audit Measurements
+
+The audit refreshed the codebase-memory graph and used function size, cognitive
+complexity, branch counts, and parameter counts to rank candidates for source
+inspection. It indexed 901 non-test functions/methods and 928 test-file
+declarations. Its fast index excludes examples, documentation, and scripts; a
+tracked-file inventory covered those separately. Standalone `gocyclo`, `gocognit`,
+`scc`, and `cloc` tools were unavailable.
+
+These are the graph tool's reported measurements at the audited revision.
+Function spans include comments and blank lines. The scores support relative
+triage; they are not standardized acceptance thresholds or evidence of a defect.
+
+| Function | Source | Lines | Cognitive score |
+| --- | --- | ---: | ---: |
+| `valueOperation.project` | [projection.go](../../internal/engine/projection.go) | 195 | 174 |
+| `parseImportDeclarationSpec` | [import_spec.go](../../internal/engine/import_spec.go) | 127 | 129 |
+| `valueOperation.clone` | [clone.go](../../internal/engine/clone.go) | 130 | 104 |
+| `schemaBuilder.describeFields` | [schema.go](../../internal/engine/schema.go) | 99 | 100 |
+| `assembleBaseInputTrackedForRole` | [load_input.go](../../internal/engine/load_input.go) | 188 | 96 |
+| `selectDirectoryImportCandidates` | [import_selection.go](../../internal/engine/import_selection.go) | 154 | 96 |
+| `valueBuilder.build` | [value.go](../../internal/engine/value.go) | 104 | 93 |
+| `decodeValue` | [decode.go](../../internal/engine/decode.go) | 115 | 85 |
+| `applyInheritanceScopeTemplates` | [inheritance_schedule.go](../../internal/engine/inheritance_schedule.go) | 219 | 75 |
+| `contextsForAcquiredSources` | [source_context.go](../../internal/engine/source_context.go) | 102 | 72 |
+
+At that revision, the engine contained 88 production Go files and approximately
+20,144 physical lines; the root facade contained 16 files and 1,861 lines.
+`imports.go` was the largest production file at 1,195 lines. These measurements
+locate concentrated responsibilities. They do not establish a need for more
+packages or make the smaller document/YAML visitors and explicit facade
+conversions maintenance defects.
+
+### Findings And Recommended Treatment
+
+The finding numbers below preserve the audit's identifiers. The selected work
+remains unimplemented; the cloning portion of finding 3 is deferred to future
+work. Retiring the original documents does not mark their findings implemented.
+
+| Audit finding | Maintenance priority | Assessment and recommended treatment |
+| --- | --- | --- |
+| 1. Import entry points and responsibilities | Higher | Main refactor. Include shared acquisition normalization, import-default ownership, declaration parsing, and directory admission. |
+| 2. Shared inheritance executor | Higher | Main refactor. Expose meaningful phases and explicit combination results while retaining one executor. |
+| 3. Projection and cloning | Higher for projection; cloning deferred | Main refactor for projection. Clone traversal review is tracked separately in [future.md](future.md#4-clone-traversal-review). |
+| 4. Schema field discovery and inline assembly | Medium | Include a focused refactor coordinated with projection. Keep one schema builder and its two descriptor views. |
+| 5. Resolved filesystem context | Medium | Include alongside acquisition work. Reuse resolved facts without merging resource lifetimes or changing validation timing. |
+| 6. Unused reverse inspection conversions | Small, independently reviewable cleanup | Include in the root facade and engine. Retain useful forward-conversion and detached-result coverage. |
+
+Findings 1–3 confirm the earlier roadmap's main opportunities; findings 4–6 add
+focused work. The following sections own their rationale and intended changes.
+Implementation and validation will establish completion of the selected work;
+the deferred clone review retains its separate disposition.
+
+Completed correctness and algorithmic remediations remain part of the baseline,
+including sequence records preserved at `ea46001:docs/roadmap/remediation.md`
+and discovery records preserved at `0369111:docs/roadmap/remediation.md`.
+Item-scope application matching and inheritance policy localization are examples
+of completed corrections that overlap this work and whose regressions should
+remain protected.
+
+The [architecture policy](../policy/architecture.md),
+[configuration contract](../config.md), and exported declaration comments own
+existing constraints and behavior. The
+[component overview](../internal/overview.md) and
+[import internals](../internal/imports.md) locate implementation responsibilities.
+
+## Consumer-Facing Target
+
+### Keep Simple Loading Simple And Advanced Inputs Explicit
+
+The current APIs already provide progressive setup:
+
+- A simple consumer calls `Load[Config](File(path))`.
+- A consumer with defaults, imports, or resolution supplies `Options[Config]`.
+- Explicit discovery produces an ordinary `Source`, so it uses the same loading
+  call and lifecycle.
+- A layered consumer supplies an `Input` and `LayeredOptions[Config]`, with
+  `Underlay.Inputs` distinguishing strict peers from precedence tiers.
+
+The two loading functions already converge on `loadRequest` and
+`executeLoadRequest`. Their public differences have meaning: ordinary options
+include the one input's controls; layered loading has per-input controls and a
+separate overlay filesystem. Ordinary overlay context follows its selected
+source, whereas layered overlay context is independently specified. These are
+observable conventions, not interchangeable forwarding spellings.
+
+**Decision (OQ-1, settled):** retain `Load`, `LoadLayered`, `Options`, `LayeredOptions`,
+`Input`, and `Underlay`. Remove repeated translation and option reconstruction
+behind them. Keep common application rules in `Definition`; do not require
+applications to build a runtime loader or manually coordinate phases.
+
+A single public request type could place main input, underlays, and common
+options together. It would reduce duplicated option fields and make promotion
+from ordinary to layered loading more uniform. A convenience entry could preserve
+the simplest call. Such a design would still need to resolve the existing
+overlay-context differences and demonstrate a clearer consumer model. The
+maintained examples do not show enough consumer benefit to justify that redesign
+in this effort. Retaining the current APIs accepts some duplicated public option
+fields and setup changes when adopting underlays; internal consolidation and
+clearer guidance address the observed maintenance needs. The decision is based on
+the resulting API, rather than the amount of refactoring needed to achieve it.
+
+### Preserve Useful Convenience And Ownership Boundaries
+
+| Surface reviewed | Recommended public end state |
+| --- | --- |
+| `Source`, `Filesystem`, `Search`, filename groups and presets | Retain typed, reusable source/search descriptions. Discovery selects a concrete source during loading; applications do not loop over complete loads. |
+| `FilesystemContext` | Retain the public description and current host/native rules. Consolidate its resolved private representation; do not expose acquisition handles or engine context records. |
+| `SequenceIdentityAt` and `SequenceIdentityMatching` | Retain the exact-path convenience and dynamic selector form over the common registration model. Both serve distinct consumer shapes. |
+| `Definition`, resolution and validation callbacks | Retain application-owned domain rules inside one recorded lifecycle. Preserve the distinction between mutable recorded resolution and read-only validation. |
+| Results, metadata, explanations, source context and diff | Retain detached, safe inspection with consumer-owned presentation. Remove unused inverse conversions without removing supported queries. |
+| Root wrappers and private conversions | Retain root-owned public types and explicit ownership conversion under ADR 0006. Consolidate repeated real conversions and delete unused ones. |
+
+The consumer-facing work is to make the ordinary path easier to find and show
+how additional features compose, using the existing maintained examples. Update
+the adoption guide with a concise choice between simple loading, discovery, and
+layered loading, and show which options belong to an input versus a whole load.
+Keep exact behavior in its canonical owners. Examples should make application
+rules recognizable and avoid requiring consumers to recreate generic merging,
+presence, or provenance machinery.
+
+Use the current simple README call, bundled-file and layered catalog examples,
+the import-focused prompt catalog, and the discovered sequence catalog to assess
+the end state. The latter exercises imports, underlays, independent overlay
+context, CLI assignment, and recorded resolution in one workflow. A high number
+of options in that example does not by itself justify a new abstraction.
+
+## Internal Target
+
+Keep the root facade, cohesive `internal/engine`, ordered document model, and
+private YAML adapter. Use ordinary private records, functions, and focused files
+to express responsibilities. Existing mapping combination, sequence combination,
+dependency scheduling, schema descriptors, and traversal accounting remain shared.
+
+`executeLoadRequest` stays the visible lifecycle coordinator. It should show
+acquisition, assembly, inheritance, decoding/CLI assignment, resolution, secret
+processing, validation, and publication in their established order. Extract a
+phase only when it gives that work a clear input, output, or ownership boundary.
+Do not replace the visible lifecycle with a registry of configurable stages.
+
+### 1. Normalize Loading Inputs And Consolidate Import Acquisition
+
+The current executor constructs an engine `Options[T]` from `loadRequest`, and
+underlay acquisition constructs `Options[struct{}]` to call the same input
+assembler. `assembleBaseInputTrackedForRole` then combines discovery, directive
+processing, version rules, imports, placement, accounting, and contexts. Import
+entry points carry long positional lists through several forwarding variants.
+This repeats the representation of information already normalized for a load.
+
+In [imports.go](../../internal/engine/imports.go), the
+`loadImportedDocumentsTrackedWithVersion`,
+`loadImportedDocumentsTrackedWithProcessing`, and
+`loadImportedDocumentsTrackedWithProcessingDeferred` variants have corresponding
+`loadImportedWithAccess...` variants. Both final signatures carry 13 parameters.
+Placement, processing results, sequence policy, accounting, repetition tracking,
+namespace identity, and deferred assembly must stay aligned through the chain.
+The same file's `importTraversal.visitPath` combines source-admission decisions
+in 174 lines, alongside acquisition, pending-item assembly, and evidence work.
+
+Introduce cohesive private acquisition inputs and explicit state ownership,
+reusing `loadRequest`, `loadInput`, `acquisitionScope`, and `importTraversal`
+where they fit. Translate ordinary and layered public declarations into the
+shared loading model once. Acquisition should receive the source, input role,
+placement, context, and policies it needs without a fabricated application type
+or a reconstructed broad options object. Small adapters may preserve meaningful
+entry operations while callers migrate; remove obsolete forwarding variants
+within the completed refactor.
+
+Separate immutable policy, mutable processing state, and results. Move import
+defaults out of `sourceVersionState` and into the load/acquisition policy owner.
+Version state continues to own version processing, projected effective version
+location, evidence, and diagnostics. Local and effective version rules have
+different meanings and must remain distinguishable.
+
+The state boundaries are especially important:
+
+| Lifetime or scope | State and responsibility |
+| --- | --- |
+| Whole load | Aggregate resource accounting, application definition/registrations, import defaults, shared version evidence and diagnostics. |
+| One strict tier | Repetition tracking shared by that tier's inputs, namespace scheduling anchors, and its inclusion/composition graph relationship. A later tier may reuse a file. |
+| Active import traversal | Active routes and inclusion edges, filesystem access ownership, and cycle detection, including edges crossing item-scope boundaries. |
+| One composition scope | Peer contributions, pending collection declarations, item-local helpers, and deferred item placement. Nested scopes do not become separate precedence tiers. |
+| Retained result | Source records, effective destinations, origins, history, and passive resource-context descriptions. |
+
+Keep repetition tracking tier-scoped. In the current code,
+`acquireUnderlayGroupScopes` creates a fresh visited map per group. Preserve valid
+reuse across tiers while keeping shared aggregate limits. Namespace equality,
+candidate spelling, and stable scheduling keys also serve different purposes.
+
+Give acquisition, already-acquired scope assembly, and evidence projection
+focused homes. Keep discovery at the acquisition boundary: resolve a search once
+per input consumption, then process the concrete file or absence. Preserve
+source IDs and source-local version processing in acquisition order, even when
+composition uses a different dependency-ready order. The layered main is acquired
+before underlays; lower-tier identity can still inform its later strict assembly.
+
+Within `parseImportDeclarationSpec`, extract boolean/collection/placement field
+handling and selector-value parsing where it clarifies responsibilities. Keep
+field presence, authored error locations, selector applicability, and the order
+of consequential validation visible. Within `selectDirectoryImportCandidates` and
+`importTraversal.visitPath`, separate admission and descent decisions from
+traversal orchestration where they represent distinct work. Retain the existing
+root deduplication, candidate union, exclusions, sorting, and active-path cycle
+rules. No shared abstraction should conflate literal first-match main discovery
+with multi-file import selection.
+
+### 2. Share Resolved Filesystem Facts Without Sharing Live Handles
+
+`importFilesystem`, `nativeFilesystemAccess`, and `contextsForAcquiredSources`
+derive overlapping root/base/namespace facts. The latter reconstructs context
+from combinations of source kind and optional fields, including absent input.
+Discovery and independent layered overlays make these combinations consequential.
+Context construction is used by ordinary acquisition and both selected-overlay
+paths, so those callers need to use the same applicable derivation rules.
+
+Use a small engine-owned resolved-context description for the facts actually
+needed by acquisition and passive views: namespace identity/kind, resolved root,
+source base, and selected source path when present. Preserve the distinction
+between host paths and native slash paths. Reuse already resolved facts where
+available instead of repeatedly deriving them from the original options.
+
+Resolution and validation can occur at different existing lifecycle points.
+The record must not force every source to perform all filesystem checks early.
+Context descriptions, library-owned acquisition handles, and returned passive
+resource views have different lifetimes. Closing acquisition must remain
+explicit on success and failure; retaining context must not retain an open root
+handle or assume ownership of a borrowed `fs.FS`.
+
+Cover selected and absent discovery outcomes, root-only absent host context,
+native sources, in-memory inputs with explicit context, and independently rooted
+overlays. Passive context remains associated with the source that contributed
+the value, including retained underlay and inherited values. Use the acquired
+source's canonical identity where available. Preserve containment failures,
+source associations, deferred search bases, and terminal selected-file errors.
+
+Acquisition and context handling use the same private handoff rather than
+maintaining parallel models for overlapping callers. The description does not
+replace the public `FilesystemContext` or `ResourceContext` contracts.
+
+### 3. Make Inheritance Combination Results Explicit
+
+Keep the mapping and identified-record adapters and one shared executor.
+`applyInheritanceScopeTemplates` currently prepares templates, mutates values
+through merge callbacks, projects policy and origins, records replacements and
+replay evidence, and enforces budgets in one body. The callbacks mutate several
+surrounding result collections, making a combination difficult to review alone.
+
+Give the executor named operations for child/control preparation, parent payload
+and policy preparation, combination, evidence construction, and retained-node
+accounting. Use a small private result for outputs of one combination where it
+replaces unrelated surrounding mutations. Value, policy, origin, replacement,
+and sequence-position evidence should come from the same combination outcome;
+do not rerun a merge to reconstruct its history.
+
+Keep borrowed authored templates separate from owned resolved payloads and from
+retained history snapshots. Parent identity exclusion and child identity/origin
+preservation must apply consistently to values and history. Preserve nested
+unresolved instructions for destination-local evaluation, policy retirement on
+actual replacement, cancellation, and source-version movement through sequences.
+
+The shared Kahn scheduler with stable keys remains unchanged. Resolve enclosing
+relationships before nested relationships and retain assembled record order.
+Preserve expansion limits and retained-history accounting for shared nodes;
+extraction must not charge shared evidence twice or make an unbounded snapshot.
+
+### 4. Separate Projection Handlers And Clarify Schema Assembly
+
+Keep `projectConfiguration` as the schema-checked entry and `valueOperation` as
+the operation-state owner. Move substantial struct, map, and sequence projection
+into focused handlers. Keep pointer/dynamic dispatch and scalar representation
+choices visible. All handlers share the same cycle, depth, and node state.
+
+Struct projection needs particular care: physical members drive traversal,
+flattened fields drive name lookup and sensitivity, and an inline container is
+not retained as an extra output node. Preserve declaration order, deterministic
+map order, nil/empty distinctions, collision diagnostics, codec failures, and
+secret classification. Scalar projection retains the existing number, duration,
+text-codec, and secret-reference representations. Keep cycle entries active
+through child traversal and balance their release on every exit.
+
+In `schemaBuilder.describeFields`, separate field discovery and tag parsing from
+inline struct assembly, inline map assembly, and ordinary field registration.
+Retain one builder/cache and its recursion detection. Make the paired updates to
+`members`, flattened `fields`, `fieldByName`, and `inlineMap` easy to follow.
+Keep index-path construction and inherited secret flags intact. These descriptor
+views are both needed; combining them into one collection would shift complexity
+into decoding and projection.
+Keep pointer-chain and recursive-inline decisions explicit, preserve supported
+field/tag forms and ambiguity paths, and retain cache/building-state behavior.
+
+Clone traversal review and cleanup are deferred to
+[future.md](future.md#4-clone-traversal-review). This effort preserves cloning's
+existing behavior while changing the shared schema and projection machinery.
+Keep projection's document-building semantics distinct from typed copying.
+The mostly explicit dispatch in `decodeValue` and `valueBuilder.build` does not
+warrant a generic reflection visitor solely because it has a high complexity
+score.
+
+### 5. Remove Unused Inspection Conversions And Consolidate Real Adapters
+
+Remove `toEngineSourceInfo`, `toEngineOrigin`, `toEngineSourceVersionCheck`, and
+`toEngineImportSelections` from [conversion.go](../../conversion.go), along with
+the engine adapters used only by that chain.
+At the reviewed revision, the three callers of `toEngineSourceInfo` are tests;
+`toEngineOrigin` has none. `SourceInfoWithPlacement`,
+`SourceInfoWithImportSelections`, `importSelectorFromString`, and
+`importSelectionOutcomeFromString` in [records.go](../../internal/engine/records.go)
+have no production role beyond that reverse chain. Consumers receive inspection
+records; production facade operations do not send those records back to the
+engine. The unused inverse path adds another ownership mapping to maintain as
+inspection evidence grows. Recheck callers at the implementation baseline before
+removal.
+
+Rewrite the affected [record tests](../../records_test.go) around real
+engine-to-public conversion and detached public inspection. Preserve useful
+placement, version evidence, import-selection, and copy-isolation assertions.
+Avoid manufacturing replacement production setters solely to keep an old
+round-trip fixture working. Existing facade loads already provide genuine sources
+and inspection records.
+
+Retain reverse conversions that serve real inputs: `toEngineDiagnostics`, for
+example, supports `WriteDiagnostics`. Consolidate repeated override/input
+conversion in `toEngineOptions` and `toEngineLayeredOptions` where semantics
+match. Keep explicit root-to-engine ownership conversion and the public-boundary
+checks. A reflective transport framework or public engine aliases would obscure
+the boundary rather than simplify it.
+
+## Scope, Compatibility, And Policy Consequences
+
+The proposed work spans private engine code, private root-facade conversions,
+affected tests, consumer guidance, and implementation documentation. Under the
+settled answer to [OQ-1](#oq-1-should-the-public-loading-apis-change-in-this-effort),
+preserve public types/signatures and the behavior owned by the current contracts,
+including:
+
+- Acquisition versus composition ordering, strict scopes versus precedence
+  tiers, identity ownership, placement, and source-version protection.
+- Discovery exhaustion and error behavior, source lifetime, passive resource
+  contexts, and host/native namespace distinctions.
+- Defaults, post-decode CLI assignment, recorded resolution, secret handling,
+  final registered-identity enforcement, and semantic validation.
+- Explicit presence, provenance/history, sensitivity, safe diagnostics and diff,
+  frozen inspection, and detached publication/query results.
+- Contracted diagnostic codes, paths, coordinates, ordering, and resource limits.
+
+Do not turn incidental helper order, exact private representations, numerical
+complexity scores, or allocation counts into new guarantees. Keep the existing
+algorithmic remediations effective; watch for repeated whole-tree traversals,
+policy scans, or copies introduced by helper extraction.
+
+The recommendation fits the existing architecture policy and ADRs 0006,
+0015, 0017, 0018, and 0019. It needs no new architectural ownership decision or
+policy revision merely to introduce private helpers. Update the component
+overview and import internals when code moves. Accepted ADR decision content
+remains unchanged. A public loading-model redesign is outside this effort's
+settled scope.
+
+Pre-1.0 public changes are possible under the [release policy](../policy/release.md),
+but they must have a consumer benefit and documented impact. This draft does not
+propose a parallel compatibility API or temporary migration scaffold. It also
+does not make refactoring completion a new release gate or establish that 1.0
+is otherwise ready. Future performance experiments remain in
+[future.md](future.md#3-performance-experiments); no benchmark campaign was run
+or is required to claim readability improvements.
+
+## Validation And Completion
+
+Use the [development guide](../development.md) and
+[testing policy](../policy/testing.md) for focused checks and the ordinary full
+development check. Preserve existing behavior tests; rewrite tests coupled only
+to removed plumbing. Add a test when a consequential handoff risk lacks coverage,
+not for every new helper.
+
+| Work area | Existing protection and review focus |
+| --- | --- |
+| Acquisition and imports | Selection, defaults, scheduling, relative/item placement, source-version evidence, aggregate limits, repetition within versus across tiers, and ordinary/layered equivalence. |
+| Resolved contexts | Host/native access, discovery selected/absent outcomes, terminal context failures, source-relative resources, independent overlay context, and handle closure. |
+| Inheritance | Mapping and record inheritance, nested destination-local evaluation, child identity, policy lifetime, version movement, history ordering, sensitivity, and retained-node budgets. |
+| Projection/schema | Inline fields, recursive schemas, dynamic values, nil/empty values, cycles and limits, text codecs, secret states, callback ownership, and independent loads; preserve existing cloning behavior where shared descriptors/state are affected. |
+| Facade and consumers | Forward conversion, detached records, supported API boundaries, source-form equivalence, maintained simple/catalog/discovery examples, and safe explanation/diff. |
+
+Examples of established boundaries include
+[source-form equivalence](../../facade_equivalence_test.go),
+[discovery integration](../../facade_discovery_test.go),
+[final identity validation](../../facade_final_sequence_identity_test.go),
+[inheritance history](../../internal/engine/inheritance_history_test.go), and
+[projection and cloning](../../internal/engine/projection_test.go).
+Use applicable race checks when changing ownership or shared state. Reuse checks
+for unchanged content and keep benchmark work separate unless new evidence
+justifies it and it is authorized.
+
+Completion requires reviewable evidence that:
+
+- Simple and advanced consumer examples remain concise and valid, with no new
+  public concepts required for existing workflows.
+- Both load entry points reach one normalized internal model; acquisition no
+  longer reconstructs broad options or uses version state to transport defaults.
+- Import, context, inheritance, and reflection responsibilities have identifiable
+  owners and explicit handoffs without duplicate semantic implementations.
+- Unused reverse conversions and their exclusive adapters are removed, with
+  useful inspection ownership coverage retained.
+- Contracted values, presence, provenance/history, diagnostics, sensitivity,
+  resource lifetime, and algorithmic corrections remain protected by appropriate
+  tests and source review.
+- The reviewed scope is accounted for against all six audit findings, with clone
+  traversal review deferred to future work. Completed portions have validation
+  evidence rather than being closed because code moved.
+- Consumer guidance, contributor references, and internal documentation describe
+  the resulting implementation. Current contracts continue to own behavior.
+
+The [implementation plan](implementation.md) defines private records, file owners,
+and stage boundaries. No open scope questions remain, and no additional feature
+semantics are needed to carry out the selected refactors.
+
+## Settled Decisions
+
+### OQ-1: Should The Public Loading APIs Change In This Effort?
+
+**Settled:** retain `Load`/`Options`, `LoadLayered`/`LayeredOptions`, `Input`, and
+`Underlay`, including their existing overlay-context behavior. Consolidate their
+private inputs, conversions, and acquisition machinery, and improve consumer
+guidance. The [consumer-facing target](#consumer-facing-target) records the
+rationale and tradeoffs. This decision governs the consolidation effort; it does
+not establish a perpetual restriction on future API design.
+
+### OQ-2: How Much Clone Cleanup Should This Effort Commit To?
+
+**Settled:** defer clone traversal review and any resulting cleanup to
+[future.md](future.md#4-clone-traversal-review). Neither the review nor clone
+refactoring is part of this consolidation effort. Projection and schema
+refactoring remain in scope, including protection of existing cloning behavior
+where they share descriptors or operation state. The future review can conclude
+that no clone edits are warranted; its goal is demonstrated maintenance benefit.

docs/roadmap/future.md

@@ -6,105 +6,19 @@ commitments. Adopting a candidate requires an explicit design decision and a
 separate plan. Significant architectural exclusions and their rationale belong
 in ADRs; this document does not maintain a list of rejected proposals.
 
-## 1. Identified record sequences
+## 1. Recursive body merging for identified records
 
-Status: deferred. PromptKit proposed this capability from its retired proposal 2,
-**Namespaced Collections As Identified Records**. The original proposal is in the
-PromptKit repository at
-`b5866dd:docs/roadmap/configuration-collections-identified-records.md`.
-PromptKit selected mounted mappings instead; this feature is not a dependency
-of that design or a request to restore multiple installed prompt versions.
+Status: deferred. The implemented
+[collection policy](../config.md#strict-document-composition) uses `upsert` to
+replace a complete matched record. Recursive merging of fields inside matching
+records remains a separate candidate and would revisit the whole-record update
+boundary selected by [ADR 0017](../adr/0017-collection-sequence-policy.md).
 
-A narrower [sequence placement and composition feature](../config.md#strict-document-composition)
-is implemented: consumers can place imported mappings as sequence items and
-register a single literal string identity field for duplicate-rejecting strict
-composition. Precedence still replaces sequences as whole values. This entry
-tracks broader identified-record behavior that remains deferred and is not part
-of that implemented contract.
-
-### Motivation and proposed behavior
-
-Allow applications to declare that selected sequences contain records identified
-by explicit fields, while retaining sequence-shaped output for slice decoding
-and effective YAML. This could make composite identities and independently
-authored catalogs more convenient than encoding identity in nested mapping keys.
-Current [composition](../config.md#strict-document-composition) appends distinct
-records only at explicitly registered paths; other sequences remain atomic.
-Selected [overlays](../config.md#selected-overlays) always treat sequences
-atomically.
-
-The proposed broader opt-in registration would extend the current reusable
-application definition from one identity field to a composite identity made of
-an ordered, nonempty set of distinct direct string-field names. For example,
-records at `profiles` could be identified by `(namespace, id)`. Records
-`(provider, brief)`
-and `(application, brief)` would coexist, and a later layer could update the
-provider record's temperature while retaining its backend and model.
-
-The requested semantics, all still subject to design review, are:
-
-- Match exact string tuples, preserving component boundaries and spelling,
-  including empty strings. Every contribution supplies its complete identity;
-  defaults, inheritance, filenames, and normalization do not supply it.
-- Retain distinct identities. Matching records from strict peers recursively
-  compose disjoint body fields and conflict on overlapping non-mapping body
-  values, even equal values. Equal identity fields act as structural keys rather
-  than conflicts and retain their contributing source evidence.
-- Higher layers recursively overlay matching bodies. A changed identity denotes
-  a different record, not a rename. Proposed ordering is first contribution in
-  precedence-assembly order; matching records keep position and new ones append.
-- Reject malformed identities, non-mapping records, non-null non-sequence values
-  at registered paths, and duplicate tuples within one source sequence. Later
-  layers cannot repair malformed structural identity in an acquired contribution.
-- Treat an empty registered sequence as contributing no records; whole-path null
-  retains ordinary conflict/replacement semantics. Unregistered sequences,
-  including nested message lists, retain existing atomic behavior.
-- Support record inheritance within the same registered sequence using an
-  `extends` mapping containing the complete parent tuple. Resolve only final
-  active relationships after precedence, preserve the child's identity, overlay
-  its body on the parent's body, and consume the directive before decoding.
-  Preserve cancellation, missing-parent/cycle errors, and declaring resource
-  contexts. Existing string-based mapping-sibling inheritance stays unchanged.
-
-Integrate ordinary and layered loads, imports, mounted paths, selected overlays,
-and whole-sequence CLI overrides. Keep origins, presence, history, sensitivity,
-and resource contexts attached to the correct record despite different source
-and final indexes. Diagnostics must retain source locations without exposing
-sensitive identity values. Final inspection may use snapshot-specific sequence
-indexes; existing atomic sequence diffs need not become identity-aware.
-
-Successful results would have valid, unique identities, including after defaults
-and application resolution, without a second merge or inheritance pass. Existing
-source-version checks remain independent; consumed headers cannot supply missing
-record identities. No identity-selector path syntax, arbitrary merge callbacks,
-wildcard registration, per-record deletion/rename operator, multiple inheritance,
-or cross-path parent references are requested.
-
-### Questions to resolve before implementation
-
-- **Need and delivery scope:** does an active consumer benefit enough to justify
-  the added semantics over keyed mappings? Are composite identities required?
-  Staging composition before inheritance is possible but would leave part of
-  the request incomplete.
-- **Defaults and callbacks:** do default records merge by identity or retain
-  existing sequence-replacement behavior? How are callback-created duplicates,
-  identity edits, and reordering validated and reflected in provenance?
-- **Null, empty, and order:** what happens when null clears a collection and a
-  later layer reintroduces records? How do absent and explicitly empty sequences
-  interact with defaults and first-contribution order?
-- **Inheritance references:** how do peers compose relationship declarations,
-  and how are complete references enforced without assembling partial tuples
-  accidentally? What happens if identity fields overlap structural controls?
-- **Registration paths:** how do overlapping registrations and paths beneath
-  sequence indexes behave when assembly changes those indexes?
-- **Evidence and lifecycle:** how are record identities mapped between source
-  trees, history, inheritance, callback snapshots, and final indexes without
-  mixing records' provenance or sensitivity? Where do identity checks run relative
-  to header consumption and other structural processing?
-
-Keep the feature deferred until its consumer value and full lifecycle design
-justify reconsidering the sequence-merging exclusion. A correct final sequence
-alone would not establish correct inspection or disclosure behavior.
+Consider this only in response to a concrete consumer need. A proposal would need
+to define conflicts for overlapping body fields, removal of omitted fields,
+presence and ordering, and how provenance, history, sensitivity, and resource
+context follow partially retained records. Any change requires a new decision and
+implementation plan; this entry does not alter current upsert behavior.
 
 ## 2. Required version declarations for selected sources
 
@@ -169,3 +83,36 @@ evidence are preserved in Git history at `8e91a2b` under `docs/roadmap/`.
   across loads without introducing aliasing?
 - What cache lifetime and concurrency design would make schema reuse worthwhile
   without excessive retained memory?
+
+## 4. Clone traversal review
+
+Status: deferred. Review typed configuration cloning after the projection and
+schema consolidation work, when the resulting structure can inform the review.
+This is future maintenance work, not a prerequisite for completing consolidation.
+
+The complexity audit identified `valueOperation.clone` in
+[clone.go](../../internal/engine/clone.go) as a candidate for cleanup. Much of its
+size is straightforward type dispatch. Focused handlers may clarify allocation,
+recursive copying, cycle tracking, secret-state handling, or text-codec
+reconstruction, but extraction may also add indirection without making the code
+easier to understand.
+
+When this work is taken up, assess the traversal and record whether changes are
+worthwhile; a conclusion that no refactor is needed is valid. Make focused
+changes only where the maintenance benefit justifies the code movement. Keep
+cloning's typed-copy semantics distinct from projection's document-building
+semantics. Preserve detached values, nil/empty distinctions, physical inline
+fields, cycle/depth checks, and unresolved versus validated secret handling.
+Reuse existing ownership, codec, secret, and traversal tests, adding coverage for
+consequential gaps. No performance improvement is assumed.
+
+### Questions to resolve before implementation
+
+- After projection and schema consolidation, which clone branches still mix
+  responsibilities enough to benefit from extraction?
+- Would a proposed helper keep allocation, recursive copying, and cycle cleanup
+  easier to follow together, or merely move a short loop out of sight?
+- Are any small shared operations semantically identical across traversals, or
+  would sharing require special cases that obscure their different purposes?
+- Which ownership or special-value risks, if any, lack sufficient existing test
+  coverage for the proposed changes?

docs/roadmap/implementation.md

@@ -0,0 +1,783 @@
+# Consolidation Implementation Plan
+
+Status: complete. Stages 1 through 20 are complete.
+The target executor is a Luna coding agent working through one end-to-end sprint.
+
+## Authority, Baseline, And Execution
+
+The [consolidation roadmap](consolidation.md) owns the target state, rationale,
+and settled scope. Start from `8a99e6107001c69117a41dc37bc6ea09d2910af9` plus the
+commit introducing this plan. Production code is unchanged from the audited
+`5959537d1adc2516e7f7e8881df72b707ec48c3f`; intervening commits consolidated the
+planning documents and settled the public-API and clone decisions.
+
+Read [development.md](../development.md), [agents.md](../policy/agents.md),
+[architecture.md](../policy/architecture.md), [testing.md](../policy/testing.md),
+and [documentation.md](../policy/documentation.md) as applicable. Use the code
+graph for discovery and confirm source at the implementation baseline. Current
+public comments and [config.md](../config.md) define behavior; this plan does not
+add public obligations.
+
+Implement only the selected consolidation. Retain the public `Load`,
+`LoadLayered`, options, inputs, callbacks, source/search descriptions, inspection,
+and sequence-registration APIs. Keep the root-to-engine-to-document/YAML
+dependency direction. Clone traversal review/refactoring remains deferred under
+[future.md](future.md#4-clone-traversal-review). Changes to shared descriptors must
+preserve existing cloning behavior. This sprint does not publish a release,
+update dependencies/toolchain requirements, change configuration semantics, or
+introduce complexity/performance gates.
+
+Stages are bounded work assignments, not independently shippable commits.
+Intermediate stages may leave callers, tests, or compilation unfinished until a
+later stage. Proceed directly through those dependencies; do not build temporary
+compatibility layers solely to keep each stage compiling. Update affected tests
+with their callers, and run the focused checks below when that portion builds.
+Record any deferred verification accurately. The completed sprint must compile,
+pass its checks, and leave no superseded plumbing. Commit completed, reviewable
+units under the agent policy; stage boundaries do not require separate commits.
+
+Preserve existing meaningful validation/processing order, diagnostics, ownership,
+and limits. Private helper order and representation are not new contracts. Do
+not add rejection rules, error recovery, caches, new merge strategies, another
+pipeline framework, or tests for incidental helper choreography. A correctness
+issue discovered during the refactor needs identifiable regression evidence and
+an explicit explanation, rather than an unexplained expectation change.
+
+## Chosen Private Design
+
+Use the existing `loadRequest[T]` as the normalized complete-load model and
+`loadInput` for each selected input. Keep generic application definitions and
+the final lifecycle in `executeLoadRequest[T]`; acquisition is non-generic.
+The following records are ordinary engine-private data, not extension points.
+Use these names to make migrations concrete; their fields describe the selected
+ownership model, not a requirement to duplicate data already available there.
+
+| Record | Fields and ownership |
+| --- | --- |
+| `acquisitionPolicy` | Read-only operation snapshot of `importDefaults`, `sequencePolicy`, and `importLimits`. Snapshot caller-owned defaults at entry, preserving nil versus empty. |
+| `acquisitionState` | Borrowed pointers to the load's `importAccounting` and `sourceVersionState`. One instance per load; version state no longer transports import defaults. |
+| `tierAcquisitionState` | The tier's visited-resource map and shared host namespace token. Underlay groups each own a fresh instance. Existing group graph aggregation and namespace anchors retain their current owners. |
+| `inputAcquisitionRequest` | `input loadInput`, source-version role, root-directive context, applicable protection rule, deferred-assembly choice, and `ordinaryOverlay string`. The last field carries only the ordinary main input's overlay-dependent validation/context timing; it is empty for underlays and layered main. |
+| `importAcquisitionRequest` | The input request, parsed main source, and already computed source-version/directive processing result. It preserves the distinction between source-local processing and application-path protection. |
+| `resolvedFilesystemContext` | `native *nativeNamespace` (nil means host), `hostToken *namespaceToken` where supplied, and `rootPath`, `basePath`, `mainPath` strings. Native facts use slash-relative paths; host facts use the existing canonical host paths. The record contains no open root/file or acquisition access object. |
+
+The main private entry is
+`acquireInput(request inputAcquisitionRequest, policy acquisitionPolicy, state *acquisitionState, tier *tierAcquisitionState) (assembledInput, []Diagnostic)`.
+Import acquisition uses the corresponding named request with the same borrowed
+policy/state/tier owners. An access-based worker receives a resolved filesystem
+description and an explicitly owned `*filesystemAccess`, rather than more
+positional paths and independent optional policy parameters. Retain
+`assembledInput`, `acquisitionScope`, and `acquiredContribution` as the structural
+handoffs; add an optional resolved-context field to `assembledInput` for reuse.
+
+`importTraversal` borrows the policy and state references. Active routes, stack,
+current item scope/prefix/fallback, and the acquired inclusion graph remain
+traversal-local. Nested item traversal shares the active graph and tier repetition
+state; it does not create another tier. Reusing a file in a later tier remains
+valid. Do not collapse namespace identity, lexical candidate spelling, and stable
+scheduling keys into one key.
+
+Context facts are obtained at the existing points where those facts are needed.
+There is no global eager context-validation pass or persistent live-handle owner.
+Directory checks, canonicalization, handle opening/closing, and passive view
+creation remain distinguishable. Reusing a description does not authorize
+earlier checks that bypass an existing earlier error or implicit loading activity
+after publication. Consumer-initiated passive filesystem operations retain their
+existing contract.
+
+For inheritance, retain both scope adapters and one executor. Use private
+prepared-child/prepared-parent records for combination inputs, then an
+`inheritanceTemplateResult` containing the resolved value, origins, local policy,
+policy templates, and the controls/transfers/replacements/operations produced by
+that template. Sequence position evidence lives in the existing operation
+records. Merge callbacks mutate that local result, not the enclosing executor's
+accumulator. The executor appends the result and applies existing accounting.
+
+For reflection, keep `valueOperation` and `schemaBuilder` as their existing state
+owners. Extract substantial value-kind and inline-field operations as methods;
+do not introduce a generic reflection visitor or merge the two schema views.
+
+## Validation Groups
+
+Use the installed compatible Go toolchain and already acquired dependencies as
+described in the development guide. Commands run from the repository root with
+`GOTOOLCHAIN=local` and `GOPROXY=off`. These are development checks for this
+refactor, not additions to the release procedure.
+
+| Group | Commands and purpose |
+| --- | --- |
+| F: facade cleanup | `go test . -run 'SourceInfo|SourceVersionCheck|ImportSelection|Facade|PublicFacadeBoundary|DependencyImportBoundary'` checks useful forward evidence and the existing public boundary. |
+| A: acquisition integration | `go test ./internal/engine -run 'Load|Grouped|Source|Search|Discovery|Import|Glob|Filesystem|Native|Destination|Overlay|Resource|Version|Sequence|Collection'`; `go test . -run 'Facade|EquivalentSourceForms|Search|SourceContext|ImportDefaults|SourceVersion'`; `go test ./examples/consumers`. Covers normalization, ordinary/layered acquisition, selection, contexts, scopes, and consumer workflows. |
+| I: inheritance | `go test ./internal/engine -run 'Inheritance|Inherited|Sequence|Collection|Version|History|Explain|Sensitivity|Secret'`; `go test . -run 'Inheritance|Inherited|SequenceIdentity|FinalSequence'`. Covers shared adapters and their evidence. |
+| R: reflection | `go test ./internal/engine -run 'Schema|Decode|Projection|Clone|Inline|CompareDocument|Callback|Ownership|Independent|Secret'`. Covers descriptors, projection, shared cloning behavior, and ownership. |
+| Final | `./scripts/check.sh` followed by `go test -race ./...`. The first owns formatting, whitespace, ordinary tests/examples/doc links, vet, and build; race validation is appropriate because state and ownership handoffs change throughout this sprint. |
+
+Run F after Stage 2, A after Stages 9 and 13, I after Stage 16, and R after
+Stage 18 when buildable. If earlier migrations still prevent compilation, repair
+them at the next integration point and run the deferred group there. Run the
+final checks once on the finished code/documentation; repeat only for subsequent
+changes affecting their evidence. No benchmark campaign, timing threshold,
+traversal-count test, extended fuzz campaign, CI wait, or manual platform check is
+required by this plan. Add narrow behavior tests only for consequential gaps
+identified below that existing tests do not already cover.
+
+## Stage 1 — Establish The Starting Map (Complete)
+
+**Work:**
+
+1. Confirm the revision/worktree and preserve unrelated work. Read the roadmap's
+   settled decisions and the selected owners above.
+2. Map the current callers of `selectOptions`, `assembleBaseInput...`, both
+   `loadImported...` ladders, `contextsForAcquiredSources`, the selected-overlay
+   loaders, and `applyInheritanceScopeTemplates`. Inspect test callers as well
+   as production callers; some old entry variants exist mainly for tests.
+3. Identify the existing behavioral owners for repeated resources within/across
+   tiers, enabled/disabled version checking, selected/absent searches, ordinary
+   versus independent layered overlays, item-local helper scopes, inherited
+   identity/history, inline fields, and detached records.
+4. Keep brief working notes or implementation progress in this plan. Reuse
+   existing validation evidence where applicable; establish an implicated
+   baseline only when needed to distinguish a pre-existing failure. Do not
+   generate another broad audit or blanket characterization-test suite.
+
+**Finish:** a concrete caller/coverage map and any actual coverage gaps. No
+production change or empty commit is needed for orientation alone.
+
+Progress notes (2026-10-25): the worktree was clean at `8ab1568`, immediately
+after the planning baseline `8a99e61`; the audited production baseline
+`5959537` is present. `selectOptions` is called by the ordinary and grouped
+load entry points. The `assembleBaseInput...` wrappers converge on
+`assembleBaseInputTrackedForRole`, reached from ordinary loading, layered main
+loading, and underlay-group acquisition. The tracked import wrappers converge
+on `loadImportedDocumentsTrackedWithProcessing`; production callers are input
+acquisition and underlay-group acquisition, while older convenience variants
+also have direct test callers. `contextsForAcquiredSources` is shared by ordinary
+loading, layered assembly, input acquisition, and overlay application. Selected
+overlay loading is reached from ordinary overlay application and layered input
+assembly. Both inheritance adapters, for ordinary and identified sequences,
+feed `applyInheritanceScopeTemplates`.
+
+Existing behavioral owners cover repeated/cyclic resources and cross-tier reuse
+(`internal/engine/imports_test.go`, `facade_equivalence_test.go`); default and
+enabled source-version modes (`internal/engine/source_version_test.go`,
+`facade_source_version_mode_test.go`); selected/absent discovery
+(`internal/engine/discovery_load_test.go`, `facade_discovery_test.go`); ordinary
+and layered overlays (`internal/engine/selected_overlay_test.go`,
+`facade_layered_test.go`); item-local helper scopes (`internal/engine/imports_test.go`,
+`facade_import_lifecycle_test.go`); inheritance identity/history
+(`internal/engine/inheritance_identity_history_test.go`,
+`internal/engine/inheritance_history_test.go`); inline fields
+(`internal/engine/schema_test.go`, `internal/engine/projection_test.go`); and
+detached results and callback ownership (`internal/engine/metadata_test.go`,
+`internal/engine/callback_ownership_test.go`, `facade_diff_test.go`). No specific
+coverage gap surfaced in this map; later focused checks remain assigned in the
+validation groups above.
+
+## Stage 2 — Remove Unused Reverse Bridges And Share Real Facade Conversion (Complete)
+
+**Owners:** root `conversion.go`, `records_test.go`, `lifecycle.go`, `layered.go`,
+and engine `records.go`.
+
+1. Reconfirm callers, then delete `toEngineSourceInfo`, `toEngineOrigin`,
+   `toEngineSourceVersionCheck`, and `toEngineImportSelections`, plus
+   `SourceInfoWithPlacement`, `SourceInfoWithImportSelections`,
+   `importSelectorFromString`, and `importSelectionOutcomeFromString` when their
+   only remaining purpose is the deleted chain.
+2. Rewrite the three reverse-round-trip record tests using genuine engine output
+   and forward conversion/public inspection. Retain placement, version-evidence,
+   selection-evidence, nil/empty, and detached-copy protection. Engine test
+   fixtures can use existing loading APIs; do not add production fixture setters.
+3. Extract one root `toEngineOverrides` helper and use it from both option
+   converters. Reuse `toEngineInput`, filesystem, path, definition, and default
+   conversion where already shared. Preserve slice ownership and nil/empty
+   behavior; do not make conversion interpret/validate input values.
+4. Retain reverse diagnostic conversions used by `WriteDiagnostics`, forward
+   source/origin inspection conversion, and all public named types.
+
+**Finish:** the unnecessary cross-package inverse interface is gone and real
+conversion is shared without a new transport layer. Run F.
+
+Progress notes (2026-10-25): removed the unused reverse source-record bridge
+and engine setters, replaced synthetic round-trip fixtures with engine loads,
+and shared override conversion across ordinary and layered options. Validation
+group F passed with `GOTOOLCHAIN=local GOPROXY=off go test . -run
+'SourceInfo|SourceVersionCheck|ImportSelection|Facade|PublicFacadeBoundary|DependencyImportBoundary' -count=1`.
+
+## Stage 3 — Normalize Preflight Without Fabricated Options (Complete)
+
+**Owners:** engine `options.go`, ordinary entry in `load.go`, grouped entry in
+`load_request.go`, and their option tests.
+
+1. Extract non-generic input normalization/validation over `loadInput`, returning
+   the normalized input plus diagnostics. Pass the ordinary overlay name only
+   where its context requirements apply. Keep discovery-description validation,
+   placement checks, normalized destinations, and filesystem option checks at
+   their existing pre-acquisition boundary.
+2. Separate load-wide import-default validation, version-rule/mode validation,
+   and sequence-registration compilation from per-input checks. Share their
+   mechanisms between entries without adding a second interpretation of options.
+3. Keep the public/engine entry arity handling and each entry's existing error
+   classification. Ordinary loading still translates its one selected options
+   value; layered loading validates main, all underlay inputs, and its independent
+   overlay context in the existing meaningful order. Preserve canonical diagnostic
+   accumulation and early returns, including invalid options before reads.
+4. Replace the grouped entry's constructed `Options[T]` values with direct
+   normalization of `loadInput`; set the effective protection rule from the
+   normalized main placement. Leave typed application behavior in the definition.
+5. Remove `importDefaultsValidated` and preflight-only forwarding machinery when
+   callers migrate. Update tests through the entry/helper that owns the behavior,
+   rather than keeping `selectOptions` solely as a test compatibility surface.
+
+**Finish:** both entries produce validated `loadRequest[T]` values without using
+the ordinary options type to validate grouped inputs. Acquisition may still use
+old options until Stage 6; do not broaden this stage into that migration.
+
+Progress notes (2026-10-25): added shared normalization over `loadInput`, moved
+load-wide defaults, source-version, and sequence-registration validation into
+shared settings preparation, and removed `selectOptions` plus its validation
+flag from grouped preflight. `GOTOOLCHAIN=local GOPROXY=off go test ./...` passed.
+
+## Stage 4 — Express Input Acquisition With Non-Generic Requests (Complete)
+
+**Owners:** new engine `acquisition.go` and existing `load_input.go`.
+
+1. Define `acquisitionPolicy`, `acquisitionState`, `tierAcquisitionState`,
+   `inputAcquisitionRequest`, and `importAcquisitionRequest` as selected above.
+   Reuse existing enums, policy records, and accounting; introduce no new public
+   controls or duplicate budget counter.
+2. Replace the generic `assembleBaseInputTrackedForRole` implementation with
+   `acquireInput`. Translate its references to source, imports, filesystem,
+   placement, role, directive context, version rule, policy, and deferred
+   assembly into explicit request/policy/state fields.
+3. Keep its phases visible: search selection; parse and failed-source evidence;
+   disabled-directive checks; source-local version/directive processing; import
+   acquisition or single-input placement; accounting/repetition registration;
+   context handoff. Small helpers may isolate version/directive preparation.
+4. Preserve discovery resolution once per input consumption and the acquired
+   concrete source on both success and failure. Keep mapping diagnostic
+   destination projection and the ordinary-overlay context deferral unchanged.
+5. Retain `assembledInput`'s existing structural/evidence fields. Do not merge
+   parsed/local payloads with placed documents or eagerly compose deferred input.
+
+**Finish:** the shared input-acquisition implementation no longer depends on
+`Options[T]` or an application type. Call-site and import-worker migration is
+completed by Stages 5–6; temporary non-compilation is acceptable.
+
+Progress notes (2026-10-25): introduced the non-generic acquisition request and
+policy/state/tier records, moved the input-acquisition implementation into
+`acquireInput`, and added the resolved-context handoff field. The focused engine
+test command currently cannot compile because the old assembly callers in
+`load_input.go` and `load_request.go` are scheduled to migrate in Stage 6; test
+verification is deferred until that integration.
+
+## Stage 5 — Consolidate Import Requests And Default Ownership (Complete)
+
+**Owners:** engine import entry points, `importTraversal`, `source_version.go`,
+and tests that directly invoke the old import variants.
+
+1. Replace the `loadImportedDocumentsTracked...` ladder with
+   `acquireImportedInput` using `importAcquisitionRequest` and the shared
+   policy/state/tier owners. Replace the access-based ladder with one worker
+   receiving the same request plus explicit access/resolved facts. Keep only
+   genuinely distinct convenience entries, not one wrapper per optional field.
+2. Move `importDefaults` out of `sourceVersionState`. Resolve declarations from
+   `acquisitionPolicy.importDefaults`, including nested item scopes. Import
+   defaults must work independently of whether a version rule/state is active.
+   Preserve enabled version processing and its separate local/effective rules.
+3. Make traversal references to aggregate accounting, version evidence, tier
+   repetition, and immutable policies point to their existing operation owners.
+   Keep active-route tracking, scope switching, and inclusion edges local to
+   the traversal. Do not allocate a fresh visited map inside a nested item scope.
+4. Preserve nil version-state behavior used by lower-level operations and the
+   existing default processing branch. Replace optional positional/variadic
+   policy passing with explicit inputs for meaningful operation distinctions.
+   Private test entry spellings do not need compatibility wrappers; preserve
+   their relevant behavioral cases through the resulting operation.
+5. Migrate direct import tests to named inputs. Small test-only constructors may
+   supply default state/policy values when this reduces repetitive fixtures.
+   Keep their behavior assertions intact.
+
+**Finish:** the import request surface has named cohesive inputs; defaults no
+longer travel through version processing; no forwarding ladder remains merely
+to supply another nil/default positional parameter.
+
+Progress notes (2026-10-25): replaced the import entry ladders with named
+requests and one access worker, moved defaults to acquisition policy, and
+retargeted direct import tests. The focused engine test command cannot compile
+yet because the remaining ordinary and grouped assembly callers are scheduled
+for Stage 6; verification is deferred until that integration. `git diff --check`
+passed.
+
+## Stage 6 — Wire Ordinary And Grouped Lifecycle To Acquisition (Complete)
+
+**Owners:** engine `load.go`, `load_request.go`, `load_input.go`, related tests.
+
+1. Construct the load's acquisition policy and mutable state once in
+   `executeLoadRequest`. Keep the definition and schema/callback lifecycle there.
+2. Call `acquireInput` for main using its ordinary/layered directive context,
+   main version role, current protection rule, and deferred assembly. Preserve
+   the existing schema-build and version-check timing, including the different
+   default/enabled source-version paths.
+3. Have `acquireUnderlayGroupScopes` use the same load policy/accounting/version
+   state and one fresh tier state per group. Remove `Options[struct{}]`
+   construction. Preserve explicit namespace anchors and graph reanchoring.
+4. Main acquisition still precedes underlays. Strict assembly still follows
+   the existing dependency-ready scopes and lower-tier identity information.
+   Keep group-local repetition separate from load-wide limits, and retain the
+   existing selected-overlay duplicate-source checks.
+5. Replace the ordinary `applyInputLayers` options argument with the precise
+   main/overlay/protection/policy inputs it uses. A named overlay request will
+   complete that migration in Stage 9. Remove remaining production
+   `assembleBaseInput...` variants and the acquisition-only `sequencePolicy`,
+   `deferAssembly`, and `directiveContext` fields from `Options`. Retain the
+   placement, destination, and import-default fields used by facade translation.
+6. Retain real lower-level test/benchmark capabilities with direct request
+   construction or test-only adapters. Do not delete meaningful source/limit
+   cases to make removed helpers disappear.
+
+**Finish:** no executor or underlay caller reconstructs broad/generic options
+for acquisition. The shared path is wired end to end; context and import-flow
+extraction continue in later stages.
+
+Progress notes (2026-10-25): `executeLoadRequest` now creates one acquisition
+policy/state and acquires the main input through `acquireInput`; underlay groups
+reuse those load owners with a fresh tier state. Removed the generic base-input
+assembly variants and the acquisition-only fields from `Options`, and adapted
+direct tests to construct named requests. A search-source regression was caught
+and fixed during verification. The focused engine selection, facade selection,
+consumer example tests, and `GOTOOLCHAIN=local GOPROXY=off go test ./...` passed.
+
+## Stage 7 — Separate Resolved Filesystem Facts From Access (Complete)
+
+**Owners:** new engine `filesystem_context.go`, `filesystem.go`,
+`filesystem_access.go`.
+
+1. Add `resolvedFilesystemContext` with the fields selected above. Reuse native
+   namespace/token identity; do not compare arbitrary `fs.FS` values or equate
+   equal labels with equal namespaces.
+2. Extract host and native fact derivation from `importFilesystem` and
+   `nativeFilesystemAccess`. Prefer a selected `SourceInfo.Path` when it already
+   supplies canonical source identity. Preserve source-derived file bases,
+   explicit in-memory roots/bases, native slash paths, and the root-only absent
+   host default.
+3. Keep separate functions for the directory checks and opening access that
+   currently occur at each operation. A returned description does not mean
+   every possible check has run. Do not add validation-state flags or an
+   all-purpose eager resolver with stronger acceptance rules.
+4. Adapt the import worker to consume resolved facts and explicitly own its
+   access until the existing acquisition handoff closes it. Keep close-error
+   reporting and primary-error precedence unchanged. Native access borrows its
+   caller filesystem and must not close it.
+5. Keep any old derivation adapters only while genuine callers migrate in
+   Stages 8–9; remove them at the end of that migration.
+
+**Finish:** common context facts have one private representation while validation
+timing and live resource ownership remain explicit.
+
+Progress notes (2026-10-25): added shared host/native filesystem descriptions,
+separated directory validation and access creation, and migrated import
+acquisition to pass resolved facts alongside its owned access. The prior
+derivation adapters remain for the validator and overlay migration. Focused
+acquisition tests, `GOTOOLCHAIN=local GOPROXY=off go test ./...`, and
+`git diff --check` passed.
+
+## Stage 8 — Carry Context Facts Through Input And Passive Views (Complete)
+
+**Owners:** engine `load_input.go`, `source_context.go`, `load_request.go`, and
+the ordinary context backfill in `load.go`.
+
+1. Add the optional resolved-context field to `assembledInput`. Populate it
+   from import acquisition or the existing non-import context validation point.
+   When context work is deferred for an ordinary overlay, leave it deferred.
+2. Replace the source-kind derivation branches of `contextsForAcquiredSources`
+   with `contextsForResolvedSources`: consume resolved facts and source records,
+   construct the existing rooted host/native passive view, and compute each
+   source's relative base using the appropriate path rules.
+3. Share relative-base/containment calculation where applicable; retain each
+   acquired source's own path and source-ID association. Do not substitute the
+   first source record for the selected main file or attach all values to main.
+4. Migrate normal input acquisition, underlay contexts, and ordinary context
+   backfill. Resolve only still-missing facts at the same lifecycle point as
+   before. Retained descriptions/views never capture `filesystemAccess` or
+   `*os.Root`; the existing passive `ResourceContext` contract stays unchanged.
+5. Retain failure evidence, root-only absent host context, discovered native
+   outcomes, and deferred search-base behavior. Update focused context tests
+   only where private function signatures changed.
+
+**Finish:** ordinary/underlay acquisition and passive views use the common facts;
+selected-overlay callers are the remaining migration in Stage 9.
+
+Progress notes (2026-10-25): input acquisition now retains resolved filesystem
+facts and builds passive contexts from those facts for ordinary and underlay
+sources. Migrated the ordinary backfill and reordered-source context test. The
+selected-overlay adapters remain for Stage 9. Focused context/acquisition tests,
+`GOTOOLCHAIN=local GOPROXY=off go test ./...`, and `git diff --check` passed.
+
+## Stage 9 — Migrate Selected Overlays Without Merging Their Semantics (Complete)
+
+**Owners:** engine `selected_overlay.go`, ordinary `applyInputLayers`, and
+`assembleLayeredInput`.
+
+1. Define a private `selectedOverlayRequest` containing the overlay name,
+   resolved filesystem description, protection rule, sequence policy, and
+   existing limits/version state. Derive context at the caller's existing
+   lifecycle point. Pass assembly and source evidence explicitly to the worker.
+2. Route ordinary overlays through the main source's context; route layered
+   overlays through their independent `OverlayFilesystem`. Use named operation
+   inputs instead of fabricating a `sourceBytes`/empty parsed-main pair merely
+   to select a context branch. Preserve the actual absent-host root behavior.
+3. Return or retain the resolved description used by overlay acquisition and
+   build overlay passive context from it. Reuse main facts only when that
+   ordinary operation previously used the same root. Context facts do not share
+   a live handle between the main import traversal and the later overlay read.
+4. Keep the production collection-aware overlay path. Migrate meaningful
+   lower-level tests to that path with explicit policy/limits, retaining their
+   budget, version, and failure assertions. Delete the test-only legacy branch
+   selected by missing variadic policy and its exclusive adapters, rather than
+   treating optional argument count as a contract. The baseline production entry
+   points all supply the policy argument.
+5. Keep overlay source IDs, duplicate detection, version protection, directory
+   validation, read/close errors, aggregate accounting, and post-read application
+   order. Remove superseded context derivation and overlay-forwarding adapters.
+
+**Finish:** all acquisition/context callers share facts and named inputs while
+ordinary and independent layered overlay semantics remain distinct. Run A when
+buildable; carry any genuine remaining migration dependencies to the next
+integration opportunity instead of adding scaffolding or stopping the sprint.
+
+Progress notes (2026-10-25): introduced the named overlay request and migrated
+ordinary and independent layered overlay acquisition to resolved facts plus
+explicit access. Replaced the variadic compatibility branch with the existing
+collection-aware path, removed old context adapters, and retained overlay
+validation timing, source evidence, budgets, version protection, and close
+reporting. Validation group A, consumer examples, the full Go suite, and
+`git diff --check` passed.
+
+## Stage 10 — Give Import Responsibilities Focused Files (Complete)
+
+**Owners:** engine `imports.go` and new `import_acquisition.go`,
+`import_scope.go`, `import_projection.go`.
+
+1. Put the request entry/access worker and traversal admission/orchestration in
+   `import_acquisition.go`. Keep `imports.go` as the small common owner for
+   limits, accounting/route/traversal data, and shared import diagnostics.
+2. Move `composeAcquiredInputWithPolicies`, `composeAcquiredScopeWithPolicy`,
+   pending-item composition, placement reservation, and their item-scope
+   assembly helpers into `import_scope.go`.
+3. Move nested-origin/policy/evidence projection, acquired source destinations,
+   version-evidence projection, sequence-prefix helpers, and diagnostic-path
+   projection into `import_projection.go`. Scheduling and graph identity remain
+   with their existing graph/scheduler owners.
+4. Make the acquisition-to-closed-resources-to-assembly handoff visible. Keep
+   evidence projection based on existing composition applications/position maps;
+   file movement does not authorize another merge, full-tree replay, or scan of
+   every unrelated policy for each record.
+
+**Finish:** maintainers can locate acquisition, local strict assembly, and evidence
+work separately. Keep this stage structural; parse/admission extraction follows.
+
+Progress notes (2026-10-25): moved request acquisition and traversal admission to
+`import_acquisition.go`, local strict composition and item-scope assembly to
+`import_scope.go`, and origin, destination, version-evidence, and diagnostic-path
+projection to `import_projection.go`. Shared limits, traversal data, and import
+diagnostics remain in `imports.go`. `./scripts/check.sh` passed.
+
+## Stage 11 — Extract Import Declaration Parsing Operations (Complete)
+
+**Owner:** engine `import_spec.go`.
+
+1. Retain the outer mapping check, exactly-one-selector check, source-order field
+   walk, applicability checks, and final selector parsing in
+   `parseImportDeclarationSpec`.
+2. Extract boolean assignment, wildcard-set parsing/validation (shared by
+   `pattern` and `exclude`), placement parsing, and selector-value parsing into
+   ordinary private helpers. Reuse existing `parseStringSet`, authored-member
+   sites, and destination/depth parsers.
+3. Preserve unspecified pointers and set flags, especially nil versus empty
+   pattern lists. Keep error paths/locations tied to the authored selector or
+   list member. Do not reorder consequential checks or replace the selector
+   matrix with a configurable parser registry.
+
+**Finish:** field decoding is readable without changing declaration syntax,
+selector rules, default resolution, or diagnostics. Keep behavior tests as the
+owner; no helper-by-helper assertion inventory is needed.
+
+Progress notes (2026-10-25): extracted boolean assignment, shared wildcard set
+assignment, placement parsing, and selector-value parsing into private helpers.
+The declaration parser retains its validation ordering, authored member sites,
+and nil-versus-empty presence behavior. Import-focused tests and
+`./scripts/check.sh` passed.
+
+## Stage 12 — Extract Directory Entry Admission And Descent (Complete)
+
+**Owner:** engine `import_selection.go`, using existing directory/link helpers.
+
+1. Keep root normalization/deduplication, root ordering, the explicit traversal
+   stack, candidate union, sorting, exclusion, and required-empty decision visible
+   in `selectDirectoryImportCandidates`.
+2. Extract coherent entry inspection and descent preparation. Return a small
+   result identifying skip, admitted file, or directory frame to enter, plus a
+   diagnostic when appropriate. Keep stack/active-directory mutation with the
+   traversal so its lifetime is visible; do not invent a general visitor API.
+3. Preserve hidden/follow/depth behavior, distinct lexical candidates versus
+   canonical access identity, resource-entry accounting, root-error handling,
+   and active-path cycle detection. A later non-active alias remains eligible;
+   exclusions still do not suppress discovery errors.
+4. Keep globs and first-match main-file discovery on their existing mechanisms.
+   Share a helper only where its existing admission semantics actually coincide.
+
+**Finish:** substantial entry/descent policy is separated from stack orchestration
+without changing the selection algorithm or adding repeated root walks.
+
+Progress notes (2026-10-25): extracted entry inspection and file/directory
+admission into a result-returning helper. The selector retains root handling,
+stack and active-path mutation, candidate union, sorting, exclusions, and the
+required-empty decision. Directory-focused tests and `./scripts/check.sh` passed.
+
+## Stage 13 — Extract Imported-Source Admission From Recursion (Complete)
+
+**Owner:** engine `import_acquisition.go` after Stage 10.
+
+1. Keep `importTraversal.visitPath` as the visible coordinator of containment,
+   canonical identity, cycle/repetition checks, read/parse, directive/version
+   processing, placement, and recursive declaration traversal.
+2. Extract source admission/read-and-process results into a private
+   `admittedImport` carrying canonical resource/node identity, source record,
+   processed payload/declarations, and processing evidence. Return an explicit
+   optional-missing outcome; do not represent a read failure as absence.
+3. Preserve when source records are appended, rolled back for optional missing
+   input, and retained for failures; preserve source IDs, accounting increments,
+   version-callback ordering, and inclusion-edge creation on repetition/cycles.
+4. Pass the admitted record to mapping/item placement helpers rather than
+   repeating its payload, declarations, and processing evidence as parallel
+   arguments to `visitItemSource`.
+5. Factor route push/pop and item-scope save/restore only where it makes their
+   shared lifetime clearer. Keep active graph state across item scopes and
+   reserve placement nodes once. Item helpers complete before outer placement;
+   they are strict local peers, not a precedence layer.
+
+**Finish:** admission decisions and recursion have clear handoffs, with one
+read/process path and the original scheduling/evidence algorithms. Run A again
+because Stages 10–13 changed the import implementation after the first checkpoint.
+
+Progress notes (2026-10-25): introduced an explicit admitted-import record and
+optional-missing outcome for source read/parse/version processing. `visitPath`
+retains containment, identity/cycle checks, graph updates, and recursive
+placement coordination; item placement receives the admitted record directly.
+Validation group A and `./scripts/check.sh` passed.
+
+## Stage 14 — Extract Inheritance Child And Parent Preparation (Complete)
+
+**Owners:** engine `inheritance_schedule.go`, new `inheritance_prepare.go`, and
+existing scope/policy helpers.
+
+1. Extract preparation of the child's directive-free payload, direct origins,
+   local policy templates, and optional control/control-origin evidence.
+2. Extract parent preparation: clone/project policies, lower them against the
+   child's claims, exclude parent identity from the inherited payload, and
+   prepare the separate parent history snapshot where currently required.
+   Keep effective policy templates and transfer construction available to the
+   combination result rather than reconstructing them afterward.
+3. Use focused prepared-child/prepared-parent records of these related values.
+   Borrow authored/resolved parent inputs read-only; retain existing clone points
+   for mutable payloads and history. Keep the current preliminary lower-bound
+   budget decisions at the executor's existing point before materialization.
+4. Keep mapping and identified-sequence adapters, the stable Kahn scheduler, and
+   the parentless/cancelled path semantics intact. Do not flatten nested directives
+   before their destination-local evaluation.
+
+**Finish:** the executor no longer embeds child/control and parent/policy
+preparation. Actual recursive combination/evidence moves in Stage 15.
+
+Progress notes (2026-10-25): extracted child/control and parent/policy preparation
+into focused records in `inheritance_prepare.go`. The executor retains its
+preliminary budget checks, scheduler, and combination path, while history and
+transfer inputs stay available to combination. Engine inheritance coverage and
+facade inheritance tests passed.
+
+## Stage 15 — Return One Inheritance Combination Result (Complete)
+
+**Owners:** new engine `inheritance_combine.go`, `inheritance_collection.go`,
+and the shared executor.
+
+1. Add `inheritanceTemplateResult` as described above and extract the existing
+   parent/child combination into a helper receiving prepared inputs and the
+   application policy. Parentless templates return the same result shape.
+2. Keep `mergeRecursiveMappings` and `combineSequence` as the combination
+   mechanisms. Their callbacks update local origins/policy and local replacement
+   evidence. Have `applyInheritanceSequenceOrigins` return its replacement slice
+   instead of taking the whole enclosing scope result; append that slice to the
+   local template result while retaining its updates to the supplied origin maps.
+3. Derive sequence history, transferred origins, retired/replaced policies,
+   identity preservation, and the transfer operation from that same combination.
+   Preserve `historyParent` and all policy/identity fields on the existing
+   `inheritanceOperation`; do not rerun a merge or project values to recover them.
+4. Keep sequence validation, diagnostic canonicalization, location assignment,
+   replacement order, and no-parent cloning behavior at their established
+   semantic points. Keep child identity absent from inherited-parent history but
+   present with its own origin in the effective child.
+
+**Finish:** merge callbacks no longer mutate the executor accumulator. The
+resolved template and all evidence travel together for Stage 16 integration.
+
+Progress notes (2026-10-25): added `inheritanceTemplateResult` and moved the
+parent/child merge and evidence construction into `combineInheritanceTemplate`.
+Callbacks now update the local origins, policies, and replacement evidence;
+sequence-origin handling returns replacement records to the template result.
+Parentless templates use the same result shape. Engine and facade inheritance
+tests passed.
+
+## Stage 16 — Finish The Inheritance Executor And Accounting (Complete)
+
+**Owner:** engine `inheritance_schedule.go` and focused finalization helpers.
+
+1. Reduce the executor to preparation, budget precheck, combination, accumulation,
+   and final rebuild. Append each template's control before its transfer/history
+   in the same order as before, and update the indexed resolved value/origin/
+   policy/template state once per template.
+2. Extract retained-history charging for one template's returned operations and
+   replacements, reusing the same `retainedNodeCounter` across the scope as
+   before. Preserve pointer-based shared-node accounting, lower-bound checks,
+   scope-slot overhead, final expansion check, limits, and diagnostics.
+3. Extract final rebuilding and scope policy/origin projection where it clarifies
+   the coordinator. Reuse `newInheritancePolicyIndex` once for scope localization;
+   do not return to scanning all policy entries for every slot.
+4. Confirm both adapters and nested walking consume the same output. Retain
+   source-version movement, sensitivity, independent snapshots, assembled order,
+   cancellation, and policy retirement on actual replacement.
+
+**Finish:** one readable executor coordinates explicit value/policy/evidence
+handoffs, with no parallel inheritance implementation. Run I.
+
+Progress notes (2026-10-25): extracted per-template retained-history charging and
+scope rebuild/origin/policy projection into `inheritance_finalize.go`. The shared
+counter, budget checks, final expansion check, and one policy index remain intact.
+Both mapping and identified-sequence adapters still use the shared executor.
+Validation group I passed.
+
+## Stage 17 — Extract Substantial Projection Handlers (Complete)
+
+**Owners:** engine `projection.go`, optionally new `projection_collection.go`.
+
+1. Keep `projectConfiguration`'s schema/type guard and one `valueOperation`.
+   Keep `project`'s depth check, pointer/dynamic dispatch, and scalar conversion
+   choices visible; delegate structs, maps, and sequences to named methods.
+2. Move struct member/inline flattening, collision checks, mapping-key charging,
+   and flattened-field/inline-map secret classification into `projectStruct`.
+   Preserve declaration order and the current decrement for a flattened
+   container that is not retained in the output.
+3. Move deterministic sorted-map traversal into `projectMap`; keep its cycle
+   entry active until all recursive children complete. Move slice/array
+   construction into `projectSequence`, preserving nil-slice handling and the
+   slice-only cycle guard.
+4. All recursive children call the same operation's dispatcher. Avoid duplicate
+   node charging/depth increments or early cycle release introduced by extraction.
+   Preserve float/text/duration/secret scalar handling and error paths.
+
+**Finish:** dispatch and substantial handlers are separately readable, using the
+original operation state. Do not refactor `clone`, `decodeValue`, or
+`valueBuilder.build` as an additional cleanup project.
+
+Progress notes (2026-10-25): delegated struct, map, and sequence projection to
+methods on the existing `valueOperation`. The dispatcher retains depth checks,
+pointer/dynamic handling, and scalar conversion; struct order, map sorting,
+flattened-node charging, nil slices, and cycle guards remain in their original
+paths. Validation group R passed.
+
+## Stage 18 — Separate Schema Field Discovery And Assembly (Complete)
+
+**Owner:** engine `schema.go`, optionally new `schema_fields.go`.
+
+1. Keep `describeFields` as declaration-order enumeration, exported/ignored/tag
+   decisions, and dispatch to ordinary or inline handling.
+2. Extract inline pointer-chain inspection and inline-struct/map assembly,
+   retaining recursion/building-state checks and the existing codec-versus-
+   structural distinction. Reuse the one builder/cache.
+3. Make ordinary registration and inline flattening visibly maintain both
+   `members` and flattened `fields`/`fieldByName`/`inlineMap`. Preserve index
+   paths, nested secret propagation, ambiguity paths, and the single-inline-map
+   rule. Share registration helpers only for genuinely identical updates.
+4. Preserve descriptor reuse and the physical-member view used by typed cloning.
+   Do not unify these views or add alternate field/tag policy. Existing schema,
+   projection, decoding, and cloning expectations remain the behavior baseline.
+
+Progress notes (2026-10-25): kept declaration-order enumeration, exported and
+ignored-field decisions, and tag parsing in `describeFields`; moved ordinary
+registration, inline pointer inspection, and inline struct/map assembly into
+focused helpers in `schema_fields.go`. Physical members remain distinct from
+flattened fields and inline-map metadata. Validation group R passed.
+
+**Finish:** field discovery and descriptor assembly have explicit responsibilities
+without a new registration framework. Run R for both Stages 17–18.
+
+## Stage 19 — Update Consumer And Internal Navigation (Complete)
+
+**Owners:** `docs/consumers/README.md`, `docs/internal/overview.md`,
+`docs/internal/imports.md`, and affected links/test-owner entries in
+`docs/development.md`.
+
+1. Add a concise consumer choice guide: ordinary `Load` for one selected source,
+   explicit discovery as a source usable by either entry, and `LoadLayered` for
+   underlay groups. Distinguish input-owned placement/import/filesystem choices
+   from load-wide definition/default/version/override choices and independent
+   layered overlay context. Link current API/config owners for exact rules.
+2. Link the existing simple README example, bundled-file/layered examples,
+   import-focused prompt catalog, and discovered sequence catalog. Keep the
+   README's simple path simple; do not duplicate complete examples or rewrite
+   consumer domain rules to showcase new internal types.
+3. Update implementation ownership and flow for normalized requests, acquisition
+   policy/state/tier lifetimes, resolved context versus live handles, import file
+   owners, and explicit inheritance/projection/schema handoffs. Fix moved-symbol
+   and behavioral-test navigation and stale comments affected by the refactor.
+4. Preserve public contract definitions and accepted ADR decisions. Keep deferred
+   clone work in `future.md`. No policy change or new ADR is needed for the
+   selected private refactor.
+
+Progress notes (2026-10-25): added a consumer entry-point and ownership guide,
+linked the existing adoption examples, and documented normalized requests,
+acquisition/context lifetimes, import owners, and inheritance/projection/schema
+handoffs. Updated test navigation and retained clone review as deferred.
+Documentation links and repository boundaries passed.
+
+**Finish:** current documentation describes implemented structure, with the
+roadmap/plan retaining future work and progress until release cleanup.
+
+## Stage 20 — Verify And Close The Combined Sprint (Complete)
+
+1. Search for obsolete import/input forwarding ladders, synthetic `Options`
+   acquisition construction, `sourceVersionState.importDefaults`, discarded
+   context derivation branches, unused inverse bridges, and temporary scaffolds.
+   Remove leftovers along with exclusive test scaffolding. Preserve distinct
+   operations and real diagnostic conversions; do not delete private code solely
+   because it resembles another helper.
+2. Review the combined call flow: one normalization model, non-generic acquisition,
+   load versus tier versus traversal state, library-owned acquisition handles
+   closed before composition/publication, one combination outcome for inheritance
+   evidence, and one state owner per reflective operation. Review for added whole-tree
+   traversals, policy scans, or ownership copies without requiring measurements.
+3. Account for every selected finding using the table below. Confirm any new
+   handoff coverage addresses a concrete gap. Existing correctness/algorithmic
+   regressions, public-boundary tests, and meaningful assertions stay effective.
+4. Run the Final validation group, resolve failures, inspect the staged diff and
+   workspace, and commit the completed remaining work with plain-English
+   messages. Report changes, checks, limitations, and any unrelated work retained.
+   Do not tag, push, publish, or update consumer repositories in this sprint.
+
+Progress notes (2026-10-25): reviewed the combined request/acquisition/tier and
+traversal flow, the inheritance result handoff, and the shared reflection state
+owners. The named obsolete source-version field, synthetic acquisition-options
+construction, and inverse conversion symbols are absent; no additional cleanup
+was needed. The final development check and race-enabled full test suite passed.
+
+| Audit finding | Completion evidence |
+| --- | --- |
+| 1: imports | Stages 3–6 and 10–13 remove options reconstruction/default coupling and forwarding ladders; acquisition/scope/evidence owners and admission operations are clear. A and final checks pass. |
+| 2: inheritance | Stages 14–16 return explicit template results, keep one executor, and preserve accounting and value/history/identity agreement. I and final checks pass. |
+| 3: projection | Stage 17 extracts substantial handlers sharing operation state. R and final checks pass. Clone review remains deferred, not implicitly completed. |
+| 4: schema | Stage 18 clarifies ordinary/inline assembly while preserving both descriptor views. R and final checks pass. |
+| 5: contexts | Stages 7–9 share resolved facts across input/import/overlay/passive contexts without retaining handles or changing validation timing. A and final checks pass. |
+| 6: facade | Stage 2 removes unused inverse conversions/adapters and shares real conversion. F and final boundary/consumer checks pass. |
+
+**Finish:** the selected roadmap target is implemented, validated, documented,
+and reviewable as one complete sprint. No unresolved product/scope decisions are
+needed to begin these stages.

docs/roadmap/remediation.md

@@ -0,0 +1,77 @@
+# Consolidation Review Findings
+
+Reviewed revision: `557e006a4ab98b666735a71b3845418c702f7cec`.
+Comparison baseline: `8ab1568` (the committed implementation plan).
+
+The review compared the [consolidation target](consolidation.md) and
+[implementation plan](implementation.md) with the completed sprint, including
+public/private conversions, preflight and acquisition, import selection and
+evidence, filesystem contexts, inheritance, projection, schema construction,
+changed tests, and documentation. The development check (`./scripts/check.sh`)
+and full race suite (`go test -race ./...`) passed with Go 1.26.10 on Linux.
+
+## 1. Complete The Non-Import Resolved-Context Handoff
+
+Status: open. Priority: medium. Category: implementation gap and maintainability.
+No user-facing correctness regression has been established for this finding.
+
+**Target.** Roadmap internal target 2 and implementation Stages 7–9 select one
+resolved filesystem description shared by validation/acquisition and passive
+context construction. Stage 8 explicitly requires populating the description
+at the existing non-import validation point and resolving only facts that are
+still missing later.
+
+**Evidence.** In [acquisition.go](../../internal/engine/acquisition.go),
+`acquireInput` calls `validateFilesystemContext` at line 181 for inputs without
+import traversal and with an applicable explicit context. That validator returns
+only a diagnostic. Its host/native branches derive a resolved description but
+discard it. At lines 220–226, acquisition sees `input.resolvedFilesystem == nil`
+and calls `resolveFilesystemContext` again before building passive views.
+
+For example, an ordinary `Load` of a byte or mapping source with explicit host
+`FilesystemContext` and imports disabled resolves/canonicalizes the base and
+root during validation, then derives those same facts again for its source
+context. The retained description therefore does not complete the intended
+validation-to-context handoff.
+
+Additionally, [filesystem.go](../../internal/engine/filesystem.go) still contains
+`validateAbsentHostFilesystemContext` (line 40), with its own root/base
+canonicalization, root-defaulting, and containment logic. That derivation
+duplicates `resolveAbsentFilesystemContext` in
+[filesystem_context.go](../../internal/engine/filesystem_context.go) (line 29).
+The two paths already maintain separate containment-diagnostic messages. Graph
+caller inspection confirms that the old validator is reachable from
+`acquireInput`; it is not unused migration scaffolding.
+
+**Why address it.** The new model exists, but one important path still discards
+and reconstructs its results, while absent-host context derivation has two
+production implementations. This leaves part of audit finding 5 unresolved and
+preserves the drift risk the consolidation was intended to remove. This is a
+structural completion issue, not a claim of measured performance loss or a new
+single-lookup guarantee.
+
+**Required revision.**
+
+- Have non-import context resolution/validation return or populate the resolved
+  description, and retain it on `assembledInput` at the existing validation
+  point. Later passive-view construction and ordinary-overlay handling should
+  reuse those applicable facts.
+- Route absent-host derivation through the common resolved-context owner and
+  remove the duplicate derivation from the old validator. Keep the existing
+  directory/access checks and close-error handling at their appropriate points.
+- Preserve deferred discovery/ordinary-overlay checks, root-only absent host
+  context, host/native distinctions, diagnostics, and borrowed filesystem
+  ownership. Independently required validation must not disappear merely to
+  reduce filesystem calls.
+- Keep internal documentation aligned with the completed handoff. Describe
+  aggregate accounting as load-wide and repetition/namespace state as
+  tier-scoped; the new internal overview/import prose currently calls the latter
+  per-tier accounting despite its distinct role.
+
+**Verification.** Review the non-import call path to confirm that applicable
+resolved facts are carried forward and absent-host derivation has one owner.
+Reuse the existing host/native, discovery selected/absent, ordinary/layered
+overlay, and passive-resource-context tests. Add a focused behavioral regression
+only for a consequential gap exposed by the change; do not assert incidental
+canonicalization/stat call counts. Run the development check and applicable
+ownership race checks after remediation.

example_test.go

@@ -19,6 +19,28 @@ func ExampleLoad() {
 	// Output: {true 3} <nil>
 }
 
+func ExampleLoad_sequenceDeclaration() {
+	type Item struct {
+		ID string `yaml:"id"`
+	}
+	type Config struct {
+		Items []Item `yaml:"items"`
+	}
+	result, err := configkit.Load[Config](configkit.Bytes("catalog.yml", []byte(`configkit:
+  sequences:
+    - destination: [items]
+      key: id
+items:
+  - id: prompt
+`)))
+	if err != nil {
+		fmt.Println(err)
+		return
+	}
+	fmt.Println(result.Config.Items[0].ID)
+	// Output: prompt
+}
+
 func ExampleNoSource() {
 	type Config struct {
 		Workers int `yaml:"workers"`
@@ -154,8 +176,15 @@ func ExampleOverride() {
 		})
 	}
 	result, err := configkit.Load(configkit.NoSource(), configkit.Options[Config]{
-		Definition: configkit.Definition[Config]{Defaults: func() Config { return Config{Workers: 4} }},
-		Overrides:  overrides,
+		Definition: configkit.Definition[Config]{
+			Defaults: func() Config { return Config{Workers: 4} },
+			Resolve: func(configuration *Config, resolution *configkit.Resolution) error {
+				configkit.Default(resolution, configkit.Keys("workers"), &configuration.Workers, 100,
+					"preserve an explicitly supplied worker count")
+				return nil
+			},
+		},
+		Overrides: overrides,
 	})
 	fmt.Println(result.Config.Workers, result.Sources()[0].Label, err)
 	// Output: 0 --workers <nil>

examples/consumers/discovery_test.go

@@ -0,0 +1,45 @@
+package consumers_test
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+
+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+)
+
+type workingDirectoryPresetConfig struct {
+	Name string `yaml:"name"`
+}
+
+func Example_workingDirectoryPreset() {
+	original, err := os.Getwd()
+	if err != nil {
+		fmt.Println(err)
+		return
+	}
+	defer func() { _ = os.Chdir(original) }()
+	root, err := os.MkdirTemp("", "configkit-working-search-")
+	if err != nil {
+		fmt.Println(err)
+		return
+	}
+	defer os.RemoveAll(root)
+	if err := os.Chdir(root); err != nil {
+		fmt.Println(err)
+		return
+	}
+	if err := os.WriteFile(filepath.Join(root, "service.yml"), []byte("name: example\n"), 0o600); err != nil {
+		fmt.Println(err)
+		return
+	}
+	result, err := configkit.Load[workingDirectoryPresetConfig](
+		configkit.SearchConfig("service", configkit.WorkingDirectory()),
+	)
+	if err != nil {
+		fmt.Println(err)
+		return
+	}
+	fmt.Println(result.Config.Name, filepath.Base(result.Sources()[0].Path))
+	// Output: example service.yml
+}

examples/consumers/prompt_catalog.go

@@ -16,9 +16,10 @@ type PromptRecord struct {
 	ID       string   `yaml:"id"`
 	Name     string   `yaml:"name"`
 	Messages []string `yaml:"messages"`
+	Resource string   `yaml:"resource"`
 }
 
-// LoadPromptCatalog composes explicitly registered prompt records in the main
+// LoadPromptCatalog discovers explicitly registered prompt records in the main
 // tier and replaces the lower-priority default collection as a whole.
 func LoadPromptCatalog(mainPath string) (*configkit.Result[PromptCatalogConfig], error) {
 	return configkit.LoadLayered(configkit.Input{
@@ -28,16 +29,29 @@ func LoadPromptCatalog(mainPath string) (*configkit.Result[PromptCatalogConfig],
 		Underlays: []configkit.Underlay{{Inputs: []configkit.Input{{
 			Source: configkit.Bytes("default prompts", []byte("prompts:\n  - id: default\n    name: Default prompt\n    messages: [Default message]\n")),
 		}}}},
-		Definition: configkit.Definition[PromptCatalogConfig]{
-			SequenceCompositions: []configkit.SequenceComposition{{
-				Path:          configkit.Keys("prompts"),
-				IdentityField: "id",
-			}},
-			Validate: validatePromptCatalog,
+		ImportDefaults: configkit.ImportDefaults{
+			Pattern: []string{"curated*.yml", "generated-*.yml"},
 		},
+		Definition: promptCatalogDefinition(),
 	})
 }
 
+// LoadRequiredPromptCatalog keeps the common one-file import shape small.
+func LoadRequiredPromptCatalog(mainPath string) (*configkit.Result[PromptCatalogConfig], error) {
+	return configkit.Load(configkit.File(mainPath), configkit.Options[PromptCatalogConfig]{
+		Imports: true, Definition: promptCatalogDefinition(),
+	})
+}
+
+func promptCatalogDefinition() configkit.Definition[PromptCatalogConfig] {
+	return configkit.Definition[PromptCatalogConfig]{
+		SequenceIdentities: []configkit.SequenceIdentity{
+			configkit.SequenceIdentityAt(configkit.Keys("prompts"), "id"),
+		},
+		Validate: validatePromptCatalog,
+	}
+}
+
 func validatePromptCatalog(configuration *PromptCatalogConfig, validation *configkit.Validation) {
 	for index, prompt := range configuration.Prompts {
 		if strings.TrimSpace(prompt.Name) == "" {

examples/consumers/prompt_catalog_test.go

@@ -3,6 +3,8 @@ package consumers_test
 import (
 	"errors"
 	"fmt"
+	"io/fs"
+	pathpkg "path"
 	"path/filepath"
 	"testing"
 
@@ -20,8 +22,26 @@ func Example_identifiedPromptCatalog() {
 	for _, prompt := range result.Config.Prompts {
 		ids = append(ids, prompt.ID)
 	}
-	fmt.Println(ids, err)
-	// Output: [main curated weather welcome] <nil>
+	emptySearches := 0
+	for _, source := range result.Sources() {
+		for _, selection := range source.ImportSelections {
+			if selection.Selector == configkit.ImportSelectorDirectory && selection.Outcome == configkit.ImportSelectionNone {
+				emptySearches++
+			}
+		}
+	}
+	fmt.Println(ids, emptySearches, err)
+	// Output: [weather curated welcome main] 1 <nil>
+}
+
+func Example_requiredPromptCatalog() {
+	result, err := consumers.LoadRequiredPromptCatalog(fixture("prompt-catalog", "simple.yml"))
+	if err != nil {
+		fmt.Println(err)
+		return
+	}
+	fmt.Println(result.Config.Prompts[0].ID, err)
+	// Output: required <nil>
 }
 
 func TestPromptCatalogImportsRegisteredItemsAndReplacesDefaults(t *testing.T) {
@@ -36,7 +56,7 @@ func TestPromptCatalogImportsRegisteredItemsAndReplacesDefaults(t *testing.T) {
 	if len(result.Config.Prompts) != 4 {
 		t.Fatalf("prompt records = %#v", result.Config.Prompts)
 	}
-	ids := []string{"main", "curated", "weather", "welcome"}
+	ids := []string{"weather", "curated", "welcome", "main"}
 	for index, id := range ids {
 		if result.Config.Prompts[index].ID != id {
 			t.Fatalf("prompt %d ID = %q, want %q", index, result.Config.Prompts[index].ID, id)
@@ -46,12 +66,15 @@ func TestPromptCatalogImportsRegisteredItemsAndReplacesDefaults(t *testing.T) {
 		if prompt.ID == "default" {
 			t.Fatalf("lower-priority default survived main sequence replacement: %#v", result.Config.Prompts)
 		}
+		if prompt.ID == "ignored" {
+			t.Fatalf("excluded generated prompt was selected: %#v", result.Config.Prompts)
+		}
 	}
 
 	var itemImports, helperImports int
 	for _, source := range result.Sources() {
 		switch filepath.Base(source.Path) {
-		case "curated.yml", "generated-weather.yml", "generated-welcome.yml":
+		case "curated.yml", "weather-feature.yml", "generated-welcome.yml":
 			if source.PlacementMode != configkit.PlacementModeSequenceItem || source.Destination.String() != "/prompts" {
 				t.Fatalf("item source placement = %#v", source)
 			}
@@ -71,6 +94,36 @@ func TestPromptCatalogImportsRegisteredItemsAndReplacesDefaults(t *testing.T) {
 	}
 }
 
+func TestPromptCatalogMountsResourceFromScheduledPromptOrigin(t *testing.T) {
+	result, err := consumers.LoadPromptCatalog(fixture("prompt-catalog", "config.yml"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if result.Config.Prompts[2].ID != "welcome" || result.Config.Prompts[2].Resource != "welcome.txt" {
+		t.Fatalf("scheduled resource prompt = %#v", result.Config.Prompts)
+	}
+	resourcePath := configkit.Keys("prompts").Index(2).Key("resource")
+	info, ok := result.Metadata().Lookup(resourcePath)
+	if !ok || len(info.Origin.Locations) != 1 {
+		t.Fatalf("resource origin = %#v, %v", info, ok)
+	}
+	context, ok := result.SourceContext(info.Origin.Locations[0].SourceID)
+	if !ok || context.FS == nil || filepath.Base(context.BaseDir) != "prompts" {
+		t.Fatalf("resource source context = %#v, %v", context, ok)
+	}
+	contents, err := fs.ReadFile(context.FS, pathpkg.Join(context.BaseDir, result.Config.Prompts[2].Resource))
+	if err != nil || string(contents) != "Welcome resource text.\n" {
+		t.Fatalf("mounted resource = %q, %v", contents, err)
+	}
+}
+
+func TestRequiredPromptCatalogUsesOneRequiredFile(t *testing.T) {
+	result, err := consumers.LoadRequiredPromptCatalog(fixture("prompt-catalog", "simple.yml"))
+	if err != nil || len(result.Config.Prompts) != 1 || result.Config.Prompts[0].ID != "required" {
+		t.Fatalf("simple required prompt = %#v, %v", result, err)
+	}
+}
+
 func TestPromptCatalogLeavesDomainValidationWithConsumer(t *testing.T) {
 	_, err := consumers.LoadPromptCatalog(fixture("prompt-catalog", "invalid.yml"))
 	var loadError *configkit.LoadError

examples/consumers/sequence_catalog.go

@@ -0,0 +1,145 @@
+package consumers
+
+import (
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"path"
+	"path/filepath"
+	"strings"
+
+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+)
+
+// SequenceCatalogConfig is a source-backed prompt catalog with an application
+// supplied run label and a value derived from that label during resolution.
+type SequenceCatalogConfig struct {
+	RunLabel      string                 `yaml:"run_label"`
+	ResolvedLabel string                 `yaml:"resolved_label"`
+	Prompts       []SequenceCatalogEntry `yaml:"prompts"`
+}
+
+// SequenceCatalogEntry keeps prompt meaning, resources, and credentials in the
+// consuming application while ConfigKit handles collection assembly.
+type SequenceCatalogEntry struct {
+	ID          string           `yaml:"id"`
+	Name        string           `yaml:"name"`
+	Description string           `yaml:"description"`
+	Messages    []string         `yaml:"messages"`
+	Resource    string           `yaml:"resource"`
+	Credential  configkit.Secret `yaml:"credential"`
+}
+
+// LoadSequenceCatalog searches its caller-selected main path before a custom
+// fallback directory, assembles imported fragments over a file-backed underlay,
+// applies one selected collection overlay, then resolves and validates once.
+func LoadSequenceCatalog(mainPath, overlayName, runLabel string) (*configkit.Result[SequenceCatalogConfig], error) {
+	absoluteMain, err := filepath.Abs(mainPath)
+	if err != nil {
+		return nil, err
+	}
+	root := filepath.Dir(absoluteMain)
+	filesystem := configkit.NewFilesystem("sequence catalog", os.DirFS(root))
+	filesystemContext := &configkit.FilesystemContext{BaseDir: ".", Root: ".", FS: &filesystem}
+	mainSearch := configkit.SearchConfig("", configkit.Searches(
+		configkit.Paths(absoluteMain),
+		configkit.SearchDirectory(filepath.Join(root, "fallback"), configkit.DirectorySearchOptions{
+			Filenames: []configkit.FilenameGroup{configkit.CustomFilenames(filepath.Base(absoluteMain))},
+		}),
+	), configkit.SearchOptions{Required: true})
+	definition := configkit.Definition[SequenceCatalogConfig]{
+		SequenceIdentities: []configkit.SequenceIdentity{
+			configkit.SequenceIdentityAt(configkit.Keys("prompts"), "id"),
+		},
+		Resolve: func(configuration *SequenceCatalogConfig, resolution *configkit.Resolution) error {
+			configuration.ResolvedLabel = "for:" + configuration.RunLabel
+			resolution.Record(configkit.Keys("resolved_label"), configkit.ChangeNormalization,
+				"derive the resolved label from the selected run label", configkit.Keys("run_label"))
+			return nil
+		},
+		Validate: validateSequenceCatalog,
+	}
+	return configkit.LoadLayered(configkit.Input{
+		Source:     mainSearch,
+		Imports:    true,
+		Filesystem: &configkit.FilesystemContext{Root: root},
+	}, configkit.LayeredOptions[SequenceCatalogConfig]{
+		Underlays: []configkit.Underlay{{Inputs: []configkit.Input{{
+			Source: filesystem.File("underlay.yml"),
+		}}}},
+		Overlay:           overlayName,
+		OverlayFilesystem: filesystemContext,
+		Overrides: []configkit.Override{{
+			Path: configkit.Keys("run_label"), Value: runLabel, Flag: "--run-label",
+		}},
+		Definition: definition,
+	})
+}
+
+// ReadSequenceCatalogResource follows the final prompt field's source context,
+// including when record inheritance retained a resource from an underlay.
+func ReadSequenceCatalogResource(result *configkit.Result[SequenceCatalogConfig], promptID string) (string, error) {
+	if result == nil {
+		return "", errors.New("sequence catalog result is nil")
+	}
+	for index, prompt := range result.Config.Prompts {
+		if prompt.ID != promptID {
+			continue
+		}
+		resourcePath := configkit.Keys("prompts").Index(index).Key("resource")
+		info, found := result.Metadata().Lookup(resourcePath)
+		if !found || len(info.Origin.Locations) != 1 {
+			return "", errors.New("prompt resource has no single declaring source")
+		}
+		context, found := result.SourceContext(info.Origin.Locations[0].SourceID)
+		if !found {
+			return "", errors.New("prompt resource source context is unavailable")
+		}
+		data, err := fs.ReadFile(context.FS, path.Join(context.BaseDir, prompt.Resource))
+		if err != nil {
+			return "", fmt.Errorf("read prompt resource: %w", err)
+		}
+		return string(data), nil
+	}
+	return "", fmt.Errorf("prompt %q is unavailable", promptID)
+}
+
+func validateSequenceCatalog(configuration *SequenceCatalogConfig, validation *configkit.Validation) {
+	for index, prompt := range configuration.Prompts {
+		if strings.TrimSpace(prompt.Name) == "" {
+			validation.Error(configkit.Keys("prompts").Index(index).Key("name"), "must not be empty")
+		}
+		if len(prompt.Messages) == 0 {
+			validation.Error(configkit.Keys("prompts").Index(index).Key("messages"), "must contain at least one message")
+		}
+	}
+	if len(configuration.Prompts) == 0 {
+		validation.Error(configkit.Keys("prompts"), "must contain at least one prompt")
+	}
+}
+
+// NamespacedMapCatalogConfig demonstrates typed application maps whose
+// independent prompt sequences use root and dynamic namespace registrations.
+type NamespacedMapCatalogConfig struct {
+	Prompts     []map[string]any          `yaml:"prompts"`
+	Collections map[string]map[string]any `yaml:"collections"`
+}
+
+// LoadNamespacedMapCatalog applies the same scalar identity constraint to one
+// root collection and each namespace's independently scoped collection.
+func LoadNamespacedMapCatalog(source configkit.Source) (*configkit.Result[NamespacedMapCatalogConfig], error) {
+	selector := configkit.SequenceSelector{
+		configkit.SequenceLiteralKey("collections"),
+		configkit.SequenceAnyMappingKey(),
+		configkit.SequenceLiteralKey("prompts"),
+	}
+	return configkit.Load(source, configkit.Options[NamespacedMapCatalogConfig]{
+		Definition: configkit.Definition[NamespacedMapCatalogConfig]{
+			SequenceIdentities: []configkit.SequenceIdentity{
+				configkit.SequenceIdentityAt(configkit.Keys("prompts"), "id"),
+				configkit.SequenceIdentityMatching(selector, "id"),
+			},
+		},
+	})
+}

examples/consumers/sequence_catalog_test.go

@@ -0,0 +1,239 @@
+package consumers_test
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"os"
+	"strings"
+	"testing"
+
+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+	"gitea.maximumdirect.net/eric/ConfigKit/examples/consumers"
+)
+
+func Example_sequenceCatalog() {
+	const oldSecret = "CONFIGKIT_SEQUENCE_CATALOG_OLD_SECRET"
+	const newSecret = "CONFIGKIT_SEQUENCE_CATALOG_NEW_SECRET"
+	restoreOld, restoreNew := preserveEnvironment(oldSecret), preserveEnvironment(newSecret)
+	defer restoreOld()
+	defer restoreNew()
+	_ = os.Setenv(oldSecret, "disposable-old-example-credential")
+	_ = os.Setenv(newSecret, "disposable-new-example-credential")
+
+	result, err := consumers.LoadSequenceCatalog(fixture("sequence-catalog", "config.yml"), "upsert", "preview")
+	if err != nil {
+		fmt.Println(err)
+		return
+	}
+	ids := make([]string, 0, len(result.Config.Prompts))
+	for _, prompt := range result.Config.Prompts {
+		ids = append(ids, prompt.ID)
+	}
+	shared := configkit.Keys("prompts").Index(1).Key("name")
+	info, _ := result.Metadata().Lookup(shared)
+	resource, resourceErr := consumers.ReadSequenceCatalogResource(result, "concise")
+	fmt.Println(ids, result.Config.ResolvedLabel, info.Explicit, len(result.Metadata().History(shared)), resource, resourceErr == nil, err)
+	// Output: [foundation shared welcome concise extra] for:preview true 2 Foundation resource text.
+	//  true <nil>
+}
+
+func TestSequenceCatalogSelectedOverlayOperations(t *testing.T) {
+	const oldSecret = "CONFIGKIT_SEQUENCE_CATALOG_OLD_SECRET"
+	const newSecret = "CONFIGKIT_SEQUENCE_CATALOG_NEW_SECRET"
+	t.Setenv(oldSecret, "sequence-catalog-old-canary")
+	t.Setenv(newSecret, "sequence-catalog-new-canary")
+
+	tests := []struct {
+		name    string
+		wantIDs []string
+		shared  *consumers.SequenceCatalogEntry
+	}{
+		{name: "append", wantIDs: []string{"foundation", "shared", "welcome", "concise", "extra"}},
+		{name: "upsert", wantIDs: []string{"foundation", "shared", "welcome", "concise", "extra"}, shared: &consumers.SequenceCatalogEntry{ID: "shared", Name: "Shared replacement", Messages: []string{"Replacement message"}, Credential: configkit.SecretEnv(newSecret)}},
+		{name: "replace", wantIDs: []string{"replacement", "last"}},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			result, err := consumers.LoadSequenceCatalog(fixture("sequence-catalog", "config.yml"), test.name, "test")
+			if err != nil {
+				var loadError *configkit.LoadError
+				if errors.As(err, &loadError) {
+					t.Fatalf("load selected overlay: %v (%#v)", err, loadError.Diagnostics())
+				}
+				t.Fatal(err)
+			}
+			gotIDs := make([]string, 0, len(result.Config.Prompts))
+			for _, prompt := range result.Config.Prompts {
+				gotIDs = append(gotIDs, prompt.ID)
+			}
+			if strings.Join(gotIDs, ",") != strings.Join(test.wantIDs, ",") {
+				t.Fatalf("prompt order = %v, want %v", gotIDs, test.wantIDs)
+			}
+			if test.shared == nil {
+				return
+			}
+			shared := result.Config.Prompts[1]
+			if shared.ID != test.shared.ID || shared.Name != test.shared.Name || len(shared.Messages) != 1 ||
+				shared.Messages[0] != test.shared.Messages[0] || shared.Description != "" || shared.Resource != "" || shared.Credential.EnvName() != newSecret {
+				t.Fatalf("upsert did not replace the complete matched record: %#v", shared)
+			}
+		})
+	}
+}
+
+func TestSequenceCatalogInspectionTracksResourcesAndSecretHistory(t *testing.T) {
+	const oldSecret = "CONFIGKIT_SEQUENCE_CATALOG_OLD_SECRET"
+	const newSecret = "CONFIGKIT_SEQUENCE_CATALOG_NEW_SECRET"
+	const oldCanary = "sequence-catalog-old-canary"
+	const newCanary = "sequence-catalog-new-canary"
+	t.Setenv(oldSecret, oldCanary)
+	t.Setenv(newSecret, newCanary)
+
+	result, err := consumers.LoadSequenceCatalog(fixture("sequence-catalog", "config.yml"), "upsert", "history")
+	if err != nil {
+		var loadError *configkit.LoadError
+		if errors.As(err, &loadError) {
+			t.Fatalf("load sequence catalog: %v (%#v)", err, loadError.Diagnostics())
+		}
+		t.Fatal(err)
+	}
+	resourcePath := configkit.Keys("prompts").Index(3).Key("resource")
+	resourceInfo, found := result.Metadata().Lookup(resourcePath)
+	if !found || len(resourceInfo.Origin.Locations) != 1 || len(resourceInfo.Origin.Inheritance) != 1 {
+		t.Fatalf("inherited resource inspection = %#v, %v", resourceInfo, found)
+	}
+	resource, err := consumers.ReadSequenceCatalogResource(result, "concise")
+	if err != nil || resource != "Foundation resource text.\n" {
+		t.Fatalf("resource from inherited source context = %q, %v", resource, err)
+	}
+	if len(result.Metadata().History(configkit.Keys("resolved_label"))) == 0 {
+		t.Fatal("recorded CLI-driven resolution was absent from final inspection")
+	}
+	credentialPath := configkit.Keys("prompts").Index(1).Key("credential")
+	credentialHistory := result.Metadata().History(credentialPath)
+	if len(credentialHistory) == 0 {
+		t.Fatal("upsert did not retain the replaced secret reference in history")
+	}
+	var explanation bytes.Buffer
+	if err := result.WriteExplanation(&explanation, credentialPath); err != nil {
+		t.Fatal(err)
+	}
+	if strings.Contains(explanation.String(), oldCanary) || strings.Contains(explanation.String(), newCanary) {
+		t.Fatalf("secret explanation exposed a credential value: %s", explanation.String())
+	}
+}
+
+func TestNamespacedTypedMapIdentityScopesAreIndependent(t *testing.T) {
+	source := configkit.Bytes("namespaced maps", []byte(`
+prompts:
+  - id: shared
+    text: root prompt
+collections:
+  team:
+    prompts:
+      - id: shared
+        text: team prompt
+  operations:
+    prompts:
+      - id: shared
+        text: operations prompt
+`))
+	result, err := consumers.LoadNamespacedMapCatalog(source)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if result.Config.Prompts[0]["text"] != "root prompt" ||
+		result.Config.Collections["team"]["prompts"].([]any)[0].(map[string]any)["text"] != "team prompt" ||
+		result.Config.Collections["operations"]["prompts"].([]any)[0].(map[string]any)["text"] != "operations prompt" {
+		t.Fatalf("typed map collections = %#v", result.Config)
+	}
+}
+
+func TestNamespacedTypedMapIdentityFindsCollectionsIntroducedByInheritance(t *testing.T) {
+	result, err := consumers.LoadNamespacedMapCatalog(configkit.Bytes("inherited namespace", []byte(`
+collections:
+  source:
+    prompts:
+      - id: shared
+        text: inherited prompt
+  copied:
+    extends: source
+`)))
+	if err != nil {
+		t.Fatal(err)
+	}
+	copied := result.Config.Collections["copied"]["prompts"].([]any)
+	if len(copied) != 1 || copied[0].(map[string]any)["text"] != "inherited prompt" {
+		t.Fatalf("inherited typed-map collection = %#v", result.Config.Collections["copied"])
+	}
+}
+
+func Example_yamlDeclaredIdentityOnly() {
+	result, err := configkit.Load(configkit.Bytes("YAML identity only", []byte(`
+configkit:
+  sequences:
+    - destination: [prompts]
+      key: id
+prompts:
+  - id: initial
+`)), configkit.Options[map[string]any]{
+		Overrides: []configkit.Override{{
+			Path: configkit.Keys("prompts"),
+			Value: []any{
+				map[string]any{"id": "same"},
+				map[string]any{"id": "same"},
+			},
+			Flag: "--prompts",
+		}},
+	})
+	fmt.Println(len(result.Config["prompts"].([]any)), err)
+	// Output: 2 <nil>
+}
+
+func TestYAMLDeclaredIdentityDoesNotRegisterFinalTypedConstraint(t *testing.T) {
+	result, err := configkit.Load(configkit.Bytes("YAML identity only", []byte(`
+configkit:
+  sequences:
+    - destination: [prompts]
+      key: id
+prompts:
+  - id: initial
+`)), configkit.Options[map[string]any]{
+		Overrides: []configkit.Override{{
+			Path: configkit.Keys("prompts"),
+			Value: []any{
+				map[string]any{"id": "same"},
+				map[string]any{"id": "same"},
+			},
+			Flag: "--prompts",
+		}},
+	})
+	if err != nil {
+		t.Fatalf("YAML-only identity incorrectly became an application constraint: %v", err)
+	}
+	prompts := result.Config["prompts"].([]any)
+	if len(prompts) != 2 || prompts[0].(map[string]any)["id"] != prompts[1].(map[string]any)["id"] {
+		t.Fatalf("CLI result = %#v", result.Config)
+	}
+}
+
+func TestNamespacedTypedMapRejectsDuplicatesWithinOneCollection(t *testing.T) {
+	_, err := consumers.LoadNamespacedMapCatalog(configkit.Bytes("duplicate namespace", []byte(`
+collections:
+  team:
+    prompts:
+      - id: duplicate
+      - id: duplicate
+`)))
+	var loadError *configkit.LoadError
+	if !errors.As(err, &loadError) || len(loadError.Diagnostics()) != 1 ||
+		loadError.Diagnostics()[0].Code != configkit.CodeComposeConflict ||
+		loadError.Diagnostics()[0].Path.String() != "/collections/team/prompts" {
+		diagnostics := []configkit.Diagnostic(nil)
+		if loadError != nil {
+			diagnostics = loadError.Diagnostics()
+		}
+		t.Fatalf("duplicate namespaced identity error = %v (%#v)", err, diagnostics)
+	}
+}

examples/consumers/testdata/prompt-catalog/config.yml

@@ -1,11 +1,18 @@
 configkit:
+  sequences:
+    - destination: [prompts]
+      key: id
+      mode: replace
   imports:
-    - path: prompts/curated.yml
+    - dir: prompts
+      exclude: [generated-ignored.yml]
       destination: [prompts]
       placement: sequence-item
-    - glob: prompts/generated-*.yml
+    - dir: featured
+      pattern: [weather-*.yml]
       destination: [prompts]
       placement: sequence-item
+    - dir: optional
 prompts:
   - id: main
     name: Main authored prompt

examples/consumers/testdata/prompt-catalog/invalid.yml

@@ -1,3 +1,8 @@
+configkit:
+  sequences:
+    - destination: [prompts]
+      key: id
+      mode: replace
 prompts:
   - id: invalid
     name: Invalid prompt

examples/consumers/testdata/prompt-catalog/optional/ignored.txt

@@ -0,0 +1 @@
+This file does not match the application import defaults.

examples/consumers/testdata/prompt-catalog/prompts/curated.yml

@@ -1,6 +1,6 @@
 configkit:
   imports:
-    - path: curated-id.yml
+    - path: helpers/curated-id.yml
 name: Curated summary
 messages:
   - Summarize the supplied content.

examples/consumers/testdata/prompt-catalog/prompts/generated-ignored.yml

@@ -0,0 +1,3 @@
+id: ignored
+name: Excluded generated prompt
+messages: [This record is excluded.]

examples/consumers/testdata/prompt-catalog/prompts/generated-welcome.yml

@@ -2,3 +2,4 @@ id: welcome
 name: Welcome
 messages:
   - Welcome the user.
+resource: welcome.txt

examples/consumers/testdata/prompt-catalog/prompts/required.yml

@@ -0,0 +1,3 @@
+id: required
+name: Required prompt
+messages: [Use the required prompt.]

examples/consumers/testdata/prompt-catalog/prompts/welcome.txt

@@ -0,0 +1 @@
+Welcome resource text.

examples/consumers/testdata/prompt-catalog/simple.yml

@@ -0,0 +1,7 @@
+configkit:
+  imports:
+    - path: prompts/required.yml
+      required: true
+      destination: [prompts]
+      placement: sequence-item
+prompts: []

examples/consumers/testdata/sequence-catalog/config.yml

@@ -0,0 +1,7 @@
+run_label: source-default
+configkit:
+  imports:
+    - dir: fragments
+      pattern: '*.yml'
+      destination: [prompts]
+      placement: sequence-item

examples/consumers/testdata/sequence-catalog/foundation.txt

@@ -0,0 +1 @@
+Foundation resource text.

examples/consumers/testdata/sequence-catalog/fragments/01-welcome.yml

@@ -0,0 +1,4 @@
+id: welcome
+name: Welcome
+messages: [Welcome message]
+credential: CONFIGKIT_SEQUENCE_CATALOG_OLD_SECRET

examples/consumers/testdata/sequence-catalog/fragments/02-concise.yml

@@ -0,0 +1,3 @@
+id: concise
+extends: {id: foundation}
+name: Concise

examples/consumers/testdata/sequence-catalog/overlays/append.yml

@@ -0,0 +1,10 @@
+configkit:
+  sequences:
+    - destination: [prompts]
+      key: id
+      mode: append
+prompts:
+  - id: extra
+    name: Extra
+    messages: [Extra message]
+    credential: CONFIGKIT_SEQUENCE_CATALOG_OLD_SECRET

examples/consumers/testdata/sequence-catalog/overlays/replace.yml

@@ -0,0 +1,14 @@
+configkit:
+  sequences:
+    - destination: [prompts]
+      key: id
+      mode: replace
+prompts:
+  - id: replacement
+    name: Replacement
+    messages: [Replacement message]
+    credential: CONFIGKIT_SEQUENCE_CATALOG_OLD_SECRET
+  - id: last
+    name: Last
+    messages: [Last message]
+    credential: CONFIGKIT_SEQUENCE_CATALOG_OLD_SECRET

examples/consumers/testdata/sequence-catalog/overlays/upsert.yml

@@ -0,0 +1,14 @@
+configkit:
+  sequences:
+    - destination: [prompts]
+      key: id
+      mode: upsert
+prompts:
+  - id: shared
+    name: Shared replacement
+    messages: [Replacement message]
+    credential: CONFIGKIT_SEQUENCE_CATALOG_NEW_SECRET
+  - id: extra
+    name: Extra
+    messages: [Extra message]
+    credential: CONFIGKIT_SEQUENCE_CATALOG_OLD_SECRET

examples/consumers/testdata/sequence-catalog/underlay.yml

@@ -0,0 +1,18 @@
+configkit:
+  sequences:
+    - destination: [prompts]
+      key: id
+      mode: append
+prompts:
+  - id: foundation
+    name: Foundation
+    description: Shared foundation instruction
+    messages: [Foundation message]
+    resource: foundation.txt
+    credential: CONFIGKIT_SEQUENCE_CATALOG_OLD_SECRET
+  - id: shared
+    name: Shared draft
+    description: This field must not survive a whole-record replacement
+    messages: [Draft message]
+    resource: shared.txt
+    credential: CONFIGKIT_SEQUENCE_CATALOG_OLD_SECRET

facade_discovery_test.go

@@ -0,0 +1,316 @@
+package configkit
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"testing"
+	"testing/fstest"
+)
+
+type facadeDiscoveryConfig struct {
+	Value    string            `yaml:"value"`
+	Settings map[string]string `yaml:"settings"`
+}
+
+type facadeDiscoveryLifecycleConfig struct {
+	Value    string `yaml:"value"`
+	Resolved string `yaml:"resolved"`
+}
+
+type facadeDiscoveryPlacementConfig struct {
+	Items []facadeDiscoveryPlacementItem `yaml:"items"`
+}
+
+type facadeDiscoveryPlacementItem struct {
+	Name string `yaml:"name"`
+}
+
+func TestFacadeSearchPresetUsesCurrentWorkingDirectory(t *testing.T) {
+	original, err := os.Getwd()
+	if err != nil {
+		t.Fatal(err)
+	}
+	root := t.TempDir()
+	if err := os.Chdir(root); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		if err := os.Chdir(original); err != nil {
+			t.Errorf("restore working directory: %v", err)
+		}
+	})
+	writeFacadeImportFile(t, root, "myapp.yml", "value: working\n")
+
+	result, err := Load[facadeDiscoveryConfig](SearchConfig("myapp", WorkingDirectory()))
+	if err != nil || result.Config.Value != "working" {
+		t.Fatalf("working-directory search = %#v, %v", result, err)
+	}
+	if sources := result.Sources(); len(sources) != 1 || sources[0].Path != canonicalFacadePath(t, filepath.Join(root, "myapp.yml")) {
+		t.Fatalf("working-directory sources = %#v", sources)
+	}
+}
+
+func TestFacadeSearchCustomGenericNamesAndEmptyFilenameSelection(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	filename := writeFacadeImportFile(t, root, "config.yml", "value: found\n")
+	custom := SearchDirectory(root, DirectorySearchOptions{
+		Filenames: []FilenameGroup{CustomFilenames("config.yml")},
+	})
+	result, err := Load[facadeDiscoveryConfig](SearchConfig("", custom))
+	if err != nil || result.Config.Value != "found" {
+		t.Fatalf("custom generic-only search with empty slug = %#v, %v", result, err)
+	}
+	if sources := result.Sources(); len(sources) != 1 || sources[0].Path != canonicalFacadePath(t, filename) {
+		t.Fatalf("custom generic-only sources = %#v", sources)
+	}
+
+	defaults := func() facadeDiscoveryConfig { return facadeDiscoveryConfig{Value: "default"} }
+	empty := SearchDirectory(root, DirectorySearchOptions{Filenames: []FilenameGroup{}})
+	absent, err := Load(SearchConfig("myapp", empty), Options[facadeDiscoveryConfig]{
+		Definition: Definition[facadeDiscoveryConfig]{Defaults: defaults},
+	})
+	if err != nil || absent.Config.Value != "default" || len(absent.Sources()) != 0 {
+		t.Fatalf("explicit empty filename selection = %#v, %v", absent, err)
+	}
+	omitted, err := Load[facadeDiscoveryConfig](SearchConfig("myapp", SearchDirectory(root)))
+	if err != nil || omitted.Config.Value != "found" {
+		t.Fatalf("omitted filename selection did not use defaults = %#v, %v", omitted, err)
+	}
+}
+
+func TestFacadeSearchOrderingRequirednessAndSnapshots(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	selectedPath := writeFacadeImportFile(t, root, "config.yml", "value: selected\n")
+	laterPath := writeFacadeImportFile(t, root, "later.yml", "value: later\n")
+	paths := []string{filepath.Join(root, "missing.yml")}
+	names := []string{"config.yml"}
+	groups := []FilenameGroup{CustomFilenames(names...)}
+	directoryOptions := []DirectorySearchOptions{{Filenames: groups}}
+	search := Searches(Paths(paths...), SearchDirectory(root, directoryOptions...), Paths(laterPath))
+	source := SearchConfig("", search, SearchOptions{Required: true})
+
+	paths[0] = laterPath
+	names[0] = "later.yml"
+	groups[0] = CustomFilenames("later.yml")
+	directoryOptions[0].Filenames[0] = CustomFilenames("later.yml")
+	search = Paths(laterPath)
+
+	result, err := Load[facadeDiscoveryConfig](source)
+	if err != nil || result.Config.Value != "selected" {
+		t.Fatalf("ordered required search after caller mutation = %#v, %v", result, err)
+	}
+	if sources := result.Sources(); len(sources) != 1 || sources[0].Path != canonicalFacadePath(t, selectedPath) {
+		t.Fatalf("ordered search sources = %#v", sources)
+	}
+
+	_, err = Load[facadeDiscoveryConfig](SearchConfig("", Paths(filepath.Join(root, "missing.yml")), SearchOptions{Required: true}))
+	var loadErr *LoadError
+	if !errors.As(err, &loadErr) {
+		t.Fatalf("required exhausted search error = %v, want *LoadError", err)
+	}
+	foundMissing := false
+	for _, diagnostic := range loadErr.Diagnostics() {
+		foundMissing = foundMissing || diagnostic.Code == CodeSourceMissing
+	}
+	if !foundMissing {
+		t.Fatalf("required exhausted search diagnostics = %#v", loadErr.Diagnostics())
+	}
+}
+
+func TestFacadeSearchWorksForLayeredMainAndUnderlay(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	mainPath := writeFacadeImportFile(t, root, "main.yml", "settings: {main: value}\n")
+	underlayPath := writeFacadeImportFile(t, root, "underlay/base.yml", "settings: {underlay: value}\n")
+	result, err := LoadLayered(
+		Input{Source: SearchConfig("", Paths(mainPath))},
+		LayeredOptions[facadeDiscoveryConfig]{Underlays: []Underlay{{Inputs: []Input{{
+			Source: SearchConfig("", SearchDirectory(filepath.Dir(underlayPath), DirectorySearchOptions{
+				Filenames: []FilenameGroup{CustomFilenames("base.yml")},
+			})),
+		}}}}},
+	)
+	if err != nil || !reflect.DeepEqual(result.Config.Settings, map[string]string{"main": "value", "underlay": "value"}) {
+		t.Fatalf("layered search = %#v, %v", result, err)
+	}
+	sources := result.Sources()
+	if len(sources) != 2 || sources[0].Path != canonicalFacadePath(t, mainPath) || sources[0].Layer != LayerBase ||
+		sources[1].Path != canonicalFacadePath(t, underlayPath) || sources[1].Layer != LayerUnderlay {
+		t.Fatalf("layered search sources = %#v", sources)
+	}
+}
+
+func TestFacadeSearchSelectedAndAbsentUseRootOnlyContext(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	mainPath := writeFacadeImportFile(t, root, "main.yml", "value: main\n")
+	writeFacadeImportFile(t, root, "overlays/testing.yml", "value: overlay\n")
+	filesystem := &FilesystemContext{Root: root}
+	options := Options[facadeDiscoveryConfig]{Overlay: "testing", Filesystem: filesystem}
+
+	selected, err := Load(SearchConfig("", Paths(mainPath)), options)
+	if err != nil || selected.Config.Value != "overlay" {
+		t.Fatalf("selected search with root-only context = %#v, %v", selected, err)
+	}
+	sources := selected.Sources()
+	if len(sources) != 2 || sources[0].Path != canonicalFacadePath(t, mainPath) || sources[0].ID != "source-1" ||
+		sources[1].ID != "source-2" || sources[1].Layer != LayerOverlay {
+		t.Fatalf("selected search source evidence = %#v", sources)
+	}
+	mainContext, ok := selected.SourceContext("source-1")
+	if !ok || mainContext.BaseDir != "." {
+		t.Fatalf("selected file base context = %#v, %v", mainContext, ok)
+	}
+
+	missing := SearchConfig("", Paths(filepath.Join(root, "missing.yml")))
+	searchedAbsent, err := Load(missing, options)
+	if err != nil {
+		t.Fatalf("exhausted search with root-only overlay context: %v", err)
+	}
+	explicitAbsent, err := Load(NoSource(), options)
+	if err != nil {
+		t.Fatalf("NoSource with root-only overlay context: %v", err)
+	}
+	if !reflect.DeepEqual(searchedAbsent.Config, explicitAbsent.Config) ||
+		!reflect.DeepEqual(searchedAbsent.Sources(), explicitAbsent.Sources()) {
+		t.Fatalf("searched absence differs from NoSource: %#v / %#v", searchedAbsent, explicitAbsent)
+	}
+	left, leftOK := searchedAbsent.Metadata().Lookup(Keys("value"))
+	right, rightOK := explicitAbsent.Metadata().Lookup(Keys("value"))
+	if leftOK != rightOK || !reflect.DeepEqual(left, right) || !leftOK {
+		t.Fatalf("searched absence metadata = %#v, %v; NoSource metadata = %#v, %v", left, leftOK, right, rightOK)
+	}
+	if sources := searchedAbsent.Sources(); len(sources) != 1 || sources[0].ID != "source-1" || sources[0].Layer != LayerOverlay {
+		t.Fatalf("absent search created unexpected source evidence = %#v", sources)
+	}
+}
+
+func TestFacadeSearchRejectsSelectedContextWithoutFallback(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	inside := writeFacadeImportFile(t, root, "inside.yml", "value: fallback\n")
+	outsideRoot := t.TempDir()
+	outside := writeFacadeImportFile(t, outsideRoot, "outside.yml", "value: selected\n")
+	search := SearchConfig("", Paths(outside, inside))
+
+	_, err := Load(search, Options[facadeDiscoveryConfig]{Filesystem: &FilesystemContext{Root: root}})
+	var loadErr *LoadError
+	if !errors.As(err, &loadErr) || !hasFacadeDiagnostic(loadErr, CodeImportOutsideRoot) {
+		t.Fatalf("selected outside-root file error = %v, want containment failure", err)
+	}
+
+	_, err = Load(search, Options[facadeDiscoveryConfig]{Filesystem: &FilesystemContext{BaseDir: root, Root: root}})
+	if !errors.As(err, &loadErr) || !hasFacadeDiagnostic(loadErr, CodeOptionsInvalid) {
+		t.Fatalf("selected file with explicit base error = %v, want option failure", err)
+	}
+
+	native := NewFilesystem("native", fstest.MapFS{})
+	_, err = Load(search, Options[facadeDiscoveryConfig]{Filesystem: &FilesystemContext{FS: &native, BaseDir: ".", Root: "."}})
+	if !errors.As(err, &loadErr) || !hasFacadeDiagnostic(loadErr, CodeOptionsInvalid) {
+		t.Fatalf("selected file with native context error = %v, want option failure", err)
+	}
+}
+
+func TestFacadeSearchRunsCallbacksOnceAndKeepsInspectionWithSelectedFile(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	selectedPath := writeFacadeImportFile(t, root, "selected.yml", "value: selected\n")
+	writeFacadeImportFile(t, root, "later.yml", "value: later\n")
+	defaultsCalls, resolveCalls, validateCalls := 0, 0, 0
+	result, err := Load(SearchConfig("", Paths(selectedPath, filepath.Join(root, "later.yml"))), Options[facadeDiscoveryLifecycleConfig]{
+		Definition: Definition[facadeDiscoveryLifecycleConfig]{
+			Defaults: func() facadeDiscoveryLifecycleConfig {
+				defaultsCalls++
+				return facadeDiscoveryLifecycleConfig{}
+			},
+			Resolve: func(configuration *facadeDiscoveryLifecycleConfig, resolution *Resolution) error {
+				resolveCalls++
+				configuration.Resolved = "from:" + configuration.Value
+				resolution.Record(Keys("resolved"), ChangeNormalization, "derive from selected value", Keys("value"))
+				return nil
+			},
+			Validate: func(_ *facadeDiscoveryLifecycleConfig, _ *Validation) { validateCalls++ },
+		},
+	})
+	if err != nil || result.Config.Value != "selected" || result.Config.Resolved != "from:selected" {
+		t.Fatalf("search lifecycle result = %#v, %v", result, err)
+	}
+	if defaultsCalls != 1 || resolveCalls != 1 || validateCalls != 1 {
+		t.Fatalf("search callbacks ran defaults=%d resolve=%d validate=%d times", defaultsCalls, resolveCalls, validateCalls)
+	}
+	sources := result.Sources()
+	if len(sources) != 1 || sources[0].Path != canonicalFacadePath(t, selectedPath) || sources[0].ID != "source-1" {
+		t.Fatalf("selected source evidence = %#v", sources)
+	}
+	valueInfo, found := result.Metadata().Lookup(Keys("value"))
+	if !found || len(valueInfo.Origin.Locations) != 1 || valueInfo.Origin.Locations[0].SourceID != sources[0].ID {
+		t.Fatalf("selected value metadata = %#v, %v", valueInfo, found)
+	}
+	var rendered strings.Builder
+	if err := result.WriteEffective(&rendered); err != nil || !strings.Contains(rendered.String(), "value: selected") || strings.Contains(rendered.String(), "later") {
+		t.Fatalf("effective output = %q, %v", rendered.String(), err)
+	}
+}
+
+func TestFacadeSearchSequenceItemAndAbsentInputPlacement(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	selectedPath := writeFacadeImportFile(t, root, "item.yml", "name: selected\n")
+	options := Options[facadeDiscoveryPlacementConfig]{
+		Destination:   Keys("items"),
+		PlacementMode: PlacementModeSequenceItem,
+	}
+	selected, err := Load(SearchConfig("", Paths(selectedPath)), options)
+	if err != nil || len(selected.Config.Items) != 1 || selected.Config.Items[0].Name != "selected" {
+		t.Fatalf("selected sequence item = %#v, %v", selected, err)
+	}
+	if sources := selected.Sources(); len(sources) != 1 || sources[0].Destination.String() != "/items" || sources[0].PlacementMode != PlacementModeSequenceItem {
+		t.Fatalf("selected sequence-item source = %#v", sources)
+	}
+
+	defaults := func() facadeDiscoveryPlacementConfig {
+		return facadeDiscoveryPlacementConfig{Items: []facadeDiscoveryPlacementItem{}}
+	}
+	absent, err := Load(SearchConfig("", Paths(filepath.Join(root, "missing.yml"))), Options[facadeDiscoveryPlacementConfig]{
+		Definition:    Definition[facadeDiscoveryPlacementConfig]{Defaults: defaults},
+		Destination:   options.Destination,
+		PlacementMode: options.PlacementMode,
+	})
+	if err != nil || len(absent.Config.Items) != 0 || len(absent.Sources()) != 0 {
+		t.Fatalf("absent search created a sequence item: %#v, %v", absent, err)
+	}
+}
+
+func hasFacadeDiagnostic(err *LoadError, code Code) bool {
+	for _, diagnostic := range err.Diagnostics() {
+		if diagnostic.Code == code {
+			return true
+		}
+	}
+	return false
+}
+
+func canonicalFacadePath(t *testing.T, path string) string {
+	t.Helper()
+	absolute, err := filepath.Abs(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	canonical, err := filepath.EvalSymlinks(absolute)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return canonical
+}

facade_final_sequence_identity_test.go

@@ -0,0 +1,249 @@
+package configkit_test
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	"gitea.maximumdirect.net/eric/ConfigKit"
+)
+
+func TestFinalSequenceIdentityTreatsLateExtendsFieldsAsPayload(t *testing.T) {
+	for _, phase := range []string{"defaults", "resolution"} {
+		for _, component := range []any{"application-data", nil} {
+			for _, duplicate := range []bool{false, true} {
+				t.Run(fmt.Sprintf("%s/%v/duplicate=%t", phase, component, duplicate), func(t *testing.T) {
+					items := []any{map[string]any{"extends": component}}
+					if duplicate {
+						items = append(items, map[string]any{"extends": component})
+					}
+					definition := configkit.Definition[map[string]any]{
+						SequenceIdentities: []configkit.SequenceIdentity{configkit.SequenceIdentityAt(configkit.Keys("items"), "extends")},
+						Defaults: func() map[string]any {
+							if phase == "defaults" {
+								return map[string]any{"items": items}
+							}
+							return map[string]any{}
+						},
+					}
+					if phase == "resolution" {
+						definition.Resolve = func(value *map[string]any, resolution *configkit.Resolution) error {
+							(*value)["items"] = items
+							resolution.Record(configkit.Keys("items"), configkit.ChangeNormalization, "supply application payload")
+							return nil
+						}
+					}
+					loaded, err := configkit.Load(configkit.NoSource(), configkit.Options[map[string]any]{Definition: definition})
+					if duplicate {
+						loadErr := requireFacadeLoadError(t, err)
+						diagnostics := loadErr.Diagnostics()
+						if loaded != nil || len(diagnostics) != 1 || diagnostics[0].Code != configkit.CodeSequenceConflict || diagnostics[0].Path.String() != "/items" {
+							t.Fatalf("duplicate effective payload diagnostics = %#v", diagnostics)
+						}
+						return
+					}
+					if err != nil || loaded == nil {
+						t.Fatalf("ordinary effective identity was interpreted as a directive: %v", err)
+					}
+					value := loaded.Config["items"].([]any)[0].(map[string]any)
+					if actual, present := value["extends"]; !present || actual != component {
+						t.Fatalf("effective payload = %#v", value)
+					}
+				})
+			}
+		}
+	}
+}
+
+func TestFinalSequenceIdentityValidatesLateValues(t *testing.T) {
+	identity := configkit.SequenceIdentityAt(configkit.Keys("items"), "id")
+	for _, source := range []string{"defaults", "CLI", "resolution"} {
+		for _, shape := range []string{"duplicate", "missing", "non-scalar"} {
+			t.Run(source+"/"+shape, func(t *testing.T) {
+				items := finalIdentityRecords(shape)
+				definition := configkit.Definition[map[string]any]{
+					SequenceIdentities: []configkit.SequenceIdentity{identity},
+					Defaults: func() map[string]any {
+						if source == "defaults" {
+							return map[string]any{"items": items}
+						}
+						return map[string]any{}
+					},
+				}
+				options := configkit.Options[map[string]any]{Definition: definition}
+				switch source {
+				case "CLI":
+					options.Overrides = []configkit.Override{{Path: configkit.Keys("items"), Value: items, Flag: "--items"}}
+				case "resolution":
+					options.Definition.Resolve = func(value *map[string]any, resolution *configkit.Resolution) error {
+						(*value)["items"] = items
+						resolution.Record(configkit.Keys("items"), configkit.ChangeNormalization, "create effective records")
+						return nil
+					}
+				}
+				result, err := configkit.Load(configkit.NoSource(), options)
+				if result != nil {
+					t.Fatalf("invalid final identities returned a result: %#v", result.Config)
+				}
+				loadErr := requireFacadeLoadError(t, err)
+				if len(loadErr.Diagnostics()) != 1 {
+					t.Fatalf("diagnostics = %#v", loadErr.Diagnostics())
+				}
+				diagnostic := loadErr.Diagnostics()[0]
+				wantCode, wantPath := configkit.CodeSequenceInvalid, "/items/0/id"
+				if shape == "duplicate" {
+					wantCode, wantPath = configkit.CodeSequenceConflict, "/items"
+				}
+				if diagnostic.Code != wantCode || diagnostic.Path.String() != wantPath {
+					t.Fatalf("diagnostic = %#v, want %s at %s", diagnostic, wantCode, wantPath)
+				}
+				if source == "CLI" && (diagnostic.Primary == nil || diagnostic.Primary.SourceID != "source-1") {
+					t.Fatalf("CLI identity diagnostic lost its source: %#v", diagnostic)
+				}
+			})
+		}
+	}
+}
+
+func TestFinalSequenceIdentityMatchesLateDynamicNamespaces(t *testing.T) {
+	selector := configkit.SequenceSelector{
+		configkit.SequenceLiteralKey("collections"),
+		configkit.SequenceAnyMappingKey(),
+		configkit.SequenceLiteralKey("items"),
+	}
+	for _, source := range []string{"defaults", "CLI", "resolution"} {
+		t.Run(source, func(t *testing.T) {
+			name := map[string]string{"defaults": "team", "CLI": "cloud", "resolution": "orbit"}[source]
+			path := configkit.Keys("collections", name, "items")
+			items := finalIdentityRecords("duplicate")
+			definition := configkit.Definition[map[string]any]{
+				SequenceIdentities: []configkit.SequenceIdentity{
+					configkit.SequenceIdentityMatching(selector, "id"),
+				},
+				Defaults: func() map[string]any {
+					if source == "defaults" {
+						return map[string]any{"collections": map[string]any{name: map[string]any{"items": items}}}
+					}
+					return map[string]any{}
+				},
+			}
+			options := configkit.Options[map[string]any]{Definition: definition}
+			switch source {
+			case "CLI":
+				options.Overrides = []configkit.Override{{Path: path, Value: items, Flag: "--items"}}
+			case "resolution":
+				options.Definition.Resolve = func(value *map[string]any, resolution *configkit.Resolution) error {
+					(*value)["collections"] = map[string]any{name: map[string]any{"items": items}}
+					resolution.Record(configkit.Keys("collections"), configkit.ChangeNormalization, "create namespaced records")
+					return nil
+				}
+			}
+			result, err := configkit.Load(configkit.NoSource(), options)
+			if result != nil {
+				t.Fatalf("invalid dynamic identity returned a result: %#v", result.Config)
+			}
+			loadErr := requireFacadeLoadError(t, err)
+			if diagnostics := loadErr.Diagnostics(); len(diagnostics) != 1 || diagnostics[0].Code != configkit.CodeSequenceConflict || diagnostics[0].Path.String() != path.String() {
+				t.Fatalf("dynamic identity diagnostics = %#v", diagnostics)
+			}
+		})
+	}
+}
+
+func TestFinalSequenceIdentityAppliesToLayeredLoads(t *testing.T) {
+	definition := configkit.Definition[map[string]any]{
+		SequenceIdentities: []configkit.SequenceIdentity{configkit.SequenceIdentityAt(configkit.Keys("items"), "id")},
+		Defaults: func() map[string]any {
+			return map[string]any{"items": finalIdentityRecords("duplicate")}
+		},
+	}
+	result, err := configkit.LoadLayered(configkit.Input{Source: configkit.NoSource()}, configkit.LayeredOptions[map[string]any]{Definition: definition})
+	if result != nil {
+		t.Fatalf("invalid layered final identities returned a result: %#v", result.Config)
+	}
+	loadErr := requireFacadeLoadError(t, err)
+	if diagnostics := loadErr.Diagnostics(); len(diagnostics) != 1 || diagnostics[0].Code != configkit.CodeSequenceConflict {
+		t.Fatalf("layered identity diagnostics = %#v", diagnostics)
+	}
+}
+
+func TestFinalSequenceIdentityUsesTypedNumbersAndIgnoresUnmatchedShapes(t *testing.T) {
+	definition := configkit.Definition[map[string]any]{
+		SequenceIdentities: []configkit.SequenceIdentity{
+			configkit.SequenceIdentityAt(configkit.Keys("items"), "id"),
+			configkit.SequenceIdentityAt(configkit.Keys("unmatched"), "id"),
+		},
+	}
+	_, err := configkit.Load(configkit.NoSource(), configkit.Options[map[string]any]{
+		Definition: configkit.Definition[map[string]any]{
+			SequenceIdentities: definition.SequenceIdentities,
+			Defaults: func() map[string]any {
+				return map[string]any{"items": []any{
+					map[string]any{"id": int64(1)}, map[string]any{"id": float64(1)},
+				}}
+			},
+		},
+	})
+	loadErr := requireFacadeLoadError(t, err)
+	if diagnostics := loadErr.Diagnostics(); len(diagnostics) != 1 || diagnostics[0].Code != configkit.CodeSequenceConflict {
+		t.Fatalf("typed numeric identity diagnostics = %#v", diagnostics)
+	}
+
+	valid, err := configkit.Load(configkit.Mapping("valid", map[string]any{
+		"items": []any{
+			map[string]any{"id": nil}, map[string]any{"id": true},
+			map[string]any{"id": int64(1)}, map[string]any{"id": "one"},
+		},
+		"other": []any{map[string]any{"id": "same"}, map[string]any{"id": "same"}},
+	}), configkit.Options[map[string]any]{Definition: definition})
+	if err != nil || valid == nil {
+		t.Fatalf("valid scalar identities and unmatched duplicate sequence = %#v, %v", valid, err)
+	}
+	if _, err := configkit.Load(configkit.Mapping("other-shapes", map[string]any{"items": nil}), configkit.Options[map[string]any]{Definition: definition}); err != nil {
+		t.Fatalf("null at a registered path was validated as an identity sequence: %v", err)
+	}
+}
+
+func TestFinalSequenceIdentityDiagnosticDoesNotRevealResolvedSecrets(t *testing.T) {
+	const canary = "FINAL-IDENTITY-CREDENTIAL-CANARY"
+	const secretName = "CONFIGKIT_FINAL_IDENTITY_SECRET"
+	t.Setenv(secretName, canary)
+	type item struct {
+		ID    string           `yaml:"id"`
+		Token configkit.Secret `yaml:"token"`
+	}
+	type config struct {
+		Items []item `yaml:"items"`
+	}
+	definition := configkit.Definition[config]{
+		SequenceIdentities: []configkit.SequenceIdentity{configkit.SequenceIdentityAt(configkit.Keys("items"), "id")},
+		Defaults: func() config {
+			return config{Items: []item{
+				{ID: "duplicate", Token: configkit.SecretEnv(secretName)},
+				{ID: "duplicate", Token: configkit.SecretEnv(secretName)},
+			}}
+		},
+	}
+	result, err := configkit.Load(configkit.NoSource(), configkit.Options[config]{Definition: definition})
+	if result != nil {
+		t.Fatalf("duplicate identity returned a result: %#v", result.Config)
+	}
+	if err == nil || strings.Contains(err.Error(), canary) {
+		t.Fatalf("identity diagnostic leaked a resolved secret: %v", err)
+	}
+	loadErr := requireFacadeLoadError(t, err)
+	if diagnostics := loadErr.Diagnostics(); len(diagnostics) != 1 || diagnostics[0].Code != configkit.CodeSequenceConflict {
+		t.Fatalf("secret-bearing identity diagnostics = %#v", diagnostics)
+	}
+}
+
+func finalIdentityRecords(shape string) []any {
+	switch shape {
+	case "duplicate":
+		return []any{map[string]any{"id": "same"}, map[string]any{"id": "same"}}
+	case "missing":
+		return []any{map[string]any{"other": "value"}}
+	default:
+		return []any{map[string]any{"id": map[string]any{"nested": "value"}}}
+	}
+}

facade_import_alias_test.go

@@ -0,0 +1,99 @@
+package configkit_test
+
+import (
+	"errors"
+	"io/fs"
+	"os"
+	"path"
+	"path/filepath"
+	"testing"
+
+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+)
+
+func TestFacadeNativeDiscoveryPreservesAliasIdentity(t *testing.T) {
+	root := t.TempDir()
+	for name, contents := range map[string]string{
+		"data/item.yml":        "configkit:\n  imports:\n    - path: helper.yml\nvalue: item\n",
+		"data/helper.yml":      "owner: target\nresource: resource.txt\n",
+		"aliases/helper.yml":   "owner: alias\nresource: resource.txt\n",
+		"data/resource.txt":    "target resource",
+		"aliases/resource.txt": "alias resource",
+	} {
+		filename := filepath.Join(root, filepath.FromSlash(name))
+		if err := os.MkdirAll(filepath.Dir(filename), 0o700); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(filename, []byte(contents), 0o600); err != nil {
+			t.Fatal(err)
+		}
+	}
+	for name, target := range map[string]string{"aliases/item.yml": "../data/item.yml", "linked": "data"} {
+		if err := os.Symlink(target, filepath.Join(root, filepath.FromSlash(name))); err != nil {
+			t.Skipf("symlinks unavailable: %v", err)
+		}
+	}
+	filesystem := configkit.NewFilesystem("aliases", os.DirFS(root))
+	type configuration struct {
+		Value    string `yaml:"value"`
+		Owner    string `yaml:"owner"`
+		Resource string `yaml:"resource"`
+	}
+	for _, test := range []struct {
+		name, declaration, item, helper, owner, resource string
+	}{
+		{"file/path", "path: aliases/item.yml", "aliases/item.yml", "aliases/helper.yml", "alias", "alias resource"},
+		{"file/dir", "dir: aliases\n      pattern: item.yml", "aliases/item.yml", "aliases/helper.yml", "alias", "alias resource"},
+		{"file/glob", "glob: 'aliases/ite*.yml'", "aliases/item.yml", "aliases/helper.yml", "alias", "alias resource"},
+		{"directory/path", "path: linked/item.yml", "linked/item.yml", "linked/helper.yml", "target", "target resource"},
+		{"directory/dir", "dir: linked\n      pattern: item.yml", "linked/item.yml", "linked/helper.yml", "target", "target resource"},
+		{"directory/glob", "glob: 'lin*/ite*.yml'", "linked/item.yml", "linked/helper.yml", "target", "target resource"},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			result, err := configkit.Load(configkit.Bytes("main", []byte("configkit:\n  imports:\n    - "+test.declaration+"\n")), configkit.Options[configuration]{
+				Imports: true, Filesystem: &configkit.FilesystemContext{FS: &filesystem, Root: ".", BaseDir: "."},
+			})
+			if err != nil {
+				t.Fatal(err)
+			}
+			if result.Config.Owner != test.owner || result.Config.Value != "item" {
+				t.Fatalf("configuration = %#v", result.Config)
+			}
+			sources := result.Sources()
+			if len(sources) != 3 || sources[1].Path != test.item || sources[2].Path != test.helper {
+				t.Fatalf("source identities = %#v", sources)
+			}
+			for field, source := range map[string]configkit.SourceInfo{"value": sources[1], "resource": sources[2]} {
+				info, ok := result.Metadata().Lookup(configkit.Keys(field))
+				if !ok || len(info.Origin.Locations) != 1 || info.Origin.Locations[0].SourceID != source.ID {
+					t.Fatalf("%s origin = %#v", field, info)
+				}
+				context, ok := result.SourceContext(source.ID)
+				if !ok || context.BaseDir != path.Dir(source.Path) {
+					t.Fatalf("%s context = %#v", field, context)
+				}
+				contents, err := fs.ReadFile(context.FS, path.Join(context.BaseDir, result.Config.Resource))
+				if err != nil || string(contents) != test.resource {
+					t.Fatalf("%s resource = %q, %v", field, contents, err)
+				}
+			}
+		})
+	}
+	// The same native path is still a repeat when separately included. An alias
+	// to a leaf file remains a different native namespace path, as for path imports.
+	for _, selector := range []string{"path: aliases/item.yml", "dir: aliases\n      pattern: item.yml", "glob: 'aliases/ite*.yml'"} {
+		_, err := configkit.Load(configkit.Bytes("main", []byte("configkit:\n  imports:\n    - "+selector+"\n    - path: aliases/item.yml\n")), configkit.Options[configuration]{
+			Imports: true, Filesystem: &configkit.FilesystemContext{FS: &filesystem, Root: ".", BaseDir: "."},
+		})
+		var loadError *configkit.LoadError
+		if !errors.As(err, &loadError) || len(loadError.Diagnostics()) != 1 || loadError.Diagnostics()[0].Code != configkit.CodeImportRepeated {
+			t.Fatalf("repeated source: %v", err)
+		}
+		_, err = configkit.Load(configkit.Bytes("main", []byte("configkit:\n  imports:\n    - "+selector+"\n    - path: data/item.yml\n")), configkit.Options[configuration]{
+			Imports: true, Filesystem: &configkit.FilesystemContext{FS: &filesystem, Root: ".", BaseDir: "."},
+		})
+		if !errors.As(err, &loadError) || len(loadError.Diagnostics()) == 0 || loadError.Diagnostics()[0].Code != configkit.CodeComposeConflict {
+			t.Fatalf("distinct native alias paths should reach composition: %v", err)
+		}
+	}
+}

facade_import_defaults_test.go

@@ -0,0 +1,260 @@
+package configkit
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"gitea.maximumdirect.net/eric/ConfigKit/internal/engine"
+)
+
+func TestImportDepthChecksSuffixAfterSaturation(t *testing.T) {
+	for _, test := range []struct {
+		depth string
+		valid bool
+	}{
+		{"999999999999999999999999.5", false},
+		{"999999999999999999999999e1", false},
+		{"999999999999999999999999", true},
+		{"-0", true},
+	} {
+		t.Run(test.depth, func(t *testing.T) {
+			main := writeFacadeImportFile(t, t.TempDir(), "main.yml", "value: true\nconfigkit:\n  imports:\n    - dir: absent\n      recursive: true\n      depth: "+test.depth+"\n")
+			result, err := Load[map[string]any](File(main), Options[map[string]any]{Imports: true})
+			if test.valid {
+				if err != nil || result.Config["value"] != true {
+					t.Fatalf("valid depth: %v", err)
+				}
+				return
+			}
+			var loadError *LoadError
+			if !errors.As(err, &loadError) || len(loadError.Diagnostics()) != 1 {
+				t.Fatalf("invalid depth accepted: %v", err)
+			}
+			if diagnostic := loadError.Diagnostics()[0]; diagnostic.Code != CodeImportInvalid || diagnostic.Path.String() != "/configkit/imports/0/depth" {
+				t.Fatalf("invalid depth diagnostic = %#v", diagnostic)
+			}
+		})
+	}
+}
+
+func TestImportDefaultsApplyToTransitiveAndUnderlayImports(t *testing.T) {
+	type config struct {
+		Main        string `yaml:"main"`
+		Transitive  string `yaml:"transitive"`
+		Exception   string `yaml:"exception"`
+		Underlay    string `yaml:"underlay"`
+		IgnoredDeep string `yaml:"ignored_deep"`
+	}
+	directory := t.TempDir()
+	mainPath := writeFacadeImportFile(t, directory, "main.yml", `configkit:
+  imports:
+    - path: parent/parent.yml
+main: main
+`)
+	writeFacadeImportFile(t, directory, "parent/parent.yml", `configkit:
+  imports:
+    - dir: generated
+    - dir: explicit
+      pattern: '*.yaml'
+      recursive: false
+`)
+	transitivePath := writeFacadeImportFile(t, directory, "parent/generated/deep/transitive.cfg", "transitive: selected\n")
+	writeFacadeImportFile(t, directory, "parent/generated/ignored.yaml", "ignored_deep: wrong-pattern\n")
+	explicitPath := writeFacadeImportFile(t, directory, "parent/explicit/exception.yaml", "exception: declaration\n")
+	writeFacadeImportFile(t, directory, "parent/explicit/deep/ignored.yaml", "ignored_deep: wrong-depth\n")
+	writeFacadeImportFile(t, directory, "parent/explicit/ignored.cfg", "ignored_deep: wrong-explicit-pattern\n")
+	underlayPath := writeFacadeImportFile(t, directory, "underlay.yml", `configkit:
+  imports:
+    - dir: underlay-files
+`)
+	underlayImportPath := writeFacadeImportFile(t, directory, "underlay-files/underlay.cfg", "underlay: selected\n")
+	recursive := true
+	loaded, err := LoadLayered(Input{Source: File(mainPath), Imports: true}, LayeredOptions[config]{
+		ImportDefaults: ImportDefaults{Recursive: &recursive, Pattern: []string{"*.cfg"}},
+		Underlays:      []Underlay{{Inputs: []Input{{Source: File(underlayPath), Imports: true}}}},
+	})
+	if err != nil {
+		t.Fatalf("LoadLayered: %v", err)
+	}
+	if loaded.Config.Main != "main" || loaded.Config.Transitive != "selected" || loaded.Config.Exception != "declaration" || loaded.Config.Underlay != "selected" || loaded.Config.IgnoredDeep != "" {
+		t.Fatalf("configuration = %#v", loaded.Config)
+	}
+	paths := make(map[string]bool)
+	for _, source := range loaded.Sources() {
+		paths[source.Path] = true
+	}
+	for _, selected := range []string{transitivePath, explicitPath, underlayImportPath} {
+		if !paths[canonicalFacadeImportPath(t, selected)] {
+			t.Errorf("selected source %q missing from source records", selected)
+		}
+	}
+}
+
+func TestImportDefaultsPreserveEmptyPatternAndRequiredness(t *testing.T) {
+	type config struct {
+		Value string `yaml:"value"`
+	}
+	directory := t.TempDir()
+	mainPath := writeFacadeImportFile(t, directory, "main.yml", `configkit:
+  imports:
+    - dir: snippets
+`)
+	writeFacadeImportFile(t, directory, "snippets/value.cfg", "value: imported\n")
+
+	unrestricted, err := Load(File(mainPath), Options[config]{Imports: true})
+	if err != nil || unrestricted.Config.Value != "imported" {
+		t.Fatalf("unspecified pattern = %#v, %v", unrestricted, err)
+	}
+	empty, err := Load(File(mainPath), Options[config]{Imports: true, ImportDefaults: ImportDefaults{Pattern: []string{}}})
+	if err != nil || empty.Config.Value != "" {
+		t.Fatalf("empty pattern = %#v, %v", empty, err)
+	}
+	emptySources := empty.Sources()
+	if len(emptySources) != 1 || len(emptySources[0].ImportSelections) != 1 || emptySources[0].ImportSelections[0].Path.String() != "/configkit/imports/0" || emptySources[0].ImportSelections[0].Selector != ImportSelectorDirectory || emptySources[0].ImportSelections[0].Outcome != ImportSelectionNone {
+		t.Fatalf("empty-pattern evidence = %#v", emptySources)
+	}
+	required := true
+	_, err = Load(File(mainPath), Options[config]{Imports: true, ImportDefaults: ImportDefaults{Required: &required, Pattern: []string{}}})
+	var loadError *LoadError
+	if !errors.As(err, &loadError) || len(loadError.Diagnostics()) != 1 || loadError.Diagnostics()[0].Code != CodeImportMissing {
+		t.Fatalf("required empty selection error = %T %v", err, err)
+	}
+	if sources := loadError.Sources(); len(sources) != 1 || len(sources[0].ImportSelections) != 0 {
+		t.Fatalf("required empty selection was recorded as optional: %#v", sources)
+	}
+
+	recursiveMain := writeFacadeImportFile(t, directory, "recursive.yml", `configkit:
+  imports:
+    - dir: recursive-files
+`)
+	writeFacadeImportFile(t, directory, "recursive-files/nested/value.cfg", "value: selected\n")
+	recursive := true
+	patterns := []string{"*.cfg"}
+	engineOptions := toEngineOptions(Options[config]{Imports: true, ImportDefaults: ImportDefaults{Recursive: &recursive, Pattern: patterns}})
+	recursive = false
+	patterns[0] = "["
+	loadedEngine, err := engine.Load(File(recursiveMain).toEngine(), secretBinding(), engineOptions)
+	if err != nil || loadedEngine.Config.Value != "selected" {
+		t.Fatalf("load after mutating caller defaults = %#v, %v", loadedEngine, err)
+	}
+}
+
+func TestInvalidImportDefaultsPreflightBeforeOrdinaryAndLayeredReads(t *testing.T) {
+	type config struct {
+		Value string `yaml:"value"`
+	}
+	for _, layered := range []bool{false, true} {
+		input := strings.NewReader("value: read\n")
+		underlayInput := strings.NewReader("value: underlay\n")
+		defaultsCalled := false
+		resolveCalled := false
+		definition := Definition[config]{
+			Defaults: func() config { defaultsCalled = true; return config{} },
+			Resolve:  func(*config, *Resolution) error { resolveCalled = true; return nil },
+		}
+		defaults := ImportDefaults{Pattern: []string{"["}}
+		var err error
+		if layered {
+			_, err = LoadLayered(Input{Source: Reader("reader.yml", input)}, LayeredOptions[config]{
+				Definition: definition, ImportDefaults: defaults,
+				Underlays: []Underlay{{Inputs: []Input{{Source: Reader("underlay.yml", underlayInput)}}}},
+			})
+		} else {
+			_, err = Load(Reader("reader.yml", input), Options[config]{Definition: definition, ImportDefaults: defaults})
+		}
+		var loadError *LoadError
+		if !errors.As(err, &loadError) || len(loadError.Diagnostics()) != 1 || loadError.Diagnostics()[0].Code != CodeOptionsInvalid {
+			if loadError != nil {
+				t.Fatalf("layered=%v diagnostics = %#v", layered, loadError.Diagnostics())
+			}
+			t.Fatalf("layered=%v error = %T %v", layered, err, err)
+		}
+		if input.Len() != len("value: read\n") || underlayInput.Len() != len("value: underlay\n") || defaultsCalled || resolveCalled {
+			t.Fatalf("layered=%v consumed input or called application hooks: remaining=%d underlay=%d defaults=%v resolve=%v", layered, input.Len(), underlayInput.Len(), defaultsCalled, resolveCalled)
+		}
+	}
+}
+
+func TestPublicImportSelectionSnapshotsAreDetachedAcrossResultErrorAndResolution(t *testing.T) {
+	type config struct {
+		Value string `yaml:"value"`
+	}
+	directory := t.TempDir()
+	mainPath := writeFacadeImportFile(t, directory, "main.yml", `configkit:
+  imports:
+    - dir: absent
+value: loaded
+`)
+	callbackPath := ""
+	loaded, err := Load(File(mainPath), Options[config]{Imports: true, Definition: Definition[config]{Resolve: func(_ *config, resolution *Resolution) error {
+		first, ok := resolution.Source("source-1")
+		if !ok || len(first.ImportSelections) != 1 {
+			t.Fatalf("resolution source = %#v, %v", first, ok)
+		}
+		first.ImportSelections[0].Path = Keys("callback mutation")
+		second, ok := resolution.Source("source-1")
+		if !ok || second.ImportSelections[0].Path.String() != "/configkit/imports/0" {
+			t.Fatalf("resolution snapshot changed after mutation: %#v", second)
+		}
+		callbackPath = second.ImportSelections[0].Path.String()
+		return nil
+	}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if callbackPath != "/configkit/imports/0" {
+		t.Fatalf("callback path = %q", callbackPath)
+	}
+	sources := loaded.Sources()
+	if len(sources) != 1 || len(sources[0].ImportSelections) != 1 || sources[0].ImportSelections[0].Location.SourceID != sources[0].ID || sources[0].ImportSelections[0].Selector != ImportSelectorDirectory {
+		t.Fatalf("result source evidence = %#v", sources)
+	}
+	sources[0].ImportSelections[0].Path = Keys("result mutation")
+	if got := loaded.Sources()[0].ImportSelections[0].Path.String(); got != "/configkit/imports/0" {
+		t.Fatalf("result snapshot changed after mutation: %q", got)
+	}
+
+	failurePath := writeFacadeImportFile(t, directory, "failure.yml", `configkit:
+  imports:
+    - dir: absent
+    - path: required-missing.yml
+      required: true
+`)
+	_, err = Load(File(failurePath), Options[config]{Imports: true})
+	var loadError *LoadError
+	if !errors.As(err, &loadError) {
+		t.Fatalf("failed load error = %T %v", err, err)
+	}
+	errorSources := loadError.Sources()
+	if len(errorSources) != 1 || len(errorSources[0].ImportSelections) != 1 || errorSources[0].ImportSelections[0].Path.String() != "/configkit/imports/0" {
+		t.Fatalf("error source evidence = %#v", errorSources)
+	}
+	errorSources[0].ImportSelections[0].Path = Keys("error mutation")
+	if got := loadError.Sources()[0].ImportSelections[0].Path.String(); got != "/configkit/imports/0" {
+		t.Fatalf("error snapshot changed after mutation: %q", got)
+	}
+}
+
+func writeFacadeImportFile(t *testing.T, root, name, contents string) string {
+	t.Helper()
+	filename := filepath.Join(root, name)
+	if err := os.MkdirAll(filepath.Dir(filename), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filename, []byte(contents), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	return filename
+}
+
+func canonicalFacadeImportPath(t *testing.T, filename string) string {
+	t.Helper()
+	canonical, err := filepath.EvalSymlinks(filename)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return filepath.ToSlash(canonical)
+}

facade_import_lifecycle_test.go

@@ -0,0 +1,135 @@
+package configkit
+
+import (
+	"errors"
+	"io/fs"
+	"path"
+	"strings"
+	"testing"
+	"testing/fstest"
+)
+
+func TestDiscoveredItemHelpersPreserveNestedInheritedResourceEvidence(t *testing.T) {
+	const canary = "PRIVATE-CONSUMED-HEADER-CANARY"
+	filesystem := NewFilesystem("bundle", fstest.MapFS{
+		"bundle/config/main.yml": {Data: []byte(`configkit:
+  imports:
+    - dir: records
+      pattern: '*-item.yml'
+      destination: [services, records]
+      placement: sequence-item
+services:
+  records:
+    - id: authored
+      version: authored
+`)},
+		"bundle/config/records/a-item.yml": {Data: []byte(`configkit:
+  imports:
+    - path: helper.yml
+version: ` + canary + `
+entries:
+  parent:
+    resource: icon.txt
+  child:
+    extends: parent
+`)},
+		"bundle/config/records/helper.yml": {Data: []byte("id: helper-supplied\n")},
+		"bundle/config/records/icon.txt":   {Data: []byte("icon payload")},
+	})
+	result, err := Load(filesystem.File("bundle/config/main.yml"), Options[map[string]any]{
+		Imports:    true,
+		Filesystem: &FilesystemContext{Root: "bundle", FS: &filesystem},
+		Definition: Definition[map[string]any]{
+			Version:            &VersionRule{Path: Keys("version"), Check: func(Version, *Validation) error { return nil }},
+			SequenceIdentities: []SequenceIdentity{SequenceIdentityAt(Keys("services", "records"), "id")},
+			Secret: func(candidate Path) bool {
+				return candidate.String() == "/services/records/0/version"
+			},
+		},
+		SourceVersionMode: SourceVersionModeIfPresent,
+	})
+	if err != nil {
+		var loadError *LoadError
+		if errors.As(err, &loadError) {
+			t.Fatalf("load discovered item: %v; diagnostics: %#v", err, loadError.Diagnostics())
+		}
+		t.Fatalf("load discovered item: %v", err)
+	}
+	services := result.Config["services"].(map[string]any)
+	records := services["records"].([]any)
+	if len(records) != 2 || records[0].(map[string]any)["id"] != "helper-supplied" || records[0].(map[string]any)["version"] != nil || records[1].(map[string]any)["version"] != "authored" {
+		t.Fatalf("nested records = %#v", records)
+	}
+	childPath := Keys("services", "records").Index(0).Key("entries").Key("child").Key("resource")
+	child := records[0].(map[string]any)["entries"].(map[string]any)["child"].(map[string]any)
+	if child["resource"] != "icon.txt" {
+		t.Fatalf("inherited relative resource = %#v", child)
+	}
+
+	sources := result.Sources()
+	filesByID := make(map[string]string, len(sources))
+	for _, source := range sources {
+		filesByID[source.ID] = source.Path
+	}
+	var itemSource SourceInfo
+	for _, source := range sources {
+		if source.Path == "bundle/config/records/a-item.yml" {
+			itemSource = source
+		}
+	}
+	if itemSource.VersionCheck == nil || !itemSource.VersionCheck.Version.Present || !itemSource.VersionCheck.Redacted || itemSource.VersionCheck.Version.Text != "" {
+		t.Fatalf("consumed header inspection = %#v", itemSource.VersionCheck)
+	}
+	idInfo, ok := result.Metadata().Lookup(Keys("services", "records").Index(0).Key("id"))
+	if !ok || len(idInfo.Origin.Locations) != 1 || filesByID[idInfo.Origin.Locations[0].SourceID] != "bundle/config/records/helper.yml" {
+		t.Fatalf("assigned helper ID origin = %#v", idInfo)
+	}
+	resourceInfo, ok := result.Metadata().Lookup(childPath)
+	if !ok || len(resourceInfo.Origin.Locations) != 1 || filesByID[resourceInfo.Origin.Locations[0].SourceID] != "bundle/config/records/a-item.yml" {
+		t.Fatalf("inherited resource metadata = %#v", resourceInfo)
+	}
+	explanation, ok := result.Explain(childPath)
+	if !ok || explanation.Effective.YAML != "icon.txt\n" || len(explanation.Origin.Locations) != 1 || explanation.Origin.Locations[0].SourceID != resourceInfo.Origin.Locations[0].SourceID {
+		t.Fatalf("inherited resource explanation = %#v", explanation)
+	}
+	context, ok := result.SourceContext(resourceInfo.Origin.Locations[0].SourceID)
+	if !ok || context.FS == nil || context.BaseDir != "config/records" {
+		t.Fatalf("inherited resource context = %#v, %v", context, ok)
+	}
+	contents, err := fs.ReadFile(context.FS, path.Join(context.BaseDir, child["resource"].(string)))
+	if err != nil || string(contents) != "icon payload" {
+		t.Fatalf("inherited resource read = %q, %v", contents, err)
+	}
+
+	_, err = Load(filesystem.File("bundle/config/main.yml"), Options[map[string]any]{
+		Imports:    true,
+		Filesystem: &FilesystemContext{Root: "bundle", FS: &filesystem},
+		Definition: Definition[map[string]any]{
+			Version:            &VersionRule{Path: Keys("version"), Check: func(Version, *Validation) error { return nil }},
+			SequenceIdentities: []SequenceIdentity{SequenceIdentityAt(Keys("services", "records"), "version")},
+			Secret: func(candidate Path) bool {
+				return candidate.String() == "/services/records/0/version"
+			},
+		},
+		SourceVersionMode: SourceVersionModeIfPresent,
+	})
+	loadError, ok := err.(*LoadError)
+	if !ok || len(loadError.Diagnostics()) != 1 || loadError.Diagnostics()[0].Code != CodeComposeInvalid {
+		t.Fatalf("consumed header supplied an identity: %v", err)
+	}
+	if strings.Contains(err.Error(), canary) {
+		t.Fatalf("diagnostic exposed the consumed secret header: %v", err)
+	}
+	var failedItemSource SourceInfo
+	foundFailedItem := false
+	for _, source := range loadError.Sources() {
+		if source.Path == "bundle/config/records/a-item.yml" {
+			failedItemSource = source
+			foundFailedItem = true
+			break
+		}
+	}
+	if !foundFailedItem || failedItemSource.VersionCheck == nil || failedItemSource.VersionCheck.Version.Text != "" || !failedItemSource.VersionCheck.Redacted {
+		t.Fatalf("failed-load source inspection exposed or omitted header evidence: %#v", failedItemSource)
+	}
+}

facade_import_root_test.go

@@ -0,0 +1,119 @@
+package configkit_test
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"testing"
+
+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+)
+
+func TestFacadeDirectoryRootBelowContainedAbsoluteSymlink(t *testing.T) {
+	root, err := filepath.EvalSymlinks(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	parts := filepath.Join(root, "real", "parts")
+	if err := os.MkdirAll(parts, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	partPath := filepath.Join(parts, "part.yml")
+	if err := os.WriteFile(partPath, []byte("value: included\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink(filepath.Join(root, "real"), filepath.Join(root, "absolute")); err != nil {
+		t.Skipf("symlinks unavailable: %v", err)
+	}
+	for _, follow := range []bool{true, false} {
+		t.Run(fmt.Sprintf("follow=%t", follow), func(t *testing.T) {
+			mainPath := filepath.Join(root, "main.yml")
+			contents := fmt.Sprintf("configkit:\n  imports:\n    - dir: absolute/parts\n      pattern: '*.yml'\n      follow: %t\n", follow)
+			if err := os.WriteFile(mainPath, []byte(contents), 0o600); err != nil {
+				t.Fatal(err)
+			}
+			result, err := configkit.Load[map[string]any](configkit.File(mainPath), configkit.Options[map[string]any]{Imports: true})
+			if err != nil {
+				t.Fatal(err)
+			}
+			if result.Config["value"] != "included" {
+				t.Fatalf("configuration = %#v", result.Config)
+			}
+			if sources := result.Sources(); len(sources) != 2 || sources[1].Path != partPath {
+				t.Fatalf("canonical imported source = %#v", sources)
+			}
+		})
+	}
+}
+
+func TestFacadeNativeDiscoveryWithNestedRoot(t *testing.T) {
+	root := t.TempDir()
+	parts := filepath.Join(root, "nested/root/parts")
+	if err := os.MkdirAll(parts, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(parts, "value.yml"), []byte("value: 1\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink("parts", filepath.Join(root, "nested/root/linked")); err != nil {
+		t.Skipf("symlinks unavailable: %v", err)
+	}
+	filesystem := configkit.NewFilesystem("nested", os.DirFS(root))
+	context := &configkit.FilesystemContext{FS: &filesystem, Root: "nested/root", BaseDir: "nested/root"}
+	for _, selector := range []string{
+		"dir: parts", "glob: 'parts/*.yml'", "dir: linked", "glob: 'lin*/*.yml'",
+	} {
+		t.Run(selector, func(t *testing.T) {
+			result, err := configkit.Load(configkit.Bytes("main", []byte("configkit:\n  imports:\n    - "+selector+"\n")), configkit.Options[map[string]any]{Imports: true, Filesystem: context})
+			if err != nil {
+				t.Fatal(err)
+			}
+			if result.Config["value"] != int64(1) {
+				t.Fatalf("configuration = %#v", result.Config)
+			}
+		})
+	}
+	if err := os.WriteFile(filepath.Join(root, "nested/outside.yml"), []byte("value: outside\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink("../../outside.yml", filepath.Join(parts, "escape.yml")); err != nil {
+		t.Fatal(err)
+	}
+	for _, selector := range []string{"dir: parts", "glob: 'parts/*.yml'"} {
+		_, err := configkit.Load(configkit.Bytes("main", []byte("configkit:\n  imports:\n    - "+selector+"\n")), configkit.Options[map[string]any]{Imports: true, Filesystem: context})
+		var loadError *configkit.LoadError
+		if !errors.As(err, &loadError) || len(loadError.Diagnostics()) != 1 || loadError.Diagnostics()[0].Code != configkit.CodeImportOutsideRoot {
+			t.Fatalf("escaping %s: %v", selector, err)
+		}
+	}
+}
+
+func TestFacadeDiscoveryAllowsFiniteLinkReuse(t *testing.T) {
+	root := t.TempDir()
+	if err := os.Mkdir(filepath.Join(root, "parts"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(root, "parts/value.yml"), []byte("value: 1\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink("..", filepath.Join(root, "parts/up")); err != nil {
+		t.Skipf("symlinks unavailable: %v", err)
+	}
+	filesystem := configkit.NewFilesystem("finite", os.DirFS(root))
+	for _, native := range []bool{false, true} {
+		for _, selector := range []string{"dir: parts/up/parts/up/parts\n      pattern: '*.yml'", "glob: 'parts/up/parts/up/parts/*.yml'"} {
+			context := &configkit.FilesystemContext{Root: root, BaseDir: root}
+			if native {
+				context = &configkit.FilesystemContext{FS: &filesystem, Root: ".", BaseDir: "."}
+			}
+			result, err := configkit.Load(configkit.Bytes("main", []byte("configkit:\n  imports:\n    - "+selector+"\n")), configkit.Options[map[string]any]{Imports: true, Filesystem: context})
+			if err != nil {
+				t.Fatalf("native=%v selector=%s: %v", native, selector, err)
+			}
+			if result.Config["value"] != int64(1) {
+				t.Fatalf("configuration = %#v", result.Config)
+			}
+		}
+	}
+}

facade_inheritance_test.go

@@ -91,6 +91,214 @@ func TestFacadeInheritancePreservesPresenceOriginsAndHistory(t *testing.T) {
 	}
 }
 
+func TestFacadeIdentifiedInheritanceResolvesChainsAndNestedCollections(t *testing.T) {
+	const secretName = "CONFIGKIT_IDENTIFIED_INHERITANCE_SECRET"
+	const canary = "IDENTIFIED-INHERITANCE-SECRET-CANARY"
+	t.Setenv(secretName, canary)
+	type step struct {
+		ID    string `yaml:"id"`
+		Value string `yaml:"value"`
+	}
+	type job struct {
+		ID         string                       `yaml:"id"`
+		Name       string                       `yaml:"name"`
+		Credential configkit.Secret             `yaml:"credential"`
+		Resource   string                       `yaml:"resource"`
+		Steps      []step                       `yaml:"steps"`
+		Settings   map[string]map[string]string `yaml:"settings"`
+	}
+	type configuration struct {
+		Jobs []job `yaml:"jobs"`
+	}
+	input := []byte(`jobs:
+- id: child
+  extends: {id: parent}
+  name: child-name
+- id: parent
+  extends: {id: base}
+- id: base
+  name: base-name
+  credential: CONFIGKIT_IDENTIFIED_INHERITANCE_SECRET
+  resource: icon.txt
+  steps:
+    - id: base-step
+      value: base-step-value
+    - id: second-step
+      value: second-step-value
+  settings:
+    primary: {value: base-setting}
+    secondary: {extends: primary}
+`)
+	filesystem := configkit.NewFilesystem("identified-bundle", fstest.MapFS{
+		"config/identified.yml": &fstest.MapFile{Data: input},
+		"config/icon.txt":       &fstest.MapFile{Data: []byte("identified-parent-resource")},
+	})
+	registrations := []configkit.SequenceIdentity{
+		configkit.SequenceIdentityAt(configkit.Keys("jobs"), "id"),
+	}
+	result, err := configkit.Load(filesystem.File("config/identified.yml"), configkit.Options[configuration]{
+		Definition: configkit.Definition[configuration]{
+			SequenceIdentities: registrations,
+			Secret: func(path configkit.Path) bool {
+				return path.String() == "/jobs/0/credential" || path.String() == "/jobs/1/credential" || path.String() == "/jobs/2/credential"
+			},
+		},
+	})
+	if err != nil {
+		if loadError, ok := err.(*configkit.LoadError); ok {
+			t.Fatalf("load identified inheritance: %v (%#v)", err, loadError.Diagnostics())
+		}
+		t.Fatal(err)
+	}
+	if len(result.Config.Jobs) != 3 || result.Config.Jobs[0].ID != "child" || result.Config.Jobs[1].ID != "parent" || result.Config.Jobs[2].ID != "base" {
+		t.Fatalf("inherited job positions and identities = %#v", result.Config.Jobs)
+	}
+	child := result.Config.Jobs[0]
+	if child.Name != "child-name" || child.Credential.Value() != canary || child.Resource != "icon.txt" || len(child.Steps) != 2 {
+		t.Fatalf("inherited child = %#v", child)
+	}
+	if got := []string{child.Steps[0].ID, child.Steps[1].ID}; strings.Join(got, ",") != "base-step,second-step" {
+		t.Fatalf("inherited nested steps = %v", got)
+	}
+	if child.Steps[0].Value != "base-step-value" || child.Steps[1].Value != "second-step-value" || child.Settings["secondary"]["value"] != "base-setting" {
+		t.Fatalf("inherited nested collection and mapping = %#v", child)
+	}
+	credentialPath := configkit.Keys("jobs").Index(0).Key("credential")
+	credentialInfo, found := result.Metadata().Lookup(credentialPath)
+	if !found || len(credentialInfo.Origin.Inheritance) != 2 {
+		t.Fatalf("inherited secret provenance = %#v, %v", credentialInfo, found)
+	}
+	resourceInfo, found := result.Metadata().Lookup(configkit.Keys("jobs").Index(0).Key("resource"))
+	if !found || len(resourceInfo.Origin.Inheritance) != 2 || len(resourceInfo.Origin.Locations) != 1 {
+		t.Fatalf("inherited resource provenance = %#v, %v", resourceInfo, found)
+	}
+	context, found := result.SourceContext(resourceInfo.Origin.Locations[0].SourceID)
+	if !found || context.BaseDir != "config" || context.FS == nil {
+		t.Fatalf("inherited resource context = %#v, %v", context, found)
+	}
+	resource, readErr := fs.ReadFile(context.FS, context.BaseDir+"/"+child.Resource)
+	if readErr != nil || string(resource) != "identified-parent-resource" {
+		t.Fatalf("inherited resource = %q, %v", resource, readErr)
+	}
+	resourceHistory, found := result.Explain(configkit.Keys("jobs").Index(0).Key("resource"))
+	if !found || len(resourceHistory.History) == 0 {
+		t.Fatalf("inherited resource history = %#v, %v", resourceHistory, found)
+	}
+	credentialHistory, found := result.Explain(credentialPath)
+	if !found || !credentialHistory.Effective.Redacted {
+		t.Fatalf("inherited secret explanation = %#v, %v", credentialHistory, found)
+	}
+	identityInfo, found := result.Metadata().Lookup(configkit.Keys("jobs").Index(0).Key("id"))
+	if !found || !identityInfo.Explicit || len(identityInfo.Origin.Inheritance) != 0 ||
+		len(identityInfo.Origin.Locations) != 1 {
+		t.Fatalf("child identity origin and presence = %#v, %v", identityInfo, found)
+	}
+	if _, found := result.Metadata().Lookup(configkit.Keys("jobs").Index(0).Key("extends")); found {
+		t.Fatal("identified record relationship remained in effective metadata")
+	}
+	var rendered bytes.Buffer
+	if err := result.WriteEffective(&rendered); err != nil || strings.Contains(rendered.String(), canary) || strings.Contains(rendered.String(), "extends:") {
+		t.Fatalf("effective inherited configuration = %q, %v", rendered.String(), err)
+	}
+}
+
+func TestFacadeIdentifiedInheritanceFailureDoesNotRevealSecretCanary(t *testing.T) {
+	const secretName = "CONFIGKIT_IDENTIFIED_INHERITANCE_FAILURE_SECRET"
+	const canary = "IDENTIFIED-INHERITANCE-FAILURE-CANARY"
+	t.Setenv(secretName, canary)
+	type job struct {
+		ID         string           `yaml:"id"`
+		Credential configkit.Secret `yaml:"credential"`
+	}
+	type configuration struct {
+		Jobs []job `yaml:"jobs"`
+	}
+	input := []byte(`jobs:
+- id: child
+  extends: {id: missing}
+  credential: CONFIGKIT_IDENTIFIED_INHERITANCE_FAILURE_SECRET
+`)
+	_, err := configkit.Load(configkit.Bytes("identified-failure.yml", input), configkit.Options[configuration]{
+		Definition: configkit.Definition[configuration]{
+			SequenceIdentities: []configkit.SequenceIdentity{configkit.SequenceIdentityAt(configkit.Keys("jobs"), "id")},
+			Secret:             func(path configkit.Path) bool { return path.String() == "/jobs/0/credential" },
+		},
+	})
+	if err == nil || strings.Contains(err.Error(), canary) {
+		t.Fatalf("identified inheritance failure = %v; secret canary must remain undisclosed", err)
+	}
+}
+
+func TestFacadeLayeredIdentifiedInheritanceUsesSurvivingRecords(t *testing.T) {
+	policy := func(mode string) string {
+		return "configkit:\n  sequences:\n    - destination: [jobs]\n      key: id\n      mode: " + mode + "\n"
+	}
+	tests := []struct {
+		name        string
+		lower       string
+		higher      string
+		wantCode    configkit.Code
+		wantValue   string
+		wantSuccess bool
+	}{
+		{
+			name:      "upserted parent supplies its final payload",
+			lower:     policy("upsert") + "jobs: [{id: parent, value: lower}]\n",
+			higher:    policy("upsert") + "jobs: [{id: parent, value: higher}, {id: child, extends: {id: parent}}]\n",
+			wantValue: "higher", wantSuccess: true,
+		},
+		{
+			name:     "replacement removes a lower parent before lookup",
+			lower:    policy("upsert") + "jobs: [{id: parent, value: lower}]\n",
+			higher:   policy("replace") + "jobs: [{id: child, extends: {id: parent}}]\n",
+			wantCode: configkit.CodeInheritanceMissing,
+		},
+		{
+			name:      "upserted child without a directive replaces the invalid lower child",
+			lower:     policy("upsert") + "jobs: [{id: child, extends: {id: missing}, value: lower}]\n",
+			higher:    policy("upsert") + "jobs: [{id: child, value: higher}]\n",
+			wantValue: "higher", wantSuccess: true,
+		},
+		{
+			name:     "self-reference cannot resolve through a lower predecessor",
+			lower:    policy("upsert") + "jobs: [{id: parent, value: lower}]\n",
+			higher:   policy("upsert") + "jobs: [{id: parent, extends: {id: parent}, value: higher}]\n",
+			wantCode: configkit.CodeInheritanceCycle,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			result, err := configkit.LoadLayered(configkit.Input{Source: configkit.Bytes("main.yml", []byte(test.higher))}, configkit.LayeredOptions[map[string]any]{
+				Underlays: []configkit.Underlay{{Inputs: []configkit.Input{{Source: configkit.Bytes("lower.yml", []byte(test.lower))}}}},
+			})
+			if test.wantSuccess {
+				if err != nil {
+					t.Fatal(err)
+				}
+				jobs, ok := result.Config["jobs"].([]any)
+				if !ok || len(jobs) == 0 {
+					t.Fatalf("assembled jobs = %#v", result.Config["jobs"])
+				}
+				child, ok := jobs[len(jobs)-1].(map[string]any)
+				if !ok || child["value"] != test.wantValue {
+					t.Fatalf("surviving record = %#v, want inherited value %q", jobs[len(jobs)-1], test.wantValue)
+				}
+				return
+			}
+			loadError, ok := err.(*configkit.LoadError)
+			if !ok {
+				t.Fatalf("load error = %v, want code %s", err, test.wantCode)
+			}
+			for _, diagnostic := range loadError.Diagnostics() {
+				if diagnostic.Code == test.wantCode {
+					return
+				}
+			}
+			t.Fatalf("load diagnostics = %#v, want code %s", loadError.Diagnostics(), test.wantCode)
+		})
+	}
+}
+
 func TestFacadeInheritanceLayeredPrecedenceAndSourceContext(t *testing.T) {
 	filesystem := configkit.NewFilesystem("bundle", fstest.MapFS{
 		"config/main.yml":          &fstest.MapFile{Data: []byte("entries: {child: {extends: parent}}\n")},
@@ -206,27 +414,24 @@ func TestFacadeInheritanceFailureStopsLaterCallbacks(t *testing.T) {
 	}
 }
 
-func TestFacadeInheritanceResolvesAfterImportsAndCLIReferenceChange(t *testing.T) {
+func TestFacadeCLIOverridesCannotChangeInheritanceRelationship(t *testing.T) {
 	filesystem := configkit.NewFilesystem("bundle", fstest.MapFS{
 		"main.yml":   &fstest.MapFile{Data: []byte("configkit: {imports: [{path: parent.yml}]}\nentries: {child: {extends: first}}\n")},
 		"parent.yml": &fstest.MapFile{Data: []byte("entries: {first: {count: 1}, second: {count: 2}}\n")},
 	})
-	result, err := configkit.Load(filesystem.File("main.yml"), configkit.Options[inheritedConfiguration]{
+	_, err := configkit.Load(filesystem.File("main.yml"), configkit.Options[inheritedConfiguration]{
 		Imports: true, Overrides: []configkit.Override{{Path: configkit.Keys("entries", "child", "extends"), Value: "second", Flag: "--extends"}},
 	})
-	if err != nil || result.Config.Entries["child"].Count != 2 {
-		t.Fatalf("import and CLI reference = %#v, %v", result, err)
-	}
-	history := result.Metadata().History(configkit.Keys("entries", "child", "extends"))
-	if len(history) < 3 || history[len(history)-1].Origin.Operation != configkit.ChangeInheritance {
-		t.Fatalf("superseded reference history = %#v", history)
+	loadError, ok := err.(*configkit.LoadError)
+	if !ok || len(loadError.Diagnostics()) == 0 || loadError.Diagnostics()[0].Code != configkit.CodeOverrideDirective {
+		t.Fatalf("CLI inheritance relationship change = %v", err)
 	}
 	conflicting := configkit.NewFilesystem("bundle", fstest.MapFS{
 		"main.yml":   &fstest.MapFile{Data: []byte("configkit: {imports: [{path: parent.yml}]}\nentries: {child: {extends: first}, first: {count: 3}}\n")},
 		"parent.yml": &fstest.MapFile{Data: []byte("entries: {first: {count: 1}}\n")},
 	})
 	_, err = configkit.Load[inheritedConfiguration](conflicting.File("main.yml"), configkit.Options[inheritedConfiguration]{Imports: true})
-	loadError, ok := err.(*configkit.LoadError)
+	loadError, ok = err.(*configkit.LoadError)
 	if !ok || len(loadError.Diagnostics()) == 0 || loadError.Diagnostics()[0].Code != configkit.CodeComposeConflict {
 		t.Fatalf("strict conflict before expansion = %v", err)
 	}

facade_item_registration_scope_test.go

@@ -0,0 +1,69 @@
+package configkit_test
+
+import (
+	"fmt"
+	"testing"
+	"testing/fstest"
+
+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+)
+
+func TestFacadeItemScopesDoNotReinterpretGlobalRegistrations(t *testing.T) {
+	t.Parallel()
+	for _, layered := range []bool{false, true} {
+		for _, dynamic := range []bool{false, true} {
+			for _, missingOuterID := range []bool{false, true} {
+				t.Run(fmt.Sprintf("layered=%t/dynamic=%t/missing-outer-id=%t", layered, dynamic, missingOuterID), func(t *testing.T) {
+					payload := "prompts: [{text: helper}]\n"
+					unused := configkit.SequenceIdentityAt(configkit.Keys("prompts"), "id")
+					if dynamic {
+						payload = "catalog: {local: {prompts: [{text: helper}]}}\n"
+						unused = configkit.SequenceIdentityMatching(configkit.SequenceSelector{
+							configkit.SequenceLiteralKey("catalog"), configkit.SequenceAnyMappingKey(), configkit.SequenceLiteralKey("prompts"),
+						}, "id")
+					}
+					item := "configkit: {imports: [{path: helper.yml}, {path: child.yml, destination: [children], placement: sequence-item}]}\n"
+					if !missingOuterID {
+						item += "id: outer\n"
+					}
+					files := configkit.NewFilesystem("items", fstest.MapFS{
+						"main.yml": {Data: []byte("configkit: {imports: [{path: item.yml, destination: [items], placement: sequence-item}]}\n")},
+						"item.yml": {Data: []byte(item)}, "helper.yml": {Data: []byte(payload)},
+						"child.yml":        {Data: []byte("id: child\nconfigkit: {imports: [{path: child-helper.yml}]}\n")},
+						"child-helper.yml": {Data: []byte(payload)},
+					})
+					definition := configkit.Definition[map[string]any]{SequenceIdentities: []configkit.SequenceIdentity{
+						unused, configkit.SequenceIdentityAt(configkit.Keys("items"), "id"),
+					}}
+					var result *configkit.Result[map[string]any]
+					var err error
+					if layered {
+						result, err = configkit.LoadLayered(configkit.Input{Source: files.File("main.yml"), Imports: true}, configkit.LayeredOptions[map[string]any]{Definition: definition})
+					} else {
+						result, err = configkit.Load(files.File("main.yml"), configkit.Options[map[string]any]{Imports: true, Definition: definition})
+					}
+					if missingOuterID {
+						failure := requireFacadeLoadError(t, err)
+						if result != nil || len(failure.Diagnostics()) != 1 || failure.Diagnostics()[0].Code != configkit.CodeComposeInvalid || failure.Diagnostics()[0].Path.String() != "/items/0/id" {
+							t.Fatalf("outer constraint diagnostics = %#v", failure.Diagnostics())
+						}
+						return
+					}
+					if err != nil {
+						t.Fatal(err)
+					}
+					for _, record := range []configkit.Path{configkit.Keys("items").Index(0), configkit.Keys("items").Index(0).Key("children").Index(0)} {
+						path := record
+						if dynamic {
+							path = path.Key("catalog").Key("local")
+						}
+						info, found := result.Metadata().Lookup(path.Key("prompts").Index(0).Key("text"))
+						if !found || !info.Explicit {
+							t.Fatalf("nested helper payload lost at %s", path)
+						}
+					}
+				})
+			}
+		}
+	}
+}

facade_item_version_test.go

@@ -0,0 +1,64 @@
+package configkit_test
+
+import (
+	"testing"
+	"testing/fstest"
+
+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+)
+
+func TestFacadeItemDomainVersionsKeepEffectiveScope(t *testing.T) {
+	for _, test := range []struct {
+		name, item, child, helper string
+		underlay, mainItem        bool
+	}{
+		{name: "item", item: "id: item\nversion: domain\n"},
+		{name: "helper", item: "id: item\nconfigkit: {imports: [{path: helper.yml}]}\n", helper: "version: domain\n"},
+		{name: "nested", item: "id: parent\nconfigkit: {imports: [{path: child.yml, destination: [children], placement: sequence-item}]}\n", child: "id: child\nversion: domain\n"},
+		{name: "underlay", item: "id: item\nversion: domain\n", underlay: true},
+		{name: "main-item", item: "id: parent\nconfigkit: {imports: [{path: child.yml, destination: [children], placement: sequence-item}]}\n", child: "id: child\nversion: domain\n", mainItem: true},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			files := fstest.MapFS{
+				"main.yml":     {Data: []byte("version: 1\nconfigkit: {imports: [{path: item.yml, destination: [items], placement: sequence-item}]}\n")},
+				"item.yml":     {Data: []byte(test.item)},
+				"child.yml":    {Data: []byte(test.child)},
+				"helper.yml":   {Data: []byte(test.helper)},
+				"underlay.yml": {Data: []byte("configkit: {imports: [{path: item.yml, destination: [items], placement: sequence-item}]}\n")},
+			}
+			filesystem := configkit.NewFilesystem("items", files)
+			definition := configkit.Definition[map[string]any]{Version: &configkit.VersionRule{
+				Path: configkit.Keys("version"), Check: func(configkit.Version, *configkit.Validation) error { return nil },
+			}}
+			var result *configkit.Result[map[string]any]
+			var err error
+			switch {
+			case test.underlay:
+				result, err = configkit.LoadLayered(configkit.Input{Source: configkit.Mapping("main", map[string]any{"version": "1"})}, configkit.LayeredOptions[map[string]any]{
+					Definition: definition, Underlays: []configkit.Underlay{{Inputs: []configkit.Input{{Source: filesystem.File("underlay.yml"), Imports: true}}}},
+				})
+			case test.mainItem:
+				result, err = configkit.Load(filesystem.File("item.yml"), configkit.Options[map[string]any]{
+					Imports: true, Destination: configkit.Keys("items"), PlacementMode: configkit.PlacementModeSequenceItem, Definition: definition,
+				})
+			default:
+				result, err = configkit.Load(filesystem.File("main.yml"), configkit.Options[map[string]any]{Imports: true, Definition: definition})
+			}
+			if err != nil {
+				t.Fatal(err)
+			}
+			item := result.Config["items"].([]any)[0].(map[string]any)
+			fieldPath := configkit.Keys("items").Index(0).Key("version")
+			if test.child != "" {
+				item = item["children"].([]any)[0].(map[string]any)
+				fieldPath = configkit.Keys("items").Index(0).Key("children").Index(0).Key("version")
+			}
+			if item["version"] != "domain" {
+				t.Fatalf("domain version = %#v", item)
+			}
+			if info, ok := result.Metadata().Lookup(fieldPath); !ok || !info.Explicit {
+				t.Fatalf("version metadata = %#v, %v", info, ok)
+			}
+		})
+	}
+}

facade_sequence_identity_test.go

@@ -0,0 +1,240 @@
+package configkit_test
+
+import (
+	"errors"
+	"strings"
+	"testing"
+
+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+)
+
+func TestFacadeSequenceIdentitySnapshotsSelectorsAndFields(t *testing.T) {
+	fields := []string{"namespace", "id", "id"}
+	selector := configkit.SequenceSelector{
+		configkit.SequenceLiteralKey("collections"),
+		configkit.SequenceAnyMappingKey(),
+		configkit.SequenceLiteralKey("prompts"),
+	}
+	identity := configkit.SequenceIdentityMatching(selector, fields...)
+	selector[1] = configkit.SequenceLiteralKey("other")
+	fields[0] = "changed"
+	definition := configkit.Definition[map[string]any]{SequenceIdentities: []configkit.SequenceIdentity{identity}}
+
+	underlay := configkit.Mapping("underlay", map[string]any{"collections": map[string]any{
+		"team": map[string]any{"prompts": []any{map[string]any{"namespace": "team", "id": "kept"}}},
+	}})
+	main := configkit.Mapping("main", map[string]any{"collections": map[string]any{
+		"team": map[string]any{"prompts": []any{map[string]any{"namespace": "team", "id": "added"}}},
+	}})
+	loaded, err := configkit.LoadLayered(configkit.Input{Source: main}, configkit.LayeredOptions[map[string]any]{
+		Definition: definition,
+		Underlays:  []configkit.Underlay{{Inputs: []configkit.Input{{Source: underlay}}}},
+	})
+	if err != nil {
+		t.Fatalf("load after mutating constructor inputs: %v", err)
+	}
+	prompts := loaded.Config["collections"].(map[string]any)["team"].(map[string]any)["prompts"].([]any)
+	if len(prompts) != 2 {
+		t.Fatalf("registered compound identity did not append records: %#v", prompts)
+	}
+}
+
+func TestFacadeSequenceIdentityUsesExactAndDynamicSelectors(t *testing.T) {
+	dynamic := configkit.SequenceIdentityMatching(configkit.SequenceSelector{
+		configkit.SequenceLiteralKey("collections"),
+		configkit.SequenceAnyMappingKey(),
+		configkit.SequenceLiteralKey("prompts"),
+	}, "id")
+	definition := configkit.Definition[map[string]any]{SequenceIdentities: []configkit.SequenceIdentity{
+		configkit.SequenceIdentityAt(configkit.Keys("prompts"), "namespace", "id"),
+		dynamic,
+	}}
+	underlay := configkit.Mapping("underlay", map[string]any{
+		"prompts": []any{map[string]any{"namespace": "alpha", "id": "same"}},
+		"collections": map[string]any{
+			"team":  map[string]any{"prompts": []any{map[string]any{"id": "team-one"}}},
+			"cloud": map[string]any{"prompts": []any{map[string]any{"id": "cloud-one"}}},
+		},
+	})
+	main := configkit.Mapping("main", map[string]any{
+		"prompts": []any{map[string]any{"namespace": "beta", "id": "same"}},
+		"collections": map[string]any{
+			"team":  map[string]any{"prompts": []any{map[string]any{"id": "team-two"}}},
+			"cloud": map[string]any{"prompts": []any{map[string]any{"id": "cloud-two"}}},
+		},
+	})
+	loaded, err := configkit.LoadLayered(configkit.Input{Source: main}, configkit.LayeredOptions[map[string]any]{
+		Definition: definition,
+		Underlays:  []configkit.Underlay{{Inputs: []configkit.Input{{Source: underlay}}}},
+	})
+	if err != nil {
+		t.Fatalf("load mixed exact and dynamic registrations: %v", err)
+	}
+	rootRecords := loaded.Config["prompts"].([]any)
+	if len(rootRecords) != 2 {
+		t.Fatalf("compound root identities = %#v", rootRecords)
+	}
+	collections := loaded.Config["collections"].(map[string]any)
+	for _, name := range []string{"team", "cloud"} {
+		prompts := collections[name].(map[string]any)["prompts"].([]any)
+		if len(prompts) != 2 {
+			t.Errorf("dynamic prompts for %q = %#v", name, prompts)
+		}
+	}
+}
+
+func TestFacadeSequenceIdentityLiteralStarIsNotWildcard(t *testing.T) {
+	definition := configkit.Definition[map[string]any]{SequenceIdentities: []configkit.SequenceIdentity{
+		configkit.SequenceIdentityMatching(configkit.SequenceSelector{
+			configkit.SequenceLiteralKey("collections"),
+			configkit.SequenceLiteralKey("*"),
+			configkit.SequenceLiteralKey("prompts"),
+		}, "id"),
+	}}
+	underlay := configkit.Mapping("underlay", map[string]any{"collections": map[string]any{
+		"*":    map[string]any{"prompts": []any{map[string]any{"id": "one"}}},
+		"team": map[string]any{"prompts": []any{map[string]any{"id": "team-one"}}},
+	}})
+	main := configkit.Mapping("main", map[string]any{"collections": map[string]any{
+		"*":    map[string]any{"prompts": []any{map[string]any{"id": "two"}}},
+		"team": map[string]any{"prompts": []any{map[string]any{"id": "team-two"}}},
+	}})
+	_, err := configkit.LoadLayered(configkit.Input{Source: configkit.Mapping("main", map[string]any{})}, configkit.LayeredOptions[map[string]any]{
+		Definition: definition,
+		Underlays:  []configkit.Underlay{{Inputs: []configkit.Input{{Source: underlay}, {Source: main}}}},
+	})
+	loadErr := requireFacadeLoadError(t, err)
+	if len(loadErr.Diagnostics()) == 0 || loadErr.Diagnostics()[0].Path.String() != "/collections/team/prompts" {
+		t.Fatalf("literal star registration also matched another key: %#v", loadErr.Diagnostics())
+	}
+
+	wildcard := configkit.Definition[map[string]any]{SequenceIdentities: []configkit.SequenceIdentity{
+		configkit.SequenceIdentityMatching(configkit.SequenceSelector{
+			configkit.SequenceLiteralKey("collections"),
+			configkit.SequenceAnyMappingKey(),
+			configkit.SequenceLiteralKey("prompts"),
+		}, "id"),
+	}}
+	loaded, err := configkit.LoadLayered(configkit.Input{Source: configkit.Mapping("main", map[string]any{})}, configkit.LayeredOptions[map[string]any]{
+		Definition: wildcard,
+		Underlays:  []configkit.Underlay{{Inputs: []configkit.Input{{Source: underlay}, {Source: main}}}},
+	})
+	if err != nil {
+		t.Fatalf("wildcard registration did not match mapping keys: %v", err)
+	}
+	for name, raw := range loaded.Config["collections"].(map[string]any) {
+		if got := len(raw.(map[string]any)["prompts"].([]any)); got != 2 {
+			t.Errorf("wildcard result for %q has %d records", name, got)
+		}
+	}
+}
+
+func TestFacadeSequenceIdentityRejectsInvalidDefinitionsBeforeReadingSource(t *testing.T) {
+	tests := []struct {
+		name     string
+		identity configkit.SequenceIdentity
+		wantPath string
+	}{
+		{
+			name:     "index path",
+			identity: configkit.SequenceIdentityAt(configkit.Keys("records").Index(0), "id"),
+			wantPath: "/records/0",
+		},
+		{
+			name:     "empty fields",
+			identity: configkit.SequenceIdentityAt(configkit.Keys("records")),
+			wantPath: "/records",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			reader := strings.NewReader("records: []\n")
+			_, err := configkit.Load(configkit.Reader("input.yml", reader), configkit.Options[map[string]any]{
+				Definition: configkit.Definition[map[string]any]{SequenceIdentities: []configkit.SequenceIdentity{test.identity}},
+			})
+			loadErr := requireFacadeLoadError(t, err)
+			if len(loadErr.Diagnostics()) != 1 || loadErr.Diagnostics()[0].Code != configkit.CodeOptionsInvalid || loadErr.Diagnostics()[0].Path.String() != test.wantPath {
+				t.Fatalf("definition diagnostics = %#v", loadErr.Diagnostics())
+			}
+			if reader.Len() == 0 {
+				t.Fatal("source was read before registration validation")
+			}
+		})
+	}
+}
+
+func TestFacadeSequenceIdentityOverlapFailsBeforeSourceAccess(t *testing.T) {
+	selector := configkit.SequenceSelector{configkit.SequenceLiteralKey("collections"), configkit.SequenceAnyMappingKey()}
+	definition := configkit.Definition[map[string]any]{SequenceIdentities: []configkit.SequenceIdentity{
+		configkit.SequenceIdentityMatching(selector, "id"),
+		configkit.SequenceIdentityMatching(configkit.SequenceSelector{
+			configkit.SequenceLiteralKey("collections"), configkit.SequenceLiteralKey("team"),
+		}, "slug"),
+	}}
+	reader := strings.NewReader("collections: {}\n")
+	_, err := configkit.Load(configkit.Reader("input.yml", reader), configkit.Options[map[string]any]{Definition: definition})
+	loadErr := requireFacadeLoadError(t, err)
+	if len(loadErr.Diagnostics()) == 0 || loadErr.Diagnostics()[0].Code != configkit.CodeOptionsInvalid {
+		t.Fatalf("overlap diagnostics = %#v", loadErr.Diagnostics())
+	}
+	if reader.Len() == 0 {
+		t.Fatal("source was read before overlapping registrations were rejected")
+	}
+}
+
+func TestFacadeSequenceIdentityConstraintsApplyAtInheritedDestinations(t *testing.T) {
+	definition := configkit.Definition[map[string]any]{SequenceIdentities: []configkit.SequenceIdentity{
+		configkit.SequenceIdentityMatching(configkit.SequenceSelector{
+			configkit.SequenceLiteralKey("entries"),
+			configkit.SequenceLiteralKey("child"),
+			configkit.SequenceLiteralKey("collections"),
+			configkit.SequenceAnyMappingKey(),
+			configkit.SequenceLiteralKey("prompts"),
+		}, "id"),
+	}}
+	loaded, err := configkit.Load(configkit.Bytes("main", []byte(`jobs:
+entries:
+  parent:
+    collections:
+      team:
+        prompts: [{id: inherited, text: base}]
+  child:
+    extends: parent
+    collections:
+      team:
+        prompts: [{id: added, text: child}]
+`)), configkit.Options[map[string]any]{Definition: definition})
+	if err != nil {
+		t.Fatalf("load with dynamic inherited destination: %v", err)
+	}
+	child := loaded.Config["entries"].(map[string]any)["child"].(map[string]any)
+	prompts := child["collections"].(map[string]any)["team"].(map[string]any)["prompts"].([]any)
+	if len(prompts) != 2 {
+		t.Fatalf("inherited dynamic collection = %#v, want parent and child records", prompts)
+	}
+}
+
+func TestFacadeSequenceIdentityLoadsUseIndependentScopes(t *testing.T) {
+	definition := configkit.Definition[map[string]any]{SequenceIdentities: []configkit.SequenceIdentity{
+		configkit.SequenceIdentityMatching(configkit.SequenceSelector{
+			configkit.SequenceLiteralKey("collections"), configkit.SequenceAnyMappingKey(),
+		}, "id"),
+	}}
+	for _, source := range []string{"first", "second"} {
+		loaded, err := configkit.Load(configkit.Mapping(source, map[string]any{"collections": map[string]any{
+			source: []any{map[string]any{"id": "reused"}},
+		}}), configkit.Options[map[string]any]{Definition: definition})
+		if err != nil || len(loaded.Config["collections"].(map[string]any)[source].([]any)) != 1 {
+			t.Fatalf("independent load %q = %#v, %v", source, loaded, err)
+		}
+	}
+}
+
+func requireFacadeLoadError(t *testing.T, err error) *configkit.LoadError {
+	t.Helper()
+	var loadErr *configkit.LoadError
+	if !errors.As(err, &loadErr) {
+		t.Fatalf("error = %v, want *LoadError", err)
+	}
+	return loadErr
+}

facade_sequence_test.go

@@ -21,7 +21,7 @@ func TestFacadeNoSourcePreservesAbsenceWithSequencePolicy(t *testing.T) {
 				definition.Defaults = func() map[string]any { return map[string]any{"fallback": true} }
 			}
 			if registered {
-				definition.SequenceCompositions = []configkit.SequenceComposition{{Path: configkit.Keys("records"), IdentityField: "id"}}
+				definition.SequenceIdentities = []configkit.SequenceIdentity{configkit.SequenceIdentityAt(configkit.Keys("records"), "id")}
 			}
 			ordinary, err := configkit.Load(configkit.NoSource(), configkit.Options[map[string]any]{Definition: definition})
 			if err != nil {
@@ -51,7 +51,7 @@ func TestFacadeNoSourcePreservesAbsenceWithSequencePolicy(t *testing.T) {
 	}
 }
 
-func TestFacadeItemHelperHistoryPreservesTraversalOrder(t *testing.T) {
+func TestFacadeItemHelperHistoryPreservesScheduledPlacement(t *testing.T) {
 	t.Parallel()
 	filesystem := configkit.NewFilesystem("history", fstest.MapFS{
 		"main.yml":         {Data: []byte("records: [{id: authored}]\nconfigkit: {imports: [{path: one.yml, destination: [records], placement: sequence-item}, {path: two.yml, destination: [records], placement: sequence-item}]}\n")},
@@ -63,24 +63,22 @@ func TestFacadeItemHelperHistoryPreservesTraversalOrder(t *testing.T) {
 		"child-helper.yml": {Data: []byte("text: nested helper\n")},
 	})
 	result, err := configkit.Load(filesystem.File("main.yml"), configkit.Options[map[string]any]{
-		Imports: true, Definition: configkit.Definition[map[string]any]{SequenceCompositions: []configkit.SequenceComposition{{Path: configkit.Keys("records"), IdentityField: "id"}}},
+		Imports: true, Definition: configkit.Definition[map[string]any]{SequenceIdentities: []configkit.SequenceIdentity{configkit.SequenceIdentityAt(configkit.Keys("records"), "id")}},
 	})
 	if err != nil {
 		t.Fatal(err)
 	}
-	sourceOrder := make(map[string]int)
 	sourceFiles := make(map[string]string)
-	for index, source := range result.Sources() {
-		sourceOrder[source.ID] = index
+	for _, source := range result.Sources() {
 		sourceFiles[source.ID] = source.Path
 	}
 	for _, test := range []struct {
 		path       configkit.Path
 		file, text string
 	}{
-		{configkit.Keys("records").Index(1).Key("text"), "helper-one.yml", "first helper\n"},
-		{configkit.Keys("records").Index(2).Key("text"), "helper-two.yml", "second helper\n"},
-		{configkit.Keys("records").Index(1).Key("children").Index(0).Key("text"), "child-helper.yml", "nested helper\n"},
+		{configkit.Keys("records").Index(0).Key("text"), "helper-one.yml", "first helper\n"},
+		{configkit.Keys("records").Index(1).Key("text"), "helper-two.yml", "second helper\n"},
+		{configkit.Keys("records").Index(0).Key("children").Index(0).Key("text"), "child-helper.yml", "nested helper\n"},
 	} {
 		explanation, ok := result.Explain(test.path)
 		if !ok || explanation.Effective.YAML != test.text || len(explanation.History) != 1 {
@@ -95,20 +93,6 @@ func TestFacadeItemHelperHistoryPreservesTraversalOrder(t *testing.T) {
 			t.Fatal("metadata and explanation disagree")
 		}
 	}
-	explanation, ok := result.Explain(configkit.Keys())
-	if !ok {
-		t.Fatal("root explanation missing")
-	}
-	previous := -1
-	for _, change := range explanation.History {
-		for _, location := range change.Origin.Locations {
-			current := sourceOrder[location.SourceID]
-			if current < previous {
-				t.Fatalf("source %s replayed out of traversal order", location.SourceID)
-			}
-			previous = current
-		}
-	}
 }
 
 func TestFacadeRegisteredReplacementExplainsRemovedDescendants(t *testing.T) {
@@ -123,8 +107,14 @@ func TestFacadeRegisteredReplacementExplainsRemovedDescendants(t *testing.T) {
 		{"removed field", []any{map[string]any{"id": "main"}}, configkit.Keys("records").Index(0).Key("text")},
 	} {
 		t.Run(test.name, func(t *testing.T) {
-			result, err := configkit.LoadLayered[map[string]any](configkit.Input{Source: configkit.Mapping("main", map[string]any{"records": test.upper})}, configkit.LayeredOptions[map[string]any]{
-				Definition: configkit.Definition[map[string]any]{SequenceCompositions: []configkit.SequenceComposition{{Path: configkit.Keys("records"), IdentityField: "id"}}},
+			mainYAML := "configkit:\n  sequences:\n    - destination: [records]\n      key: id\n      mode: replace\n"
+			if len(test.upper) == 0 {
+				mainYAML += "records: []\n"
+			} else {
+				mainYAML += "records: [{id: main}]\n"
+			}
+			result, err := configkit.LoadLayered[map[string]any](configkit.Input{Source: configkit.Bytes("main", []byte(mainYAML))}, configkit.LayeredOptions[map[string]any]{
+				Definition: configkit.Definition[map[string]any]{SequenceIdentities: []configkit.SequenceIdentity{configkit.SequenceIdentityAt(configkit.Keys("records"), "id")}},
 				Underlays:  []configkit.Underlay{{Inputs: []configkit.Input{{Source: configkit.Mapping("lower", map[string]any{"records": []any{map[string]any{"id": "one", "text": "old"}, map[string]any{"id": "two"}}})}}}},
 			})
 			if err != nil {
@@ -153,14 +143,14 @@ func TestFacadeItemConflictDiagnosticsFollowEnclosingIndexes(t *testing.T) {
 		"bad.yml":    {Data: []byte("id: bad\nconfigkit: {imports: [{path: helper.yml}]}\n")},
 		"helper.yml": {Data: []byte("id: duplicate-field\n")},
 	})
-	definition := configkit.Definition[map[string]any]{SequenceCompositions: []configkit.SequenceComposition{{Path: configkit.Keys("records"), IdentityField: "id"}}}
+	definition := configkit.Definition[map[string]any]{SequenceIdentities: []configkit.SequenceIdentity{configkit.SequenceIdentityAt(configkit.Keys("records"), "id")}}
 	for _, test := range []struct {
 		name, file, path  string
 		grouped, itemMain bool
 	}{
-		{"preceding authored and imported items", "main.yml", "/records/2/id", false, false},
-		{"nested item", "nested.yml", "/records/1/children/1/id", false, false},
-		{"preceding grouped input", "group.yml", "/records/2/id", true, false},
+		{"preceding authored and imported items", "main.yml", "/records/0/id", false, false},
+		{"nested item", "nested.yml", "/records/0/children/0/id", false, false},
+		{"preceding grouped input", "group.yml", "/records/1/id", true, false},
 		{"item main source", "bad.yml", "/records/0/id", false, true},
 		{"grouped item source", "bad.yml", "/records/1/id", true, true},
 	} {
@@ -193,8 +183,16 @@ func TestFacadeItemConflictDiagnosticsFollowEnclosingIndexes(t *testing.T) {
 			for _, source := range loadError.Sources() {
 				files[source.ID] = source.Path
 			}
-			if diagnostic.Primary == nil || files[diagnostic.Primary.SourceID] != "bad.yml" || len(diagnostic.Related) != 1 || files[diagnostic.Related[0].SourceID] != "helper.yml" {
-				t.Fatal("conflict lost physical source locations")
+			locations := append([]configkit.Location(nil), diagnostic.Related...)
+			if diagnostic.Primary != nil {
+				locations = append(locations, *diagnostic.Primary)
+			}
+			gotFiles := make(map[string]bool, len(locations))
+			for _, location := range locations {
+				gotFiles[files[location.SourceID]] = location.Line == 1 && location.Column == 5
+			}
+			if len(locations) != 2 || !gotFiles["bad.yml"] || !gotFiles["helper.yml"] {
+				t.Fatalf("conflict lost physical source locations: diagnostic=%#v sources=%#v", diagnostic, files)
 			}
 		})
 	}
@@ -202,7 +200,7 @@ func TestFacadeItemConflictDiagnosticsFollowEnclosingIndexes(t *testing.T) {
 
 func TestFacadeSequencePlacementControlsAcrossLoadEntryPoints(t *testing.T) {
 	definition := configkit.Definition[map[string]any]{
-		SequenceCompositions: []configkit.SequenceComposition{{Path: configkit.Keys("entries"), IdentityField: "id"}},
+		SequenceIdentities: []configkit.SequenceIdentity{configkit.SequenceIdentityAt(configkit.Keys("entries"), "id")},
 	}
 	ordinary, err := configkit.Load(configkit.Mapping("ordinary", map[string]any{"id": "one"}), configkit.Options[map[string]any]{
 		Definition: definition, Destination: configkit.Keys("entries"), PlacementMode: configkit.PlacementModeSequenceItem,
@@ -248,8 +246,8 @@ func TestFacadeSequencePlacementControlsAcrossLoadEntryPoints(t *testing.T) {
 	if err != nil {
 		t.Fatalf("registered sequence precedence load: %v", err)
 	}
-	if got := precedence.Config["entries"].([]any); len(got) != 1 || got[0].(map[string]any)["id"] != "main" {
-		t.Fatalf("higher-priority list did not replace the lower sequence: %#v", precedence.Config)
+	if got := precedence.Config["entries"].([]any); len(got) != 2 || got[0].(map[string]any)["id"] != "lower" || got[1].(map[string]any)["id"] != "main" {
+		t.Fatalf("registered upsert did not retain the lower sequence: %#v", precedence.Config)
 	}
 
 	for _, test := range []struct {
@@ -303,7 +301,7 @@ items:
 	result, err := configkit.Load(configkit.File(mainPath), configkit.Options[map[string]any]{
 		Imports: true,
 		Definition: configkit.Definition[map[string]any]{
-			SequenceCompositions: []configkit.SequenceComposition{{Path: configkit.Keys("items"), IdentityField: "id"}},
+			SequenceIdentities: []configkit.SequenceIdentity{configkit.SequenceIdentityAt(configkit.Keys("items"), "id")},
 			Resolve: func(_ *map[string]any, resolution *configkit.Resolution) error {
 				for _, id := range []string{"source-2", "source-3"} {
 					source, ok := resolution.Source(id)
@@ -326,7 +324,7 @@ items:
 		t.Fatalf("load item glob: %v", err)
 	}
 	items := result.Config["items"].([]any)
-	wantIDs := []string{"authored", "imported-a", "imported-b"}
+	wantIDs := []string{"imported-a", "imported-b", "authored"}
 	for index, item := range items {
 		if got := item.(map[string]any)["id"]; got != wantIDs[index] {
 			t.Errorf("item %d ID = %#v, want %q", index, got, wantIDs[index])
@@ -344,10 +342,10 @@ items:
 		}
 	}
 	metadata := result.Metadata()
-	for index := 1; index < len(wantIDs); index++ {
+	for index := 0; index < 2; index++ {
 		path := configkit.Keys("items").Index(index).Key("id")
 		info, ok := metadata.Lookup(path)
-		if !ok || !info.Explicit || len(info.Origin.Locations) != 1 || info.Origin.Locations[0].SourceID != []string{"source-2", "source-3"}[index-1] {
+		if !ok || !info.Explicit || len(info.Origin.Locations) != 1 || info.Origin.Locations[0].SourceID != []string{"source-2", "source-3"}[index] {
 			t.Errorf("shifted item origin at %s = %#v, %v", path.String(), info, ok)
 		}
 	}
@@ -463,15 +461,17 @@ func TestFacadeNestedItemFallbackUsesNearestResolvedContainer(t *testing.T) {
 	}
 }
 
-func TestFacadeSequenceCompositionRegistrationPathIsDetached(t *testing.T) {
-	registrations := []configkit.SequenceComposition{{Path: configkit.Keys("records"), IdentityField: "id"}}
+func TestFacadeSequenceIdentityRegistrationIsDetached(t *testing.T) {
+	fields := []string{"id"}
+	path := configkit.Keys("records")
+	registration := configkit.SequenceIdentityAt(path, fields...)
+	fields[0] = "changed"
 	definition := configkit.Definition[map[string]any]{
-		SequenceCompositions: registrations,
+		SequenceIdentities: []configkit.SequenceIdentity{registration},
 		Version: &configkit.VersionRule{
 			Path: configkit.Keys("version"),
 			Check: func(configkit.Version, *configkit.Validation) error {
-				registrations[0].Path = configkit.Keys("other")
-				registrations[0].IdentityField = "changed"
+				path = configkit.Keys("other")
 				return nil
 			},
 		},
@@ -514,6 +514,31 @@ func TestFacadeSourceInfoPlacementCopiesAndZeroValues(t *testing.T) {
 	}
 }
 
+func TestLayeredSequenceUpsertHistoryRetainsLowerTierRecords(t *testing.T) {
+	definition := configkit.Definition[map[string]any]{
+		SequenceIdentities: []configkit.SequenceIdentity{configkit.SequenceIdentityAt(configkit.Keys("entries"), "id")},
+	}
+	result, err := configkit.LoadLayered[map[string]any](configkit.Input{Source: configkit.Bytes("main", []byte("entries: [{id: main}]\n"))}, configkit.LayeredOptions[map[string]any]{
+		Definition: definition,
+		Underlays: []configkit.Underlay{{Inputs: []configkit.Input{{
+			Source: configkit.Bytes("lower", []byte("entries: [{id: lower}]\n")),
+		}}}},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for index, id := range []string{"lower", "main"} {
+		path := configkit.Keys("entries").Index(index).Key("id")
+		explanation, ok := result.Explain(path)
+		if !ok || !explanation.Effective.Present || explanation.Effective.YAML != id+"\n" || len(explanation.History) == 0 {
+			t.Fatalf("tier history at %s = %#v, %v", path.String(), explanation, ok)
+		}
+		if explanation.History[len(explanation.History)-1].After.YAML != id+"\n" {
+			t.Fatalf("tier history at %s does not retain final record: %#v", path.String(), explanation.History)
+		}
+	}
+}
+
 func TestFacadeSequenceReplacementKeepsTypedAndHistoricalEvidenceAligned(t *testing.T) {
 	type record struct {
 		ID       string  `yaml:"id"`
@@ -531,7 +556,12 @@ func TestFacadeSequenceReplacementKeepsTypedAndHistoricalEvidenceAligned(t *test
 	directory := t.TempDir()
 	mainPath := filepath.Join(directory, "main.yml")
 	underlayPath := filepath.Join(directory, "underlay.yml")
-	if err := os.WriteFile(mainPath, []byte(`entries:
+	if err := os.WriteFile(mainPath, []byte(`configkit:
+  sequences:
+    - destination: [entries]
+      key: id
+      mode: replace
+entries:
   - id: current
     count: 0
     enabled: false
@@ -567,7 +597,7 @@ func TestFacadeSequenceReplacementKeepsTypedAndHistoricalEvidenceAligned(t *test
 	result, err := configkit.LoadLayered(configkit.Input{Source: configkit.File(mainPath)}, configkit.LayeredOptions[configuration]{
 		Underlays: []configkit.Underlay{{Inputs: []configkit.Input{{Source: configkit.File(underlayPath), Imports: true}}}},
 		Definition: configkit.Definition[configuration]{
-			SequenceCompositions: []configkit.SequenceComposition{{Path: configkit.Keys("entries"), IdentityField: "id"}},
+			SequenceIdentities: []configkit.SequenceIdentity{configkit.SequenceIdentityAt(configkit.Keys("entries"), "id")},
 			Secret: func(path configkit.Path) bool {
 				return path.String() == "/entries/0/token" || path.String() == "/entries/1/token"
 			},

facade_sequence_version_test.go

@@ -0,0 +1,197 @@
+package configkit_test
+
+import (
+	"fmt"
+	"testing"
+	"testing/fstest"
+
+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+)
+
+type movedVersionItem struct {
+	ID      string `yaml:"id"`
+	Version string `yaml:"version"`
+}
+
+type movedVersionCatalog struct {
+	Items []movedVersionItem `yaml:"items"`
+}
+
+func TestMainVersionDecodingFollowsSequenceMovement(t *testing.T) {
+	t.Parallel()
+	for _, mounted := range []bool{false, true} {
+		for _, matching := range []bool{false, true} {
+			for _, version := range []string{"4", "'4'"} {
+				t.Run(fmt.Sprintf("mounted=%t/matched=%t/%s", mounted, matching, version), func(t *testing.T) {
+					body := "items: [{id: main, version: " + version + "}]\n"
+					path := configkit.Keys("items").Index(0).Key("version")
+					main := configkit.Input{}
+					if mounted {
+						body, path = "id: main\nversion: "+version+"\n", configkit.Keys("version")
+						main.Destination, main.PlacementMode = configkit.Keys("items"), configkit.PlacementModeSequenceItem
+					}
+					main.Source = configkit.Bytes("main", []byte(body))
+					keep := "{id: keep}"
+					if mounted {
+						keep = "{id: keep, version: ordinary}"
+					}
+					lower := "items: [" + keep + "]\n"
+					if matching {
+						lower = "items: [" + keep + ", {id: main}]\n"
+					}
+					calls := 0
+					loaded, err := configkit.LoadLayered(main, configkit.LayeredOptions[movedVersionCatalog]{
+						SourceVersionMode: configkit.SourceVersionModeIfPresent,
+						Underlays:         []configkit.Underlay{{Inputs: []configkit.Input{{Source: configkit.Bytes("lower", []byte(lower))}}}},
+						Definition: configkit.Definition[movedVersionCatalog]{
+							SequenceIdentities: []configkit.SequenceIdentity{configkit.SequenceIdentityAt(configkit.Keys("items"), "id")},
+							Version: &configkit.VersionRule{Path: path, Check: func(version configkit.Version, _ *configkit.Validation) error {
+								calls++
+								if !version.Present || version.Text != "4" {
+									t.Errorf("checked version = %#v", version)
+								}
+								return nil
+							}},
+						},
+					})
+					if err != nil {
+						t.Fatal(err)
+					}
+					if calls != 1 || len(loaded.Config.Items) != 2 || loaded.Config.Items[1].ID != "main" || loaded.Config.Items[1].Version != "4" {
+						t.Fatalf("moved main = %#v, checker calls = %d", loaded.Config, calls)
+					}
+					if mounted && loaded.Config.Items[0].Version != "ordinary" {
+						t.Fatal("unrelated underlay payload was treated as the main declaration")
+					}
+					for _, source := range loaded.Sources() {
+						if source.Layer == configkit.LayerBase && source.VersionCheck.Path.String() != path.String() {
+							t.Fatal("effective movement changed source-local version evidence")
+						}
+					}
+				})
+			}
+		}
+	}
+}
+
+func TestOverlayVersionProtectionUsesAssignedRecordPositions(t *testing.T) {
+	t.Parallel()
+	for _, test := range []struct {
+		name, payload string
+		code          configkit.Code
+	}{
+		{name: "change main header", payload: "[{id: main, version: changed}]", code: configkit.CodeOverlayVersion},
+		{name: "remove main header", payload: "[{id: main}]", code: configkit.CodeOverlayVersion},
+		{name: "other record version", payload: "[{id: keep, version: ordinary}]"},
+		{name: "new record version", payload: "[{id: new, version: ordinary}]"},
+		{name: "only main header gets integer conversion", payload: "[{id: new, version: 5}]", code: configkit.CodeDecodeType},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			files := configkit.NewFilesystem("catalog", fstest.MapFS{
+				"overlays/test.yml": {Data: []byte("items: " + test.payload + "\n")},
+			})
+			calls := 0
+			loaded, err := configkit.LoadLayered(configkit.Input{
+				Source: configkit.Bytes("main", []byte("id: main\nversion: 4\n")), Destination: configkit.Keys("items"), PlacementMode: configkit.PlacementModeSequenceItem,
+			}, configkit.LayeredOptions[movedVersionCatalog]{
+				SourceVersionMode: configkit.SourceVersionModeIfPresent,
+				Overlay:           "test", OverlayFilesystem: &configkit.FilesystemContext{FS: &files, BaseDir: ".", Root: "."},
+				Underlays: []configkit.Underlay{{Inputs: []configkit.Input{{Source: configkit.Bytes("lower", []byte("items: [{id: keep}]\n"))}}}},
+				Definition: configkit.Definition[movedVersionCatalog]{
+					SequenceIdentities: []configkit.SequenceIdentity{configkit.SequenceIdentityAt(configkit.Keys("items"), "id")},
+					Version:            &configkit.VersionRule{Path: configkit.Keys("version"), Check: func(configkit.Version, *configkit.Validation) error { calls++; return nil }},
+				},
+			})
+			if calls != 1 {
+				t.Fatalf("checker calls = %d", calls)
+			}
+			if test.code != "" {
+				loadErr := requireFacadeLoadError(t, err)
+				if loaded != nil || len(loadErr.Diagnostics()) != 1 || loadErr.Diagnostics()[0].Code != test.code {
+					t.Fatalf("version diagnostics = %#v", loadErr.Diagnostics())
+				}
+				return
+			}
+			if err != nil {
+				t.Fatal(err)
+			}
+			if loaded.Config.Items[1].Version != "4" {
+				t.Fatal("unrelated overlay changed main header")
+			}
+		})
+	}
+}
+
+func TestUnderlayVersionProtectionUsesMainRecordPosition(t *testing.T) {
+	t.Parallel()
+	for _, imported := range []bool{false, true} {
+		t.Run(fmt.Sprintf("imported=%t", imported), func(t *testing.T) {
+			payload := "items: [{id: keep}, {id: main, version: forbidden}]\n"
+			lower := configkit.Input{Source: configkit.Bytes("lower", []byte(payload))}
+			want := configkit.CodeUnderlayVersion
+			if imported {
+				files := configkit.NewFilesystem("lower", fstest.MapFS{
+					"main.yml":     {Data: []byte("configkit: {imports: [{path: fragment.yml}]}\n")},
+					"fragment.yml": {Data: []byte(payload)},
+				})
+				lower.Source, lower.Imports = files.File("main.yml"), true
+				want = configkit.CodeImportVersion
+			}
+			calls := 0
+			result, err := configkit.LoadLayered(configkit.Input{
+				Source:      configkit.Bytes("main", []byte("id: main\nversion: 4\n")),
+				Destination: configkit.Keys("items"), PlacementMode: configkit.PlacementModeSequenceItem,
+			}, configkit.LayeredOptions[movedVersionCatalog]{
+				SourceVersionMode: configkit.SourceVersionModeIfPresent,
+				Underlays:         []configkit.Underlay{{Inputs: []configkit.Input{lower}}},
+				Definition: configkit.Definition[movedVersionCatalog]{
+					SequenceIdentities: []configkit.SequenceIdentity{configkit.SequenceIdentityAt(configkit.Keys("items"), "id")},
+					Version:            &configkit.VersionRule{Path: configkit.Keys("version"), Check: func(configkit.Version, *configkit.Validation) error { calls++; return nil }},
+				},
+			})
+			failure := requireFacadeLoadError(t, err)
+			if result != nil || calls != 1 || len(failure.Diagnostics()) != 1 || failure.Diagnostics()[0].Code != want || failure.Diagnostics()[0].Path.String() != "/items/1/version" {
+				t.Fatalf("result=%#v calls=%d diagnostics=%#v", result, calls, failure.Diagnostics())
+			}
+		})
+	}
+}
+
+func TestMainVersionFollowsInheritedSequenceMovement(t *testing.T) {
+	t.Parallel()
+	for _, parentID := range []string{"keep", "main"} {
+		t.Run(parentID, func(t *testing.T) {
+			body := "base: {items: [{id: " + parentID + ", version: ordinary}]}\nchild:\n  extends: base\n  items: [{id: main, version: 4}]\n"
+			type config struct {
+				Base, Child movedVersionCatalog
+			}
+			calls := 0
+			result, err := configkit.Load(configkit.Bytes("main", []byte(body)), configkit.Options[config]{
+				SourceVersionMode: configkit.SourceVersionModeIfPresent,
+				Definition: configkit.Definition[config]{
+					SequenceIdentities: []configkit.SequenceIdentity{
+						configkit.SequenceIdentityAt(configkit.Keys("base", "items"), "id"),
+						configkit.SequenceIdentityAt(configkit.Keys("child", "items"), "id"),
+					},
+					Version: &configkit.VersionRule{Path: configkit.Keys("child", "items").Index(0).Key("version"), Check: func(configkit.Version, *configkit.Validation) error { calls++; return nil }},
+				},
+			})
+			if calls != 1 {
+				t.Fatalf("checker calls = %d", calls)
+			}
+			if parentID == "main" {
+				failure := requireFacadeLoadError(t, err)
+				if result != nil || len(failure.Diagnostics()) != 1 || failure.Diagnostics()[0].Code != configkit.CodeInheritanceVersion {
+					t.Fatalf("diagnostics = %#v", failure.Diagnostics())
+				}
+				return
+			}
+			if err != nil {
+				t.Fatal(err)
+			}
+			if len(result.Config.Child.Items) != 2 || result.Config.Child.Items[1].Version != "4" || result.Config.Child.Items[0].Version != "ordinary" {
+				t.Fatalf("inherited items = %#v", result.Config.Child.Items)
+			}
+		})
+	}
+}

facade_source_version_mode_test.go

@@ -13,15 +13,19 @@ import (
 	configkit "gitea.maximumdirect.net/eric/ConfigKit"
 )
 
-func TestFacadeSourceVersionEvidenceFollowsAuthoredSequenceRanges(t *testing.T) {
+func TestFacadeSourceVersionEvidenceFollowsAssembledSequenceRanges(t *testing.T) {
 	t.Parallel()
 	for _, grouped := range []bool{false, true} {
-		for _, sensitivePath := range []string{"", "/records/1/version", "/records/1"} {
+		index := 0
+		if grouped {
+			index = 1
+		}
+		for _, sensitivePath := range []string{"", fmt.Sprintf("/records/%d/version", index), fmt.Sprintf("/records/%d", index)} {
 			t.Run(fmt.Sprintf("grouped=%t/secret=%s", grouped, sensitivePath), func(t *testing.T) {
 				definition := configkit.Definition[map[string]any]{
-					SequenceCompositions: []configkit.SequenceComposition{{Path: configkit.Keys("records"), IdentityField: "id"}},
-					Version:              &configkit.VersionRule{Path: configkit.Keys("records").Index(0).Key("version"), Check: func(configkit.Version, *configkit.Validation) error { return nil }},
-					Secret:               func(path configkit.Path) bool { return sensitivePath != "" && path.String() == sensitivePath },
+					SequenceIdentities: []configkit.SequenceIdentity{configkit.SequenceIdentityAt(configkit.Keys("records"), "id")},
+					Version:            &configkit.VersionRule{Path: configkit.Keys("records").Index(0).Key("version"), Check: func(configkit.Version, *configkit.Validation) error { return nil }},
+					Secret:             func(path configkit.Path) bool { return sensitivePath != "" && path.String() == sensitivePath },
 				}
 				first := "records: [{id: first, version: first-version}]\n"
 				child := "records: [{id: child, version: PRIVATE-VERSION-CANARY}]\n"
@@ -46,6 +50,16 @@ func TestFacadeSourceVersionEvidenceFollowsAuthoredSequenceRanges(t *testing.T)
 				if err != nil {
 					t.Fatal(err)
 				}
+				if !grouped {
+					records, ok := result.Config["records"].([]any)
+					if !ok || len(records) != 2 {
+						t.Fatalf("scheduled records = %#v", result.Config["records"])
+					}
+					firstRecord, ok := records[0].(map[string]any)
+					if !ok || firstRecord["id"] != "child" {
+						t.Fatalf("scheduled records = %#v", result.Config["records"])
+					}
+				}
 				sources := result.Sources()
 				check := sources[len(sources)-1].VersionCheck
 				if check == nil || check.Path.String() != "/records/0/version" || check.Location == nil || check.Location.SourceID != sources[len(sources)-1].ID {
@@ -72,8 +86,8 @@ func TestFacadeSourceVersionOwnershipAcceptsContextualIndexes(t *testing.T) {
 	for _, grouped := range []bool{false, true} {
 		for _, path := range []configkit.Path{configkit.Keys("records").Index(0).Key("version"), parsed} {
 			definition := configkit.Definition[map[string]any]{
-				SequenceCompositions: []configkit.SequenceComposition{{Path: configkit.Keys("records"), IdentityField: "id"}},
-				Version:              &configkit.VersionRule{Path: path, Check: func(configkit.Version, *configkit.Validation) error { return nil }},
+				SequenceIdentities: []configkit.SequenceIdentity{configkit.SequenceIdentityAt(configkit.Keys("records"), "id")},
+				Version:            &configkit.VersionRule{Path: path, Check: func(configkit.Version, *configkit.Validation) error { return nil }},
 			}
 			first := "records: [{id: first, version: first}]\n"
 			child := "records: [{id: child, version: child}]\n"
@@ -90,11 +104,7 @@ func TestFacadeSourceVersionOwnershipAcceptsContextualIndexes(t *testing.T) {
 			if err != nil || result == nil {
 				t.Fatalf("grouped=%t path=%#v: %v", grouped, path, err)
 			}
-			want := 2
-			if grouped {
-				want = 1
-			}
-			if len(result.Config["records"].([]any)) != want {
+			if len(result.Config["records"].([]any)) != 2 {
 				t.Fatal("version path changed composition")
 			}
 		}
@@ -626,7 +636,7 @@ func TestFacadeSourceVersionEvidenceOnFailedLoadsAndSyntheticSources(t *testing.
 			Path: configkit.Keys("version"), Check: func(configkit.Version, *configkit.Validation) error { checked++; return nil },
 		}}
 		path := filepath.Join(t.TempDir(), "main.yml")
-		contents := "version: " + canary + "\nconfigkit:\n  imports:\n    - path: missing.yml\n"
+		contents := "version: " + canary + "\nconfigkit:\n  imports:\n    - path: missing.yml\n      required: true\n"
 		if err := os.WriteFile(path, []byte(contents), 0o600); err != nil {
 			t.Fatal(err)
 		}

internal/engine/acquisition.go

@@ -0,0 +1,253 @@
+package engine
+
+import "strconv"
+
+type acquisitionPolicy struct {
+	importDefaults importDefaults
+	sequencePolicy sequencePolicy
+	importLimits   importLimits
+}
+
+type acquisitionState struct {
+	accounting   *importAccounting
+	versionState *sourceVersionState
+}
+
+type tierAcquisitionState struct {
+	visited   map[resourceIdentity]importRoute
+	hostToken *namespaceToken
+}
+
+type inputAcquisitionRequest struct {
+	input            loadInput
+	role             sourceVersionRole
+	directiveContext rootDirectiveContext
+	protectionRule   *VersionRule
+	deferAssembly    bool
+	ordinaryOverlay  string
+}
+
+type importAcquisitionRequest struct {
+	input      inputAcquisitionRequest
+	main       parsedSource
+	processing *sourceVersionProcessingResult
+}
+
+func acquireInput(request inputAcquisitionRequest, policy acquisitionPolicy, state *acquisitionState, tier *tierAcquisitionState) (assembledInput, []Diagnostic) {
+	source := request.input.source
+	destination := request.input.destination
+	accounting := state.accounting
+	versionState := state.versionState
+	visited := tier.visited
+	hostToken := tier.hostToken
+	role := request.role
+	sourceID := "source-" + strconv.Itoa(accounting.sources+1)
+	selectedSource := source
+	if source.kind == sourceSearch {
+		resolved, failedSource, diagnostics := resolveSearchInput(source, sourceID, defaultDiscoveryDirectoryHelpers(), defaultDiscoveryHostProbe())
+		if len(diagnostics) != 0 {
+			if failedSource != nil {
+				failedSource.Destination = destination.clone()
+				failedSource.placementMode = request.input.placementMode
+			}
+			return assembledInput{source: resolved, sources: sourceInfos(failedSource), versionState: versionState, accounting: accounting}, diagnostics
+		}
+		selectedSource = resolved
+		if request.input.filesystem != nil {
+			if diagnostics := filesystemOptionDiagnostics(selectedSource, request.input.filesystem); len(diagnostics) != 0 {
+				return assembledInput{source: selectedSource, versionState: versionState, accounting: accounting}, diagnostics
+			}
+		}
+		if selectedSource.kind == sourceNone && activeOverlay(request.ordinaryOverlay) && request.input.filesystem == nil {
+			return assembledInput{source: selectedSource, versionState: versionState, accounting: accounting}, []Diagnostic{optionDiagnostic(CodeOptionsInvalid, "NoSource overlays require explicit filesystem context")}
+		}
+	}
+	limits := policy.importLimits
+	parseLimits := defaultParseLimits()
+	parseLimits.source.remaining = limits.bytes - accounting.bytes
+	parsed, diagnostics := parseSource(selectedSource, sourceID, parseLimits)
+	if parsed.source != nil {
+		parsed.source.Destination = destination.clone()
+		parsed.source.placementMode = request.input.placementMode
+	}
+	input := assembledInput{source: selectedSource, parsed: parsed, document: parsed.document, sources: sourceInfos(parsed.source), versionState: versionState, accounting: accounting}
+	if len(diagnostics) != 0 {
+		input.sources = sourceInfos(parsed.source)
+		// Mapping value issues already identify application content. Other early
+		// failures describe source syntax or access, not a placed value.
+		if selectedSource.kind == sourceMapping && selectedSource.mapIssue != nil && len(destination.segments) != 0 {
+			for index := range diagnostics {
+				relative := diagnostics[index].Path
+				segments := clonePathSegments(destination.segments, len(relative.segments))
+				diagnostics[index].Path = Path{segments: append(segments, relative.segments...)}
+			}
+		}
+		return input, diagnostics
+	}
+	directiveContext := request.directiveContext
+	if directiveContext == 0 {
+		directiveContext = rootDirectiveContextImportsOnly
+	}
+	if !request.input.imports && parsed.document != nil {
+		var directiveDiagnostics []Diagnostic
+		if directiveContext == rootDirectiveContextSource || directiveContext == rootDirectiveContextLayered {
+			directiveDiagnostics = disabledRootImportDiagnostics(parsed.document)
+		} else {
+			directiveDiagnostics = disabledDirectiveDiagnostics(parsed.document, Path{})
+		}
+		if len(directiveDiagnostics) != 0 {
+			return input, directiveDiagnostics
+		}
+	}
+	var versionProcessing *sourceVersionProcessingResult
+	if directiveContext == rootDirectiveContextSource {
+		var sourceID string
+		if parsed.source != nil {
+			sourceID = parsed.source.ID
+		}
+		var processed sourceVersionProcessingResult
+		var failures []Diagnostic
+		if versionState != nil {
+			processed, failures = versionState.processWithDirectiveContext(parsed.document, role, destination, sourceID, request.input.placementMode, directiveContext)
+		} else {
+			processed = processSourceVersionWithDirectiveContext(parsed.document, request.protectionRule, role, destination, sourceVersionModeDefault, directiveContext)
+			failures = processed.diagnostics
+		}
+		if len(failures) != 0 {
+			return input, failures
+		}
+		versionProcessing = &processed
+		if role == sourceVersionMain && versionState != nil {
+			versionState.mainProcessing = &processed
+		}
+	} else if directiveContext == rootDirectiveContextLayered {
+		extracted, failures := extractRootDirectives(parsed.document, rootDirectiveContextLayered)
+		if len(failures) != 0 {
+			return input, failures
+		}
+		processed := sourceVersionProcessingResult{
+			payload: extracted.body, imports: extracted.imports, sequences: extracted.sequences,
+			directiveContext: rootDirectiveContextLayered,
+		}
+		if versionState != nil && versionState.mode != sourceVersionModeDefault {
+			var sourceID string
+			if parsed.source != nil {
+				sourceID = parsed.source.ID
+			}
+			versionProcessed, versionFailures := versionState.process(extracted.body, role, destination, sourceID, request.input.placementMode)
+			if len(versionFailures) != 0 {
+				return input, versionFailures
+			}
+			versionProcessed.imports = extracted.imports
+			versionProcessed.sequences = append(cloneSequenceDeclarations(extracted.sequences), versionProcessed.sequences...)
+			versionProcessed.directiveContext = rootDirectiveContextLayered
+			processed = versionProcessed
+			if role == sourceVersionMain {
+				versionState.mainProcessing = &processed
+			}
+		}
+		versionProcessing = &processed
+	} else if versionState != nil && versionState.mode != sourceVersionModeDefault {
+		var sourceID string
+		if parsed.source != nil {
+			sourceID = parsed.source.ID
+		}
+		processed, failures := versionState.process(parsed.document, role, destination, sourceID, request.input.placementMode)
+		if len(failures) != 0 {
+			return input, failures
+		}
+		versionProcessing = &processed
+		if role == sourceVersionMain {
+			versionState.mainProcessing = &processed
+		}
+	}
+	request.input.source = selectedSource
+	if request.input.imports && selectedSource.kind != sourceNone {
+		importRequest := importAcquisitionRequest{input: request, main: parsed, processing: versionProcessing}
+		input.composition, input.sources, input.resolvedFilesystem, diagnostics = acquireImportedInput(importRequest, &policy, state, tier)
+		if len(diagnostics) != 0 {
+			return input, diagnostics
+		}
+		if input.composition != nil {
+			input.acquisition = cloneAcquisitionScopes(input.composition.acquisition)
+			input.document = input.composition.root
+		}
+	} else {
+		input.sources = sourceInfos(parsed.source)
+		if versionProcessing != nil {
+			input.document = versionProcessing.payload
+		}
+		if request.input.filesystem != nil && (selectedSource.kind == sourceNone || !activeOverlay(request.ordinaryOverlay)) {
+			if diagnostic := validateFilesystemContext(selectedSource, request.input.filesystem, parsed); diagnostic != nil {
+				return input, []Diagnostic{*diagnostic}
+			}
+		}
+	}
+	if !request.input.imports && input.document != nil {
+		_, placed, err := placeDocumentWithMode(input.document, destination, request.input.placementMode, input.document.Location, parseLimits.document.Depth, parseLimits.document.Nodes)
+		if err != nil {
+			return input, []Diagnostic{sourceDiagnostic(CodeSourceLimitExceeded, parsed.source.ID, "configuration exceeds the source depth or node limit after destination placement")}
+		}
+		localPayload := input.document
+		input.document = placed
+		identity := importKeyForMainSource(parsed.source)
+		var sequenceDeclarations []sequenceDeclarationSpec
+		if versionProcessing != nil {
+			sequenceDeclarations = cloneSequenceDeclarations(versionProcessing.sequences)
+		}
+		input.acquisition = []acquisitionScope{{
+			owner:       identity,
+			destination: destination.clone(),
+			contributions: []acquiredContribution{{
+				source: cloneSourceInfo(*parsed.source), payload: localPayload,
+				identity: identity, role: importRoleMain, scopeOwner: identity,
+				document: placed, destination: destination.clone(), processing: versionProcessing,
+				sequenceDeclarations: sequenceDeclarations,
+			}},
+		}}
+		rawNodes := countInputNodes(parsed.document)
+		placementNodes := destinationWrapperNodeCountForMode(destination, request.input.placementMode)
+		if accounting.sources+1 > limits.sources || accounting.bytes+parsed.bytes > limits.bytes || accounting.nodes+rawNodes+placementNodes > limits.nodes {
+			return input, []Diagnostic{sourceDiagnostic(CodeSourceLimitExceeded, parsed.source.ID, "configuration exceeds the aggregate input limit")}
+		}
+		if diagnostic := registerAcquiredSource(selectedSource, request.input.filesystem, parsed.source, visited, hostToken); diagnostic != nil {
+			return input, []Diagnostic{*diagnostic}
+		}
+		accounting.sources++
+		accounting.bytes += parsed.bytes
+		accounting.nodes += rawNodes + placementNodes
+	}
+	if !activeOverlay(request.ordinaryOverlay) || request.input.imports {
+		if input.resolvedFilesystem == nil && len(input.sources) != 0 && (selectedSource.kind == sourceFile || request.input.filesystem != nil || nativeContext(selectedSource, request.input.filesystem)) {
+			resolved, diagnostic := resolveFilesystemContext(selectedSource, request.input.filesystem, parsed, tier.hostToken)
+			if diagnostic != nil {
+				return input, []Diagnostic{*diagnostic}
+			}
+			input.resolvedFilesystem = &resolved
+		}
+		contexts, diagnostic := contextsForResolvedSources(input.resolvedFilesystem, input.sources)
+		if diagnostic != nil {
+			return input, []Diagnostic{*diagnostic}
+		}
+		input.contexts = contexts
+	}
+	return input, nil
+}
+
+func registerAcquiredSource(source Source, context *FilesystemContext, info *SourceInfo, visited map[resourceIdentity]importRoute, hostToken *namespaceToken) *Diagnostic {
+	if visited == nil || info == nil || info.Path == "" {
+		return nil
+	}
+	identity := resourceIdentity{namespace: hostToken, path: info.Path}
+	if source.kind == sourceFilesystem {
+		identity.namespace = source.namespace.token
+	} else if context != nil && context.FS != nil {
+		identity.namespace = context.FS.namespace.token
+	}
+	if previous, repeated := visited[identity]; repeated {
+		value := importRepeatedDiagnostic(Location{SourceID: info.ID}, previous, importRoute{})
+		return &value
+	}
+	visited[identity] = importRoute{canonical: info.Path}
+	return nil
+}

internal/engine/collection_ancestor_test.go

@@ -0,0 +1,106 @@
+package engine
+
+import (
+	"errors"
+	"fmt"
+	"testing"
+	"testing/fstest"
+)
+
+func TestNestedCollectionInitializationIsIndependentOfAncestorPresence(t *testing.T) {
+	t.Parallel()
+	for _, ancestor := range []string{"{}", "group: {}", "group: null"} {
+		for _, test := range []struct {
+			mode, key, value string
+			valid            bool
+		}{
+			{mode: "append", value: "[{id: a}]"},
+			{mode: "upsert", value: "[{id: a}]"},
+			{mode: "append", value: "[]"},
+			{mode: "upsert", value: "[]"},
+			{mode: "append", key: ", key: id", value: "{}"},
+			{mode: "upsert", key: ", key: id", value: "null"},
+			{mode: "append", key: ", key: id", value: "[{id: a}]", valid: true},
+			{mode: "upsert", key: ", key: id", value: "[]", valid: true},
+		} {
+			t.Run(fmt.Sprintf("%s/%s/%s/%s", ancestor, test.mode, test.key, test.value), func(t *testing.T) {
+				main := "configkit:\n  sequences: [{destination: [group, items], mode: " + test.mode + test.key + "}]\ngroup: {items: " + test.value + "}\n"
+				loaded, err := testGroupedLoad(loadRequest[map[string]any]{
+					main:      loadInput{source: Bytes("main", []byte(main))},
+					underlays: []loadGroup{{inputs: []loadInput{{source: Bytes("lower", []byte(ancestor))}}}},
+				})
+				if test.valid {
+					if err != nil || loaded == nil {
+						t.Fatalf("valid initialization failed: %v", err)
+					}
+					return
+				}
+				var loadErr *LoadError
+				if !errors.As(err, &loadErr) || loaded != nil {
+					t.Fatalf("invalid collection operation succeeded: %#v, %v", loaded, err)
+				}
+				diagnostics := loadErr.Diagnostics()
+				if len(diagnostics) != 1 || diagnostics[0].Code != CodeSequenceInvalid || diagnostics[0].Path.String() != "/group/items" {
+					t.Fatalf("operation diagnostics = %#v", diagnostics)
+				}
+			})
+		}
+	}
+}
+
+func TestAddedAncestorTransfersNestedRecordPolicies(t *testing.T) {
+	t.Parallel()
+	type record struct {
+		ID    string           `yaml:"id"`
+		Steps []map[string]any `yaml:"steps"`
+	}
+	type config struct {
+		Group struct {
+			Items []record `yaml:"items"`
+		} `yaml:"group"`
+	}
+	files := fstest.MapFS{
+		"main.yml": {Data: []byte(`configkit:
+  sequences: [{destination: [group, items], key: id}]
+  imports: [{path: base.yml, destination: [group, items], placement: sequence-item}]
+group:
+  items: [{id: child, extends: {id: base}, steps: [{name: child}]}]
+`)},
+		"base.yml": {Data: []byte("configkit:\n  sequences: [{destination: [steps], key: name}]\nid: base\nsteps: [{name: base}]\n")},
+	}
+	loaded, err := testGroupedLoad(loadRequest[config]{
+		main:      loadInput{source: NewFilesystem("catalog", files).File("main.yml"), imports: true},
+		underlays: []loadGroup{{inputs: []loadInput{{source: Bytes("lower", []byte("{}"))}}}},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, item := range loaded.Config.Group.Items {
+		if item.ID == "child" {
+			if len(item.Steps) != 2 || item.Steps[0]["name"] != "base" || item.Steps[1]["name"] != "child" {
+				t.Fatalf("record-local identity was lost when adding its ancestor: %#v", item.Steps)
+			}
+			return
+		}
+	}
+	t.Fatal("missing child record")
+}
+
+func TestInheritanceChecksCollectionOperationUnderAddedAncestor(t *testing.T) {
+	t.Parallel()
+	_, err := testLoad[map[string]any](Bytes("inheritance", []byte(`configkit:
+  sequences: [{destination: [child, group, items], mode: append}]
+base: {}
+child:
+  extends: base
+  group: {items: [{id: a}]}
+`)))
+	var loadErr *LoadError
+	if !errors.As(err, &loadErr) {
+		t.Fatalf("missing nested operation error: %v", err)
+	}
+	diagnostics := loadErr.Diagnostics()
+	if len(diagnostics) != 1 || diagnostics[0].Code != CodeSequenceInvalid || diagnostics[0].Path.String() != "/child/group/items" {
+		t.Fatalf("nested inheritance operation diagnostics = %#v", diagnostics)
+	}
+}

internal/engine/collection_lookup_test.go

@@ -0,0 +1,98 @@
+package engine
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	"gitea.maximumdirect.net/eric/ConfigKit/internal/document"
+)
+
+func TestOverlayBroadCollectionPoliciesAndRetainedDeclarations(t *testing.T) {
+	var baseBody, overlayBody strings.Builder
+	basePolicies := collectionPolicyScope{}
+	var declarations []sequenceDeclarationSpec
+	for index := range 64 {
+		name := fmt.Sprintf("group/%03d~", index)
+		fmt.Fprintf(&baseBody, "%s: {items: [{id: base}], retained: [{id: retained}], scalar: pending}\n", name)
+		fmt.Fprintf(&overlayBody, "%s: {items: [{id: overlay}], added: true}\n", name)
+		basePolicies.set(Keys(name, "items"), collectionPolicy{
+			identityFields: []string{"id"}, identityPresent: true,
+			explicitMode: sequenceModeAppend, explicitModePresent: true,
+		})
+		for _, key := range []string{"retained", "missing", "scalar"} {
+			declarations = append(declarations, sequenceDeclarationSpec{
+				destination: Keys(name, key), identityFields: []string{"id"}, identityPresent: true,
+				mode: sequenceModeAppend, modePresent: true,
+			})
+		}
+	}
+	base, diagnostics := composeDocuments(parseCompositionDocument(t, "base", baseBody.String()))
+	if len(diagnostics) != 0 {
+		t.Fatal(diagnostics)
+	}
+	base.collectionPolicies = basePolicies
+	assembly := newAssemblyAccumulator(base)
+	overlay := parseCompositionDocument(t, "overlay", overlayBody.String())
+	diagnostics = assembly.applyOverlayWithCollectionPolicy(overlay, nil, collectionPolicyScope{}, nil, LayerOverlay, sequencePolicy{}, declarations)
+	if len(diagnostics) != 0 {
+		t.Fatal(diagnostics)
+	}
+	lookup := buildDocumentLookup(assembly.current.root)
+	for index := range 64 {
+		name := fmt.Sprintf("group/%03d~", index)
+		items, found := documentAtPathWithLookup(assembly.current.root, Keys(name, "items"), lookup)
+		if !found || items.Kind != document.Sequence || len(items.Sequence) != 2 || items.Sequence[0].Mapping[0].Value.Text != "base" || items.Sequence[1].Mapping[0].Value.Text != "overlay" {
+			t.Fatalf("collection %s did not append in order", name)
+		}
+		for _, key := range []string{"retained", "missing", "scalar"} {
+			policy, found := assembly.current.collectionPolicies.at(Keys(name, key))
+			if !found || !policy.identityPresent || !policy.explicitModePresent || policy.explicitMode != sequenceModeAppend {
+				t.Fatalf("retained/pending declaration lost at %s/%s", name, key)
+			}
+		}
+		if _, found := documentAtPathWithLookup(assembly.current.root, Keys(name, "missing"), lookup); found {
+			t.Fatal("pending declaration created a value")
+		}
+		if origin := assembly.current.origins[Keys(name, "items").Index(1).Key("id").String()]; origin.Layer != LayerOverlay {
+			t.Fatal("appended item lost overlay attribution")
+		}
+	}
+}
+
+func TestInheritanceBroadCollectionsInOneDefinition(t *testing.T) {
+	var body strings.Builder
+	policies := collectionPolicyScope{}
+	for _, definition := range []string{"base", "child"} {
+		fmt.Fprintf(&body, "%s:\n", definition)
+		if definition == "child" {
+			body.WriteString("  extends: base\n")
+		}
+		for index := range 64 {
+			name := fmt.Sprintf("group/%03d~", index)
+			fmt.Fprintf(&body, "  %s: {items: [{id: %s}]}\n", name, definition)
+			policy := collectionPolicy{identityFields: []string{"id"}, identityPresent: true}
+			if definition == "child" {
+				policy.explicitMode, policy.explicitModePresent = sequenceModeAppend, true
+			}
+			policies.set(Keys(definition, name, "items"), policy)
+			policies.set(Keys(definition, name, "pending"), collectionPolicy{identityFields: []string{"id"}, identityPresent: true})
+		}
+	}
+	root := parseCompositionDocument(t, "wide-collections", body.String())
+	result, diagnostics := expandInheritanceWithPolicies(root, nil, policies, defaultProjectionLimits())
+	if len(diagnostics) != 0 {
+		t.Fatal(diagnostics)
+	}
+	lookup := buildDocumentLookup(result.root)
+	for index := range 64 {
+		name := fmt.Sprintf("group/%03d~", index)
+		items, found := documentAtPathWithLookup(result.root, Keys("child", name, "items"), lookup)
+		if !found || len(items.Sequence) != 2 || items.Sequence[0].Mapping[0].Value.Text != "base" || items.Sequence[1].Mapping[0].Value.Text != "child" {
+			t.Fatalf("inherited collection %s did not append in order", name)
+		}
+		if policy, found := result.collectionPolicies.at(Keys("child", name, "pending")); !found || !policy.identityPresent {
+			t.Fatalf("pending inherited policy lost at %s", name)
+		}
+	}
+}

internal/engine/collection_policy.go

@@ -0,0 +1,209 @@
+package engine
+
+type collectionPolicy struct {
+	identityFields      []string
+	identityPresent     bool
+	identityLocation    *Location
+	explicitMode        sequenceMode
+	explicitModePresent bool
+	modeLocation        *Location
+	recordOrder         []*collectionRecordOwner
+	recordPolicies      map[*collectionRecordOwner]collectionPolicyScope
+}
+
+type collectionPolicyResolution struct {
+	policy                     collectionPolicy
+	operation                  sequenceMode
+	declarations               []sequenceDeclarationSpec
+	declarationsPresent        bool
+	identityDeclarationPresent bool
+	modeDeclarationPresent     bool
+	applicationIdentityFields  []string
+	applicationIdentityPresent bool
+	effectiveIdentityFields    []string
+}
+
+// resolveCollectionPolicy reconciles declarations for one destination before
+// peers are composed. The caller supplies only lower policy that is applicable
+// to this destination; record survival and ownership are resolved elsewhere.
+func resolveCollectionPolicy(
+	destination Path,
+	declarations []sequenceDeclarationSpec,
+	applicationIdentityFields []string,
+	lower *collectionPolicy,
+) (collectionPolicyResolution, []Diagnostic) {
+	normalizedDeclarations := cloneSequenceDeclarations(declarations)
+	for index := range normalizedDeclarations {
+		declaration := &normalizedDeclarations[index]
+		if !declaration.identityPresent {
+			continue
+		}
+		fields, err := normalizeSequenceIdentityFields(declaration.identityFields)
+		if err != nil {
+			return collectionPolicyResolution{}, []Diagnostic{{
+				Code: CodeSequenceInvalid, Severity: SeverityError, Path: destination.clone(),
+				Message: "collection identity declaration requires at least one field",
+				Primary: collectionDeclarationLocation(declaration.identityLocation, declaration.location),
+			}}
+		}
+		declaration.identityFields = fields
+	}
+	normalizedApplicationIdentityFields := cloneStrings(applicationIdentityFields)
+	if len(applicationIdentityFields) != 0 {
+		var err error
+		normalizedApplicationIdentityFields, err = normalizeSequenceIdentityFields(applicationIdentityFields)
+		if err != nil {
+			return collectionPolicyResolution{}, []Diagnostic{{
+				Code: CodeOptionsInvalid, Severity: SeverityError, Path: destination.clone(),
+				Message: "application collection identity fields are invalid",
+			}}
+		}
+	}
+	result := collectionPolicyResolution{
+		declarations:               normalizedDeclarations,
+		declarationsPresent:        len(normalizedDeclarations) != 0,
+		applicationIdentityFields:  normalizedApplicationIdentityFields,
+		applicationIdentityPresent: len(normalizedApplicationIdentityFields) != 0,
+	}
+
+	var diagnostics []Diagnostic
+	var declaredIdentityFields []string
+	var declaredIdentityLocation *Location
+	var declaredMode sequenceMode
+	var declaredModeLocation *Location
+	for _, declaration := range normalizedDeclarations {
+		if declaration.identityPresent {
+			result.identityDeclarationPresent = true
+			if declaredIdentityFields == nil {
+				declaredIdentityFields = cloneStrings(declaration.identityFields)
+				declaredIdentityLocation = collectionDeclarationLocation(declaration.identityLocation, declaration.location)
+			} else if !equalSequenceIdentityFields(declaredIdentityFields, declaration.identityFields) {
+				diagnostics = append(diagnostics, collectionPolicyConflictDiagnostic(
+					destination, declaredIdentityLocation,
+					collectionDeclarationLocation(declaration.identityLocation, declaration.location),
+					"collection identity declarations conflict",
+				))
+			}
+		}
+		if declaration.modePresent {
+			result.modeDeclarationPresent = true
+			if declaredMode == 0 {
+				declaredMode = declaration.mode
+				declaredModeLocation = collectionDeclarationLocation(declaration.modeLocation, declaration.location)
+			} else if declaredMode != declaration.mode {
+				diagnostics = append(diagnostics, collectionPolicyConflictDiagnostic(
+					destination, declaredModeLocation,
+					collectionDeclarationLocation(declaration.modeLocation, declaration.location),
+					"collection operation declarations conflict",
+				))
+			}
+		}
+	}
+	if len(diagnostics) != 0 {
+		return collectionPolicyResolution{}, canonicalDiagnostics(diagnostics)
+	}
+
+	if lower != nil && lower.identityPresent && declaredIdentityFields != nil && !equalSequenceIdentityFields(lower.identityFields, declaredIdentityFields) {
+		diagnostics = append(diagnostics, collectionPolicyConflictDiagnostic(
+			destination, declaredIdentityLocation,
+			collectionDeclarationLocation(lower.identityLocation, Location{}),
+			"collection identity declaration conflicts with retained identity",
+		))
+	}
+	if result.applicationIdentityPresent {
+		if declaredIdentityFields != nil && !equalSequenceIdentityFields(normalizedApplicationIdentityFields, declaredIdentityFields) {
+			diagnostics = append(diagnostics, collectionPolicyConflictDiagnostic(
+				destination, declaredIdentityLocation, nil,
+				"collection identity declaration conflicts with application constraint",
+			))
+		}
+		if lower != nil && lower.identityPresent && !equalSequenceIdentityFields(normalizedApplicationIdentityFields, lower.identityFields) {
+			diagnostics = append(diagnostics, collectionPolicyConflictDiagnostic(
+				destination, declaredIdentityLocation,
+				collectionDeclarationLocation(lower.identityLocation, Location{}),
+				"retained collection identity conflicts with application constraint",
+			))
+		}
+	}
+	if len(diagnostics) != 0 {
+		return collectionPolicyResolution{}, canonicalDiagnostics(diagnostics)
+	}
+
+	if declaredIdentityFields != nil {
+		result.policy.identityFields = declaredIdentityFields
+		result.policy.identityPresent = true
+		result.policy.identityLocation = cloneLocation(declaredIdentityLocation)
+	} else if lower != nil && lower.identityPresent {
+		result.policy.identityFields = cloneStrings(lower.identityFields)
+		result.policy.identityPresent = true
+		result.policy.identityLocation = cloneLocation(lower.identityLocation)
+	}
+	if result.applicationIdentityPresent {
+		result.effectiveIdentityFields = cloneStrings(normalizedApplicationIdentityFields)
+	} else if result.policy.identityPresent {
+		result.effectiveIdentityFields = cloneStrings(result.policy.identityFields)
+	}
+
+	if result.modeDeclarationPresent {
+		result.policy.explicitMode = declaredMode
+		result.policy.explicitModePresent = true
+		result.policy.modeLocation = cloneLocation(declaredModeLocation)
+	} else if lower != nil && lower.explicitModePresent {
+		result.policy.explicitMode = lower.explicitMode
+		result.policy.explicitModePresent = true
+		result.policy.modeLocation = cloneLocation(lower.modeLocation)
+	}
+	result.operation = collectionOperationMode(declaredMode, result.policy.explicitMode, len(result.effectiveIdentityFields) != 0)
+
+	return result, nil
+}
+
+func collectionOperationMode(current, retained sequenceMode, identified bool) sequenceMode {
+	if current != 0 {
+		return current
+	}
+	if retained != 0 {
+		return retained
+	}
+	if identified {
+		return sequenceModeUpsert
+	}
+	return sequenceModeReplace
+}
+
+func cloneSequenceDeclarations(declarations []sequenceDeclarationSpec) []sequenceDeclarationSpec {
+	if declarations == nil {
+		return nil
+	}
+	cloned := make([]sequenceDeclarationSpec, len(declarations))
+	for index, declaration := range declarations {
+		cloned[index] = declaration
+		cloned[index].path = declaration.path.clone()
+		cloned[index].destination = declaration.destination.clone()
+		cloned[index].identityFields = cloneStrings(declaration.identityFields)
+		cloned[index].identityLocation = cloneLocation(declaration.identityLocation)
+		cloned[index].modeLocation = cloneLocation(declaration.modeLocation)
+	}
+	return cloned
+}
+
+func collectionDeclarationLocation(specific *Location, fallback Location) *Location {
+	if specific != nil {
+		return cloneLocation(specific)
+	}
+	if fallback != (Location{}) {
+		return cloneLocation(&fallback)
+	}
+	return nil
+}
+
+func collectionPolicyConflictDiagnostic(path Path, primary, related *Location, message string) Diagnostic {
+	diagnostic := Diagnostic{
+		Code: CodeSequenceConflict, Severity: SeverityError,
+		Path: path.clone(), Message: message, Primary: cloneLocation(primary),
+	}
+	if related != nil {
+		diagnostic.Related = []Location{*cloneLocation(related)}
+	}
+	return diagnostic
+}

internal/engine/collection_policy_state.go

@@ -0,0 +1,258 @@
+package engine
+
+import (
+	"sort"
+
+	"gitea.maximumdirect.net/eric/ConfigKit/internal/document"
+)
+
+type collectionPolicyScope struct {
+	collections map[string]collectionPolicyEntry
+}
+
+type collectionPolicyEntry struct {
+	destination Path
+	policy      collectionPolicy
+}
+
+type collectionRecordPolicy struct {
+	owner *collectionRecordOwner
+	scope collectionPolicyScope
+}
+
+// The nonzero field ensures simultaneously live record owners have distinct
+// addresses. The token is per-record ownership, not a source or identity key.
+type collectionRecordOwner struct {
+	marker byte
+}
+
+type projectedCollectionPolicy struct {
+	path   Path
+	policy collectionPolicy
+}
+
+func newCollectionRecordPolicy() collectionRecordPolicy {
+	return collectionRecordPolicy{owner: &collectionRecordOwner{marker: 1}}
+}
+
+func retainedCollectionRecordPolicy(record collectionRecordPolicy) collectionRecordPolicy {
+	return collectionRecordPolicy{
+		owner: record.owner,
+		scope: cloneCollectionPolicyScope(record.scope),
+	}
+}
+
+func replacedCollectionRecordPolicy() collectionRecordPolicy {
+	return newCollectionRecordPolicy()
+}
+
+func (policy *collectionPolicy) setRecordPolicy(record collectionRecordPolicy) {
+	if record.owner == nil {
+		record.owner = newCollectionRecordPolicy().owner
+	}
+	if policy.recordPolicies == nil {
+		policy.recordPolicies = make(map[*collectionRecordOwner]collectionPolicyScope)
+	}
+	if _, exists := policy.recordPolicies[record.owner]; !exists {
+		policy.recordOrder = append(policy.recordOrder, record.owner)
+	}
+	policy.recordPolicies[record.owner] = cloneCollectionPolicyScope(record.scope)
+}
+
+func (policy *collectionPolicy) setRecordPolicyAt(index int, record collectionRecordPolicy) {
+	if index < 0 {
+		return
+	}
+	if record.owner == nil {
+		record.owner = newCollectionRecordPolicy().owner
+	}
+	if policy.recordPolicies == nil {
+		policy.recordPolicies = make(map[*collectionRecordOwner]collectionPolicyScope)
+	}
+	for len(policy.recordOrder) <= index {
+		owner := newCollectionRecordPolicy().owner
+		policy.recordOrder = append(policy.recordOrder, owner)
+		policy.recordPolicies[owner] = collectionPolicyScope{}
+	}
+	delete(policy.recordPolicies, policy.recordOrder[index])
+	policy.recordOrder[index] = record.owner
+	policy.recordPolicies[record.owner] = cloneCollectionPolicyScope(record.scope)
+}
+
+func (policy collectionPolicy) recordPolicyAt(index int) (collectionRecordPolicy, bool) {
+	if index < 0 || index >= len(policy.recordOrder) {
+		return collectionRecordPolicy{}, false
+	}
+	owner := policy.recordOrder[index]
+	scope, ok := policy.recordPolicies[owner]
+	if !ok {
+		return collectionRecordPolicy{}, false
+	}
+	return collectionRecordPolicy{owner: owner, scope: cloneCollectionPolicyScope(scope)}, true
+}
+
+func collectionPolicyForReplacement(lower *collectionPolicy, current collectionPolicy) collectionPolicy {
+	result := cloneCollectionPolicy(current)
+	if !current.explicitModePresent && lower != nil && lower.explicitModePresent {
+		result.explicitMode = lower.explicitMode
+		result.explicitModePresent = true
+		result.modeLocation = cloneLocation(lower.modeLocation)
+	}
+	return result
+}
+
+// collectionPolicyWithoutValue keeps identity and record ownership because no
+// collection value was replaced. A key-only declaration can remain pending
+// when no sequence is present, or validate the retained sequence immediately.
+func collectionPolicyWithoutValue(
+	lower *collectionPolicy,
+	current collectionPolicy,
+	retainedValue *document.Node,
+	path Path,
+) (collectionPolicy, []Diagnostic) {
+	result := collectionPolicy{}
+	if lower != nil {
+		result = cloneCollectionPolicy(*lower)
+	}
+	if lower != nil && lower.identityPresent && current.identityPresent && !equalSequenceIdentityFields(lower.identityFields, current.identityFields) {
+		return collectionPolicy{}, []Diagnostic{collectionPolicyConflictDiagnostic(
+			path, current.identityLocation, lower.identityLocation,
+			"collection identity declaration conflicts with retained identity",
+		)}
+	}
+	if current.identityPresent {
+		result.identityFields = cloneStrings(current.identityFields)
+		result.identityPresent = true
+		result.identityLocation = cloneLocation(current.identityLocation)
+	}
+	if current.explicitModePresent {
+		result.explicitMode = current.explicitMode
+		result.explicitModePresent = true
+		result.modeLocation = cloneLocation(current.modeLocation)
+	}
+	if current.identityPresent && retainedValue != nil && retainedValue.Kind == document.Sequence {
+		_, diagnostics := validateSequenceIdentity(retainedValue, path, result.identityFields, sequenceIdentityDiagnosticCodes{
+			invalid: CodeSequenceInvalid, conflict: CodeSequenceConflict,
+		})
+		if len(diagnostics) != 0 {
+			return collectionPolicy{}, diagnostics
+		}
+	}
+	return result, nil
+}
+
+func (scope *collectionPolicyScope) set(destination Path, policy collectionPolicy) {
+	if scope.collections == nil {
+		scope.collections = make(map[string]collectionPolicyEntry)
+	}
+	scope.collections[destination.String()] = collectionPolicyEntry{
+		destination: destination.clone(), policy: cloneCollectionPolicy(policy),
+	}
+}
+
+func (scope collectionPolicyScope) at(destination Path) (collectionPolicy, bool) {
+	entry, ok := scope.collections[destination.String()]
+	if !ok {
+		return collectionPolicy{}, false
+	}
+	return cloneCollectionPolicy(entry.policy), true
+}
+
+// retireCollectionPoliciesAtOrBelow clears YAML identity and record-owned state
+// below a replaced ancestor while retaining independently scoped explicit modes.
+func (scope *collectionPolicyScope) retireCollectionPoliciesAtOrBelow(ancestor Path) {
+	if scope == nil {
+		return
+	}
+	for key, entry := range scope.collections {
+		if !pathHasPrefix(entry.destination, ancestor) {
+			continue
+		}
+		clearCollectionIdentity(&entry.policy)
+		scope.collections[key] = entry
+	}
+}
+
+func projectCollectionPolicyScope(scope collectionPolicyScope, prefix Path) []projectedCollectionPolicy {
+	keys := make([]string, 0, len(scope.collections))
+	for key := range scope.collections {
+		keys = append(keys, key)
+	}
+	sort.Strings(keys)
+	var projected []projectedCollectionPolicy
+	for _, key := range keys {
+		entry := scope.collections[key]
+		concrete := appendDestination(prefix, entry.destination)
+		projected = append(projected, projectedCollectionPolicy{path: concrete, policy: cloneCollectionPolicy(entry.policy)})
+		for index, owner := range entry.policy.recordOrder {
+			if recordScope, ok := entry.policy.recordPolicies[owner]; ok {
+				projected = append(projected, projectCollectionPolicyScope(recordScope, concrete.Index(index))...)
+			}
+		}
+	}
+	return projected
+}
+
+func cloneCollectionPolicyScope(scope collectionPolicyScope) collectionPolicyScope {
+	if scope.collections == nil {
+		return collectionPolicyScope{}
+	}
+	cloned := collectionPolicyScope{collections: make(map[string]collectionPolicyEntry, len(scope.collections))}
+	for key, entry := range scope.collections {
+		cloned.collections[key] = collectionPolicyEntry{
+			destination: entry.destination.clone(), policy: cloneCollectionPolicy(entry.policy),
+		}
+	}
+	return cloned
+}
+
+func cloneCollectionPolicyScopeForInheritance(scope collectionPolicyScope) collectionPolicyScope {
+	if scope.collections == nil {
+		return collectionPolicyScope{}
+	}
+	cloned := collectionPolicyScope{collections: make(map[string]collectionPolicyEntry, len(scope.collections))}
+	for key, entry := range scope.collections {
+		cloned.collections[key] = collectionPolicyEntry{
+			destination: entry.destination.clone(), policy: cloneCollectionPolicyForInheritance(entry.policy),
+		}
+	}
+	return cloned
+}
+
+func cloneCollectionPolicy(policy collectionPolicy) collectionPolicy {
+	cloned := policy
+	cloned.identityFields = cloneStrings(policy.identityFields)
+	cloned.identityLocation = cloneLocation(policy.identityLocation)
+	cloned.modeLocation = cloneLocation(policy.modeLocation)
+	if policy.recordOrder != nil {
+		cloned.recordOrder = append([]*collectionRecordOwner(nil), policy.recordOrder...)
+	}
+	if policy.recordPolicies != nil {
+		cloned.recordPolicies = make(map[*collectionRecordOwner]collectionPolicyScope, len(policy.recordPolicies))
+		for owner, scope := range policy.recordPolicies {
+			cloned.recordPolicies[owner] = cloneCollectionPolicyScope(scope)
+		}
+	}
+	return cloned
+}
+
+func cloneCollectionPolicyForInheritance(policy collectionPolicy) collectionPolicy {
+	cloned := policy
+	cloned.identityFields = cloneStrings(policy.identityFields)
+	cloned.identityLocation = cloneLocation(policy.identityLocation)
+	cloned.modeLocation = cloneLocation(policy.modeLocation)
+	if policy.recordOrder != nil {
+		cloned.recordOrder = make([]*collectionRecordOwner, 0, len(policy.recordOrder))
+	}
+	if policy.recordPolicies != nil {
+		cloned.recordPolicies = make(map[*collectionRecordOwner]collectionPolicyScope, len(policy.recordPolicies))
+		for _, sourceOwner := range policy.recordOrder {
+			owner := newCollectionRecordPolicy().owner
+			cloned.recordOrder = append(cloned.recordOrder, owner)
+			if sourceScope, ok := policy.recordPolicies[sourceOwner]; ok {
+				cloned.recordPolicies[owner] = cloneCollectionPolicyScopeForInheritance(sourceScope)
+			}
+		}
+	}
+	return cloned
+}

internal/engine/collection_policy_state_test.go

@@ -0,0 +1,292 @@
+package engine
+
+import (
+	"reflect"
+	"testing"
+
+	"gitea.maximumdirect.net/eric/ConfigKit/internal/document"
+)
+
+func TestCollectionPolicyWithoutValueRetainsIdentityAndMode(t *testing.T) {
+	lower := collectionPolicy{
+		identityFields:      []string{"id"},
+		identityPresent:     true,
+		explicitMode:        sequenceModeAppend,
+		explicitModePresent: true,
+	}
+	lower.setRecordPolicy(newCollectionRecordPolicy())
+	current := collectionPolicy{explicitMode: sequenceModeReplace, explicitModePresent: true}
+	retained, diagnostics := collectionPolicyWithoutValue(&lower, current, nil, Keys("prompts"))
+	if len(diagnostics) != 0 || !retained.identityPresent || !reflect.DeepEqual(retained.identityFields, []string{"id"}) {
+		t.Fatalf("no-value replace reset identity: %#v, %#v", retained, diagnostics)
+	}
+	if retained.explicitMode != sequenceModeReplace || !retained.explicitModePresent || len(retained.recordOrder) != 1 {
+		t.Fatalf("no-value policy update lost mode or record ownership: %#v", retained)
+	}
+	retainedRecord, _ := retained.recordPolicyAt(0)
+	lowerRecord, _ := lower.recordPolicyAt(0)
+	if retainedRecord.owner != lowerRecord.owner {
+		t.Fatal("no-value policy update changed record ownership")
+	}
+}
+
+func TestCollectionPolicyWithoutValueLeavesAbsentAndNonSequenceDestinationsUnconstrained(t *testing.T) {
+	current := collectionPolicy{identityFields: []string{"id"}, identityPresent: true}
+	for _, value := range []*document.Node{nil, parsePolicyNode(t, "value: scalar\n").Mapping[0].Value} {
+		retained, diagnostics := collectionPolicyWithoutValue(nil, current, value, Keys("prompts"))
+		if len(diagnostics) != 0 || !retained.identityPresent || !reflect.DeepEqual(retained.identityFields, []string{"id"}) {
+			t.Fatalf("pending identity at absent/non-sequence destination = %#v, %#v", retained, diagnostics)
+		}
+	}
+}
+
+func TestCollectionPolicyWithoutValueValidatesRetainedSequenceImmediately(t *testing.T) {
+	current := collectionPolicy{identityFields: []string{"id"}, identityPresent: true}
+	valid := parsePolicyNode(t, "items: [{id: one}, {id: two}]\n").Mapping[0].Value
+	retained, diagnostics := collectionPolicyWithoutValue(nil, current, valid, Keys("prompts"))
+	if len(diagnostics) != 0 || !retained.identityPresent {
+		t.Fatalf("valid retained records were rejected: %#v, %#v", retained, diagnostics)
+	}
+
+	invalid := parsePolicyNode(t, "items: [{name: missing-id}]\n").Mapping[0].Value
+	retained, diagnostics = collectionPolicyWithoutValue(nil, current, invalid, Keys("prompts"))
+	if !reflect.DeepEqual(retained, collectionPolicy{}) || len(diagnostics) != 1 || diagnostics[0].Code != CodeSequenceInvalid || diagnostics[0].Path.String() != "/prompts/0/id" {
+		t.Fatalf("invalid retained records = %#v, %#v", retained, diagnostics)
+	}
+}
+
+func TestCollectionPolicyWithoutValueRejectsIdentityChange(t *testing.T) {
+	lower := collectionPolicy{identityFields: []string{"id"}, identityPresent: true}
+	current := collectionPolicy{identityFields: []string{"name"}, identityPresent: true}
+	retained, diagnostics := collectionPolicyWithoutValue(&lower, current, nil, Keys("prompts"))
+	if !reflect.DeepEqual(retained, collectionPolicy{}) || len(diagnostics) != 1 || diagnostics[0].Code != CodeSequenceConflict {
+		t.Fatalf("no-value identity change = %#v, %#v", retained, diagnostics)
+	}
+}
+
+func TestCollectionPolicyLifetimePersistenceAndReplacementTable(t *testing.T) {
+	tests := []struct {
+		name            string
+		current         collectionPolicy
+		replaceValue    bool
+		wantIdentity    []string
+		wantIdentitySet bool
+		wantMode        sequenceMode
+		wantRecords     int
+	}{
+		{
+			name: "mode-only replace declaration does not reset retained identity",
+			current: collectionPolicy{
+				explicitMode: sequenceModeReplace, explicitModePresent: true,
+			},
+			wantIdentity: []string{"id"}, wantIdentitySet: true,
+			wantMode: sequenceModeReplace, wantRecords: 1,
+		},
+		{
+			name:            "whole-sequence replacement resets lower identity",
+			replaceValue:    true,
+			wantIdentitySet: false,
+			wantMode:        sequenceModeAppend,
+			wantRecords:     0,
+		},
+		{
+			name:            "replacement can establish a new identity",
+			current:         collectionPolicy{identityFields: []string{"name"}, identityPresent: true},
+			replaceValue:    true,
+			wantIdentity:    []string{"name"},
+			wantIdentitySet: true,
+			wantMode:        sequenceModeAppend,
+			wantRecords:     0,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			lower := collectionPolicy{
+				identityFields: []string{"id"}, identityPresent: true,
+				explicitMode: sequenceModeAppend, explicitModePresent: true,
+			}
+			lower.setRecordPolicy(newCollectionRecordPolicy())
+			var got collectionPolicy
+			if test.replaceValue {
+				got = collectionPolicyForReplacement(&lower, test.current)
+			} else {
+				var diagnostics []Diagnostic
+				got, diagnostics = collectionPolicyWithoutValue(&lower, test.current, nil, Keys("prompts"))
+				if len(diagnostics) != 0 {
+					t.Fatalf("policy diagnostics = %#v", diagnostics)
+				}
+			}
+			if got.identityPresent != test.wantIdentitySet || !reflect.DeepEqual(got.identityFields, test.wantIdentity) || got.explicitMode != test.wantMode || len(got.recordOrder) != test.wantRecords {
+				t.Fatalf("transition result = %#v", got)
+			}
+		})
+	}
+}
+
+func TestCollectionPolicyValueReplacementResetsIdentityButRetainsExplicitMode(t *testing.T) {
+	lower := collectionPolicy{
+		identityFields:      []string{"id"},
+		identityPresent:     true,
+		explicitMode:        sequenceModeAppend,
+		explicitModePresent: true,
+	}
+	lower.setRecordPolicy(newCollectionRecordPolicy())
+	current := collectionPolicy{identityFields: []string{"name"}, identityPresent: true}
+	replaced := collectionPolicyForReplacement(&lower, current)
+	if !replaced.identityPresent || !reflect.DeepEqual(replaced.identityFields, []string{"name"}) {
+		t.Fatalf("replacement identity was not reset: %#v", replaced)
+	}
+	if replaced.explicitMode != sequenceModeAppend || !replaced.explicitModePresent || len(replaced.recordOrder) != 0 {
+		t.Fatalf("replacement failed to retain explicit mode or retire lower record policy: %#v", replaced)
+	}
+
+	cleared := collectionPolicyForReplacement(&lower, collectionPolicy{})
+	if cleared.identityPresent || len(cleared.identityFields) != 0 || cleared.explicitMode != sequenceModeAppend || !cleared.explicitModePresent {
+		t.Fatalf("replacement without a new key did not clear YAML identity while retaining mode: %#v", cleared)
+	}
+}
+
+func TestCollectionRecordRetentionAndReplacementUseOpaqueOwners(t *testing.T) {
+	oldRecord := newCollectionRecordPolicy()
+	oldRecord.scope.set(Keys("steps"), collectionPolicy{identityFields: []string{"id"}, identityPresent: true})
+	retained := retainedCollectionRecordPolicy(oldRecord)
+	if retained.owner != oldRecord.owner {
+		t.Fatal("retained record did not keep its owner")
+	}
+	if got, ok := retained.scope.at(Keys("steps")); !ok || !got.identityPresent {
+		t.Fatalf("retained record lost its local policy: %#v, %t", got, ok)
+	}
+	if retained.scope.collections["/steps"].policy.identityFields[0] = "changed"; oldRecord.scope.collections["/steps"].policy.identityFields[0] != "id" {
+		t.Fatal("retained record policy aliases its source")
+	}
+
+	// A whole-record replacement at the same list position, even with equal
+	// authored identity/source metadata, receives new ownership and no old rules.
+	replacement := replacedCollectionRecordPolicy()
+	if replacement.owner == oldRecord.owner || len(replacement.scope.collections) != 0 {
+		t.Fatal("replacement record inherited discarded owner policy")
+	}
+}
+
+func TestCollectionPolicyAncestorRetirementPreservesIndependentMode(t *testing.T) {
+	var scope collectionPolicyScope
+	owner := newCollectionRecordPolicy()
+	owner.scope.set(Keys("steps"), collectionPolicy{identityFields: []string{"id"}, identityPresent: true})
+	scope.set(Keys("catalog", "prompts"), collectionPolicyWithRecords(collectionPolicy{
+		identityFields:      []string{"id"},
+		identityPresent:     true,
+		explicitMode:        sequenceModeAppend,
+		explicitModePresent: true,
+	}, owner))
+	scope.retireCollectionPoliciesAtOrBelow(Keys("catalog"))
+	policy, ok := scope.at(Keys("catalog", "prompts"))
+	if !ok || policy.identityPresent || len(policy.recordOrder) != 0 || policy.explicitMode != sequenceModeAppend || !policy.explicitModePresent {
+		t.Fatalf("ancestor retirement = %#v, %t", policy, ok)
+	}
+	reintroduced, diagnostics := collectionPolicyWithoutValue(&policy, collectionPolicy{}, nil, Keys("catalog", "prompts"))
+	if len(diagnostics) != 0 || reintroduced.identityPresent || reintroduced.explicitMode != sequenceModeAppend {
+		t.Fatalf("retired identity was resurrected while mode persisted: %#v, %#v", reintroduced, diagnostics)
+	}
+}
+
+func TestEqualOuterIdentitiesHaveDistinctRecordOwners(t *testing.T) {
+	retained := newCollectionRecordPolicy()
+	replacement := replacedCollectionRecordPolicy()
+	if retained.owner == replacement.owner {
+		t.Fatal("replacement with the same outer identity reused the old owner")
+	}
+	if retained.owner == nil || replacement.owner == nil {
+		t.Fatal("record owner token is missing")
+	}
+}
+
+func TestCollectionPolicyScopesKeepRootAndItemRulesIndependent(t *testing.T) {
+	var root collectionPolicyScope
+	root.set(Keys("steps"), collectionPolicy{identityFields: []string{"root-id"}, identityPresent: true})
+	owner := newCollectionRecordPolicy()
+	owner.scope.set(Keys("steps"), collectionPolicy{identityFields: []string{"item-id"}, identityPresent: true})
+	root.set(Keys("items"), collectionPolicyWithRecords(collectionPolicy{}, owner))
+
+	root.retireCollectionPoliciesAtOrBelow(Keys("steps"))
+	rootPolicy, ok := root.at(Keys("steps"))
+	if !ok || rootPolicy.identityPresent {
+		t.Fatalf("root-local policy was not retired: %#v", rootPolicy)
+	}
+	itemPolicy, ok := root.at(Keys("items"))
+	if !ok || len(itemPolicy.recordOrder) != 1 {
+		t.Fatalf("unrelated item owner disappeared: %#v", itemPolicy)
+	}
+	itemRecord, _ := itemPolicy.recordPolicyAt(0)
+	nested, ok := itemRecord.scope.at(Keys("steps"))
+	if !ok || !nested.identityPresent || !reflect.DeepEqual(nested.identityFields, []string{"item-id"}) {
+		t.Fatalf("item-local policy was coupled to root destination: %#v", nested)
+	}
+}
+
+func TestCollectionPolicyProjectionUsesConcretePlacement(t *testing.T) {
+	first := newCollectionRecordPolicy()
+	first.scope.set(Keys("steps"), collectionPolicy{identityFields: []string{"step"}, identityPresent: true})
+	second := newCollectionRecordPolicy()
+	second.scope.set(Keys("steps"), collectionPolicy{explicitMode: sequenceModeAppend, explicitModePresent: true})
+	var scope collectionPolicyScope
+	scope.set(Keys("items"), collectionPolicyWithRecords(collectionPolicy{}, first, second))
+
+	projected := projectCollectionPolicyScope(scope, Keys("mounted"))
+	if len(projected) != 3 {
+		t.Fatalf("projected policies = %#v", projected)
+	}
+	want := []string{"/mounted/items", "/mounted/items/0/steps", "/mounted/items/1/steps"}
+	for index, policy := range projected {
+		if policy.path.String() != want[index] {
+			t.Fatalf("projected path[%d] = %q, want %q", index, policy.path.String(), want[index])
+		}
+	}
+}
+
+func TestCollectionPolicyInheritanceCopiesOwnersAndState(t *testing.T) {
+	owner := newCollectionRecordPolicy()
+	owner.scope.set(Keys("steps"), collectionPolicy{identityFields: []string{"id"}, identityPresent: true})
+	original := collectionPolicyWithRecords(collectionPolicy{}, owner)
+	copy := cloneCollectionPolicyForInheritance(original)
+	copyOwner := copy.recordOrder[0]
+	if copyOwner == owner.owner {
+		t.Fatal("inheritance copy retained the source record owner")
+	}
+	copy.recordPolicies[copyOwner].collections["/steps"].policy.identityFields[0] = "changed"
+	if owner.scope.collections["/steps"].policy.identityFields[0] != "id" {
+		t.Fatal("inheritance copy aliases source policy")
+	}
+}
+
+func TestAcquisitionScopeCloneOwnsCollectionPolicyCopy(t *testing.T) {
+	owner := newCollectionRecordPolicy()
+	owner.scope.set(Keys("steps"), collectionPolicy{identityFields: []string{"id"}, identityPresent: true})
+	var scope acquisitionScope
+	scope.collectionPolicies.set(Keys("items"), collectionPolicyWithRecords(collectionPolicy{}, owner))
+	cloned := cloneAcquisitionScope(scope)
+	clonedOwner := cloned.collectionPolicies.collections["/items"].policy.recordOrder[0]
+	cloned.collectionPolicies.collections["/items"].policy.recordPolicies[clonedOwner].collections["/steps"].policy.identityFields[0] = "changed"
+	sourceOwner := scope.collectionPolicies.collections["/items"].policy.recordOrder[0]
+	if scope.collectionPolicies.collections["/items"].policy.recordPolicies[sourceOwner].collections["/steps"].policy.identityFields[0] != "id" {
+		t.Fatal("acquisition scope clone aliases collection policy")
+	}
+	if clonedOwner != owner.owner {
+		t.Fatal("acquisition scope clone changed record ownership")
+	}
+}
+
+func collectionPolicyWithRecords(policy collectionPolicy, records ...collectionRecordPolicy) collectionPolicy {
+	for _, record := range records {
+		policy.setRecordPolicy(record)
+	}
+	return policy
+}
+
+func parsePolicyNode(t *testing.T, input string) *document.Node {
+	t.Helper()
+	parsed, diagnostics := parseSource(Bytes("collection-policy-state.yml", []byte(input)), "collection-policy-state", defaultParseLimits())
+	if len(diagnostics) != 0 {
+		t.Fatalf("parse policy value: %#v", diagnostics)
+	}
+	return parsed.document
+}

internal/engine/collection_policy_test.go

@@ -0,0 +1,192 @@
+package engine
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestResolveCollectionPolicyReconcilesDeclarationsBeforeComposition(t *testing.T) {
+	declarations := extractSequenceDeclarationsYAML(t, `configkit:
+  sequences:
+    - destination: [prompts]
+      key: [namespace, id]
+      mode: append
+    - destination: [prompts]
+      key: [id, namespace, id]
+    - destination: [prompts]
+      mode: append
+`, rootDirectiveContextSource).sequences
+
+	resolved, diagnostics := resolveCollectionPolicy(Keys("prompts"), declarations, nil, nil)
+	if len(diagnostics) != 0 {
+		t.Fatalf("policy diagnostics = %#v", diagnostics)
+	}
+	if !resolved.declarationsPresent || !resolved.identityDeclarationPresent || !resolved.modeDeclarationPresent {
+		t.Fatalf("declaration presence was lost: %#v", resolved)
+	}
+	wantFields := []string{"id", "namespace"}
+	if !reflect.DeepEqual(resolved.policy.identityFields, wantFields) || !reflect.DeepEqual(resolved.effectiveIdentityFields, wantFields) {
+		t.Fatalf("effective identity = %#v / %#v, want %#v", resolved.policy.identityFields, resolved.effectiveIdentityFields, wantFields)
+	}
+	if !resolved.policy.identityPresent || !resolved.policy.explicitModePresent || resolved.policy.explicitMode != sequenceModeAppend || resolved.operation != sequenceModeAppend {
+		t.Fatalf("resolved explicit policy = %#v, operation %d", resolved.policy, resolved.operation)
+	}
+	if len(resolved.declarations) != 3 || resolved.declarations[0].identityLocation == nil || resolved.declarations[2].location.Line == 0 {
+		t.Fatalf("declaration locations were not retained: %#v", resolved.declarations)
+	}
+}
+
+func TestResolveCollectionPolicyRejectsConflictingPeersAtBothSites(t *testing.T) {
+	tests := []struct {
+		name string
+		body string
+	}{
+		{
+			name: "identity fields",
+			body: `configkit:
+  sequences:
+    - destination: [prompts]
+      key: id
+    - destination: [prompts]
+      key: name
+`,
+		},
+		{
+			name: "explicit modes",
+			body: `configkit:
+  sequences:
+    - destination: [prompts]
+      mode: append
+    - destination: [prompts]
+      mode: replace
+`,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			declarations := extractSequenceDeclarationsYAML(t, test.body, rootDirectiveContextSource).sequences
+			resolved, diagnostics := resolveCollectionPolicy(Keys("prompts"), declarations, nil, nil)
+			if !reflect.DeepEqual(resolved, collectionPolicyResolution{}) || len(diagnostics) != 1 || diagnostics[0].Code != CodeSequenceConflict {
+				t.Fatalf("resolution/diagnostics = %#v / %#v", resolved, diagnostics)
+			}
+			diagnostic := diagnostics[0]
+			if diagnostic.Path.String() != "/prompts" || diagnostic.Primary == nil || len(diagnostic.Related) != 1 {
+				t.Fatalf("conflict does not identify both declaration sites: %#v", diagnostic)
+			}
+			if diagnostic.Primary.SourceID != "sequence-declarations" || diagnostic.Related[0].SourceID != "sequence-declarations" || diagnostic.Primary.Line == diagnostic.Related[0].Line {
+				t.Fatalf("conflict locations = %#v and %#v", diagnostic.Primary, diagnostic.Related)
+			}
+		})
+	}
+}
+
+func TestResolveCollectionPolicySelectsCurrentThenRetainedExplicitMode(t *testing.T) {
+	lower := &collectionPolicy{
+		identityFields:      []string{"id"},
+		identityPresent:     true,
+		explicitMode:        sequenceModeAppend,
+		explicitModePresent: true,
+		modeLocation:        &Location{SourceID: "lower", Line: 2},
+	}
+	current := extractSequenceDeclarationsYAML(t, `configkit:
+  sequences:
+    - destination: [prompts]
+      mode: upsert
+`, rootDirectiveContextSource).sequences
+	resolved, diagnostics := resolveCollectionPolicy(Keys("prompts"), current, nil, lower)
+	if len(diagnostics) != 0 || resolved.operation != sequenceModeUpsert || resolved.policy.explicitMode != sequenceModeUpsert || !resolved.policy.explicitModePresent {
+		t.Fatalf("current mode did not override retained mode: %#v, %#v", resolved, diagnostics)
+	}
+
+	resolved, diagnostics = resolveCollectionPolicy(Keys("prompts"), nil, nil, lower)
+	if len(diagnostics) != 0 || resolved.operation != sequenceModeAppend || resolved.policy.explicitMode != sequenceModeAppend || !resolved.policy.explicitModePresent {
+		t.Fatalf("omitted current mode did not retain lower explicit mode: %#v, %#v", resolved, diagnostics)
+	}
+	if !reflect.DeepEqual(resolved.effectiveIdentityFields, []string{"id"}) {
+		t.Fatalf("retained identity = %#v", resolved.effectiveIdentityFields)
+	}
+}
+
+func TestResolveCollectionPolicyInfersWithoutPersistingMode(t *testing.T) {
+	keyOnly := extractSequenceDeclarationsYAML(t, `configkit:
+  sequences:
+    - destination: [prompts]
+      key: id
+`, rootDirectiveContextSource).sequences
+	resolved, diagnostics := resolveCollectionPolicy(Keys("prompts"), keyOnly, nil, nil)
+	if len(diagnostics) != 0 || resolved.operation != sequenceModeUpsert || resolved.policy.explicitModePresent {
+		t.Fatalf("identity-based mode inference = %#v, %#v", resolved, diagnostics)
+	}
+
+	resolved, diagnostics = resolveCollectionPolicy(Keys("prompts"), nil, []string{"id"}, nil)
+	if len(diagnostics) != 0 || resolved.operation != sequenceModeUpsert || resolved.policy.identityPresent || !resolved.applicationIdentityPresent {
+		t.Fatalf("application identity was not kept distinct from YAML policy: %#v, %#v", resolved, diagnostics)
+	}
+
+	noIdentity := extractSequenceDeclarationsYAML(t, `configkit:
+  sequences:
+    - destination: [prompts]
+`, rootDirectiveContextSource).sequences
+	resolved, diagnostics = resolveCollectionPolicy(Keys("prompts"), noIdentity, nil, nil)
+	if len(diagnostics) != 0 || resolved.operation != sequenceModeReplace || resolved.policy.explicitModePresent {
+		t.Fatalf("unkeyed mode inference = %#v, %#v", resolved, diagnostics)
+	}
+
+	explicitDefault := extractSequenceDeclarationsYAML(t, `configkit:
+  sequences:
+    - destination: [prompts]
+      mode: replace
+`, rootDirectiveContextSource).sequences
+	resolved, diagnostics = resolveCollectionPolicy(Keys("prompts"), explicitDefault, nil, nil)
+	if len(diagnostics) != 0 || resolved.operation != sequenceModeReplace || !resolved.policy.explicitModePresent {
+		t.Fatalf("explicit default mode lost its presence: %#v, %#v", resolved, diagnostics)
+	}
+}
+
+func TestResolveCollectionPolicyChecksKeyOnlyAgainstApplicationConstraint(t *testing.T) {
+	declarations := extractSequenceDeclarationsYAML(t, `configkit:
+  sequences:
+    - destination: [prompts]
+      key: [namespace, id]
+`, rootDirectiveContextSource).sequences
+	resolved, diagnostics := resolveCollectionPolicy(Keys("prompts"), declarations, []string{"id", "namespace", "id"}, nil)
+	if len(diagnostics) != 0 || resolved.operation != sequenceModeUpsert || !reflect.DeepEqual(resolved.effectiveIdentityFields, []string{"id", "namespace"}) {
+		t.Fatalf("equivalent key-only declaration was rejected: %#v, %#v", resolved, diagnostics)
+	}
+
+	resolved, diagnostics = resolveCollectionPolicy(Keys("prompts"), declarations, []string{"slug"}, nil)
+	if len(diagnostics) != 1 || diagnostics[0].Code != CodeSequenceConflict {
+		t.Fatalf("conflicting key-only declaration = %#v, %#v", resolved, diagnostics)
+	}
+	if diagnostics[0].Primary == nil || diagnostics[0].Path.String() != "/prompts" || len(diagnostics[0].Related) != 0 {
+		t.Fatalf("application conflict diagnostic = %#v", diagnostics[0])
+	}
+}
+
+func TestResolveCollectionPolicyChecksRetainedIdentityAgainstApplicationConstraint(t *testing.T) {
+	lower := &collectionPolicy{identityFields: []string{"id"}, identityPresent: true}
+	resolved, diagnostics := resolveCollectionPolicy(Keys("prompts"), nil, []string{"name"}, lower)
+	if len(diagnostics) != 1 || diagnostics[0].Code != CodeSequenceConflict || diagnostics[0].Path.String() != "/prompts" {
+		t.Fatalf("retained/application conflict = %#v, %#v", resolved, diagnostics)
+	}
+}
+
+func TestResolveCollectionPolicyRequiresCurrentIdentityToAgreeWithRetainedIdentity(t *testing.T) {
+	declarations := extractSequenceDeclarationsYAML(t, `configkit:
+  sequences:
+    - destination: [prompts]
+      key: name
+`, rootDirectiveContextSource).sequences
+	lower := &collectionPolicy{
+		identityFields:   []string{"id"},
+		identityPresent:  true,
+		identityLocation: &Location{SourceID: "lower", Line: 4},
+	}
+	resolved, diagnostics := resolveCollectionPolicy(Keys("prompts"), declarations, nil, lower)
+	if len(diagnostics) != 1 || diagnostics[0].Code != CodeSequenceConflict || diagnostics[0].Path.String() != "/prompts" {
+		t.Fatalf("current/retained identity conflict = %#v, %#v", resolved, diagnostics)
+	}
+	if diagnostics[0].Primary == nil || len(diagnostics[0].Related) != 1 || diagnostics[0].Related[0].SourceID != "lower" {
+		t.Fatalf("current/retained conflict locations = %#v", diagnostics[0])
+	}
+}

internal/engine/collection_retirement.go

@@ -0,0 +1,81 @@
+package engine
+
+import "gitea.maximumdirect.net/eric/ConfigKit/internal/document"
+
+// A true entry replaces the collection itself as well as its descendants;
+// false records ordinary ancestor replacement without selecting a collection
+// operation at that exact path.
+type collectionReplacementPaths map[string]bool
+
+func (paths collectionReplacementPaths) contains(path Path, includeExact bool) bool {
+	for length := 0; length <= len(path.segments); length++ {
+		prefix := Path{segments: path.segments[:length]}
+		inclusive, found := paths[prefix.String()]
+		if found && (length < len(path.segments) || includeExact && inclusive) {
+			return true
+		}
+	}
+	return false
+}
+
+// lowerCollectionPoliciesForClaims makes replacement eligibility independent of
+// declaration order. It removes only old YAML identity/record state; new pending
+// declarations and application constraints are reconciled afterward.
+func lowerCollectionPoliciesForClaims(
+	lower collectionPolicyScope,
+	claims []compositionClaim,
+	declarations map[string][]sequenceDeclarationSpec,
+	application sequencePolicy,
+) (collectionPolicyScope, collectionReplacementPaths) {
+	byPath := make(map[string]compositionClaim, len(claims))
+	rootPath := ""
+	if len(claims) != 0 {
+		rootPath = claims[0].path.String()
+	}
+	for _, claim := range claims {
+		byPath[claim.path.String()] = claim
+	}
+	replaced := make(collectionReplacementPaths)
+	for key, claim := range byPath {
+		old, hasOld := lower.collections[key]
+		current := declarations[key]
+		if claim.kind == document.Mapping && (key == rootPath || !hasOld && len(current) == 0) {
+			continue // Ordinary mapping combination preserves descendants.
+		}
+		mode := sequenceMode(0)
+		identity := old.policy.identityPresent
+		for _, declaration := range current {
+			identity = identity || declaration.identityPresent
+			if mode == 0 && declaration.modePresent {
+				mode = declaration.mode
+			}
+		}
+		retainedMode := sequenceMode(0)
+		if old.policy.explicitModePresent {
+			retainedMode = old.policy.explicitMode
+		}
+		_, registered := application.identityFieldsAt(claim.path)
+		mode = collectionOperationMode(mode, retainedMode, identity || registered)
+		if mode == sequenceModeReplace {
+			replaced[key] = true
+		} else if claim.kind != document.Mapping && claim.kind != document.Sequence {
+			replaced[key] = false
+		}
+	}
+	result := cloneCollectionPolicyScope(lower)
+	for key, entry := range result.collections {
+		if replaced.contains(entry.destination, true) {
+			clearCollectionIdentity(&entry.policy)
+			result.collections[key] = entry
+		}
+	}
+	return result, replaced
+}
+
+func clearCollectionIdentity(policy *collectionPolicy) {
+	policy.identityFields = nil
+	policy.identityPresent = false
+	policy.identityLocation = nil
+	policy.recordOrder = nil
+	policy.recordPolicies = nil
+}

internal/engine/collection_retirement_test.go

@@ -0,0 +1,111 @@
+package engine
+
+import (
+	"errors"
+	"testing"
+)
+
+func TestSourceReplacementRetiresIdentityForEveryValueKind(t *testing.T) {
+	t.Parallel()
+	for _, value := range []string{"null", "42", "{}", "[{name: new}]"} {
+		t.Run(value, func(t *testing.T) {
+			lower := "configkit:\n  sequences: [{destination: [items], key: id}]\nitems: [{id: old}]\n"
+			main := "configkit:\n  sequences: [{destination: [items], key: name, mode: replace}]\nitems: " + value + "\n"
+			loaded, err := testGroupedLoad(loadRequest[map[string]any]{
+				main:      loadInput{source: Bytes("main", []byte(main))},
+				underlays: []loadGroup{{inputs: []loadInput{{source: Bytes("lower", []byte(lower))}}}},
+			})
+			if err != nil || loaded == nil {
+				t.Fatalf("replacement retained obsolete identity: %v", err)
+			}
+		})
+	}
+}
+
+func TestAncestorRemovalCanEstablishPendingReplacementIdentity(t *testing.T) {
+	t.Parallel()
+	for _, inheritance := range []bool{false, true} {
+		name := "tiers"
+		if inheritance {
+			name = "inheritance"
+		}
+		t.Run(name, func(t *testing.T) {
+			var loaded *testResult[map[string]any]
+			var err error
+			if inheritance {
+				loaded, err = testLoad[map[string]any](Bytes("source", []byte(`configkit:
+  sequences:
+    - {destination: [base, group, items], key: id}
+    - {destination: [child, group, items], key: name}
+base: {group: {items: [{id: old}]}}
+child:
+  extends: base
+  group: null
+grandchild:
+  extends: child
+  group: {items: [{name: new}]}
+`)))
+			} else {
+				loaded, err = testGroupedLoad(loadRequest[map[string]any]{
+					main: loadInput{source: Bytes("main", []byte("group: {items: [{name: new}]}\n"))},
+					underlays: []loadGroup{
+						{inputs: []loadInput{{source: Bytes("base", []byte("configkit:\n  sequences: [{destination: [group, items], key: id}]\ngroup: {items: [{id: old}]}\n"))}}},
+						{inputs: []loadInput{{source: Bytes("remove", []byte("configkit:\n  sequences: [{destination: [group, items], key: name}]\ngroup: null\n"))}}},
+					},
+				})
+			}
+			if err != nil {
+				t.Fatal(err)
+			}
+			value := loaded.Config
+			if inheritance {
+				value = value["grandchild"].(map[string]any)
+			}
+			items := value["group"].(map[string]any)["items"].([]any)
+			if len(items) != 1 || items[0].(map[string]any)["name"] != "new" {
+				t.Fatalf("reintroduced collection = %#v", items)
+			}
+		})
+	}
+}
+
+func TestInheritanceAncestorRetirementDoesNotResurrectOldIdentity(t *testing.T) {
+	t.Parallel()
+	_, err := testLoad[map[string]any](Bytes("source", []byte(`configkit:
+  sequences: [{destination: [base, group, items], key: id}]
+base: {group: {items: [{id: old}]}}
+child:
+  extends: base
+  group: null
+grandchild:
+  extends: child
+  group: {items: [{name: new}]}
+`)))
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestReplacementRetirementPreservesApplicationConstraintsAndRetainedKeys(t *testing.T) {
+	t.Parallel()
+	for _, withValue := range []bool{false, true} {
+		main := "configkit:\n  sequences: [{destination: [items], key: name, mode: replace}]\n"
+		if withValue {
+			main += "items: null\n"
+		}
+		definition := Definition[map[string]any]{}
+		if withValue {
+			definition.sequenceIdentityRegistrations = []sequenceIdentityRegistration{{
+				selector: sequenceIdentitySelector{literalSequenceSelector("items")}, identityFields: []string{"id"},
+			}}
+		}
+		_, err := testGroupedLoad(loadRequest[map[string]any]{
+			main: loadInput{source: Bytes("main", []byte(main))}, definition: definition,
+			underlays: []loadGroup{{inputs: []loadInput{{source: Bytes("lower", []byte("configkit:\n  sequences: [{destination: [items], key: id}]\nitems: [{id: old}]\n"))}}}},
+		})
+		var loadErr *LoadError
+		if !errors.As(err, &loadErr) || len(loadErr.Diagnostics()) == 0 || loadErr.Diagnostics()[0].Code != CodeSequenceConflict {
+			t.Fatalf("retirement bypassed identity agreement: %v", err)
+		}
+	}
+}

internal/engine/compose.go

@@ -1,20 +1,26 @@
 package engine
 
-import "gitea.maximumdirect.net/eric/ConfigKit/internal/document"
+import (
+	"maps"
+
+	"gitea.maximumdirect.net/eric/ConfigKit/internal/document"
+)
 
 // composedDocument is the private handoff between source assembly and later
 // precedence layers. Claims remain ordered by source and declaration traversal;
 // origins retain every source that contributes to a composite mapping.
 type composedDocument struct {
-	root           *document.Node
-	acquisition    []acquisitionScope
-	claims         []compositionClaim
-	sequenceRanges []sequenceRange
-	origins        map[string]Origin
-	overlays       []overlayRecord
-	applications   []historyApplication
-	inputBytes     int64
-	inputNodes     int
+	root               *document.Node
+	acquisition        []acquisitionScope
+	importGraph        importInclusionGraph
+	collectionPolicies collectionPolicyScope
+	claims             []compositionClaim
+	sequenceRanges     []sequenceRange
+	origins            map[string]Origin
+	overlays           []overlayRecord
+	applications       []historyApplication
+	inputBytes         int64
+	inputNodes         int
 }
 
 type sequenceHistoryMode uint8
@@ -22,13 +28,16 @@ type sequenceHistoryMode uint8
 const (
 	sequenceHistoryReplace sequenceHistoryMode = iota + 1
 	sequenceHistoryAppend
+	sequenceHistoryMapped
 )
 
 type sequenceHistoryContribution struct {
-	path   Path
-	mode   sequenceHistoryMode
-	offset int
-	length int
+	path         Path
+	mode         sequenceHistoryMode
+	offset       int
+	length       int
+	items        []sequenceItemProjection
+	replacements []sequenceItemReplacement
 }
 
 // assemblyAccumulator owns one mutable working document. Acquired trees held by
@@ -50,9 +59,11 @@ func cloneComposedDocument(base *composedDocument) *composedDocument {
 	}
 	return &composedDocument{
 		root: document.Clone(base.root), claims: cloneCompositionClaims(base.claims),
-		acquisition:    cloneAcquisitionScopes(base.acquisition),
-		sequenceRanges: cloneSequenceRanges(base.sequenceRanges),
-		origins:        cloneOriginIndex(base.origins), overlays: cloneOverlayRecords(base.overlays),
+		acquisition:        cloneAcquisitionScopes(base.acquisition),
+		importGraph:        base.importGraph.clone(),
+		collectionPolicies: cloneCollectionPolicyScope(base.collectionPolicies),
+		sequenceRanges:     cloneSequenceRanges(base.sequenceRanges),
+		origins:            cloneOriginIndex(base.origins), overlays: cloneOverlayRecords(base.overlays),
 		applications: cloneHistoryApplications(base.applications),
 		inputBytes:   base.inputBytes, inputNodes: base.inputNodes,
 	}
@@ -78,6 +89,53 @@ type sequenceRange struct {
 	path        Path
 	start       int
 	end         int
+	items       []sequenceItemProjection
+	projection  sequenceItemProjectionIndex
+}
+
+func (assigned sequenceRange) outputForInput(inputIndex int) (int, bool) {
+	if assigned.projection.outputByInput != nil {
+		return assigned.projection.outputForInput(inputIndex)
+	}
+	if assigned.items != nil {
+		output, found := 0, false
+		for _, item := range assigned.items {
+			if item.inputIndex == inputIndex && inputIndex >= 0 && item.outputIndex >= 0 {
+				output, found = item.outputIndex, true
+			}
+		}
+		return output, found
+	}
+	if inputIndex < 0 || inputIndex >= assigned.end-assigned.start {
+		return 0, false
+	}
+	return assigned.start + inputIndex, true
+}
+
+func (assigned sequenceRange) inputForOutput(outputIndex int) (int, bool) {
+	if assigned.projection.inputByOutput != nil {
+		return assigned.projection.inputForOutput(outputIndex)
+	}
+	if assigned.items != nil {
+		input, found := 0, false
+		for _, item := range assigned.items {
+			if item.outputIndex == outputIndex && outputIndex >= 0 && item.inputIndex >= 0 {
+				input, found = item.inputIndex, true
+			}
+		}
+		return input, found
+	}
+	if outputIndex < assigned.start || outputIndex >= assigned.end {
+		return 0, false
+	}
+	return outputIndex - assigned.start, true
+}
+
+func indexSequenceRange(assigned sequenceRange) sequenceRange {
+	if assigned.items != nil && assigned.projection.outputByInput == nil && assigned.projection.inputByOutput == nil {
+		assigned.projection = newSequenceItemProjectionIndex(assigned.items)
+	}
+	return assigned
 }
 
 // composeDocuments recursively joins disjoint mapping entries. Source order
@@ -91,6 +149,17 @@ func composeDocuments(inputs ...*document.Node) (*composedDocument, []Diagnostic
 // sequence rules when policy contains registrations. The ordinary adapter above
 // deliberately preserves the existing unregistered behavior for current callers.
 func composeDocumentsWithPolicy(policy sequencePolicy, inputs ...*document.Node) (*composedDocument, []Diagnostic) {
+	return composeDocumentsWithCollectionPolicy(policy, collectionPolicyScope{}, nil, inputs...)
+}
+
+// composeDocumentsWithCollectionPolicy resolves collection declarations and
+// eligible lower policy before strictly composing completed peer documents.
+func composeDocumentsWithCollectionPolicy(
+	policy sequencePolicy,
+	lower collectionPolicyScope,
+	declarations []sequenceDeclarationSpec,
+	inputs ...*document.Node,
+) (*composedDocument, []Diagnostic) {
 	if len(inputs) == 0 {
 		return nil, []Diagnostic{compositionInvalidDiagnostic("strict composition requires at least one document", nil)}
 	}
@@ -108,6 +177,13 @@ func composeDocumentsWithPolicy(policy sequencePolicy, inputs ...*document.Node)
 		collected.append(input, Path{}, sourceIndex)
 	}
 
+	identityFieldsByPath, collectionPolicies, diagnostics := resolveStrictCollectionPolicies(
+		collected.ordered, policy, lower, declarations,
+	)
+	if len(diagnostics) != 0 {
+		return nil, diagnostics
+	}
+
 	checked := make(map[string]struct{}, len(collected.byPath))
 	for _, claim := range collected.ordered {
 		pointer := claim.path.String()
@@ -116,13 +192,13 @@ func composeDocumentsWithPolicy(policy sequencePolicy, inputs ...*document.Node)
 		}
 		checked[pointer] = struct{}{}
 		claims := collected.byPath[pointer]
-		if len(claims) < 2 || allMappingClaims(claims) || (allSequenceClaims(claims) && policy.registered(claim.path)) {
+		if len(claims) < 2 || allMappingClaims(claims) || (allSequenceClaims(claims) && len(identityFieldsByPath[pointer]) != 0) {
 			continue
 		}
 		return nil, []Diagnostic{compositionConflictDiagnostic(claim.path, claims)}
 	}
 
-	validated, ranges, diagnostics := validateRegisteredSequences(collected.ordered, policy)
+	validated, ranges, diagnostics := validateRegisteredSequences(collected.ordered, identityFieldsByPath)
 	if len(diagnostics) != 0 {
 		return nil, diagnostics
 	}
@@ -130,7 +206,7 @@ func composeDocumentsWithPolicy(policy sequencePolicy, inputs ...*document.Node)
 	root := document.Clone(inputs[0])
 	index := new(mappingIndex)
 	for sourceIndex, input := range inputs[1:] {
-		mergeComposedMappings(root, input, Path{}, index, sourceIndex+1, policy, validated)
+		mergeComposedMappings(root, input, Path{}, index, sourceIndex+1, identityFieldsByPath, validated)
 	}
 	applications := make([]historyApplication, 0, len(inputs))
 	seenSequences := make(map[string]bool)
@@ -157,11 +233,12 @@ func composeDocumentsWithPolicy(policy sequencePolicy, inputs ...*document.Node)
 	origins := projectedCompositionOrigins(inputs, ranges)
 	completeCompositionOrigins(root, Path{}, origins)
 	return &composedDocument{
-		root:           root,
-		claims:         cloneCompositionClaims(collected.ordered),
-		sequenceRanges: cloneSequenceRanges(ranges),
-		origins:        origins,
-		applications:   applications,
+		root:               root,
+		collectionPolicies: collectionPolicies,
+		claims:             cloneCompositionClaims(collected.ordered),
+		sequenceRanges:     cloneSequenceRanges(ranges),
+		origins:            origins,
+		applications:       applications,
 	}, nil
 }
 
@@ -217,71 +294,128 @@ type validatedSequence struct {
 	items []*document.Node
 }
 
-func validateRegisteredSequences(claims []compositionClaim, policy sequencePolicy) (map[string]map[int]validatedSequence, []sequenceRange, []Diagnostic) {
+func resolveStrictCollectionPolicies(
+	claims []compositionClaim,
+	applicationPolicy sequencePolicy,
+	lower collectionPolicyScope,
+	declarations []sequenceDeclarationSpec,
+) (map[string][]string, collectionPolicyScope, []Diagnostic) {
+	paths := make([]Path, 0, len(claims)+len(declarations))
+	seen := make(map[string]bool, len(claims)+len(declarations))
+	valuePresent := make(map[string]bool)
+	declarationsByPath := make(map[string][]sequenceDeclarationSpec, len(declarations))
+	for _, claim := range claims {
+		if len(lower.collections) != 0 {
+			valuePresent[claim.path.String()] = true
+		}
+		if claim.kind != document.Sequence {
+			continue
+		}
+		key := claim.path.String()
+		if !seen[key] {
+			seen[key] = true
+			paths = append(paths, claim.path.clone())
+		}
+	}
+	for _, declaration := range declarations {
+		key := declaration.destination.String()
+		declarationsByPath[key] = append(declarationsByPath[key], declaration)
+		if !seen[key] {
+			seen[key] = true
+			paths = append(paths, declaration.destination.clone())
+		}
+	}
+
+	identityFieldsByPath := make(map[string][]string)
+	effectiveLower := lower
+	if len(lower.collections) != 0 {
+		effectiveLower, _ = lowerCollectionPoliciesForClaims(lower, claims, declarationsByPath, applicationPolicy)
+	}
+	collectionPolicies := cloneCollectionPolicyScope(effectiveLower)
+	var diagnostics []Diagnostic
+	for _, path := range paths {
+		key := path.String()
+		currentDeclarations := declarationsByPath[key]
+
+		lowerEntry, hasLower := effectiveLower.collections[key]
+		var lowerPolicy *collectionPolicy
+		if hasLower {
+			copy := cloneCollectionPolicy(lowerEntry.policy)
+			lowerPolicy = &copy
+		}
+		applicationIdentity, _ := applicationPolicy.identityFieldsAt(path)
+
+		resolution, found := resolveCollectionPolicy(path, currentDeclarations, applicationIdentity, lowerPolicy)
+		if len(found) != 0 {
+			diagnostics = append(diagnostics, found...)
+			continue
+		}
+		if len(resolution.effectiveIdentityFields) != 0 {
+			identityFieldsByPath[key] = cloneStrings(resolution.effectiveIdentityFields)
+		}
+
+		policyForPath := resolution.policy
+		if hasLower && !valuePresent[key] {
+			// A declaration without a new value changes policy metadata but
+			// leaves retained record ownership untouched.
+			policyForPath = cloneCollectionPolicy(lowerEntry.policy)
+			policyForPath.identityFields = cloneStrings(resolution.policy.identityFields)
+			policyForPath.identityPresent = resolution.policy.identityPresent
+			policyForPath.identityLocation = cloneLocation(resolution.policy.identityLocation)
+			policyForPath.explicitMode = resolution.policy.explicitMode
+			policyForPath.explicitModePresent = resolution.policy.explicitModePresent
+			policyForPath.modeLocation = cloneLocation(resolution.policy.modeLocation)
+		}
+		if collectionPolicies.collections == nil {
+			collectionPolicies.collections = make(map[string]collectionPolicyEntry)
+		}
+		collectionPolicies.collections[key] = collectionPolicyEntry{destination: path.clone(), policy: policyForPath}
+	}
+	return identityFieldsByPath, collectionPolicies, canonicalDiagnostics(diagnostics)
+}
+
+func validateRegisteredSequences(claims []compositionClaim, identityFieldsByPath map[string][]string) (map[string]map[int]validatedSequence, []sequenceRange, []Diagnostic) {
 	itemsByPath := make(map[string]map[int]validatedSequence)
-	identitiesByPath := make(map[string]map[string]Location)
+	identitiesByPath := make(map[string]map[string]document.Location)
 	lengthsByPath := make(map[string]int)
 	var ranges []sequenceRange
 	for _, claim := range claims {
 		if claim.kind != document.Sequence {
 			continue
 		}
-		identityField, registered := policy.identityFields[claim.path.String()]
-		if !registered {
+		identityFields := identityFieldsByPath[claim.path.String()]
+		if len(identityFields) == 0 {
 			continue
 		}
 		node := claim.node
 		pathKey := claim.path.String()
 		identities := identitiesByPath[pathKey]
 		if identities == nil {
-			identities = make(map[string]Location, len(node.Sequence))
+			identities = make(map[string]document.Location, len(node.Sequence))
 			identitiesByPath[pathKey] = identities
 		}
 		start := lengthsByPath[pathKey]
 		contribution := validatedSequence{items: node.Sequence}
-		for itemIndex, item := range node.Sequence {
-			itemPath := claim.path.Index(start + itemIndex)
-			if item == nil || item.Kind != document.Mapping {
-				location := (*Location)(nil)
-				if item != nil {
-					converted := publicLocation(item.Location)
-					location = &converted
-				}
-				return nil, nil, []Diagnostic{{
-					Code: CodeComposeInvalid, Severity: SeverityError,
-					Path: itemPath, Message: "registered sequence items must be mappings", Primary: location,
-				}}
-			}
-			fieldIndex := documentEntryIndex(item.Mapping, identityField)
-			if fieldIndex < 0 {
-				location := publicLocation(item.Location)
-				return nil, nil, []Diagnostic{{
-					Code: CodeComposeInvalid, Severity: SeverityError,
-					Path: itemPath, Message: "registered sequence item is missing its identity field",
-					Primary: &location,
-				}}
-			}
-			field := item.Mapping[fieldIndex].Value
-			if field == nil || field.Kind != document.String {
-				location := publicLocation(item.Mapping[fieldIndex].ValueLocation)
-				if field != nil {
-					location = publicLocation(field.Location)
-				}
-				return nil, nil, []Diagnostic{{
-					Code: CodeComposeInvalid, Severity: SeverityError,
-					Path: itemPath.Key(identityField), Message: "registered sequence identity must be a string",
-					Primary: &location,
-				}}
-			}
-			if first, duplicate := identities[field.Text]; duplicate {
-				current := publicLocation(field.Location)
+		records, diagnostics := validateNormalizedSequenceIdentityFrom(node, claim.path, identityFields, sequenceIdentityDiagnosticCodes{
+			invalid: CodeComposeInvalid, conflict: CodeComposeConflict,
+		}, start, sequenceStructuralRecord)
+		if len(diagnostics) != 0 {
+			return nil, nil, diagnostics
+		}
+		byIndex := make([]sequenceIdentityRecord, len(node.Sequence))
+		for _, record := range records {
+			byIndex[record.index] = record
+		}
+		for _, record := range byIndex {
+			if first, duplicate := identities[record.tuple]; duplicate {
+				current := publicLocation(record.location)
 				return nil, nil, []Diagnostic{{
 					Code: CodeComposeConflict, Severity: SeverityError,
 					Path: claim.path.clone(), Message: "registered sequence contains duplicate identities",
-					Primary: &first, Related: []Location{current},
+					Primary: ptrLocation(publicLocation(first)), Related: []Location{current},
 				}}
 			}
-			identities[field.Text] = publicLocation(field.Location)
+			identities[record.tuple] = record.location
 		}
 		if itemsByPath[pathKey] == nil {
 			itemsByPath[pathKey] = make(map[int]validatedSequence)
@@ -295,7 +429,7 @@ func validateRegisteredSequences(claims []compositionClaim, policy sequencePolic
 	return itemsByPath, ranges, nil
 }
 
-func mergeComposedMappings(target, incoming *document.Node, path Path, index *mappingIndex, sourceIndex int, policy sequencePolicy, validated map[string]map[int]validatedSequence) {
+func mergeComposedMappings(target, incoming *document.Node, path Path, index *mappingIndex, sourceIndex int, identityFieldsByPath map[string][]string, validated map[string]map[int]validatedSequence) {
 	for _, incomingEntry := range incoming.Mapping {
 		entryPath := path.Key(incomingEntry.Key)
 		position := index.find(target, incomingEntry.Key)
@@ -306,7 +440,7 @@ func mergeComposedMappings(target, incoming *document.Node, path Path, index *ma
 			continue
 		}
 		current := target.Mapping[position].Value
-		if current.Kind == document.Sequence && incomingEntry.Value.Kind == document.Sequence && policy.registered(entryPath) {
+		if current.Kind == document.Sequence && incomingEntry.Value.Kind == document.Sequence && len(identityFieldsByPath[entryPath.String()]) != 0 {
 			contribution := validated[entryPath.String()][sourceIndex]
 			if contribution.items != nil {
 				for _, item := range contribution.items {
@@ -315,20 +449,15 @@ func mergeComposedMappings(target, incoming *document.Node, path Path, index *ma
 			}
 			continue
 		}
-		mergeDisjointMappingsAtPath(current, incomingEntry.Value, entryPath, index, sourceIndex, policy, validated)
+		mergeDisjointMappingsAtPath(current, incomingEntry.Value, entryPath, index, sourceIndex, identityFieldsByPath, validated)
 	}
 }
 
-func mergeDisjointMappingsAtPath(target, incoming *document.Node, path Path, index *mappingIndex, sourceIndex int, policy sequencePolicy, validated map[string]map[int]validatedSequence) {
+func mergeDisjointMappingsAtPath(target, incoming *document.Node, path Path, index *mappingIndex, sourceIndex int, identityFieldsByPath map[string][]string, validated map[string]map[int]validatedSequence) {
 	if target.Kind != document.Mapping || incoming.Kind != document.Mapping {
 		return
 	}
-	mergeComposedMappings(target, incoming, path, index, sourceIndex, policy, validated)
-}
-
-func (p sequencePolicy) registered(path Path) bool {
-	_, ok := p.identityFields[path.String()]
-	return ok
+	mergeComposedMappings(target, incoming, path, index, sourceIndex, identityFieldsByPath, validated)
 }
 
 func cloneSequenceRanges(ranges []sequenceRange) []sequenceRange {
@@ -336,6 +465,11 @@ func cloneSequenceRanges(ranges []sequenceRange) []sequenceRange {
 	for i, assigned := range ranges {
 		cloned[i] = assigned
 		cloned[i].path = assigned.path.clone()
+		if assigned.items != nil {
+			cloned[i].items = append([]sequenceItemProjection{}, assigned.items...)
+		}
+		cloned[i].projection.outputByInput = maps.Clone(assigned.projection.outputByInput)
+		cloned[i].projection.inputByOutput = maps.Clone(assigned.projection.inputByOutput)
 	}
 	return cloned
 }
@@ -375,12 +509,28 @@ func documentEntryIndex(entries []document.Entry, key string) int {
 
 func projectedCompositionOrigins(inputs []*document.Node, ranges []sequenceRange) map[string]Origin {
 	origins := make(map[string]Origin)
-	rangeBySourcePath := make(map[sequenceRangeKey]int, len(ranges))
-	for index, assigned := range ranges {
-		rangeBySourcePath[sequenceRangeKey{sourceIndex: assigned.sourceIndex, path: assigned.path.String()}] = index
+	sequencesBySource := make([][]sequenceHistoryContribution, len(inputs))
+	for _, assigned := range ranges {
+		contribution := sequenceHistoryContribution{
+			path: assigned.path.clone(), mode: sequenceHistoryAppend,
+			offset: assigned.start, length: assigned.end - assigned.start,
+		}
+		if assigned.items != nil {
+			contribution.mode = sequenceHistoryMapped
+			contribution.items = assigned.items
+		}
+		sequencesBySource[assigned.sourceIndex] = append(sequencesBySource[assigned.sourceIndex], contribution)
 	}
 	for sourceIndex, input := range inputs {
-		collectProjectedCompositionOrigins(input, Path{}, Path{}, sourceIndex, ranges, rangeBySourcePath, origins)
+		application := historyApplication{value: input, sequences: sequencesBySource[sourceIndex]}
+		application.sequencesByPath = indexSequenceHistoryContributions(application.sequences)
+		walkHistoryApplication(application, func(_, effective Path, node *document.Node) {
+			pointer := effective.String()
+			origin := origins[pointer]
+			origin.Layer = LayerBase
+			origin.Locations = append(origin.Locations, publicLocation(node.Location))
+			origins[pointer] = origin
+		})
 	}
 	return origins
 }
@@ -398,39 +548,12 @@ func indexSequenceRanges(ranges []sequenceRange) sequenceRangeIndex {
 	}
 	index := make(sequenceRangeIndex, len(ranges))
 	for _, assigned := range ranges {
+		assigned = indexSequenceRange(assigned)
 		index[sequenceRangeKey{sourceIndex: assigned.sourceIndex, path: assigned.path.String()}] = assigned
 	}
 	return index
 }
 
-// Keep local paths for matching Stage 2 ranges and effective paths for emitted
-// evidence. The paths are transformed segment by segment; pointer strings are
-// only used as map keys after projection is complete.
-func collectProjectedCompositionOrigins(node *document.Node, localPath, effectivePath Path, sourceIndex int, ranges []sequenceRange, rangeBySourcePath map[sequenceRangeKey]int, origins map[string]Origin) {
-	pointer := effectivePath.String()
-	origin := origins[pointer]
-	origin.Layer = LayerBase
-	origin.Locations = append(origin.Locations, publicLocation(node.Location))
-	origins[pointer] = origin
-
-	switch node.Kind {
-	case document.Mapping:
-		for _, entry := range node.Mapping {
-			collectProjectedCompositionOrigins(entry.Value, localPath.Key(entry.Key), effectivePath.Key(entry.Key), sourceIndex, ranges, rangeBySourcePath, origins)
-		}
-	case document.Sequence:
-		start := 0
-		if rangeIndex, ok := rangeBySourcePath[sequenceRangeKey{sourceIndex: sourceIndex, path: localPath.String()}]; ok {
-			start = ranges[rangeIndex].start
-		}
-		for index, child := range node.Sequence {
-			localChild := localPath.Index(index)
-			effectiveChild := effectivePath.Index(start + index)
-			collectProjectedCompositionOrigins(child, localChild, effectiveChild, sourceIndex, ranges, rangeBySourcePath, origins)
-		}
-	}
-}
-
 func applyCompositionOrigins(decoded *decodedConfiguration, origins map[string]Origin) {
 	for pointer, origin := range origins {
 		if _, present := decoded.presence[pointer]; present {

internal/engine/compose_test.go

@@ -10,17 +10,20 @@ import (
 )
 
 func TestComposeWideRegisteredCollectionsPreservesEvidenceAndReplay(t *testing.T) {
-	policy := sequencePolicy{identityFields: make(map[string]string)}
+	registrations := make([]sequenceIdentityRegistration, 0, 128)
 	var inputs []*document.Node
 	for source := 0; source < 3; source++ {
 		var text strings.Builder
 		for collection := 0; collection < 128; collection++ {
 			key := fmt.Sprintf("records%d", collection)
-			policy.identityFields[Keys(key).String()] = "id"
+			registrations = append(registrations, sequenceIdentityRegistration{
+				selector: sequenceIdentitySelector{literalSequenceSelector(key)}, identityFields: []string{"id"},
+			})
 			fmt.Fprintf(&text, "%s: [{id: source%d}]\n", key, source)
 		}
 		inputs = append(inputs, parseCompositionDocument(t, fmt.Sprintf("source-%d", source), text.String()))
 	}
+	policy := mustCompileSequenceIdentityPolicy(t, registrations)
 	composed, diagnostics := composeDocumentsWithPolicy(policy, inputs...)
 	if len(diagnostics) != 0 {
 		t.Fatal(diagnostics)
@@ -242,7 +245,7 @@ func TestComposeDocumentsAppendsRegisteredSequencesAndReturnsRanges(t *testing.T
 	first := parseCompositionDocument(t, "source-1", "records: [{id: '', left: 1}, {id: ' spaced ', right: 1}]\nother: [one]\n")
 	second := parseCompositionDocument(t, "source-2", "records: [{id: ' ', text: second}]\n")
 	firstBefore, secondBefore := document.Clone(first), document.Clone(second)
-	policy := sequencePolicy{identityFields: map[string]string{"/records": "id"}}
+	policy := mustCompileSequenceIdentityPolicy(t, []sequenceIdentityRegistration{{selector: sequenceIdentitySelector{literalSequenceSelector("records")}, identityFields: []string{"id"}}})
 
 	composed, diagnostics := composeDocumentsWithPolicy(policy, first, second)
 	if len(diagnostics) != 0 {
@@ -287,10 +290,10 @@ escaped/~:
       name: escaped-second-name
 `)
 	firstBefore, secondBefore := document.Clone(first), document.Clone(second)
-	policy := sequencePolicy{identityFields: map[string]string{
-		Keys("mounted", "records").String(): "id",
-		Keys("escaped/~", "7").String():     "id",
-	}}
+	policy := mustCompileSequenceIdentityPolicy(t, []sequenceIdentityRegistration{
+		{selector: sequenceIdentitySelector{literalSequenceSelector("mounted"), literalSequenceSelector("records")}, identityFields: []string{"id"}},
+		{selector: sequenceIdentitySelector{literalSequenceSelector("escaped/~"), literalSequenceSelector("7")}, identityFields: []string{"id"}},
+	})
 
 	composed, diagnostics := composeDocumentsWithPolicy(policy, first, second)
 	if len(diagnostics) != 0 {
@@ -357,6 +360,78 @@ escaped/~:
 	}
 }
 
+func TestProjectedCompositionOriginsUseNoncontiguousItemMappings(t *testing.T) {
+	lowerRoot := parseCompositionDocument(t, "lower", `records:
+  - id: first
+    label: equal
+  - id: middle
+  - id: last
+    nested: {old: lower}
+`)
+	higherRoot := parseCompositionDocument(t, "higher", `records:
+  - id: last
+    nested: {new: higher}
+  - id: first
+    label: equal
+  - id: added
+`)
+	lower, _ := documentAtPath(lowerRoot, Keys("records"))
+	higher, _ := documentAtPath(higherRoot, Keys("records"))
+	combined, diagnostics := combineSequence(
+		lower, higher, sequenceCombinationPolicy(sequenceModeUpsert, "id"),
+		sequenceCombinationContext{destination: Keys("records")},
+	)
+	if len(diagnostics) != 0 {
+		t.Fatalf("combine diagnostics = %#v", diagnostics)
+	}
+	inputs := []*document.Node{lowerRoot, higherRoot}
+	ranges := []sequenceRange{
+		{
+			sourceIndex: 0, path: Keys("records"), start: 0, end: 3,
+			items: combined.lowerItems,
+		}, {
+			sourceIndex: 1, path: Keys("records"), start: 0, end: 3,
+			items: combined.higherItems,
+		},
+	}
+	origins := projectedCompositionOrigins(inputs, ranges)
+	if got, want := sequenceIdentityValues(combined.value, "id"), []string{"first", "middle", "last", "added"}; !reflect.DeepEqual(got, want) {
+		t.Fatalf("combined IDs = %#v, want %#v", got, want)
+	}
+	for path, want := range map[string][]string{
+		"/records/0/label":      {"higher"},
+		"/records/1/id":         {"lower"},
+		"/records/2/nested/new": {"higher"},
+		"/records/3/id":         {"higher"},
+		"/records/0/nested/new": nil,
+		"/records/2/nested/old": nil,
+	} {
+		origin := origins[path]
+		var got []string
+		for _, location := range origin.Locations {
+			got = append(got, location.SourceID)
+		}
+		if !reflect.DeepEqual(got, want) {
+			t.Errorf("origin sources at %s = %#v, want %#v", path, got, want)
+		}
+	}
+}
+
+func TestCloneSequenceRangesPreservesPreparedProjection(t *testing.T) {
+	ranges := []sequenceRange{{
+		start: 0, end: 1,
+		projection: newSequenceItemProjectionIndex([]sequenceItemProjection{{inputIndex: 0, outputIndex: 4}}),
+	}}
+	cloned := cloneSequenceRanges(ranges)
+	if output, ok := cloned[0].outputForInput(0); !ok || output != 4 {
+		t.Fatalf("cloned projection = %d, %v; want output index 4", output, ok)
+	}
+	cloned[0].projection.outputByInput[0] = 9
+	if output, ok := ranges[0].outputForInput(0); !ok || output != 4 {
+		t.Fatalf("cloned projection aliases original: %d, %v", output, ok)
+	}
+}
+
 func TestComposeDocumentsValidatesRegisteredSequenceSingletons(t *testing.T) {
 	tests := []struct {
 		name     string
@@ -365,15 +440,12 @@ func TestComposeDocumentsValidatesRegisteredSequenceSingletons(t *testing.T) {
 		wantCode Code
 	}{
 		{name: "nonmapping item", body: "records: [plain]\n", path: "/records/0", wantCode: CodeComposeInvalid},
-		{name: "missing identity", body: "records: [{name: plain}]\n", path: "/records/0", wantCode: CodeComposeInvalid},
-		{name: "null identity", body: "records: [{id: null}]\n", path: "/records/0/id", wantCode: CodeComposeInvalid},
-		{name: "numeric identity", body: "records: [{id: 12}]\n", path: "/records/0/id", wantCode: CodeComposeInvalid},
-		{name: "boolean identity", body: "records: [{id: false}]\n", path: "/records/0/id", wantCode: CodeComposeInvalid},
+		{name: "missing identity", body: "records: [{name: plain}]\n", path: "/records/0/id", wantCode: CodeComposeInvalid},
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 			_, diagnostics := composeDocumentsWithPolicy(
-				sequencePolicy{identityFields: map[string]string{"/records": "id"}},
+				mustCompileSequenceIdentityPolicy(t, []sequenceIdentityRegistration{{selector: sequenceIdentitySelector{literalSequenceSelector("records")}, identityFields: []string{"id"}}}),
 				parseCompositionDocument(t, "source-1", test.body),
 			)
 			if len(diagnostics) != 1 || diagnostics[0].Code != test.wantCode || diagnostics[0].Path.String() != test.path {
@@ -386,14 +458,138 @@ func TestComposeDocumentsValidatesRegisteredSequenceSingletons(t *testing.T) {
 	}
 }
 
+func TestComposeDocumentsUsesLowerIdentityForStrictPeers(t *testing.T) {
+	path := Keys("records")
+	lower := collectionPolicyScope{collections: map[string]collectionPolicyEntry{
+		path.String(): {
+			destination: path,
+			policy:      collectionPolicy{identityFields: []string{"id"}, identityPresent: true},
+		},
+	}}
+	composed, diagnostics := composeDocumentsWithCollectionPolicy(
+		sequencePolicy{}, lower, nil,
+		parseCompositionDocument(t, "source-1", "records: [{id: first}]\n"),
+		parseCompositionDocument(t, "source-2", "records: [{id: second}]\n"),
+	)
+	if len(diagnostics) != 0 {
+		t.Fatalf("compose strict peers with lower identity: %#v", diagnostics)
+	}
+	value, present := documentAtPath(composed.root, path)
+	if !present || value.Kind != document.Sequence || len(value.Sequence) != 2 {
+		t.Fatalf("composed records = %#v, %v; want two strict peer records", value, present)
+	}
+	resolved, present := composed.collectionPolicies.collections[path.String()]
+	if !present || !resolved.policy.identityPresent || !reflect.DeepEqual(resolved.policy.identityFields, []string{"id"}) {
+		t.Fatalf("composed collection policy = %#v, %v; want retained lower identity", resolved, present)
+	}
+	clone := cloneComposedDocument(composed)
+	resolved.policy.identityFields[0] = "mutated"
+	if !reflect.DeepEqual(clone.collectionPolicies.collections[path.String()].policy.identityFields, []string{"id"}) {
+		t.Fatal("cloned composition shares mutable collection identity fields")
+	}
+}
+
+func TestComposeDocumentsResolvesDeclarationsBeforePeerComposition(t *testing.T) {
+	path := Keys("records")
+	declaration := func(source string, line int, fields ...string) sequenceDeclarationSpec {
+		location := Location{SourceID: source, Line: line}
+		return sequenceDeclarationSpec{
+			destination: path, identityFields: fields, identityPresent: true,
+			identityLocation: &location,
+		}
+	}
+
+	_, diagnostics := composeDocumentsWithCollectionPolicy(
+		sequencePolicy{}, collectionPolicyScope{},
+		[]sequenceDeclarationSpec{declaration("source-1", 2, "id"), declaration("source-2", 4, "name")},
+		parseCompositionDocument(t, "source-1", "left: true\n"),
+		parseCompositionDocument(t, "source-2", "right: true\n"),
+	)
+	if len(diagnostics) != 1 || diagnostics[0].Code != CodeSequenceConflict || diagnostics[0].Path.String() != "/records" {
+		t.Fatalf("conflicting policy-only declarations = %#v", diagnostics)
+	}
+	if diagnostics[0].Primary == nil || len(diagnostics[0].Related) != 1 {
+		t.Fatalf("declaration conflict lacks both locations: %#v", diagnostics[0])
+	}
+
+	composed, diagnostics := composeDocumentsWithCollectionPolicy(
+		sequencePolicy{}, collectionPolicyScope{},
+		[]sequenceDeclarationSpec{declaration("source-1", 2, "tenant", "id"), declaration("source-2", 4, "id", "tenant")},
+		parseCompositionDocument(t, "source-1", "records: [{tenant: true, id: null}, {tenant: \"alpha\", id: 1}]\n"),
+		parseCompositionDocument(t, "source-2", "records: [{id: 1.0, tenant: \"beta\"}, {id: \"1\", tenant: \"alpha\"}]\n"),
+	)
+	if len(diagnostics) != 0 {
+		t.Fatalf("compose normalized compound identities: %#v", diagnostics)
+	}
+	value, present := documentAtPath(composed.root, path)
+	if !present || len(value.Sequence) != 4 {
+		t.Fatalf("compound identity records = %#v, %v; want four distinct records", value, present)
+	}
+
+	_, diagnostics = composeDocumentsWithCollectionPolicy(
+		sequencePolicy{}, collectionPolicyScope{},
+		[]sequenceDeclarationSpec{declaration("source-1", 2, "id")},
+		parseCompositionDocument(t, "source-1", "records: [{id: 1}]\n"),
+		parseCompositionDocument(t, "source-2", "records: [{id: 1.0}]\n"),
+	)
+	if len(diagnostics) != 1 || diagnostics[0].Code != CodeComposeConflict || diagnostics[0].Path.String() != "/records" {
+		t.Fatalf("equivalent numeric peer identities = %#v", diagnostics)
+	}
+}
+
+func TestComposeDocumentsReplacementDoesNotBorrowLowerYAMLIdentity(t *testing.T) {
+	path := Keys("records")
+	lower := collectionPolicyScope{collections: map[string]collectionPolicyEntry{
+		path.String(): {
+			destination: path,
+			policy:      collectionPolicy{identityFields: []string{"id"}, identityPresent: true},
+		},
+	}}
+	declaration := sequenceDeclarationSpec{destination: path, mode: sequenceModeReplace, modePresent: true}
+	_, diagnostics := composeDocumentsWithCollectionPolicy(
+		sequencePolicy{}, lower, []sequenceDeclarationSpec{declaration},
+		parseCompositionDocument(t, "source-1", "records: [{name: first}]\n"),
+		parseCompositionDocument(t, "source-2", "records: [{name: second}]\n"),
+	)
+	if len(diagnostics) != 1 || diagnostics[0].Code != CodeComposeConflict || diagnostics[0].Path.String() != "/records" {
+		t.Fatalf("replacement peers borrowing lower identity = %#v", diagnostics)
+	}
+
+	identityReplacement := sequenceDeclarationSpec{
+		destination: path, identityFields: []string{"name"}, identityPresent: true,
+		mode: sequenceModeReplace, modePresent: true,
+	}
+	composed, diagnostics := composeDocumentsWithCollectionPolicy(
+		sequencePolicy{}, lower, []sequenceDeclarationSpec{identityReplacement},
+		parseCompositionDocument(t, "source-1", "records: [{name: first}]\n"),
+		parseCompositionDocument(t, "source-2", "records: [{name: second}]\n"),
+	)
+	if len(diagnostics) != 0 {
+		t.Fatalf("replacement with a new identity declaration: %#v", diagnostics)
+	}
+	resolved := composed.collectionPolicies.collections[path.String()].policy
+	if !reflect.DeepEqual(resolved.identityFields, []string{"name"}) || !resolved.identityPresent {
+		t.Fatalf("replacement collection identity = %#v; want name", resolved)
+	}
+
+	_, diagnostics = composeDocumentsWithCollectionPolicy(
+		mustCompileSequenceIdentityPolicy(t, []sequenceIdentityRegistration{{selector: sequenceIdentitySelector{literalSequenceSelector("records")}, identityFields: []string{"id"}}}), lower,
+		[]sequenceDeclarationSpec{declaration},
+		parseCompositionDocument(t, "source-1", "records: [{name: replacement}]\n"),
+	)
+	if len(diagnostics) != 1 || diagnostics[0].Code != CodeComposeInvalid || diagnostics[0].Path.String() != "/records/0/id" {
+		t.Fatalf("replacement ignored application identity constraint = %#v", diagnostics)
+	}
+}
+
 func TestComposeDocumentsReportsAssignedPathForMalformedRegisteredSequenceContribution(t *testing.T) {
 	_, diagnostics := composeDocumentsWithPolicy(
-		sequencePolicy{identityFields: map[string]string{"/records": "id"}},
+		mustCompileSequenceIdentityPolicy(t, []sequenceIdentityRegistration{{selector: sequenceIdentitySelector{literalSequenceSelector("records")}, identityFields: []string{"id"}}}),
 		parseCompositionDocument(t, "source-1", "records: [{id: first}]\n"),
 		parseCompositionDocument(t, "source-2", "records: [{name: malformed}]\n"),
 	)
-	if len(diagnostics) != 1 || diagnostics[0].Code != CodeComposeInvalid || diagnostics[0].Path.String() != "/records/1" {
-		t.Fatalf("diagnostics = %#v, want invalid item at /records/1", diagnostics)
+	if len(diagnostics) != 1 || diagnostics[0].Code != CodeComposeInvalid || diagnostics[0].Path.String() != "/records/1/id" {
+		t.Fatalf("diagnostics = %#v, want invalid identity field at /records/1/id", diagnostics)
 	}
 	if diagnostics[0].Primary == nil || diagnostics[0].Primary.SourceID != "source-2" {
 		t.Fatalf("malformed item location = %#v, want source-2", diagnostics[0].Primary)
@@ -420,7 +616,7 @@ func TestComposeDocumentsRejectsRegisteredDuplicateIdentities(t *testing.T) {
 				inputs = append(inputs, parseCompositionDocument(t, "source-2", test.second))
 			}
 			_, diagnostics := composeDocumentsWithPolicy(
-				sequencePolicy{identityFields: map[string]string{"/records": "id"}}, inputs...,
+				mustCompileSequenceIdentityPolicy(t, []sequenceIdentityRegistration{{selector: sequenceIdentitySelector{literalSequenceSelector("records")}, identityFields: []string{"id"}}}), inputs...,
 			)
 			if len(diagnostics) != 1 || diagnostics[0].Code != CodeComposeConflict || diagnostics[0].Path.String() != "/records" {
 				t.Fatalf("diagnostics = %#v, want duplicate conflict at /records", diagnostics)
@@ -438,9 +634,12 @@ func TestComposeDocumentsRejectsRegisteredDuplicateIdentities(t *testing.T) {
 }
 
 func TestComposeDocumentsSkipsMissingAndNonSequenceRegistrations(t *testing.T) {
-	policy := sequencePolicy{identityFields: map[string]string{
-		"/absent": "id", "/not-a-sequence": "id", "/catalog": "id", "/catalog/records": "id",
-	}}
+	policy := mustCompileSequenceIdentityPolicy(t, []sequenceIdentityRegistration{
+		{selector: sequenceIdentitySelector{literalSequenceSelector("absent")}, identityFields: []string{"id"}},
+		{selector: sequenceIdentitySelector{literalSequenceSelector("not-a-sequence")}, identityFields: []string{"id"}},
+		{selector: sequenceIdentitySelector{literalSequenceSelector("catalog")}, identityFields: []string{"id"}},
+		{selector: sequenceIdentitySelector{literalSequenceSelector("catalog"), literalSequenceSelector("records")}, identityFields: []string{"id"}},
+	})
 	composed, diagnostics := composeDocumentsWithPolicy(policy, parseCompositionDocument(t, "source-1", `
 not-a-sequence: null
 catalog:
@@ -454,7 +653,7 @@ catalog:
 	}
 
 	composed, diagnostics = composeDocumentsWithPolicy(
-		sequencePolicy{identityFields: map[string]string{"/records": "id"}},
+		mustCompileSequenceIdentityPolicy(t, []sequenceIdentityRegistration{{selector: sequenceIdentitySelector{literalSequenceSelector("records")}, identityFields: []string{"id"}}}),
 		parseCompositionDocument(t, "source-1", "records: []\n"),
 		parseCompositionDocument(t, "source-2", "records: []\n"),
 	)
@@ -471,7 +670,7 @@ catalog:
 
 func TestComposeDocumentsKeepsUnregisteredSequenceConflicts(t *testing.T) {
 	_, diagnostics := composeDocumentsWithPolicy(
-		sequencePolicy{identityFields: map[string]string{"/registered": "id"}},
+		mustCompileSequenceIdentityPolicy(t, []sequenceIdentityRegistration{{selector: sequenceIdentitySelector{literalSequenceSelector("registered")}, identityFields: []string{"id"}}}),
 		parseCompositionDocument(t, "source-1", "unregistered: [one]\n"),
 		parseCompositionDocument(t, "source-2", "unregistered: [two]\n"),
 	)
@@ -491,7 +690,7 @@ func TestComposeDocumentsKeepsNonSequenceRegisteredOverlapsConflicting(t *testin
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 			_, diagnostics := composeDocumentsWithPolicy(
-				sequencePolicy{identityFields: map[string]string{"/records": "id"}},
+				mustCompileSequenceIdentityPolicy(t, []sequenceIdentityRegistration{{selector: sequenceIdentitySelector{literalSequenceSelector("records")}, identityFields: []string{"id"}}}),
 				parseCompositionDocument(t, "source-1", test.first),
 				parseCompositionDocument(t, "source-2", test.second),
 			)

internal/engine/dependency_integration_test.go

@@ -0,0 +1,77 @@
+package engine
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestImportAndInheritanceIntegrationsUseEquivalentReadySchedules(t *testing.T) {
+	names := []string{"a-base", "b-independent", "z-dependent"}
+	keys := make(map[string]importNodeKey, len(names))
+	contributions := make([]acquiredContribution, len(names))
+	for index, name := range names {
+		key := importNodeKey{
+			namespaceKind: "host", namespaceAnchor: "/shared",
+			resourceKind: "file", resourcePath: "/" + name,
+		}
+		keys[name] = key
+		contributions[index] = acquiredContribution{
+			identity: key,
+			source:   SourceInfo{ID: "source-" + name, Path: name},
+		}
+	}
+
+	var want []string
+	for _, reverse := range []bool{false, true} {
+		graph := newImportInclusionGraph()
+		orderedNames := append([]string(nil), names...)
+		if reverse {
+			orderedNames[0], orderedNames[2] = orderedNames[2], orderedNames[0]
+		}
+		for _, name := range orderedNames {
+			graph.addNode(importGraphNode{key: keys[name], sourceID: "source-" + name, role: importRoleMapping})
+		}
+		graph.addEdge(keys["z-dependent"], keys["a-base"], Location{})
+
+		scheduled := scheduleContributionSlots(contributions, []int{0, 1, 2}, graph)
+		got := make([]string, len(scheduled))
+		for index, contribution := range scheduled {
+			got[index] = contribution.identity.resourcePath[1:]
+		}
+		if !reflect.DeepEqual(got, []string{"a-base", "b-independent", "z-dependent"}) {
+			t.Fatalf("import schedule reverse=%t: %v", reverse, got)
+		}
+		if !reflect.DeepEqual(
+			[]string{contributions[0].source.ID, contributions[1].source.ID, contributions[2].source.ID},
+			[]string{"source-a-base", "source-b-independent", "source-z-dependent"},
+		) {
+			t.Fatal("scheduling mutated acquisition source records")
+		}
+
+		inheritanceText := "a-base: {value: ready}\nb-independent: {value: independent}\nz-dependent: {extends: a-base}\n"
+		if reverse {
+			inheritanceText = "z-dependent: {extends: a-base}\nb-independent: {value: independent}\na-base: {value: ready}\n"
+		}
+		scope := parseCompositionDocument(t, "inheritance", inheritanceText)
+		inheritance, diagnostics := analyzeInheritanceGraph(scope, Path{})
+		if len(diagnostics) != 0 {
+			t.Fatalf("analyze inheritance reverse=%t: %#v", reverse, diagnostics)
+		}
+		order, diagnostics := inheritance.schedule()
+		if len(diagnostics) != 0 {
+			t.Fatalf("schedule inheritance reverse=%t: %#v", reverse, diagnostics)
+		}
+		inheritanceNames := make([]string, len(order))
+		for index, node := range order {
+			inheritanceNames[index] = inheritance.nodes[node].name
+		}
+		if !reflect.DeepEqual(inheritanceNames, got) {
+			t.Fatalf("equivalent graph schedules differ reverse=%t: imports=%v inheritance=%v", reverse, got, inheritanceNames)
+		}
+		if want == nil {
+			want = got
+		} else if !reflect.DeepEqual(got, want) {
+			t.Fatalf("import graph construction changed schedule: got %v, want %v", got, want)
+		}
+	}
+}

internal/engine/dependency_order.go

@@ -0,0 +1,200 @@
+package engine
+
+import (
+	"container/heap"
+	"sort"
+)
+
+// dependencyKey is an immutable tuple used to order dependency-graph nodes.
+// Callers provide unique keys and valid edge endpoints.
+type dependencyKey []string
+
+// dependencyEdge points from a prerequisite to the node that depends on it.
+type dependencyEdge struct {
+	prerequisite int
+	dependent    int
+}
+
+type dependencyReadyHeap struct {
+	nodes []int
+	keys  []dependencyKey
+}
+
+func (h dependencyReadyHeap) Len() int { return len(h.nodes) }
+
+func (h dependencyReadyHeap) Less(i, j int) bool {
+	return dependencyKeyLess(h.keys[h.nodes[i]], h.keys[h.nodes[j]])
+}
+
+func (h dependencyReadyHeap) Swap(i, j int) {
+	h.nodes[i], h.nodes[j] = h.nodes[j], h.nodes[i]
+}
+
+func (h *dependencyReadyHeap) Push(value any) {
+	h.nodes = append(h.nodes, value.(int))
+}
+
+func (h *dependencyReadyHeap) Pop() any {
+	last := len(h.nodes) - 1
+	node := h.nodes[last]
+	h.nodes = h.nodes[:last]
+	return node
+}
+
+// dependencyKeyLess compares tuple components bytewise, with a shorter tuple
+// sorting first when all of its components match the corresponding prefix.
+func dependencyKeyLess(left, right dependencyKey) bool {
+	for i := 0; i < len(left) && i < len(right); i++ {
+		if left[i] != right[i] {
+			return left[i] < right[i]
+		}
+	}
+	return len(left) < len(right)
+}
+
+// scheduleDependencies applies Kahn's algorithm, always selecting the
+// smallest currently-ready key. Duplicate edges count only once. If scheduling
+// stalls, an explicit depth-first traversal of the residual graph returns an
+// actual directed cycle, rotated to its smallest key and closed by repeating
+// its first node; blocked non-cycle dependents are excluded.
+//
+// Nodes are visited by precomputed key rank, which also makes each adjacency
+// list deterministic without sorting edges. The work is O(E + V log V), with
+// O(V + E) additional memory, apart from key copying and tuple comparisons.
+func scheduleDependencies(keys []dependencyKey, edges []dependencyEdge) (order, cycle []int) {
+	ownedKeys := make([]dependencyKey, len(keys))
+	for i, key := range keys {
+		ownedKeys[i] = append(dependencyKey(nil), key...)
+	}
+
+	nodeOrder := make([]int, len(ownedKeys))
+	for i := range nodeOrder {
+		nodeOrder[i] = i
+	}
+	sort.Slice(nodeOrder, func(i, j int) bool {
+		return dependencyKeyLess(ownedKeys[nodeOrder[i]], ownedKeys[nodeOrder[j]])
+	})
+
+	incoming := make([][]int, len(ownedKeys))
+	for _, edge := range edges {
+		incoming[edge.dependent] = append(incoming[edge.dependent], edge.prerequisite)
+	}
+
+	outgoing := make([][]int, len(ownedKeys))
+	indegree := make([]int, len(ownedKeys))
+	for _, dependent := range nodeOrder {
+		seen := make(map[int]struct{}, len(incoming[dependent]))
+		for _, prerequisite := range incoming[dependent] {
+			if _, duplicate := seen[prerequisite]; duplicate {
+				continue
+			}
+			seen[prerequisite] = struct{}{}
+			indegree[dependent]++
+			// Dependents are visited by key rank, so each outgoing list is
+			// already ordered by key.
+			outgoing[prerequisite] = append(outgoing[prerequisite], dependent)
+		}
+	}
+
+	ready := dependencyReadyHeap{keys: ownedKeys}
+	for _, node := range nodeOrder {
+		if indegree[node] == 0 {
+			ready.nodes = append(ready.nodes, node)
+		}
+	}
+	heap.Init(&ready)
+
+	order = make([]int, 0, len(ownedKeys))
+	for ready.Len() != 0 {
+		node := heap.Pop(&ready).(int)
+		order = append(order, node)
+		for _, dependent := range outgoing[node] {
+			indegree[dependent]--
+			if indegree[dependent] == 0 {
+				heap.Push(&ready, dependent)
+			}
+		}
+	}
+	if len(order) == len(ownedKeys) {
+		return order, nil
+	}
+	return nil, dependencyCycle(ownedKeys, nodeOrder, outgoing, indegree)
+}
+
+type dependencyDFSFrame struct {
+	node int
+	next int
+}
+
+// dependencyCycle searches the residual graph iteratively to avoid recursion
+// depth depending on input size.
+func dependencyCycle(keys []dependencyKey, nodeOrder []int, outgoing [][]int, indegree []int) []int {
+	const (
+		unvisited = uint8(0)
+		active    = uint8(1)
+		finished  = uint8(2)
+	)
+
+	state := make([]uint8, len(keys))
+	position := make([]int, len(keys))
+	for i := range position {
+		position[i] = -1
+	}
+	path := make([]int, 0, len(keys))
+	frames := make([]dependencyDFSFrame, 0, len(keys))
+
+	for _, root := range nodeOrder {
+		if indegree[root] == 0 || state[root] != unvisited {
+			continue
+		}
+		state[root] = active
+		position[root] = len(path)
+		path = append(path, root)
+		frames = append(frames, dependencyDFSFrame{node: root})
+
+		for len(frames) != 0 {
+			frame := &frames[len(frames)-1]
+			if frame.next == len(outgoing[frame.node]) {
+				state[frame.node] = finished
+				position[frame.node] = -1
+				path = path[:len(path)-1]
+				frames = frames[:len(frames)-1]
+				continue
+			}
+
+			next := outgoing[frame.node][frame.next]
+			frame.next++
+			if indegree[next] == 0 {
+				continue
+			}
+			switch state[next] {
+			case unvisited:
+				state[next] = active
+				position[next] = len(path)
+				path = append(path, next)
+				frames = append(frames, dependencyDFSFrame{node: next})
+			case active:
+				return canonicalDependencyCycle(keys, path[position[next]:])
+			}
+		}
+	}
+
+	// A stalled Kahn traversal always leaves a cycle in the residual graph.
+	return nil
+}
+
+func canonicalDependencyCycle(keys []dependencyKey, path []int) []int {
+	start := 0
+	for i := 1; i < len(path); i++ {
+		if dependencyKeyLess(keys[path[i]], keys[path[start]]) {
+			start = i
+		}
+	}
+
+	cycle := make([]int, len(path)+1)
+	for i := range path {
+		cycle[i] = path[(start+i)%len(path)]
+	}
+	cycle[len(path)] = cycle[0]
+	return cycle
+}

internal/engine/dependency_order_test.go

@@ -0,0 +1,215 @@
+package engine
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestScheduleDependenciesOrdersReadyNodes(t *testing.T) {
+	tests := []struct {
+		name  string
+		keys  []string
+		edges [][2]string
+		want  []string
+	}{
+		{
+			name: "independent branches",
+			keys: []string{"branch-c", "branch-a", "branch-b"},
+			want: []string{"branch-a", "branch-b", "branch-c"},
+		},
+		{
+			name: "unequal chains",
+			keys: []string{"chain-d", "chain-c", "chain-b", "chain-a"},
+			edges: [][2]string{
+				{"chain-a", "chain-b"},
+				{"chain-b", "chain-c"},
+				{"chain-c", "chain-d"},
+			},
+			want: []string{"chain-a", "chain-b", "chain-c", "chain-d"},
+		},
+		{
+			name: "multiple dependencies",
+			keys: []string{"application", "right", "base", "left"},
+			edges: [][2]string{
+				{"base", "left"}, {"base", "right"},
+				{"left", "application"}, {"right", "application"},
+			},
+			want: []string{"base", "left", "right", "application"},
+		},
+		{
+			name: "shared dependency at equal depths",
+			keys: []string{"sink", "right", "root", "left"},
+			edges: [][2]string{
+				{"root", "left"}, {"root", "right"},
+				{"left", "sink"}, {"right", "sink"},
+			},
+			want: []string{"root", "left", "right", "sink"},
+		},
+		{
+			name: "shared dependency at unequal depths",
+			keys: []string{"sink", "deep", "side", "middle", "root"},
+			edges: [][2]string{
+				{"root", "middle"}, {"middle", "deep"}, {"root", "side"},
+				{"deep", "sink"}, {"side", "sink"},
+			},
+			want: []string{"root", "middle", "deep", "side", "sink"},
+		},
+		{
+			name:  "newly ready small key precedes older large key",
+			keys:  []string{"z-ready", "a-new", "b-ready"},
+			edges: [][2]string{{"b-ready", "a-new"}},
+			want:  []string{"b-ready", "a-new", "z-ready"},
+		},
+		{
+			name: "duplicate edges count once",
+			keys: []string{"dependent", "prerequisite"},
+			edges: [][2]string{
+				{"prerequisite", "dependent"},
+				{"prerequisite", "dependent"},
+			},
+			want: []string{"prerequisite", "dependent"},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			keys, edges, indexes := dependencyGraph(test.keys, test.edges)
+			order, cycle := scheduleDependencies(keys, edges)
+			if len(cycle) != 0 {
+				t.Fatalf("unexpected cycle: %v", dependencyNames(cycle, indexes))
+			}
+			if got := dependencyNames(order, indexes); !reflect.DeepEqual(got, test.want) {
+				t.Fatalf("schedule = %v, want %v", got, test.want)
+			}
+		})
+	}
+}
+
+func TestScheduleDependenciesUsesTupleKeys(t *testing.T) {
+	keys := []dependencyKey{
+		{"a", "z"},
+		{"a"},
+		{"a", "aa"},
+		{"A"},
+	}
+	order, cycle := scheduleDependencies(keys, nil)
+	if len(cycle) != 0 {
+		t.Fatalf("unexpected cycle: %v", cycle)
+	}
+	want := []int{3, 1, 2, 0}
+	if !reflect.DeepEqual(order, want) {
+		t.Fatalf("schedule = %v, want %v", order, want)
+	}
+}
+
+func TestScheduleDependenciesReportsActualCanonicalCycles(t *testing.T) {
+	tests := []struct {
+		name  string
+		keys  []string
+		edges [][2]string
+		want  []string
+	}{
+		{
+			name:  "self cycle",
+			keys:  []string{"self"},
+			edges: [][2]string{{"self", "self"}},
+			want:  []string{"self", "self"},
+		},
+		{
+			name: "multi-node cycle excludes blocked dependent",
+			keys: []string{"blocked", "cycle-b", "cycle-a"},
+			edges: [][2]string{
+				{"cycle-a", "cycle-b"},
+				{"cycle-b", "cycle-a"},
+				{"cycle-b", "blocked"},
+			},
+			want: []string{"cycle-a", "cycle-b", "cycle-a"},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			keys, edges, indexes := dependencyGraph(test.keys, test.edges)
+			order, cycle := scheduleDependencies(keys, edges)
+			if len(order) != 0 {
+				t.Fatalf("unexpected schedule: %v", dependencyNames(order, indexes))
+			}
+			if got := dependencyNames(cycle, indexes); !reflect.DeepEqual(got, test.want) {
+				t.Fatalf("cycle = %v, want %v", got, test.want)
+			}
+		})
+	}
+}
+
+func TestScheduleDependenciesIsStableAcrossInsertionPermutations(t *testing.T) {
+	edges := [][2]string{
+		{"base", "left"}, {"base", "right"},
+		{"left", "sink"}, {"right", "sink"},
+	}
+	permutations := [][]string{
+		{"sink", "right", "base", "left"},
+		{"left", "base", "sink", "right"},
+		{"right", "left", "base", "sink"},
+	}
+	for i, permutation := range permutations {
+		keys, permutedEdges, indexes := dependencyGraph(permutation, edges)
+		if i%2 != 0 {
+			reverseDependencyEdges(permutedEdges)
+		}
+		order, cycle := scheduleDependencies(keys, permutedEdges)
+		if len(cycle) != 0 {
+			t.Fatalf("permutation %d returned cycle %v", i, dependencyNames(cycle, indexes))
+		}
+		if got, want := dependencyNames(order, indexes), []string{"base", "left", "right", "sink"}; !reflect.DeepEqual(got, want) {
+			t.Fatalf("permutation %d schedule = %v, want %v", i, got, want)
+		}
+	}
+
+	cycleEdges := [][2]string{{"b", "a"}, {"a", "b"}, {"b", "blocked"}}
+	cyclePermutations := [][]string{{"blocked", "b", "a"}, {"a", "blocked", "b"}, {"b", "a", "blocked"}}
+	for i, permutation := range cyclePermutations {
+		keys, permutedEdges, indexes := dependencyGraph(permutation, cycleEdges)
+		if i%2 != 0 {
+			reverseDependencyEdges(permutedEdges)
+		}
+		order, cycle := scheduleDependencies(keys, permutedEdges)
+		if len(order) != 0 {
+			t.Fatalf("cycle permutation %d returned schedule %v", i, dependencyNames(order, indexes))
+		}
+		if got, want := dependencyNames(cycle, indexes), []string{"a", "b", "a"}; !reflect.DeepEqual(got, want) {
+			t.Fatalf("cycle permutation %d returned %v, want %v", i, got, want)
+		}
+	}
+}
+
+func dependencyGraph(nodeNames []string, namedEdges [][2]string) ([]dependencyKey, []dependencyEdge, map[int]string) {
+	keys := make([]dependencyKey, len(nodeNames))
+	indexes := make(map[string]int, len(nodeNames))
+	for i, name := range nodeNames {
+		keys[i] = dependencyKey{name}
+		indexes[name] = i
+	}
+	edges := make([]dependencyEdge, len(namedEdges))
+	for i, edge := range namedEdges {
+		edges[i] = dependencyEdge{prerequisite: indexes[edge[0]], dependent: indexes[edge[1]]}
+	}
+	byIndex := make(map[int]string, len(nodeNames))
+	for name, index := range indexes {
+		byIndex[index] = name
+	}
+	return keys, edges, byIndex
+}
+
+func dependencyNames(nodes []int, names map[int]string) []string {
+	result := make([]string, len(nodes))
+	for i, node := range nodes {
+		result[i] = names[node]
+	}
+	return result
+}
+
+func reverseDependencyEdges(edges []dependencyEdge) {
+	for i, j := 0, len(edges)-1; i < j; i, j = i+1, j-1 {
+		edges[i], edges[j] = edges[j], edges[i]
+	}
+}

internal/engine/destination_accounting_test.go

@@ -34,7 +34,7 @@ func TestDestinationPlacementCountsAgainstSharedNodeBudget(t *testing.T) {
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 			accounting := &importAccounting{nodes: limits.nodes - perInput + test.delta}
-			composition, _, _, diagnostics := acquireUnderlayGroup(loadGroup{inputs: []loadInput{{
+			composition, _, _, diagnostics := testAcquireUnderlayGroup(loadGroup{inputs: []loadInput{{
 				source: empty, destination: destination,
 			}}}, 1, nil, accounting)
 			if test.wantError {
@@ -62,7 +62,7 @@ func TestMultipleMountedInputsSharePlacementCharges(t *testing.T) {
 	perInput := countInputNodes(&document.Node{Kind: document.Mapping}) + destinationWrapperNodeCount(Keys("collection", "one"))
 	charge := len(inputs) * perInput
 	accounting := &importAccounting{nodes: limits.nodes - charge}
-	composition, _, _, diagnostics := acquireUnderlayGroup(loadGroup{inputs: inputs}, 1, nil, accounting)
+	composition, _, _, diagnostics := testAcquireUnderlayGroup(loadGroup{inputs: inputs}, 1, nil, accounting)
 	if len(diagnostics) != 0 || composition == nil || accounting.nodes != limits.nodes || composition.inputNodes != charge {
 		t.Fatalf("shared placement accounting = %#v, %#v, accounting %#v; want charge %d", composition, diagnostics, accounting, charge)
 	}
@@ -107,7 +107,7 @@ id: parent
 	} {
 		t.Run(test.name, func(t *testing.T) {
 			accounting := &importAccounting{nodes: limits.nodes - wantNodes + test.delta}
-			composition, sources, _, diagnostics := acquireUnderlayGroup(loadGroup{inputs: []loadInput{{
+			composition, sources, _, diagnostics := testAcquireUnderlayGroup(loadGroup{inputs: []loadInput{{
 				source: File(mainPath), imports: true, destination: destination, placementMode: placementModeSequenceItem,
 			}, {
 				source: Mapping("other", map[string]any{"id": "other"}), destination: otherDestination, placementMode: placementModeSequenceItem,
@@ -160,7 +160,7 @@ func TestImportedEmptyBodiesChargeEachDestinationWrapper(t *testing.T) {
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 			accounting := &importAccounting{nodes: limits.nodes - rawNodes - placementNodes + test.delta}
-			composition, sources, _, diagnostics := acquireUnderlayGroup(loadGroup{inputs: []loadInput{{
+			composition, sources, _, diagnostics := testAcquireUnderlayGroup(loadGroup{inputs: []loadInput{{
 				source: mainSource, imports: true, destination: destination,
 			}}}, 1, nil, accounting)
 			if test.wantError {
@@ -216,9 +216,8 @@ func TestImportedEmptyBodiesChargeFullRelativeDestinations(t *testing.T) {
 			currentLimits := limits
 			currentLimits.nodes = wantNodes + test.delta
 			accounting := &importAccounting{}
-			composed, sources, diagnostics := loadImportedDocumentsTracked(
-				File(mainPath), nil, main, entryDestination, nil, currentLimits, accounting, nil, nil,
-			)
+			request := testImportRequest(File(mainPath), nil, main, entryDestination, nil, nil)
+			composed, sources, diagnostics := testAcquireImportWithAccounting(request, currentLimits, accounting)
 			if test.wantError {
 				if composed != nil || len(diagnostics) != 1 || diagnostics[0].Code != CodeImportLimitExceeded {
 					t.Fatalf("below-bound relative placement = %#v, %#v", composed, diagnostics)
@@ -279,9 +278,8 @@ func TestGlobMatchesChargeTheirSharedRelativeDestination(t *testing.T) {
 			currentLimits := limits
 			currentLimits.nodes = wantNodes + test.delta
 			accounting := &importAccounting{}
-			composed, sources, diagnostics := loadImportedDocumentsTracked(
-				File(mainPath), nil, main, entryDestination, nil, currentLimits, accounting, nil, nil,
-			)
+			request := testImportRequest(File(mainPath), nil, main, entryDestination, nil, nil)
+			composed, sources, diagnostics := testAcquireImportWithAccounting(request, currentLimits, accounting)
 			if test.wantError {
 				if composed != nil || len(diagnostics) != 1 || diagnostics[0].Code != CodeImportLimitExceeded {
 					t.Fatalf("below-bound glob placement = %#v, %#v", composed, diagnostics)
@@ -345,11 +343,11 @@ func TestAbsentOptionalImportsDoNotChargeUnusedDeepDestinations(t *testing.T) {
 	}{
 		{
 			name: "optional missing path",
-			body: "configkit: {imports: [{path: missing.yml, optional: true, destination: [unused]}]}\n",
+			body: "configkit: {imports: [{path: missing.yml, destination: [unused]}]}\n",
 		},
 		{
 			name: "optional unmatched glob",
-			body: "configkit: {imports: [{glob: empty/*.yml, optional: true, destination: [unused]}]}\n",
+			body: "configkit: {imports: [{glob: empty/*.yml, destination: [unused]}]}\n",
 			setup: func(t *testing.T, directory string) {
 				if err := os.Mkdir(filepath.Join(directory, "empty"), 0o755); err != nil {
 					t.Fatal(err)
@@ -366,9 +364,8 @@ func TestAbsentOptionalImportsDoNotChargeUnusedDeepDestinations(t *testing.T) {
 			main := parseImportMain(t, mainPath)
 			limits := defaultImportLimits()
 			accounting := &importAccounting{}
-			composed, sources, diagnostics := loadImportedDocumentsTracked(
-				File(mainPath), nil, main, destination, nil, limits, accounting, nil, nil,
-			)
+			request := testImportRequest(File(mainPath), nil, main, destination, nil, nil)
+			composed, sources, diagnostics := testAcquireImportWithAccounting(request, limits, accounting)
 			if len(diagnostics) != 0 || composed == nil || len(sources) != 1 {
 				t.Fatalf("absent optional import = %#v, %#v, %#v", composed, sources, diagnostics)
 			}
@@ -387,7 +384,7 @@ func TestNoSourceAndRootPlacementAddNoWrapperCharges(t *testing.T) {
 	t.Parallel()
 
 	accounting := &importAccounting{}
-	composition, sources, _, diagnostics := acquireUnderlayGroup(loadGroup{inputs: []loadInput{
+	composition, sources, _, diagnostics := testAcquireUnderlayGroup(loadGroup{inputs: []loadInput{
 		{source: NoSource(), destination: Keys("absent")},
 		{source: Mapping("root", map[string]any{})},
 	}}, 1, nil, accounting)
@@ -412,7 +409,7 @@ func TestSelectedOverlayAndCLIUsePlacementNodeCharges(t *testing.T) {
 			overlay:   "test", overlayFilesystem: &FilesystemContext{Root: ".", BaseDir: ".", FS: &filesystem},
 		}
 		accounting := &importAccounting{nodes: limits.nodes - baseNodes}
-		_, diagnostics := assembleLayeredInput(request, assembledInput{}, accounting)
+		_, diagnostics := testAssembleLayeredInput(request, assembledInput{}, accounting)
 		if len(diagnostics) != 1 || diagnostics[0].Code != CodeOverlayLimitExceeded {
 			t.Fatalf("overlay diagnostics = %#v", diagnostics)
 		}
@@ -431,9 +428,27 @@ func TestSelectedOverlayAndCLIUsePlacementNodeCharges(t *testing.T) {
 			overrides: []Override{override},
 		}
 		accounting := &importAccounting{nodes: limits.nodes - baseNodes - overrideNodes + 1}
-		_, diagnostics := assembleLayeredInput(request, assembledInput{}, accounting)
+		input, diagnostics := testAssembleLayeredInput(request, assembledInput{}, accounting)
+		if len(diagnostics) != 0 {
+			t.Fatalf("assembly diagnostics = %#v", diagnostics)
+		}
+		_, diagnostics = preparePostStructuralOverrides(overridePreparationInput{
+			root: input.document, inputBytes: accounting.bytes, inputNodes: accounting.nodes,
+		}, input.sources, request.overrides, nil, limits)
 		if len(diagnostics) != 1 || diagnostics[0].Code != CodeOverrideLimitExceeded {
 			t.Fatalf("override diagnostics = %#v", diagnostics)
 		}
 	})
 }
+
+func testAssembleLayeredInput[T any](request loadRequest[T], input assembledInput, accounting *importAccounting) (assembledInput, []Diagnostic) {
+	if accounting == nil {
+		accounting = &importAccounting{}
+	}
+	policy := acquisitionPolicy{
+		importDefaults: snapshotImportDefaults(request.importDefaults),
+		sequencePolicy: request.sequencePolicy,
+		importLimits:   defaultImportLimits(),
+	}
+	return assembleLayeredInput(request, input, policy, &acquisitionState{accounting: accounting, versionState: input.versionState})
+}

internal/engine/destination_import_test.go

@@ -108,8 +108,11 @@ parent: true
 	}
 	defer func() { _ = access.close() }()
 	state := importTraversal{
-		access: access, accounting: &importAccounting{}, limits: defaultImportLimits(),
-		active: make(map[resourceIdentity]int), visited: make(map[resourceIdentity]importRoute),
+		access: access,
+		policy: &acquisitionPolicy{importLimits: defaultImportLimits()},
+		state:  &acquisitionState{accounting: &importAccounting{}},
+		tier:   &tierAcquisitionState{visited: make(map[resourceIdentity]importRoute)},
+		active: make(map[resourceIdentity]int),
 	}
 	if diagnostics := state.walkDeclarations(directory, declarations, 0, Keys("entry")); len(diagnostics) != 0 {
 		t.Fatalf("walk diagnostics = %#v", diagnostics)
@@ -160,11 +163,10 @@ func TestEntryDestinationSurvivesImportSetupAndParseFailures(t *testing.T) {
 	t.Run("import context failure", func(t *testing.T) {
 		directory := t.TempDir()
 		mainPath := writeImportFile(t, directory, "main.yml", "configkit: {imports: [{path: child.yml}]}\n")
-		input, diagnostics := assembleBaseInputTracked(
-			File(mainPath),
-			Options[map[string]any]{Imports: true, Filesystem: &FilesystemContext{Root: t.TempDir()}},
-			Keys("mounted"), &importAccounting{}, nil, nil,
-		)
+		input, diagnostics := testAcquireInput(inputAcquisitionRequest{
+			input: loadInput{source: File(mainPath), imports: true, filesystem: &FilesystemContext{Root: t.TempDir()}, destination: Keys("mounted")},
+			role:  sourceVersionMain, directiveContext: rootDirectiveContextImportsOnly,
+		}, acquisitionPolicy{importLimits: defaultImportLimits()}, nil)
 		if len(diagnostics) != 1 || diagnostics[0].Code != CodeImportOutsideRoot {
 			t.Fatalf("context diagnostics = %#v", diagnostics)
 		}
@@ -177,10 +179,10 @@ func TestEntryDestinationSurvivesImportSetupAndParseFailures(t *testing.T) {
 		directory := t.TempDir()
 		mainPath := writeImportFile(t, directory, "main.yml", "configkit: {imports: [{path: broken.yml}]}\n")
 		writeImportFile(t, directory, "broken.yml", "broken: [\n")
-		input, diagnostics := assembleBaseInputTracked(
-			File(mainPath), Options[map[string]any]{Imports: true},
-			Keys("mounted"), &importAccounting{}, nil, nil,
-		)
+		input, diagnostics := testAcquireInput(inputAcquisitionRequest{
+			input: loadInput{source: File(mainPath), imports: true, destination: Keys("mounted")},
+			role:  sourceVersionMain, directiveContext: rootDirectiveContextImportsOnly,
+		}, acquisitionPolicy{importLimits: defaultImportLimits()}, nil)
 		if len(diagnostics) != 1 || diagnostics[0].Code != CodeYAMLInvalid {
 			t.Fatalf("parse diagnostics = %#v", diagnostics)
 		}
@@ -451,7 +453,6 @@ func TestLayeredImportOnlyInputMaterializesDestination(t *testing.T) {
 	mainPath := writeImportFile(t, directory, "main.yml", `configkit:
   imports:
     - path: optional.yml
-      optional: true
 `)
 	loaded, err := LoadLayered(
 		Input{Source: File(mainPath), Imports: true, Destination: Keys("collections", "empty")},

internal/engine/destination_integration_test.go

@@ -197,8 +197,8 @@ func TestLayeredItemVersionProtectionTracksAssignedPeerIndexes(t *testing.T) {
 	t.Parallel()
 
 	definition := Definition[map[string]any]{
-		Version:               &VersionRule{Path: Keys("schema", "version"), Check: func(Version, *Validation) error { return nil }},
-		sequenceRegistrations: []sequenceRegistration{{path: Keys("catalog", "entries"), identityField: "id"}},
+		Version:                       &VersionRule{Path: Keys("schema", "version"), Check: func(Version, *Validation) error { return nil }},
+		sequenceIdentityRegistrations: []sequenceIdentityRegistration{{selector: sequenceIdentitySelector{literalSequenceSelector("catalog"), literalSequenceSelector("entries")}, identityFields: []string{"id"}}},
 	}
 	item := func(label string, value map[string]any) Input {
 		return Input{Source: Mapping(label, value), Destination: Keys("catalog", "entries"), placementMode: placementModeSequenceItem}
@@ -209,7 +209,7 @@ func TestLayeredItemVersionProtectionTracksAssignedPeerIndexes(t *testing.T) {
 	main := item("main", map[string]any{"id": "main", "schema": map[string]any{"version": "v1"}})
 
 	t.Run("same assigned main path is protected", func(t *testing.T) {
-		_, err := LoadLayered(main, testSecretBinding(), options(item("underlay", map[string]any{"id": "underlay", "schema": nil})))
+		_, err := LoadLayered(main, testSecretBinding(), options(item("underlay", map[string]any{"id": "main", "schema": nil})))
 		if got := groupedErrorCode(t, err); got != CodeUnderlayVersion {
 			t.Fatalf("protected item claim code = %s, want %s", got, CodeUnderlayVersion)
 		}
@@ -224,7 +224,7 @@ func TestLayeredItemVersionProtectionTracksAssignedPeerIndexes(t *testing.T) {
 			t.Fatalf("unrelated appended peer rejected: %v", err)
 		}
 		entries := layeredMapValue(t, testLoaded(loaded).Config, "catalog", "entries").([]any)
-		if len(entries) != 1 || entries[0].(map[string]any)["id"] != "main" {
+		if len(entries) != 3 || entries[0].(map[string]any)["id"] != "first" || entries[1].(map[string]any)["id"] != "peer" || entries[2].(map[string]any)["id"] != "main" {
 			t.Fatalf("main item projection = %#v", entries)
 		}
 	})

internal/engine/directives.go

@@ -9,135 +9,104 @@ import (
 
 const directiveKey = "configkit"
 
-type importDeclaration struct {
-	path              string
-	glob              string
-	destination       Path
-	placement         placementMode
-	placementPath     Path
-	placementLocation *Location
-	optional          bool
-	location          Location
+type rootDirectiveContext uint8
+
+const (
+	rootDirectiveContextImportsOnly rootDirectiveContext = iota + 1
+	rootDirectiveContextSource
+	rootDirectiveContextOverlay
+	rootDirectiveContextLayered
+)
+
+type rootDirectiveExtraction struct {
+	body             *document.Node
+	imports          []importDeclarationSpec
+	sequences        []sequenceDeclarationSpec
+	importsPresent   bool
+	sequencesPresent bool
 }
 
-func splitImportDirectives(root *document.Node) (*document.Node, []importDeclaration, []Diagnostic) {
+func splitImportDirectives(root *document.Node) (*document.Node, []importDeclarationSpec, []Diagnostic) {
+	extracted, diagnostics := extractRootDirectives(root, rootDirectiveContextImportsOnly)
+	if len(diagnostics) != 0 {
+		return nil, nil, diagnostics
+	}
+	return extracted.body, extracted.imports, nil
+}
+
+func extractRootDirectives(root *document.Node, context rootDirectiveContext) (rootDirectiveExtraction, []Diagnostic) {
+	if root == nil {
+		return rootDirectiveExtraction{}, nil
+	}
 	body := document.Clone(root)
-	var declarations []importDeclaration
 	directiveIndex := -1
 	for index, entry := range body.Mapping {
 		if entry.Key != directiveKey {
 			continue
 		}
 		directiveIndex = index
-		parsed, diagnostics := parseImportDirective(entry.Value, Keys(directiveKey))
+		extracted, diagnostics := parseRootDirectiveBlock(entry.Value, Keys(directiveKey), context)
 		if len(diagnostics) != 0 {
-			return nil, nil, diagnostics
+			return rootDirectiveExtraction{}, diagnostics
 		}
-		declarations = parsed
-		break
-	}
-	if directiveIndex >= 0 {
-		body.Mapping = append(body.Mapping[:directiveIndex], body.Mapping[directiveIndex+1:]...)
+		extracted.body = body
+		if directiveIndex >= 0 {
+			extracted.body.Mapping = append(extracted.body.Mapping[:directiveIndex], extracted.body.Mapping[directiveIndex+1:]...)
+		}
+		if diagnostics := nestedDirectiveDiagnostics(extracted.body, Path{}); len(diagnostics) != 0 {
+			return rootDirectiveExtraction{}, diagnostics
+		}
+		return extracted, nil
 	}
 	if diagnostics := nestedDirectiveDiagnostics(body, Path{}); len(diagnostics) != 0 {
-		return nil, nil, diagnostics
+		return rootDirectiveExtraction{}, diagnostics
 	}
-	return body, declarations, nil
+	return rootDirectiveExtraction{body: body}, nil
 }
 
-func parseImportDirective(node *document.Node, directivePath Path) ([]importDeclaration, []Diagnostic) {
-	if node.Kind != document.Mapping {
-		return nil, []Diagnostic{nodeImportDiagnostic(CodeImportInvalid, directivePath, "configuration directive must be a mapping", node)}
+func parseRootDirectiveBlock(node *document.Node, directivePath Path, context rootDirectiveContext) (rootDirectiveExtraction, []Diagnostic) {
+	if node == nil || node.Kind != document.Mapping {
+		return rootDirectiveExtraction{}, []Diagnostic{nodeImportDiagnostic(CodeImportInvalid, directivePath, "configuration directive must be a mapping", node)}
 	}
-	var declarations []importDeclaration
+	var extracted rootDirectiveExtraction
+	var diagnostics []Diagnostic
 	for _, entry := range node.Mapping {
 		fieldPath := directivePath.Key(entry.Key)
-		if entry.Key != "imports" {
-			return nil, []Diagnostic{nodeImportDiagnostic(CodeImportInvalid, fieldPath, "configuration directive field is not recognized", entry.Value)}
-		}
-		if entry.Value.Kind != document.Sequence {
-			return nil, []Diagnostic{nodeImportDiagnostic(CodeImportInvalid, fieldPath, "imports must be a sequence", entry.Value)}
-		}
-		for index, item := range entry.Value.Sequence {
-			declaration, diagnostics := parseImportDeclaration(item, fieldPath.Index(index))
-			if len(diagnostics) != 0 {
-				return nil, diagnostics
-			}
-			declarations = append(declarations, declaration)
-		}
-	}
-	return declarations, nil
-}
-
-func parseImportDeclaration(node *document.Node, declarationPath Path) (importDeclaration, []Diagnostic) {
-	if node.Kind != document.Mapping {
-		return importDeclaration{}, []Diagnostic{nodeImportDiagnostic(CodeImportInvalid, declarationPath, "import declaration must be a mapping", node)}
-	}
-	declaration := importDeclaration{location: publicLocation(node.Location), placementPath: declarationPath.clone()}
-	seenTarget := false
-	for _, entry := range node.Mapping {
-		fieldPath := declarationPath.Key(entry.Key)
 		switch entry.Key {
-		case "path", "glob":
-			if seenTarget || entry.Value.Kind != document.String || entry.Value.Text == "" || strings.TrimSpace(entry.Value.Text) != entry.Value.Text {
-				return importDeclaration{}, []Diagnostic{nodeImportDiagnostic(CodeImportInvalid, fieldPath, "import declaration requires exactly one nonempty path or glob string", entry.Value)}
+		case "imports":
+			extracted.importsPresent = true
+			if context == rootDirectiveContextOverlay {
+				diagnostics = append(diagnostics, nodeImportDiagnostic(CodeOverlayDirective, fieldPath, "overlays cannot contain imports", entry.Value))
+				continue
 			}
-			seenTarget = true
-			declaration.location = publicLocation(entry.Value.Location)
-			if entry.Key == "path" {
-				declaration.path = entry.Value.Text
-			} else {
-				declaration.glob = entry.Value.Text
+			if context != rootDirectiveContextImportsOnly && context != rootDirectiveContextSource && context != rootDirectiveContextLayered {
+				diagnostics = append(diagnostics, nodeImportDiagnostic(CodeImportInvalid, fieldPath, "directive extraction context is invalid", entry.Value))
+				continue
 			}
-		case "optional":
-			if entry.Value.Kind != document.Boolean {
-				return importDeclaration{}, []Diagnostic{nodeImportDiagnostic(CodeImportInvalid, fieldPath, "optional must be a boolean", entry.Value)}
+			parsed, issues := parseImportDeclarations(entry.Value, fieldPath)
+			extracted.imports = append(extracted.imports, parsed...)
+			diagnostics = append(diagnostics, issues...)
+		case "sequences":
+			extracted.sequencesPresent = true
+			if context == rootDirectiveContextImportsOnly {
+				diagnostics = append(diagnostics, sequenceDeclarationDiagnostic(fieldPath, "sequence declarations are not enabled in this extraction context", entry.Value))
+				continue
 			}
-			declaration.optional = entry.Value.Text == "true"
-		case "destination":
-			if entry.Value.Kind != document.Sequence {
-				return importDeclaration{}, []Diagnostic{nodeImportDiagnostic(CodeImportInvalid, fieldPath, "destination must be a sequence of strings", entry.Value)}
-			}
-			relative := Path{segments: make([]pathSegment, 0, len(entry.Value.Sequence))}
-			for index, item := range entry.Value.Sequence {
-				memberPath := fieldPath.Index(index)
-				if item.Kind != document.String {
-					return importDeclaration{}, []Diagnostic{nodeImportDiagnostic(CodeImportInvalid, memberPath, "destination members must be strings", item)}
-				}
-				member := Path{segments: []pathSegment{{kind: pathSegmentKey, key: item.Text}}}
-				if _, err := normalizeDestination(member); err != nil {
-					return importDeclaration{}, []Diagnostic{nodeImportDiagnostic(CodeImportInvalid, memberPath, "destination members must be non-reserved mapping keys", item)}
-				}
-				relative.segments = append(relative.segments, pathSegment{kind: pathSegmentKey, key: item.Text})
-			}
-			normalized, err := normalizeDestination(relative)
-			if err != nil {
-				return importDeclaration{}, []Diagnostic{nodeImportDiagnostic(CodeImportInvalid, fieldPath, "destination must contain only non-reserved mapping keys", entry.Value)}
-			}
-			declaration.destination = normalized
-		case "placement":
-			declaration.placementPath = fieldPath.clone()
-			placementLocation := publicLocation(entry.Value.Location)
-			declaration.placementLocation = &placementLocation
-			if entry.Value.Kind != document.String {
-				return importDeclaration{}, []Diagnostic{nodeImportDiagnostic(CodeImportInvalid, fieldPath, "placement must be mapping or sequence-item", entry.Value)}
-			}
-			switch entry.Value.Text {
-			case "mapping":
-				declaration.placement = placementModeMapping
-			case "sequence-item":
-				declaration.placement = placementModeSequenceItem
-			default:
-				return importDeclaration{}, []Diagnostic{nodeImportDiagnostic(CodeImportInvalid, fieldPath, "placement must be mapping or sequence-item", entry.Value)}
+			if context != rootDirectiveContextSource && context != rootDirectiveContextOverlay && context != rootDirectiveContextLayered {
+				diagnostics = append(diagnostics, sequenceDeclarationDiagnostic(fieldPath, "directive extraction context is invalid", entry.Value))
+				continue
 			}
+			parsed, issues := parseSequenceDeclarationDirective(entry.Value, fieldPath)
+			extracted.sequences = append(extracted.sequences, parsed...)
+			diagnostics = append(diagnostics, issues...)
 		default:
-			return importDeclaration{}, []Diagnostic{nodeImportDiagnostic(CodeImportInvalid, fieldPath, "import declaration field is not recognized", entry.Value)}
+			diagnostics = append(diagnostics, nodeImportDiagnostic(CodeImportInvalid, fieldPath, "configuration directive field is not recognized", entry.Value))
 		}
 	}
-	if !seenTarget {
-		return importDeclaration{}, []Diagnostic{nodeImportDiagnostic(CodeImportInvalid, declarationPath, "import declaration requires exactly one path or glob", node)}
+	if len(diagnostics) != 0 {
+		return rootDirectiveExtraction{}, canonicalDiagnostics(diagnostics)
 	}
-	return declaration, nil
+	return extracted, nil
 }
 
 func nestedDirectiveDiagnostics(node *document.Node, current Path) []Diagnostic {
@@ -197,10 +166,11 @@ func fragmentVersionClaimWithIndex(root *document.Node, rule *VersionRule, sourc
 				return current
 			}
 			if assigned, found := ranges[sequenceRangeKey{sourceIndex: sourceIndex, path: currentPath.String()}]; found {
-				if index < assigned.start || index >= assigned.end {
+				projected, ok := assigned.inputForOutput(index)
+				if !ok {
 					return nil
 				}
-				index -= assigned.start
+				index = projected
 			}
 			if index < 0 || index >= len(current.Sequence) {
 				return nil
@@ -249,24 +219,28 @@ func nodeImportDiagnostic(code Code, path Path, message string, node *document.N
 	return Diagnostic{Code: code, Severity: SeverityError, Path: path, Message: message, Primary: &location}
 }
 
-func overlayDirectiveDiagnostics(node *document.Node, current Path) []Diagnostic {
+func overlayDirectiveDiagnostics(node *document.Node, current Path, allowSequences ...bool) []Diagnostic {
+	sequencesAllowed := len(allowSequences) != 0 && allowSequences[0]
 	if node.Kind == document.Mapping {
 		for _, entry := range node.Mapping {
 			childPath := current.Key(entry.Key)
 			if entry.Key == directiveKey {
+				if sequencesAllowed && len(current.segments) == 0 && entry.Value != nil && entry.Value.Kind == document.Mapping && len(entry.Value.Mapping) == 1 && entry.Value.Mapping[0].Key == "sequences" {
+					continue
+				}
 				location := publicLocation(entry.KeyLocation)
 				return []Diagnostic{{
 					Code: CodeOverlayDirective, Severity: SeverityError, Path: childPath,
-					Message: "overlays cannot contain configuration directives", Primary: &location,
+					Message: "overlays may contain only root collection sequence declarations", Primary: &location,
 				}}
 			}
-			if diagnostics := overlayDirectiveDiagnostics(entry.Value, childPath); len(diagnostics) != 0 {
+			if diagnostics := overlayDirectiveDiagnostics(entry.Value, childPath, sequencesAllowed); len(diagnostics) != 0 {
 				return diagnostics
 			}
 		}
 	} else if node.Kind == document.Sequence {
 		for index, child := range node.Sequence {
-			if diagnostics := overlayDirectiveDiagnostics(child, current.Index(index)); len(diagnostics) != 0 {
+			if diagnostics := overlayDirectiveDiagnostics(child, current.Index(index), sequencesAllowed); len(diagnostics) != 0 {
 				return diagnostics
 			}
 		}
@@ -295,3 +269,72 @@ func disabledDirectiveDiagnostics(node *document.Node, path Path) []Diagnostic {
 	}
 	return diagnostics
 }
+
+func disabledRootImportDiagnostics(node *document.Node) []Diagnostic {
+	if node == nil || node.Kind != document.Mapping {
+		return nil
+	}
+	var rootDirective *document.Node
+	var rootLocation document.Location
+	var foundRootDirective bool
+	for index := range node.Mapping {
+		if node.Mapping[index].Key == directiveKey {
+			rootDirective = node.Mapping[index].Value
+			rootLocation = node.Mapping[index].KeyLocation
+			foundRootDirective = true
+			break
+		}
+	}
+	if foundRootDirective {
+		if rootDirective == nil || rootDirective.Kind != document.Mapping {
+			return disabledDirectiveDiagnostic(rootLocation)
+		}
+		for _, directive := range rootDirective.Mapping {
+			if directive.Key == "imports" {
+				return disabledDirectiveDiagnostic(rootLocation)
+			}
+		}
+	}
+	for _, entry := range node.Mapping {
+		if entry.Key == directiveKey {
+			continue
+		}
+		if diagnostic := disabledNestedDirectiveDiagnostics(entry.Value, Path{}.Key(entry.Key)); len(diagnostic) != 0 {
+			return diagnostic
+		}
+	}
+	return nil
+}
+
+func disabledNestedDirectiveDiagnostics(node *document.Node, path Path) []Diagnostic {
+	if node.Kind == document.Mapping {
+		for _, entry := range node.Mapping {
+			childPath := path.Key(entry.Key)
+			if entry.Key == directiveKey {
+				location := Location{SourceID: entry.KeyLocation.SourceID, Line: entry.KeyLocation.Line, Column: entry.KeyLocation.Column}
+				return []Diagnostic{{
+					Code: CodeImportDisabled, Severity: SeverityError, Path: childPath,
+					Message: "configuration directives require imports to be enabled", Primary: &location,
+				}}
+			}
+			if diagnostics := disabledNestedDirectiveDiagnostics(entry.Value, childPath); len(diagnostics) != 0 {
+				return diagnostics
+			}
+		}
+	} else if node.Kind == document.Sequence {
+		for index, child := range node.Sequence {
+			if diagnostics := disabledNestedDirectiveDiagnostics(child, path.Index(index)); len(diagnostics) != 0 {
+				return diagnostics
+			}
+		}
+	}
+	return nil
+}
+
+func disabledDirectiveDiagnostic(location document.Location) []Diagnostic {
+	public := Location{SourceID: location.SourceID, Line: location.Line, Column: location.Column}
+	return []Diagnostic{{
+		Code: CodeImportDisabled, Severity: SeverityError, Path: Keys(directiveKey),
+		Message: "configuration directives require imports to be enabled", Primary: &public,
+	}}
+}

internal/engine/directory_links_test.go

@@ -0,0 +1,353 @@
+package engine
+
+import (
+	"io/fs"
+	"os"
+	"path"
+	"path/filepath"
+	"strings"
+	"testing"
+	"testing/fstest"
+	"time"
+)
+
+func TestSelectDirectoriesApplyHiddenAndFollowControls(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	for name, content := range map[string]string{
+		"direct.yaml":          "value: direct\n",
+		".private.yaml":        "value: hidden\n",
+		".private/nested.yaml": "value: hidden directory\n",
+		"target/linked.yaml":   "value: linked\n",
+		"target/source.txt":    "value: source\n",
+	} {
+		filename := filepath.Join(root, filepath.FromSlash(name))
+		if err := os.MkdirAll(filepath.Dir(filename), 0o700); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(filename, []byte(content), 0o600); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := os.Symlink("target", filepath.Join(root, "visible-alias")); err != nil {
+		t.Skipf("symlinks are unavailable: %v", err)
+	}
+	if err := os.Symlink("target/linked.yaml", filepath.Join(root, "linked-alias.txt")); err != nil {
+		t.Skipf("symlinks are unavailable: %v", err)
+	}
+	if err := os.Symlink("target/source.txt", filepath.Join(root, "selected.yaml")); err != nil {
+		t.Skipf("symlinks are unavailable: %v", err)
+	}
+	if err := os.Symlink("target", filepath.Join(root, ".hidden-alias")); err != nil {
+		t.Skipf("symlinks are unavailable: %v", err)
+	}
+
+	access, err := openHostAccess(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer access.close()
+
+	selection := selectDirectoryWithOptions(t, access, root, `    - dir: .
+      recursive: true
+      follow: false
+      hidden: false
+      pattern: '*.yaml'
+`)
+	if got, want := selectedPathsRelativeTo(selection, root), []string{"direct.yaml", "target/linked.yaml"}; !equalStrings(got, want) {
+		t.Fatalf("filtered paths = %#v, want %#v", got, want)
+	}
+	selection = selectDirectoryWithOptions(t, access, root, `    - dir: visible-alias
+      follow: false
+      pattern: '*.yaml'
+`)
+	if got, want := selectedPathsRelativeTo(selection, root), []string{"visible-alias/linked.yaml"}; !equalStrings(got, want) {
+		t.Fatalf("explicit symlink root paths = %#v, want %#v", got, want)
+	}
+
+	selection = selectDirectoryWithOptions(t, access, root, `    - dir: .
+      recursive: true
+      follow: true
+      hidden: false
+      pattern: '*.yaml'
+`)
+	if got, want := selectedPathsRelativeTo(selection, root), []string{"direct.yaml", "selected.yaml", "target/linked.yaml", "visible-alias/linked.yaml"}; !equalStrings(got, want) {
+		t.Fatalf("followed paths = %#v, want %#v", got, want)
+	}
+
+	selection = selectDirectoryWithOptions(t, access, root, `    - dir: .
+      recursive: true
+      follow: true
+      hidden: true
+      pattern: '*.yaml'
+`)
+	if got, want := selectedPathsRelativeTo(selection, root), []string{
+		".hidden-alias/linked.yaml", ".private.yaml", ".private/nested.yaml", "direct.yaml",
+		"selected.yaml", "target/linked.yaml", "visible-alias/linked.yaml",
+	}; !equalStrings(got, want) {
+		t.Fatalf("hidden-enabled paths = %#v, want %#v", got, want)
+	}
+}
+
+func TestSelectDirectoriesRejectEscapingAndCyclicLinks(t *testing.T) {
+	t.Parallel()
+
+	t.Run("escape", func(t *testing.T) {
+		root := t.TempDir()
+		outside := t.TempDir()
+		if err := os.WriteFile(filepath.Join(outside, "outside.yaml"), []byte("value: outside\n"), 0o600); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.Symlink(outside, filepath.Join(root, "escape")); err != nil {
+			t.Skipf("symlinks are unavailable: %v", err)
+		}
+		access, err := openHostAccess(root)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer access.close()
+		_, diagnostics := selectDirectoryWithDiagnostics(t, access, root, `    - dir: .
+      recursive: true
+      follow: true
+      pattern: '*.yaml'
+`)
+		if len(diagnostics) != 1 || diagnostics[0].Code != CodeImportOutsideRoot {
+			t.Fatalf("escape diagnostics = %#v, want import.outside_root", diagnostics)
+		}
+		selection := selectDirectoryWithOptions(t, access, root, `    - dir: .
+      recursive: true
+      follow: false
+      pattern: '*.yaml'
+`)
+		if len(selection.candidates) != 0 {
+			t.Fatalf("follow:false selected an escaping symlink: %#v", selection.candidates)
+		}
+	})
+
+	for _, test := range []struct {
+		name string
+	}{
+		{name: "self"},
+		{name: "ancestor"},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			root := t.TempDir()
+			if test.name == "self" {
+				if err := os.Symlink(".", filepath.Join(root, "loop")); err != nil {
+					t.Skipf("symlinks are unavailable: %v", err)
+				}
+			} else {
+				if err := os.Mkdir(filepath.Join(root, "nested"), 0o700); err != nil {
+					t.Fatal(err)
+				}
+				if err := os.Symlink("..", filepath.Join(root, "nested", "up")); err != nil {
+					t.Skipf("symlinks are unavailable: %v", err)
+				}
+			}
+			access, err := openHostAccess(root)
+			if err != nil {
+				t.Fatal(err)
+			}
+			defer access.close()
+			_, diagnostics := selectDirectoryWithDiagnostics(t, access, root, `    - dir: .
+      recursive: true
+      follow: true
+`)
+			if len(diagnostics) != 1 || diagnostics[0].Code != CodeImportCycle {
+				t.Fatalf("cycle diagnostics = %#v, want import.cycle", diagnostics)
+			}
+			if diagnostics[0].Message != "directory traversal cycle detected" {
+				t.Fatalf("cycle diagnostic exposes unexpected detail: %q", diagnostics[0].Message)
+			}
+		})
+	}
+}
+
+func TestSelectDirectoriesRetainSeparateNoncyclicAliases(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	if err := os.Mkdir(filepath.Join(root, "target"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(root, "target", "item.yaml"), []byte("value: item\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	for _, alias := range []string{"first", "second"} {
+		if err := os.Symlink("target", filepath.Join(root, alias)); err != nil {
+			t.Skipf("symlinks are unavailable: %v", err)
+		}
+	}
+	access, err := openHostAccess(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer access.close()
+
+	selection := selectDirectoryWithOptions(t, access, root, `    - dir: .
+      recursive: true
+      follow: true
+      pattern: '*.yaml'
+`)
+	want := []string{"first/item.yaml", "second/item.yaml", "target/item.yaml"}
+	if got := selectedPathsRelativeTo(selection, root); !equalStrings(got, want) {
+		t.Fatalf("alias candidates = %#v, want %#v", got, want)
+	}
+}
+
+func TestSelectDirectoriesUseNativeReadLinkCapability(t *testing.T) {
+	t.Parallel()
+
+	filesystem := &linkAwareMapFS{
+		files: fstest.MapFS{
+			"real":                &fstest.MapFile{Mode: fs.ModeDir | 0o700},
+			"real/item.yaml":      &fstest.MapFile{Data: []byte("value: item\n")},
+			"alias":               &fstest.MapFile{Mode: fs.ModeSymlink, Data: []byte("real")},
+			".hidden":             &fstest.MapFile{Mode: fs.ModeDir | 0o700},
+			".hidden/secret.yaml": &fstest.MapFile{Data: []byte("value: secret\n")},
+		},
+		links: map[string]string{"alias": "real"},
+	}
+	access := newNativeAccess(filesystem, ".", &namespaceToken{})
+	selection := selectDirectoryWithOptions(t, access, ".", `    - dir: .
+      recursive: true
+      follow: true
+      hidden: false
+      pattern: '*.yaml'
+`)
+	if got, want := selectedPaths(selection), []string{"alias/item.yaml", "real/item.yaml"}; !equalStrings(got, want) {
+		t.Fatalf("native link candidates = %#v, want %#v", got, want)
+	}
+	cyclic := &linkAwareMapFS{
+		files: fstest.MapFS{
+			"loop": &fstest.MapFile{Mode: fs.ModeSymlink, Data: []byte(".")},
+		},
+		links: map[string]string{"loop": "."},
+	}
+	_, diagnostics := selectDirectoryWithDiagnostics(t, newNativeAccess(cyclic, ".", &namespaceToken{}), ".", `    - dir: .
+      recursive: true
+      follow: true
+`)
+	if len(diagnostics) != 1 || diagnostics[0].Code != CodeImportCycle {
+		t.Fatalf("native loop diagnostics = %#v, want import.cycle", diagnostics)
+	}
+
+	plain := newNativeAccess(fstest.MapFS{"plain.yaml": &fstest.MapFile{Data: []byte("value: plain\n")}}, ".", &namespaceToken{})
+	selection = selectDirectoryWithOptions(t, plain, ".", "    - dir: .\n")
+	if got, want := selectedPaths(selection), []string{"plain.yaml"}; !equalStrings(got, want) {
+		t.Fatalf("plain native filesystem selection = %#v, want %#v", got, want)
+	}
+}
+
+func selectDirectoryWithOptions(t *testing.T, access *filesystemAccess, base, declaration string) importSelection {
+	t.Helper()
+	selection, diagnostics := selectDirectoryWithDiagnostics(t, access, base, declaration)
+	if len(diagnostics) != 0 {
+		t.Fatalf("directory selection diagnostics = %#v", diagnostics)
+	}
+	return selection
+}
+
+func selectDirectoryWithDiagnostics(t *testing.T, access *filesystemAccess, base, declaration string) (importSelection, []Diagnostic) {
+	t.Helper()
+	specs, diagnostics := parseImportSpecsYAML(t, declaration)
+	if len(diagnostics) != 0 {
+		t.Fatalf("parse diagnostics = %#v", diagnostics)
+	}
+	policy, diagnostics := resolveImportPolicy(specs[0], importDefaults{})
+	if len(diagnostics) != 0 {
+		t.Fatalf("policy diagnostics = %#v", diagnostics)
+	}
+	return selectDirectoryImportCandidates(access, base, specs[0], policy, defaultImportLimits(), &importAccounting{})
+}
+
+func selectedPaths(selection importSelection) []string {
+	paths := make([]string, 0, len(selection.candidates))
+	for _, candidate := range selection.candidates {
+		paths = append(paths, candidate.path)
+	}
+	return paths
+}
+
+func selectedPathsRelativeTo(selection importSelection, root string) []string {
+	paths := make([]string, 0, len(selection.candidates))
+	for _, candidate := range selection.candidates {
+		relative, err := filepath.Rel(root, candidate.path)
+		if err != nil {
+			paths = append(paths, candidate.path)
+			continue
+		}
+		paths = append(paths, filepath.ToSlash(relative))
+	}
+	return paths
+}
+
+func equalStrings(left, right []string) bool {
+	if len(left) != len(right) {
+		return false
+	}
+	for index := range left {
+		if left[index] != right[index] {
+			return false
+		}
+	}
+	return true
+}
+
+type linkAwareMapFS struct {
+	files fstest.MapFS
+	links map[string]string
+}
+
+func (f *linkAwareMapFS) Open(name string) (fs.File, error) {
+	resolved, err := f.resolve(name)
+	if err != nil {
+		return nil, err
+	}
+	return f.files.Open(resolved)
+}
+
+func (f *linkAwareMapFS) ReadLink(name string) (string, error) {
+	target, ok := f.links[name]
+	if !ok {
+		return "", &fs.PathError{Op: "readlink", Path: name, Err: fs.ErrInvalid}
+	}
+	return target, nil
+}
+
+func (f *linkAwareMapFS) Lstat(name string) (fs.FileInfo, error) {
+	if _, ok := f.links[name]; ok {
+		return linkMapFileInfo{name: path.Base(name)}, nil
+	}
+	return fs.Stat(f.files, name)
+}
+
+func (f *linkAwareMapFS) resolve(name string) (string, error) {
+	if !fs.ValidPath(name) {
+		return "", fs.ErrInvalid
+	}
+	resolved := ""
+	seen := make(map[string]struct{})
+	for _, segment := range strings.Split(name, "/") {
+		candidate := path.Join(resolved, segment)
+		if target, ok := f.links[candidate]; ok {
+			if _, exists := seen[candidate]; exists {
+				return "", fs.ErrInvalid
+			}
+			seen[candidate] = struct{}{}
+			candidate = path.Clean(path.Join(path.Dir(candidate), target))
+		}
+		resolved = candidate
+	}
+	return resolved, nil
+}
+
+type linkMapFileInfo struct{ name string }
+
+func (i linkMapFileInfo) Name() string     { return i.name }
+func (linkMapFileInfo) Size() int64        { return 0 }
+func (linkMapFileInfo) Mode() fs.FileMode  { return fs.ModeSymlink | 0o777 }
+func (linkMapFileInfo) ModTime() time.Time { return time.Time{} }
+func (linkMapFileInfo) IsDir() bool        { return false }
+func (linkMapFileInfo) Sys() any           { return nil }

internal/engine/directory_selection_test.go

@@ -0,0 +1,371 @@
+package engine
+
+import (
+	"io/fs"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"testing/fstest"
+)
+
+func TestSelectShallowDirectoriesUnionsRootsAndPatterns(t *testing.T) {
+	t.Parallel()
+
+	filesystem := fstest.MapFS{
+		"one":                  &fstest.MapFile{Mode: fs.ModeDir | 0o700},
+		"one/a.yaml":           &fstest.MapFile{Data: []byte("a: 1\n")},
+		"one/README":           &fstest.MapFile{Data: []byte("readme\n")},
+		"one/.hidden":          &fstest.MapFile{Data: []byte("hidden\n")},
+		"one/draft.draft.yaml": &fstest.MapFile{Data: []byte("draft\n")},
+		"one/nested/deep.yaml": &fstest.MapFile{Data: []byte("deep: 1\n")},
+		"two":                  &fstest.MapFile{Mode: fs.ModeDir | 0o700},
+		"two/a.yaml":           &fstest.MapFile{Data: []byte("a: 2\n")},
+		"three":                &fstest.MapFile{Mode: fs.ModeDir | 0o700},
+		"three/extensionless":  &fstest.MapFile{Data: []byte("plain\n")},
+	}
+	access := newNativeAccess(filesystem, ".", &namespaceToken{})
+	specs, diagnostics := parseImportSpecsYAML(t, `
+    - dir: [one, one, missing, two]
+      pattern: ['*.yaml', 'a.*', 'README']
+      exclude: '*.draft.yaml'
+      required: true
+`)
+	if len(diagnostics) != 0 {
+		t.Fatal(diagnostics)
+	}
+	policy, diagnostics := resolveImportPolicy(specs[0], importDefaults{})
+	if len(diagnostics) != 0 {
+		t.Fatal(diagnostics)
+	}
+	accounting := &importAccounting{}
+	selection, diagnostics := selectDirectoryImportCandidates(access, ".", specs[0], policy, defaultImportLimits(), accounting)
+	if len(diagnostics) != 0 {
+		t.Fatalf("selection diagnostics = %#v", diagnostics)
+	}
+	if selection.outcome != importSelectionHasCandidates || len(selection.candidates) != 3 {
+		t.Fatalf("selection = %#v, want three unioned matches", selection)
+	}
+	if selection.candidates[0].path != "one/README" || selection.candidates[1].path != "one/a.yaml" || selection.candidates[2].path != "two/a.yaml" {
+		t.Fatalf("selected paths = %#v", selection.candidates)
+	}
+	if accounting.entries != 6 {
+		t.Fatalf("entry visits = %d, want 6 entries across distinct roots", accounting.entries)
+	}
+}
+
+func TestSelectShallowDirectoriesIncludeUnrestrictedHiddenAndExtensionlessFiles(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	for name, value := range map[string]string{
+		"a.yaml":      "a: 1\n",
+		".private":    "private\n",
+		"README":      "readme\n",
+		"nested/deep": "deep\n",
+	} {
+		filename := filepath.Join(root, filepath.FromSlash(name))
+		if err := os.MkdirAll(filepath.Dir(filename), 0o700); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(filename, []byte(value), 0o600); err != nil {
+			t.Fatal(err)
+		}
+	}
+	access, err := openHostAccess(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer access.close()
+
+	specs, diagnostics := parseImportSpecsYAML(t, "    - dir: .\n")
+	if len(diagnostics) != 0 {
+		t.Fatal(diagnostics)
+	}
+	policy, diagnostics := resolveImportPolicy(specs[0], importDefaults{})
+	if len(diagnostics) != 0 {
+		t.Fatal(diagnostics)
+	}
+	selection, diagnostics := selectDirectoryImportCandidates(access, root, specs[0], policy, defaultImportLimits(), &importAccounting{})
+	if len(diagnostics) != 0 {
+		t.Fatalf("selection diagnostics = %#v", diagnostics)
+	}
+	if len(selection.candidates) != 3 {
+		t.Fatalf("selected files = %#v, want yaml, hidden, and extensionless files", selection.candidates)
+	}
+	for _, candidate := range selection.candidates {
+		if filepath.Base(candidate.path) == "deep" {
+			t.Fatalf("shallow search descended into a child directory: %#v", selection.candidates)
+		}
+	}
+}
+
+func TestSelectShallowDirectoriesApplyRequirednessToFinalUnion(t *testing.T) {
+	t.Parallel()
+
+	filesystem := fstest.MapFS{
+		"available":               &fstest.MapFile{Mode: fs.ModeDir | 0o700},
+		"available/match.yaml":    &fstest.MapFile{Data: []byte("match: true\n")},
+		"available/excluded.yaml": &fstest.MapFile{Data: []byte("excluded: true\n")},
+	}
+	access := newNativeAccess(filesystem, ".", &namespaceToken{})
+	for _, test := range []struct {
+		name      string
+		yaml      string
+		wantError bool
+		wantCount int
+	}{
+		{
+			name:      "missing root alongside a match",
+			yaml:      "    - dir: [missing, available]\n      pattern: '*.yaml'\n      exclude: excluded.yaml\n      required: true\n",
+			wantCount: 1,
+		},
+		{
+			name:      "all matches excluded",
+			yaml:      "    - dir: available\n      pattern: '*.yaml'\n      exclude: '*.yaml'\n      required: true\n",
+			wantError: true,
+		},
+		{
+			name:      "explicit empty patterns select nothing",
+			yaml:      "    - dir: available\n      pattern: []\n",
+			wantCount: 0,
+		},
+		{
+			name:      "empty search roots",
+			yaml:      "    - dir: []\n      required: true\n",
+			wantError: true,
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			specs, diagnostics := parseImportSpecsYAML(t, test.yaml)
+			if len(diagnostics) != 0 {
+				t.Fatal(diagnostics)
+			}
+			policy, diagnostics := resolveImportPolicy(specs[0], importDefaults{})
+			if len(diagnostics) != 0 {
+				t.Fatal(diagnostics)
+			}
+			selection, diagnostics := selectDirectoryImportCandidates(access, ".", specs[0], policy, defaultImportLimits(), &importAccounting{})
+			if test.wantError {
+				if len(diagnostics) != 1 || diagnostics[0].Code != CodeImportMissing {
+					t.Fatalf("diagnostics = %#v, want required empty-union error", diagnostics)
+				}
+				return
+			}
+			if len(diagnostics) != 0 || len(selection.candidates) != test.wantCount {
+				t.Fatalf("selection, diagnostics = %#v, %#v", selection, diagnostics)
+			}
+			if test.wantCount == 1 && selection.candidates[0].path != "available/match.yaml" {
+				t.Fatalf("selected path = %q, want available/match.yaml", selection.candidates[0].path)
+			}
+		})
+	}
+}
+
+func TestSelectShallowDirectoryRejectsInvalidRootInsteadOfTreatingItAsMissing(t *testing.T) {
+	t.Parallel()
+
+	filesystem := fstest.MapFS{
+		"file.yaml": &fstest.MapFile{Data: []byte("not a directory\n")},
+	}
+	access := newNativeAccess(filesystem, ".", &namespaceToken{})
+	specs, diagnostics := parseImportSpecsYAML(t, "    - dir: file.yaml\n")
+	if len(diagnostics) != 0 {
+		t.Fatal(diagnostics)
+	}
+	policy, diagnostics := resolveImportPolicy(specs[0], importDefaults{})
+	if len(diagnostics) != 0 {
+		t.Fatal(diagnostics)
+	}
+	_, diagnostics = selectDirectoryImportCandidates(access, ".", specs[0], policy, defaultImportLimits(), &importAccounting{})
+	if len(diagnostics) != 1 || diagnostics[0].Code != CodeImportInvalid {
+		t.Fatalf("invalid-root diagnostics = %#v", diagnostics)
+	}
+
+	denied := &statOnlyImportFilesystem{statErrors: map[string]error{"denied": fs.ErrPermission}}
+	access = newNativeAccess(denied, ".", &namespaceToken{})
+	specs, diagnostics = parseImportSpecsYAML(t, "    - dir: denied\n")
+	if len(diagnostics) != 0 {
+		t.Fatal(diagnostics)
+	}
+	policy, diagnostics = resolveImportPolicy(specs[0], importDefaults{})
+	if len(diagnostics) != 0 {
+		t.Fatal(diagnostics)
+	}
+	_, diagnostics = selectDirectoryImportCandidates(access, ".", specs[0], policy, defaultImportLimits(), &importAccounting{})
+	if len(diagnostics) != 1 || diagnostics[0].Code != CodeImportInvalid {
+		t.Fatalf("inaccessible-root diagnostics = %#v", diagnostics)
+	}
+}
+
+func TestSelectShallowDirectoryFiltersSymlinkAliasSpelling(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	if err := os.WriteFile(filepath.Join(root, "welcome.yaml"), []byte("welcome: true\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink("welcome.yaml", filepath.Join(root, "welcome.draft.yaml")); err != nil {
+		t.Skipf("symlinks are unavailable: %v", err)
+	}
+	access, err := openHostAccess(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer access.close()
+
+	specs, diagnostics := parseImportSpecsYAML(t, "    - dir: .\n      pattern: '*.yaml'\n      exclude: '*.draft.yaml'\n")
+	if len(diagnostics) != 0 {
+		t.Fatal(diagnostics)
+	}
+	policy, diagnostics := resolveImportPolicy(specs[0], importDefaults{})
+	if len(diagnostics) != 0 {
+		t.Fatal(diagnostics)
+	}
+	selection, diagnostics := selectDirectoryImportCandidates(access, root, specs[0], policy, defaultImportLimits(), &importAccounting{})
+	if len(diagnostics) != 0 || len(selection.candidates) != 1 || filepath.Base(selection.candidates[0].path) != "welcome.yaml" {
+		t.Fatalf("alias filtering selection, diagnostics = %#v, %#v", selection, diagnostics)
+	}
+}
+
+func TestSelectDirectoriesApplyRecursiveDepthToFileLevels(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	for name := range map[string]struct{}{
+		"direct.yaml":            {},
+		"child/child.yaml":       {},
+		"child/grand/grand.yaml": {},
+	} {
+		filename := filepath.Join(root, filepath.FromSlash(name))
+		if err := os.MkdirAll(filepath.Dir(filename), 0o700); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(filename, []byte("value: true\n"), 0o600); err != nil {
+			t.Fatal(err)
+		}
+	}
+	access, err := openHostAccess(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer access.close()
+
+	for _, test := range []struct {
+		name      string
+		yaml      string
+		defaults  importDefaults
+		wantPaths []string
+	}{
+		{
+			name:      "depth one includes direct files",
+			yaml:      "    - dir: .\n      recursive: true\n      depth: 1\n      pattern: '*.yaml'\n",
+			wantPaths: []string{"direct.yaml"},
+		},
+		{
+			name:      "depth two includes one descendant level",
+			yaml:      "    - dir: .\n      recursive: true\n      depth: 2\n      pattern: '*.yaml'\n",
+			wantPaths: []string{"child.yaml", "direct.yaml"},
+		},
+		{
+			name:      "zero depth is unlimited",
+			yaml:      "    - dir: .\n      recursive: true\n      depth: 0\n      pattern: '*.yaml'\n",
+			wantPaths: []string{"child.yaml", "grand.yaml", "direct.yaml"},
+		},
+		{
+			name:      "recursion stays disabled by default",
+			yaml:      "    - dir: .\n      pattern: '*.yaml'\n",
+			wantPaths: []string{"direct.yaml"},
+		},
+		{
+			name:      "explicit false overrides application recursion",
+			yaml:      "    - dir: .\n      recursive: false\n      pattern: '*.yaml'\n",
+			defaults:  importDefaults{recursive: boolPointer(true)},
+			wantPaths: []string{"direct.yaml"},
+		},
+		{
+			name:      "application default enables recursion for depth",
+			yaml:      "    - dir: .\n      depth: 2\n      pattern: '*.yaml'\n",
+			defaults:  importDefaults{recursive: boolPointer(true)},
+			wantPaths: []string{"child.yaml", "direct.yaml"},
+		},
+		{
+			name:      "large depth remains a valid unlimited traversal bound",
+			yaml:      "    - dir: .\n      recursive: true\n      depth: 999999999999999999999999999999\n      pattern: '*.yaml'\n",
+			wantPaths: []string{"child.yaml", "grand.yaml", "direct.yaml"},
+		},
+		{
+			name:      "filename filter does not prune directories",
+			yaml:      "    - dir: .\n      recursive: true\n      depth: 3\n      pattern: grand.yaml\n",
+			wantPaths: []string{"grand.yaml"},
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			specs, diagnostics := parseImportSpecsYAML(t, test.yaml)
+			if len(diagnostics) != 0 {
+				t.Fatal(diagnostics)
+			}
+			policy, diagnostics := resolveImportPolicy(specs[0], test.defaults)
+			if len(diagnostics) != 0 {
+				t.Fatal(diagnostics)
+			}
+			selection, diagnostics := selectDirectoryImportCandidates(access, root, specs[0], policy, defaultImportLimits(), &importAccounting{})
+			if len(diagnostics) != 0 {
+				t.Fatalf("selection diagnostics = %#v", diagnostics)
+			}
+			var got []string
+			for _, candidate := range selection.candidates {
+				got = append(got, filepath.Base(candidate.path))
+			}
+			if strings.Join(got, ",") != strings.Join(test.wantPaths, ",") {
+				t.Fatalf("selected basenames = %#v, want %#v", got, test.wantPaths)
+			}
+		})
+	}
+}
+
+func TestSelectDirectoriesRetainsEmptySearchAndDirectoryVisitLimits(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	for _, name := range []string{"direct.yaml", "child/child.yaml", "child/grand/grand.yaml"} {
+		filename := filepath.Join(root, filepath.FromSlash(name))
+		if err := os.MkdirAll(filepath.Dir(filename), 0o700); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(filename, []byte("value: true\n"), 0o600); err != nil {
+			t.Fatal(err)
+		}
+	}
+	access, err := openHostAccess(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer access.close()
+
+	specs, diagnostics := parseImportSpecsYAML(t, "    - dir: .\n      recursive: true\n      pattern: []\n")
+	if len(diagnostics) != 0 {
+		t.Fatal(diagnostics)
+	}
+	policy, diagnostics := resolveImportPolicy(specs[0], importDefaults{})
+	if len(diagnostics) != 0 {
+		t.Fatal(diagnostics)
+	}
+	accounting := &importAccounting{}
+	selection, diagnostics := selectDirectoryImportCandidates(access, root, specs[0], policy, defaultImportLimits(), accounting)
+	if len(diagnostics) != 0 || selection.outcome != importSelectionNone || len(selection.candidates) != 0 {
+		t.Fatalf("empty recursive selection, diagnostics = %#v, %#v", selection, diagnostics)
+	}
+	if accounting.entries != 5 {
+		t.Fatalf("empty search visited %d entries, want all 5 within the recursive search", accounting.entries)
+	}
+
+	limited := defaultImportLimits()
+	limited.entries = 2
+	_, diagnostics = selectDirectoryImportCandidates(access, root, specs[0], policy, limited, &importAccounting{})
+	if len(diagnostics) != 1 || diagnostics[0].Code != CodeImportLimitExceeded {
+		t.Fatalf("directory limit diagnostics = %#v", diagnostics)
+	}
+}
+
+func boolPointer(value bool) *bool { return &value }

internal/engine/directory_walk.go

@@ -0,0 +1,32 @@
+package engine
+
+import (
+	"errors"
+	"io/fs"
+)
+
+var errImportDirectoryEntryLimit = errors.New("import directory-entry visit limit reached")
+
+// visitBoundedImportDirectory shares entry accounting across directory and glob searches.
+func visitBoundedImportDirectory(access *filesystemAccess, directory string, limit int, accounting *importAccounting, visit func(fs.DirEntry) error) error {
+	if accounting == nil {
+		accounting = &importAccounting{}
+	}
+	var visitError error
+	err := access.readDirectory(directory, func(entry fs.DirEntry) bool {
+		accounting.entries++
+		if accounting.entries > limit {
+			visitError = errImportDirectoryEntryLimit
+			return false
+		}
+		if err := visit(entry); err != nil {
+			visitError = err
+			return false
+		}
+		return true
+	})
+	if visitError != nil {
+		return visitError
+	}
+	return err
+}

internal/engine/discovery.go

@@ -0,0 +1,540 @@
+package engine
+
+import (
+	"errors"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+)
+
+// Search is an immutable ordered description of possible host-file inputs.
+// It does not access the filesystem until a later loading integration consumes it.
+type Search struct {
+	entries []searchEntry
+	issues  []string
+}
+
+// FilenameGroup is an immutable ordered group used by a directory search.
+type FilenameGroup struct {
+	kind   filenameGroupKind
+	names  []string
+	issues []string
+}
+
+// DirectorySearchOptions controls the filename groups used by SearchDirectory.
+// A nil Filenames slice selects the default groups; a non-nil empty slice selects none.
+type DirectorySearchOptions struct {
+	Filenames []FilenameGroup
+}
+
+// SearchOptions controls whether a later source consumption requires a match.
+type SearchOptions struct {
+	Required bool
+}
+
+// SearchConfig creates a source that selects the first matching host file when
+// consumed. Description and option errors are reported during loading.
+func SearchConfig(application string, search Search, supplied ...SearchOptions) Source {
+	captured := Search{entries: cloneSearchEntries(search.entries), issues: append([]string(nil), search.issues...)}
+	source := Source{kind: sourceSearch, search: &captured, searchApp: application}
+	if len(supplied) > 1 {
+		source.searchIssues = []string{"SearchConfig accepts at most one options value"}
+	} else if len(supplied) == 1 {
+		source.searchRequired = supplied[0].Required
+	}
+	return source
+}
+
+type filenameGroupKind uint8
+
+const (
+	filenameGroupEmpty filenameGroupKind = iota
+	filenameGroupNamed
+	filenameGroupGeneric
+	filenameGroupCustom
+)
+
+type searchEntryKind uint8
+
+const (
+	searchEntryPath searchEntryKind = iota + 1
+	searchEntryDirectory
+)
+
+type directoryBaseKind uint8
+
+const (
+	directoryBaseLiteral directoryBaseKind = iota
+	directoryBaseUnixLocal
+	directoryBaseUnixEtc
+	directoryBaseUserConfig
+	directoryBaseHome
+	directoryBaseWorking
+)
+
+type searchEntry struct {
+	kind       searchEntryKind
+	path       string
+	baseKind   directoryBaseKind
+	directory  string
+	appendSlug bool
+	slugPrefix string
+	filenames  []FilenameGroup
+}
+
+// NamedFilenames selects <application>.yml followed by <application>.yaml.
+func NamedFilenames() FilenameGroup {
+	return FilenameGroup{kind: filenameGroupNamed}
+}
+
+// GenericFilenames selects config.yml, config.yaml, main.yml, and main.yaml.
+func GenericFilenames() FilenameGroup {
+	return FilenameGroup{kind: filenameGroupGeneric}
+}
+
+// CustomFilenames selects literal filename components in the supplied order.
+func CustomFilenames(names ...string) FilenameGroup {
+	group := FilenameGroup{kind: filenameGroupCustom, names: append([]string(nil), names...)}
+	for _, name := range group.names {
+		if !validFilenameComponent(name) {
+			group.issues = append(group.issues, "custom filename must be a usable host filename component")
+		}
+	}
+	return group
+}
+
+// SearchDirectory searches the supplied directory using the selected filename groups.
+// With omitted options or nil Filenames, it selects Named then Generic filenames.
+func SearchDirectory(directory string, supplied ...DirectorySearchOptions) Search {
+	search := Search{}
+	if len(supplied) > 1 {
+		search.issues = append(search.issues, "directory search accepts at most one options value")
+	}
+	var groups []FilenameGroup
+	if len(supplied) == 0 || supplied[0].Filenames == nil {
+		groups = []FilenameGroup{NamedFilenames(), GenericFilenames()}
+	} else {
+		groups = cloneFilenameGroups(supplied[0].Filenames)
+	}
+	search.entries = append(search.entries, searchEntry{
+		kind: searchEntryDirectory, baseKind: directoryBaseLiteral,
+		directory: directory, filenames: groups,
+	})
+	return search
+}
+
+// Paths describes literal host-file candidates in the supplied order.
+func Paths(paths ...string) Search {
+	search := Search{entries: make([]searchEntry, 0, len(paths))}
+	for _, path := range append([]string(nil), paths...) {
+		search.entries = append(search.entries, searchEntry{kind: searchEntryPath, path: path})
+	}
+	return search
+}
+
+// Searches concatenates descriptions in order and snapshots their entries.
+func Searches(searches ...Search) Search {
+	result := Search{}
+	for _, search := range append([]Search(nil), searches...) {
+		result.entries = append(result.entries, cloneSearchEntries(search.entries)...)
+		result.issues = append(result.issues, search.issues...)
+	}
+	return result
+}
+
+// UnixSystemDirectories describes the conventional Unix system directories.
+func UnixSystemDirectories() Search {
+	namedGeneric := []FilenameGroup{NamedFilenames(), GenericFilenames()}
+	return Search{entries: []searchEntry{
+		{kind: searchEntryDirectory, baseKind: directoryBaseUnixLocal, appendSlug: true, filenames: cloneFilenameGroups(namedGeneric)},
+		{kind: searchEntryDirectory, baseKind: directoryBaseUnixEtc, appendSlug: true, filenames: cloneFilenameGroups(namedGeneric)},
+		{kind: searchEntryDirectory, baseKind: directoryBaseUnixEtc, filenames: []FilenameGroup{NamedFilenames()}},
+	}}
+}
+
+// UserConfigDirectory describes the Go user-configuration directory searches.
+func UserConfigDirectory() Search {
+	return Search{entries: []searchEntry{
+		{kind: searchEntryDirectory, baseKind: directoryBaseUserConfig, appendSlug: true, filenames: defaultFilenameGroups()},
+		{kind: searchEntryDirectory, baseKind: directoryBaseUserConfig, filenames: []FilenameGroup{NamedFilenames()}},
+	}}
+}
+
+// HomeDirectory describes the Go home-directory searches.
+func HomeDirectory() Search {
+	return Search{entries: []searchEntry{
+		{kind: searchEntryDirectory, baseKind: directoryBaseHome, appendSlug: true, slugPrefix: ".", filenames: defaultFilenameGroups()},
+		{kind: searchEntryDirectory, baseKind: directoryBaseHome, filenames: []FilenameGroup{NamedFilenames()}},
+	}}
+}
+
+// WorkingDirectory describes application-named files in the current directory.
+func WorkingDirectory() Search {
+	return Search{entries: []searchEntry{{
+		kind: searchEntryDirectory, baseKind: directoryBaseWorking,
+		filenames: []FilenameGroup{NamedFilenames()},
+	}}}
+}
+
+func defaultFilenameGroups() []FilenameGroup {
+	return []FilenameGroup{NamedFilenames(), GenericFilenames()}
+}
+
+func cloneFilenameGroups(groups []FilenameGroup) []FilenameGroup {
+	if groups == nil {
+		return nil
+	}
+	cloned := make([]FilenameGroup, len(groups))
+	for i, group := range groups {
+		cloned[i] = FilenameGroup{
+			kind: group.kind, names: append([]string(nil), group.names...),
+			issues: append([]string(nil), group.issues...),
+		}
+	}
+	return cloned
+}
+
+func cloneSearchEntries(entries []searchEntry) []searchEntry {
+	if entries == nil {
+		return nil
+	}
+	cloned := make([]searchEntry, len(entries))
+	for i, entry := range entries {
+		cloned[i] = entry
+		cloned[i].filenames = cloneFilenameGroups(entry.filenames)
+	}
+	return cloned
+}
+
+func validateSearch(search Search, application string) []Diagnostic {
+	var diagnostics []Diagnostic
+	for _, issue := range search.issues {
+		diagnostics = append(diagnostics, optionDiagnostic(CodeOptionsInvalid, issue))
+	}
+	slugNeeded := false
+	for _, entry := range search.entries {
+		switch entry.kind {
+		case searchEntryPath:
+			if entry.path == "" {
+				diagnostics = append(diagnostics, optionDiagnostic(CodeOptionsInvalid, "search path must not be empty"))
+			}
+		case searchEntryDirectory:
+			if entry.baseKind == directoryBaseLiteral && entry.directory == "" {
+				diagnostics = append(diagnostics, optionDiagnostic(CodeOptionsInvalid, "directory search path must not be empty"))
+			}
+			if entry.appendSlug {
+				slugNeeded = true
+			}
+			for _, group := range entry.filenames {
+				switch group.kind {
+				case filenameGroupEmpty, filenameGroupGeneric:
+				case filenameGroupNamed:
+					slugNeeded = true
+				case filenameGroupCustom:
+				default:
+					diagnostics = append(diagnostics, optionDiagnostic(CodeOptionsInvalid, "filename group is invalid"))
+				}
+				for _, issue := range group.issues {
+					diagnostics = append(diagnostics, optionDiagnostic(CodeOptionsInvalid, issue))
+				}
+			}
+		default:
+			diagnostics = append(diagnostics, optionDiagnostic(CodeOptionsInvalid, "search description is invalid"))
+		}
+	}
+	if slugNeeded && !validFilenameComponent(application) {
+		diagnostics = append(diagnostics, optionDiagnostic(CodeOptionsInvalid, "application name must be a usable host filename component"))
+	}
+	return canonicalDiagnostics(diagnostics)
+}
+
+func validFilenameComponent(value string) bool {
+	if value == "" || value == "." || value == ".." || strings.IndexByte(value, 0) >= 0 {
+		return false
+	}
+	if filepath.IsAbs(value) || filepath.VolumeName(value) != "" || filepath.Base(value) != value {
+		return false
+	}
+	if runtime.GOOS == "windows" {
+		if !filepath.IsLocal(value) || strings.ContainsAny(value, `<>:"|?*`) || strings.HasSuffix(value, ".") || strings.HasSuffix(value, " ") {
+			return false
+		}
+		for _, character := range value {
+			if character < 32 {
+				return false
+			}
+		}
+	}
+	return true
+}
+
+var errUnixSystemPresetUnavailable = errors.New("Unix system directories are unavailable on this platform")
+
+type discoveryDirectoryHelpers struct {
+	userConfigDir func() (string, error)
+	userHomeDir   func() (string, error)
+	workingDir    func() (string, error)
+	unixSupported func() bool
+}
+
+type searchCandidateIterator struct {
+	search      Search
+	application string
+	helpers     discoveryDirectoryHelpers
+	entryIndex  int
+	groupIndex  int
+	nameIndex   int
+	directory   string
+	dirReady    bool
+}
+
+func newSearchCandidateIterator(search Search, application string, helpers discoveryDirectoryHelpers) (*searchCandidateIterator, []Diagnostic) {
+	if diagnostics := validateSearch(search, application); len(diagnostics) != 0 {
+		return nil, diagnostics
+	}
+	defaults := defaultDiscoveryDirectoryHelpers()
+	if helpers.userConfigDir == nil {
+		helpers.userConfigDir = defaults.userConfigDir
+	}
+	if helpers.userHomeDir == nil {
+		helpers.userHomeDir = defaults.userHomeDir
+	}
+	if helpers.workingDir == nil {
+		helpers.workingDir = defaults.workingDir
+	}
+	if helpers.unixSupported == nil {
+		helpers.unixSupported = defaults.unixSupported
+	}
+	return &searchCandidateIterator{search: search, application: application, helpers: helpers}, nil
+}
+
+func defaultDiscoveryDirectoryHelpers() discoveryDirectoryHelpers {
+	return discoveryDirectoryHelpers{
+		userConfigDir: os.UserConfigDir,
+		userHomeDir:   os.UserHomeDir,
+		workingDir:    os.Getwd,
+		unixSupported: unixSystemPresetSupported,
+	}
+}
+
+// next expands one candidate at a time, resolving only the directory currently
+// reached. Directory filenames are visited before moving to the next directory.
+func (iterator *searchCandidateIterator) next() (string, bool, error) {
+	for {
+		if iterator.dirReady {
+			entry := iterator.search.entries[iterator.entryIndex]
+			for iterator.groupIndex < len(entry.filenames) {
+				group := entry.filenames[iterator.groupIndex]
+				count := filenameGroupLength(group)
+				if iterator.nameIndex < count {
+					name := filenameGroupAt(group, iterator.nameIndex, iterator.application)
+					iterator.nameIndex++
+					return filepath.Join(iterator.directory, name), true, nil
+				}
+				iterator.groupIndex++
+				iterator.nameIndex = 0
+			}
+			iterator.dirReady = false
+			iterator.entryIndex++
+		}
+		if iterator.entryIndex >= len(iterator.search.entries) {
+			return "", false, nil
+		}
+		entry := iterator.search.entries[iterator.entryIndex]
+		if entry.kind == searchEntryPath {
+			iterator.entryIndex++
+			path, err := iterator.absoluteCandidate(entry.path)
+			if err != nil {
+				return "", false, err
+			}
+			return path, true, nil
+		}
+		if !directoryHasCandidates(entry.filenames) {
+			iterator.entryIndex++
+			continue
+		}
+		directory, err := iterator.resolveDirectory(entry)
+		if err != nil {
+			return "", false, err
+		}
+		iterator.directory = directory
+		iterator.groupIndex = 0
+		iterator.nameIndex = 0
+		iterator.dirReady = true
+	}
+}
+
+func (iterator *searchCandidateIterator) absoluteCandidate(path string) (string, error) {
+	if filepath.IsAbs(path) {
+		return filepath.Clean(path), nil
+	}
+	// Drive-relative and drive-root-relative Windows paths need native
+	// resolution; joining a rooted path to the whole working directory changes it.
+	if filepath.VolumeName(path) != "" || runtime.GOOS == "windows" && len(path) > 0 && os.IsPathSeparator(path[0]) {
+		return filepath.Abs(path)
+	}
+	working, err := iterator.helpers.workingDir()
+	if err != nil {
+		return "", err
+	}
+	return filepath.Clean(filepath.Join(working, path)), nil
+}
+
+func (iterator *searchCandidateIterator) resolveDirectory(entry searchEntry) (string, error) {
+	var base string
+	switch entry.baseKind {
+	case directoryBaseLiteral:
+		base = entry.directory
+	case directoryBaseUnixLocal:
+		if !iterator.helpers.unixSupported() {
+			return "", errUnixSystemPresetUnavailable
+		}
+		base = "/usr/local/etc"
+	case directoryBaseUnixEtc:
+		if !iterator.helpers.unixSupported() {
+			return "", errUnixSystemPresetUnavailable
+		}
+		base = "/etc"
+	case directoryBaseUserConfig:
+		var err error
+		base, err = iterator.helpers.userConfigDir()
+		if err != nil {
+			return "", err
+		}
+	case directoryBaseHome:
+		var err error
+		base, err = iterator.helpers.userHomeDir()
+		if err != nil {
+			return "", err
+		}
+	case directoryBaseWorking:
+		var err error
+		base, err = iterator.helpers.workingDir()
+		if err != nil {
+			return "", err
+		}
+	default:
+		return "", errors.New("directory search base is invalid")
+	}
+	if entry.appendSlug {
+		base = filepath.Join(base, entry.slugPrefix+iterator.application)
+	}
+	if entry.baseKind == directoryBaseLiteral && !filepath.IsAbs(base) {
+		return iterator.absoluteCandidate(base)
+	}
+	return filepath.Clean(base), nil
+}
+
+func directoryHasCandidates(groups []FilenameGroup) bool {
+	for _, group := range groups {
+		if filenameGroupLength(group) != 0 {
+			return true
+		}
+	}
+	return false
+}
+
+func filenameGroupLength(group FilenameGroup) int {
+	switch group.kind {
+	case filenameGroupNamed:
+		return 2
+	case filenameGroupGeneric:
+		return 4
+	case filenameGroupCustom:
+		return len(group.names)
+	default:
+		return 0
+	}
+}
+
+func filenameGroupAt(group FilenameGroup, index int, application string) string {
+	switch group.kind {
+	case filenameGroupNamed:
+		if index == 0 {
+			return application + ".yml"
+		}
+		return application + ".yaml"
+	case filenameGroupGeneric:
+		return [...]string{"config.yml", "config.yaml", "main.yml", "main.yaml"}[index]
+	case filenameGroupCustom:
+		return group.names[index]
+	default:
+		return ""
+	}
+}
+
+type discoveryHostProbe struct {
+	evalSymlinks func(string) (string, error)
+	stat         func(string) (fs.FileInfo, error)
+}
+
+func defaultDiscoveryHostProbe() discoveryHostProbe {
+	return discoveryHostProbe{evalSymlinks: filepath.EvalSymlinks, stat: os.Stat}
+}
+
+// resolveSearchInput associates a terminal candidate failure with the same file
+// evidence as ordinary acquisition. Exhaustion and base failures have no file.
+func resolveSearchInput(source Source, sourceID string, helpers discoveryDirectoryHelpers, probe discoveryHostProbe) (Source, *SourceInfo, []Diagnostic) {
+	selected, diagnostics := resolveSearchSource(source, source.search, source.searchApp, source.searchRequired, helpers, probe)
+	if len(diagnostics) == 0 || selected.kind != sourceFile {
+		return selected, nil, diagnostics
+	}
+	info := &SourceInfo{ID: sourceID, Label: selected.label, Path: selected.path, Layer: LayerBase, Kind: SourceKindFile}
+	for index := range diagnostics {
+		diagnostics[index].Primary = &Location{SourceID: sourceID}
+	}
+	return selected, info, diagnostics
+}
+
+// resolveSearchSource selects one ordinary file source. A nil description leaves
+// an existing source untouched; the selected file is read later by readSource.
+// A terminal candidate failure returns its file descriptor for error evidence.
+func resolveSearchSource(source Source, description *Search, application string, required bool, helpers discoveryDirectoryHelpers, probe discoveryHostProbe) (Source, []Diagnostic) {
+	if description == nil {
+		return source, nil
+	}
+	iterator, diagnostics := newSearchCandidateIterator(*description, application, helpers)
+	if len(diagnostics) != 0 {
+		return Source{}, diagnostics
+	}
+	defaults := defaultDiscoveryHostProbe()
+	if probe.evalSymlinks == nil {
+		probe.evalSymlinks = defaults.evalSymlinks
+	}
+	if probe.stat == nil {
+		probe.stat = defaults.stat
+	}
+	for {
+		candidate, ok, err := iterator.next()
+		if err != nil {
+			if errors.Is(err, errUnixSystemPresetUnavailable) {
+				return Source{}, []Diagnostic{optionDiagnostic(CodeOptionsInvalid, "Unix system directory search is unavailable on this platform")}
+			}
+			return Source{}, []Diagnostic{classifySourceError(err, "")}
+		}
+		if !ok {
+			if required {
+				return Source{}, []Diagnostic{sourceDiagnostic(CodeSourceMissing, "", "required configuration search found no file")}
+			}
+			return NoSource(), nil
+		}
+		canonical, err := probe.evalSymlinks(candidate)
+		if err != nil {
+			if errors.Is(err, fs.ErrNotExist) {
+				continue
+			}
+			return File(candidate), []Diagnostic{classifySourceError(err, "")}
+		}
+		if _, err := probe.stat(canonical); err != nil {
+			if errors.Is(err, fs.ErrNotExist) {
+				continue
+			}
+			failed := File(candidate)
+			failed.path = canonical
+			return failed, []Diagnostic{classifySourceError(err, "")}
+		}
+		return File(candidate), nil
+	}
+}

internal/engine/discovery_load_test.go

@@ -0,0 +1,430 @@
+package engine
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"reflect"
+	"runtime"
+	"testing"
+)
+
+type discoveryLoadConfig struct {
+	Service struct {
+		Settings map[string]string `yaml:"settings"`
+	} `yaml:"service"`
+	Settings map[string]string `yaml:"settings"`
+	Value    string            `yaml:"value"`
+}
+
+func TestSearchLoadMatchesExplicitFileThroughImportsAndContext(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	mainPath := writeImportFile(t, root, "app.yml", `configkit:
+  imports: [{path: fragments/extra.yml}]
+settings: {main: selected}
+`)
+	importPath := writeImportFile(t, root, "fragments/extra.yml", "settings: {imported: value}\n")
+	search := SearchConfig("app", SearchDirectory(root))
+	options := Options[discoveryLoadConfig]{
+		Imports: true, Filesystem: &FilesystemContext{Root: root}, destination: Keys("service"),
+	}
+	searched, err := testLoad(search, options)
+	if err != nil {
+		t.Fatal(err)
+	}
+	explicit, err := testLoad(File(mainPath), options)
+	if err != nil {
+		t.Fatal(err)
+	}
+	assertEquivalentDiscoveryLoads(t, searched.Config, searched.Inspection, explicit.Config, explicit.Inspection,
+		Keys("service", "settings", "main"), Keys("service", "settings", "imported"))
+
+	sources := searched.Sources()
+	if len(sources) != 2 || sources[0].Kind != SourceKindFile || sources[0].Path != canonicalTestPath(t, mainPath) || sources[1].Path != canonicalTestPath(t, importPath) {
+		t.Fatalf("searched source evidence = %#v", sources)
+	}
+}
+
+func TestSearchLayeredMainAndUnderlayMatchExplicitFiles(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	mainPath := writeImportFile(t, root, "main.yml", "settings: {main: value}\n")
+	underlayPath := writeImportFile(t, root, "underlay/base.yml", `configkit:
+  imports: [{path: extra.yml}]
+settings: {underlay: value}
+`)
+	importPath := writeImportFile(t, root, "underlay/extra.yml", "settings: {imported: value}\n")
+	mainSearch := SearchConfig("", SearchDirectory(root, DirectorySearchOptions{Filenames: []FilenameGroup{CustomFilenames("main.yml")}}))
+	underlaySearch := SearchConfig("", SearchDirectory(filepath.Join(root, "underlay"), DirectorySearchOptions{Filenames: []FilenameGroup{CustomFilenames("base.yml")}}))
+	load := func(main, underlay Source) (*Loaded[discoveryLoadConfig], error) {
+		return LoadLayered(
+			Input{Source: main, Imports: true}, testSecretBinding(),
+			LayeredOptions[discoveryLoadConfig]{Underlays: []Underlay{{Inputs: []Input{{Source: underlay, Imports: true}}}}},
+		)
+	}
+	searched, err := load(mainSearch, underlaySearch)
+	if err != nil {
+		t.Fatal(err)
+	}
+	explicit, err := load(File(mainPath), File(underlayPath))
+	if err != nil {
+		t.Fatal(err)
+	}
+	assertEquivalentDiscoveryLoads(t, searched.Config, searched.Inspection, explicit.Config, explicit.Inspection,
+		Keys("settings", "main"), Keys("settings", "underlay"), Keys("settings", "imported"))
+
+	sources := searched.Inspection.Sources()
+	if len(sources) != 3 || sources[0].ID != "source-1" || sources[0].Layer != LayerBase || sources[1].ID != "source-2" || sources[1].Layer != LayerUnderlay || sources[2].Path != canonicalTestPath(t, importPath) || sources[2].UnderlayIndex != 1 {
+		t.Fatalf("layered search source evidence = %#v", sources)
+	}
+}
+
+func TestOptionalSearchExhaustionMatchesNoSource(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	missing := filepath.Join(root, "missing.yml")
+	defaults := func() discoveryLoadConfig {
+		return discoveryLoadConfig{Value: "default"}
+	}
+	options := Options[discoveryLoadConfig]{
+		Definition: Definition[discoveryLoadConfig]{Defaults: defaults},
+		Imports:    true, Filesystem: &FilesystemContext{Root: root},
+	}
+	searched, err := testLoad(SearchConfig("", Paths(missing)), options)
+	if err != nil {
+		t.Fatal(err)
+	}
+	explicit, err := testLoad(NoSource(), options)
+	if err != nil {
+		t.Fatal(err)
+	}
+	assertEquivalentDiscoveryLoads(t, searched.Config, searched.Inspection, explicit.Config, explicit.Inspection, Keys("value"))
+	if len(searched.Sources()) != 0 {
+		t.Fatalf("optional exhausted search created sources: %#v", searched.Sources())
+	}
+}
+
+func TestSearchSelectedFileFailuresDoNotFallBack(t *testing.T) {
+	t.Parallel()
+
+	t.Run("malformed YAML", func(t *testing.T) {
+		first := writeImportFile(t, t.TempDir(), "first.yml", ": malformed\n")
+		writeImportFile(t, filepath.Dir(first), "later.yml", "value: valid\n")
+		loaded, err := testLoad[discoveryLoadConfig](SearchConfig("", Paths(first, filepath.Join(filepath.Dir(first), "later.yml"))), Options[discoveryLoadConfig]{})
+		if loaded != nil || err == nil {
+			t.Fatalf("malformed selected source = %#v, %v", loaded, err)
+		}
+	})
+
+	t.Run("version check", func(t *testing.T) {
+		root := t.TempDir()
+		first := writeImportFile(t, root, "first.yml", "version: rejected\n")
+		writeImportFile(t, root, "later.yml", "version: accepted\n")
+		var checked []string
+		loaded, err := testLoad[discoveryLoadConfig](SearchConfig("", Paths(first, filepath.Join(root, "later.yml"))), Options[discoveryLoadConfig]{
+			SourceVersionMode: sourceVersionModeIfPresent,
+			Definition: Definition[discoveryLoadConfig]{Version: &VersionRule{
+				Path: Keys("version"),
+				Check: func(version Version, _ *Validation) error {
+					checked = append(checked, version.Text)
+					if version.Text == "rejected" {
+						return errors.New("version rejected")
+					}
+					return nil
+				},
+			}},
+		})
+		if loaded != nil || err == nil || !reflect.DeepEqual(checked, []string{"rejected"}) {
+			t.Fatalf("version failure search = %#v, %v; checked %#v", loaded, err, checked)
+		}
+	})
+
+	t.Run("decode", func(t *testing.T) {
+		root := t.TempDir()
+		first := writeImportFile(t, root, "first.yml", "value: not-an-integer\n")
+		writeImportFile(t, root, "later.yml", "value: 3\n")
+		type config struct {
+			Value int `yaml:"value"`
+		}
+		loaded, err := testLoad[config](SearchConfig("", Paths(first, filepath.Join(root, "later.yml"))), Options[config]{})
+		if loaded != nil || err == nil {
+			t.Fatalf("decode failure search = %#v, %v", loaded, err)
+		}
+	})
+}
+
+func TestSearchProbeFailureRetainsFileEvidence(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	main := writeImportFile(t, root, "main.yml", "value: main\n")
+	underlay := writeImportFile(t, root, "underlay.yml", "settings: {first: underlay}\n")
+	bad := filepath.Join(main, "child.yml")
+	later := writeImportFile(t, root, "later.yml", "value: later\n")
+	missing := filepath.Join(root, "missing.yml")
+	for _, entry := range []struct {
+		name string
+		id   string
+		load func(Source) (*Loaded[discoveryLoadConfig], error)
+	}{
+		{"ordinary", "source-1", func(source Source) (*Loaded[discoveryLoadConfig], error) {
+			return Load(source, testSecretBinding(), Options[discoveryLoadConfig]{destination: Keys("settings")})
+		}},
+		{"underlay after acquired sources", "source-3", func(source Source) (*Loaded[discoveryLoadConfig], error) {
+			return LoadLayered(Input{Source: File(main)}, testSecretBinding(), LayeredOptions[discoveryLoadConfig]{
+				Underlays: []Underlay{{Inputs: []Input{
+					{Source: File(underlay)}, {Source: source, Destination: Keys("service", "settings")},
+				}}},
+			})
+		}},
+	} {
+		t.Run(entry.name, func(t *testing.T) {
+			_, err := entry.load(File(bad))
+			var explicit *LoadError
+			if !errors.As(err, &explicit) || len(explicit.Diagnostics()) != 1 {
+				t.Fatalf("explicit failed file = %v", err)
+			}
+			if explicit.Diagnostics()[0].Code == CodeSourceMissing {
+				t.Skip("host classifies a non-directory ancestor as absence; controlled probe tests cover access failures")
+			}
+			result, err := entry.load(SearchConfig("", Paths(missing, bad, later)))
+			var searched *LoadError
+			if result != nil || !errors.As(err, &searched) {
+				t.Fatalf("failed search = %#v, %v", result, err)
+			}
+			if !reflect.DeepEqual(searched.Sources(), explicit.Sources()) || !reflect.DeepEqual(searched.Diagnostics(), explicit.Diagnostics()) {
+				t.Fatalf("search failure differs from explicit file:\nsources %#v / %#v\ndiagnostics %#v / %#v", searched.Sources(), explicit.Sources(), searched.Diagnostics(), explicit.Diagnostics())
+			}
+			primary := searched.Diagnostics()[0].Primary
+			if primary == nil || primary.SourceID != entry.id {
+				t.Fatalf("failed candidate location = %#v, want %s", primary, entry.id)
+			}
+		})
+	}
+}
+
+func TestSearchValidationPrecedesCandidateProbing(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	first := writeImportFile(t, root, "first.yml", "value: selected\n")
+	_, err := testLoad[discoveryLoadConfig](SearchConfig("", Searches(Paths(first), Paths(""))), Options[discoveryLoadConfig]{})
+	var loadErr *LoadError
+	if !errors.As(err, &loadErr) {
+		t.Fatalf("invalid later search error = %v, want *LoadError", err)
+	}
+	if len(loadErr.Diagnostics()) == 0 || loadErr.Diagnostics()[0].Code != CodeOptionsInvalid {
+		t.Fatalf("invalid later search component diagnostics = %#v", loadErr.Diagnostics())
+	}
+
+	malformed := writeImportFile(t, t.TempDir(), "main.yml", ": malformed\n")
+	loaded, err := LoadLayered(
+		Input{Source: SearchConfig("", Paths(malformed))}, testSecretBinding(),
+		LayeredOptions[discoveryLoadConfig]{Underlays: []Underlay{{Inputs: []Input{{Source: SearchConfig("", Paths(""))}}}}},
+	)
+	if loaded != nil || !errors.As(err, &loadErr) {
+		t.Fatalf("invalid later underlay search = %#v, %v", loaded, err)
+	}
+	for _, diagnostic := range loadErr.Diagnostics() {
+		if diagnostic.Code != CodeOptionsInvalid {
+			t.Fatalf("layered validation acquired main before rejecting underlay: %#v", loadErr.Diagnostics())
+		}
+	}
+}
+
+func TestSearchContextCompatibilityUsesSelectedOutcome(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	first := writeImportFile(t, root, "first.yml", "value: first\n")
+	writeImportFile(t, root, "later.yml", "value: later\n")
+	search := SearchConfig("", Paths(first, filepath.Join(root, "later.yml")))
+	options := Options[discoveryLoadConfig]{Filesystem: &FilesystemContext{BaseDir: root, Root: root}}
+	_, err := testLoad[discoveryLoadConfig](search, options)
+	var loadErr *LoadError
+	if !errors.As(err, &loadErr) {
+		t.Fatalf("selected file with explicit base error = %v, want *LoadError", err)
+	}
+	if len(loadErr.Diagnostics()) == 0 || loadErr.Diagnostics()[0].Code != CodeOptionsInvalid {
+		t.Fatalf("selected file context diagnostics = %#v", loadErr.Diagnostics())
+	}
+}
+
+func TestSearchEmptyContextUsesSelectedOutcome(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	selected := writeImportFile(t, root, "selected.yml", "value: selected\n")
+	missing := filepath.Join(root, "missing.yml")
+	context := &FilesystemContext{}
+	for _, entry := range []struct {
+		name string
+		load func(Source) (*Loaded[discoveryLoadConfig], error)
+	}{
+		{"ordinary", func(source Source) (*Loaded[discoveryLoadConfig], error) {
+			return Load(source, testSecretBinding(), Options[discoveryLoadConfig]{Imports: true, Filesystem: context})
+		}},
+		{"layered main", func(source Source) (*Loaded[discoveryLoadConfig], error) {
+			return LoadLayered(Input{Source: source, Imports: true, Filesystem: context}, testSecretBinding(), LayeredOptions[discoveryLoadConfig]{})
+		}},
+		{"underlay", func(source Source) (*Loaded[discoveryLoadConfig], error) {
+			return LoadLayered(Input{Source: NoSource()}, testSecretBinding(), LayeredOptions[discoveryLoadConfig]{
+				Underlays: []Underlay{{Inputs: []Input{{Source: source, Imports: true, Filesystem: context}}}},
+			})
+		}},
+	} {
+		t.Run(entry.name, func(t *testing.T) {
+			explicit, err := entry.load(File(selected))
+			if err != nil {
+				t.Fatal(err)
+			}
+			searched, err := entry.load(SearchConfig("", Paths(missing, selected)))
+			if err != nil {
+				t.Fatal(err)
+			}
+			assertEquivalentDiscoveryLoads(t, searched.Config, searched.Inspection, explicit.Config, explicit.Inspection, Keys("value"))
+			if searched.Config.Value != "selected" {
+				t.Fatalf("selected value = %q", searched.Config.Value)
+			}
+			for _, source := range []Source{NoSource(), SearchConfig("", Paths(missing))} {
+				result, err := entry.load(source)
+				var failure *LoadError
+				if result != nil || !errors.As(err, &failure) || len(failure.Diagnostics()) != 1 || failure.Diagnostics()[0].Code != CodeOptionsInvalid {
+					t.Fatalf("absent input with empty context = %#v, %v", result, err)
+				}
+			}
+		})
+	}
+}
+
+func TestSearchSourceObservesFileChangesBetweenLoads(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	file := writeImportFile(t, root, "config.yml", "value: first\n")
+	source := SearchConfig("", SearchDirectory(root, DirectorySearchOptions{Filenames: []FilenameGroup{CustomFilenames("config.yml")}}))
+	load := func() string {
+		loaded, err := testLoad[discoveryLoadConfig](source, Options[discoveryLoadConfig]{})
+		if err != nil {
+			t.Fatal(err)
+		}
+		return loaded.Config.Value
+	}
+	if value := load(); value != "first" {
+		t.Fatalf("first search value = %q", value)
+	}
+	if err := os.WriteFile(file, []byte("value: second\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if value := load(); value != "second" {
+		t.Fatalf("updated search value = %q", value)
+	}
+}
+
+func TestSearchSourceObservesUserConfigEnvironmentChanges(t *testing.T) {
+	setBase := func(directory string) string {
+		t.Helper()
+		switch runtime.GOOS {
+		case "windows":
+			t.Setenv("AppData", directory)
+		case "darwin", "ios":
+			t.Setenv("HOME", directory)
+		case "plan9":
+			t.Setenv("home", directory)
+		default:
+			t.Setenv("XDG_CONFIG_HOME", directory)
+		}
+		base, err := os.UserConfigDir()
+		if err != nil {
+			t.Fatal(err)
+		}
+		return base
+	}
+	type config struct {
+		Value string `yaml:"value"`
+	}
+	firstBase := setBase(filepath.Join(t.TempDir(), "first"))
+	first := writeImportFile(t, firstBase, "app/app.yml", "value: first\n")
+	source := SearchConfig("app", UserConfigDirectory())
+	load := func() string {
+		loaded, err := testLoad[config](source, Options[config]{})
+		if err != nil {
+			t.Fatal(err)
+		}
+		return loaded.Config.Value
+	}
+	if value := load(); value != "first" {
+		t.Fatalf("first user-config search value = %q (%s)", value, first)
+	}
+	secondBase := setBase(filepath.Join(t.TempDir(), "second"))
+	second := writeImportFile(t, secondBase, "app/app.yml", "value: second\n")
+	if value := load(); value != "second" {
+		t.Fatalf("updated user-config search value = %q (%s)", value, second)
+	}
+}
+
+func TestSearchSourceObservesWorkingDirectoryChanges(t *testing.T) {
+	original, err := os.Getwd()
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		if err := os.Chdir(original); err != nil {
+			t.Errorf("restore working directory: %v", err)
+		}
+	})
+	firstDir := t.TempDir()
+	secondDir := t.TempDir()
+	writeImportFile(t, firstDir, "app.yml", "value: first\n")
+	writeImportFile(t, secondDir, "app.yml", "value: second\n")
+	source := SearchConfig("app", WorkingDirectory())
+	load := func() string {
+		loaded, err := testLoad[discoveryLoadConfig](source, Options[discoveryLoadConfig]{})
+		if err != nil {
+			t.Fatal(err)
+		}
+		return loaded.Config.Value
+	}
+	if err := os.Chdir(firstDir); err != nil {
+		t.Fatal(err)
+	}
+	if value := load(); value != "first" {
+		t.Fatalf("first working-directory search value = %q", value)
+	}
+	if err := os.Chdir(secondDir); err != nil {
+		t.Fatal(err)
+	}
+	if value := load(); value != "second" {
+		t.Fatalf("updated working-directory search value = %q", value)
+	}
+}
+
+func assertEquivalentDiscoveryLoads[T any](t *testing.T, leftConfig T, left *Inspection, rightConfig T, right *Inspection, presencePaths ...Path) {
+	t.Helper()
+	if !reflect.DeepEqual(leftConfig, rightConfig) {
+		t.Fatalf("search config %#v differs from explicit file config %#v", leftConfig, rightConfig)
+	}
+	leftSources, rightSources := left.Sources(), right.Sources()
+	if !reflect.DeepEqual(leftSources, rightSources) {
+		t.Fatalf("search sources %#v differ from explicit file sources %#v", leftSources, rightSources)
+	}
+	leftMetadata, rightMetadata := left.Metadata(), right.Metadata()
+	for _, path := range presencePaths {
+		leftInfo, leftPresent := leftMetadata.Lookup(path)
+		rightInfo, rightPresent := rightMetadata.Lookup(path)
+		if leftPresent != rightPresent || !reflect.DeepEqual(leftInfo, rightInfo) {
+			t.Fatalf("search metadata at %s = %#v, %v; explicit metadata = %#v, %v", path.String(), leftInfo, leftPresent, rightInfo, rightPresent)
+		}
+	}
+	for _, source := range leftSources {
+		leftContext, leftOK := left.SourceContext(source.ID)
+		rightContext, rightOK := right.SourceContext(source.ID)
+		if leftOK != rightOK || leftContext.BaseDir != rightContext.BaseDir || (leftContext.FS != nil) != (rightContext.FS != nil) {
+			t.Fatalf("search context for %s = %#v, %v; explicit context = %#v, %v", source.ID, leftContext, leftOK, rightContext, rightOK)
+		}
+	}
+}

internal/engine/discovery_platform_other.go

@@ -0,0 +1,5 @@
+//go:build !aix && !android && !darwin && !dragonfly && !freebsd && !hurd && !illumos && !ios && !linux && !netbsd && !openbsd && !solaris
+
+package engine
+
+func unixSystemPresetSupported() bool { return false }

internal/engine/discovery_platform_unix.go

@@ -0,0 +1,5 @@
+//go:build aix || android || darwin || dragonfly || freebsd || hurd || illumos || ios || linux || netbsd || openbsd || solaris
+
+package engine
+
+func unixSystemPresetSupported() bool { return true }

internal/engine/discovery_test.go

@@ -0,0 +1,519 @@
+package engine
+
+import (
+	"errors"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+)
+
+func TestSearchDescriptionEmptyAndSlugRequirements(t *testing.T) {
+	t.Parallel()
+
+	if diagnostics := validateSearch(Search{}, ""); len(diagnostics) != 0 {
+		t.Fatalf("zero search diagnostics = %#v", diagnostics)
+	}
+	if diagnostics := validateSearch(Searches(), ""); len(diagnostics) != 0 {
+		t.Fatalf("empty concatenation diagnostics = %#v", diagnostics)
+	}
+	if diagnostics := validateSearch(Paths(), ""); len(diagnostics) != 0 {
+		t.Fatalf("empty path list diagnostics = %#v", diagnostics)
+	}
+	if diagnostics := validateSearch(Paths("relative/config.yml"), ""); len(diagnostics) != 0 {
+		t.Fatalf("literal path unexpectedly requires a slug: %#v", diagnostics)
+	}
+	generic := SearchDirectory("configs", DirectorySearchOptions{Filenames: []FilenameGroup{GenericFilenames()}})
+	if diagnostics := validateSearch(generic, ""); len(diagnostics) != 0 {
+		t.Fatalf("generic-only directory unexpectedly requires a slug: %#v", diagnostics)
+	}
+	if diagnostics := validateSearch(SearchDirectory("configs"), ""); len(diagnostics) == 0 || diagnostics[0].Code != CodeOptionsInvalid {
+		t.Fatalf("default named directory accepted an empty slug: %#v", diagnostics)
+	}
+	if diagnostics := validateSearch(UnixSystemDirectories(), "myapp"); len(diagnostics) != 0 {
+		t.Fatalf("valid preset slug diagnostics = %#v", diagnostics)
+	}
+}
+
+func TestSearchDescriptionSnapshotsInputs(t *testing.T) {
+	t.Parallel()
+
+	paths := []string{"first.yml", "second.yml"}
+	pathSearch := Paths(paths...)
+	paths[0] = "changed.yml"
+
+	customNames := []string{"one.yml", "two.yml"}
+	group := CustomFilenames(customNames...)
+	customNames[0] = "changed.yml"
+	groups := []FilenameGroup{group}
+	options := DirectorySearchOptions{Filenames: groups}
+	directorySearch := SearchDirectory("configs", options)
+	groups[0] = GenericFilenames()
+	options.Filenames[0] = NamedFilenames()
+
+	searches := []Search{pathSearch, directorySearch}
+	combined := Searches(searches...)
+	searches[0] = Search{}
+
+	if got := combined.entries[0].path; got != "first.yml" {
+		t.Fatalf("snapshotted path = %q", got)
+	}
+	gotNames := combined.entries[2].filenames[0].names
+	if len(gotNames) != 2 || gotNames[0] != "one.yml" || gotNames[1] != "two.yml" {
+		t.Fatalf("snapshotted custom names = %#v", gotNames)
+	}
+	if diagnostics := validateSearch(combined, ""); len(diagnostics) != 0 {
+		t.Fatalf("snapshot description diagnostics = %#v", diagnostics)
+	}
+}
+
+func TestDirectoryFilenameDefaultsAndExplicitEmpty(t *testing.T) {
+	t.Parallel()
+
+	omitted := SearchDirectory("configs")
+	if len(omitted.entries) != 1 || len(omitted.entries[0].filenames) != 2 || omitted.entries[0].filenames[0].kind != filenameGroupNamed || omitted.entries[0].filenames[1].kind != filenameGroupGeneric {
+		t.Fatalf("omitted groups = %#v", omitted.entries)
+	}
+	explicitNil := SearchDirectory("configs", DirectorySearchOptions{})
+	if len(explicitNil.entries[0].filenames) != 2 {
+		t.Fatalf("nil filename selection did not use defaults: %#v", explicitNil.entries[0].filenames)
+	}
+	explicitEmpty := SearchDirectory("configs", DirectorySearchOptions{Filenames: []FilenameGroup{}})
+	if explicitEmpty.entries[0].filenames == nil || len(explicitEmpty.entries[0].filenames) != 0 {
+		t.Fatalf("explicit empty selection lost its distinction: %#v", explicitEmpty.entries[0].filenames)
+	}
+	if len(validateSearch(explicitEmpty, "")) != 0 {
+		t.Fatal("explicit empty filename selection should need no slug")
+	}
+}
+
+func TestSearchDescriptionArityAndErrorConcatenation(t *testing.T) {
+	t.Parallel()
+
+	tooMany := SearchDirectory("configs", DirectorySearchOptions{}, DirectorySearchOptions{})
+	if diagnostics := validateSearch(tooMany, "app"); len(diagnostics) == 0 {
+		t.Fatal("multiple option values should be invalid")
+	}
+	invalid := Paths("")
+	combined := Searches(Paths("good.yml"), invalid)
+	if diagnostics := validateSearch(combined, ""); len(diagnostics) == 0 {
+		t.Fatal("concatenation lost a constructor error")
+	}
+	if diagnostics := validateSearch(Paths("good.yml", ""), ""); len(diagnostics) == 0 {
+		t.Fatal("later invalid path was hidden by an earlier component")
+	}
+}
+
+func TestSearchDescriptionPreservesFilenameGroupOrder(t *testing.T) {
+	t.Parallel()
+
+	groups := []FilenameGroup{GenericFilenames(), NamedFilenames(), CustomFilenames("override.yml")}
+	search := SearchDirectory("configs", DirectorySearchOptions{Filenames: groups})
+	got := search.entries[0].filenames
+	if len(got) != 3 || got[0].kind != filenameGroupGeneric || got[1].kind != filenameGroupNamed || got[2].names[0] != "override.yml" {
+		t.Fatalf("filename group order = %#v", got)
+	}
+	if got := SearchDirectory("configs", DirectorySearchOptions{Filenames: []FilenameGroup{CustomFilenames()}}).entries[0].filenames[0].names; len(got) != 0 {
+		t.Fatalf("empty custom group = %#v", got)
+	}
+}
+
+func TestFilenameComponentValidation(t *testing.T) {
+	t.Parallel()
+
+	for _, value := range []string{"", ".", "..", "nested/name", "bad\x00name"} {
+		if validFilenameComponent(value) {
+			t.Errorf("validFilenameComponent(%q) = true", value)
+		}
+	}
+	if runtime.GOOS == "windows" {
+		for _, value := range []string{"CON", "CONIN$", "CONOUT$", "name.", "bad:name", "bad\x01name"} {
+			if validFilenameComponent(value) {
+				t.Errorf("Windows component %q unexpectedly accepted", value)
+			}
+		}
+		// Device names with extensions depend on the Windows version. Match
+		// Go's platform-aware decision instead of imposing a blanket ban.
+		for _, value := range []string{"nul.txt", "COM¹.log", "LPT³.txt", "CON.extra.yml"} {
+			if got, want := validFilenameComponent(value), filepath.IsLocal(value); got != want {
+				t.Errorf("Windows component %q validity = %v, want Go's %v", value, got, want)
+			}
+		}
+	} else {
+		for _, value := range []string{"CONIN$", "CONOUT$", "nul.txt"} {
+			if !validFilenameComponent(value) {
+				t.Errorf("Windows component restriction applied to this host: %q", value)
+			}
+		}
+	}
+	for _, value := range []string{"name with spaces", "naïve"} {
+		if !validFilenameComponent(value) {
+			t.Errorf("host-valid component %q rejected", value)
+		}
+	}
+	if diagnostics := validateSearch(SearchDirectory("configs", DirectorySearchOptions{Filenames: []FilenameGroup{CustomFilenames("bad/name")}}), ""); len(diagnostics) == 0 {
+		t.Fatal("invalid custom filename was not retained for validation")
+	}
+}
+
+func TestSearchCandidatesPreserveDirectoryAndGroupOrder(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	helpers := discoveryDirectoryHelpers{workingDir: func() (string, error) { return root, nil }}
+	search := Searches(
+		Paths("first.yml"),
+		SearchDirectory("settings", DirectorySearchOptions{Filenames: []FilenameGroup{
+			GenericFilenames(), CustomFilenames("special.yml"),
+		}}),
+		Paths("last.yml"),
+	)
+	candidates := collectSearchCandidates(t, search, "app", helpers)
+	want := []string{
+		filepath.Join(root, "first.yml"),
+		filepath.Join(root, "settings", "config.yml"),
+		filepath.Join(root, "settings", "config.yaml"),
+		filepath.Join(root, "settings", "main.yml"),
+		filepath.Join(root, "settings", "main.yaml"),
+		filepath.Join(root, "settings", "special.yml"),
+		filepath.Join(root, "last.yml"),
+	}
+	assertCandidatePaths(t, candidates, want)
+
+	reversed := SearchDirectory("settings", DirectorySearchOptions{Filenames: []FilenameGroup{NamedFilenames(), GenericFilenames()}})
+	reversedCandidates := collectSearchCandidates(t, reversed, "app", helpers)
+	assertCandidatePaths(t, reversedCandidates[:2], []string{
+		filepath.Join(root, "settings", "app.yml"),
+		filepath.Join(root, "settings", "app.yaml"),
+	})
+}
+
+func TestSearchPresetCandidateLists(t *testing.T) {
+	t.Parallel()
+
+	helpers := discoveryDirectoryHelpers{
+		userConfigDir: func() (string, error) { return "/controlled/config", nil },
+		userHomeDir:   func() (string, error) { return "/controlled/home", nil },
+		workingDir:    func() (string, error) { return "/controlled/work", nil },
+		unixSupported: func() bool { return true },
+	}
+
+	unix := collectSearchCandidates(t, UnixSystemDirectories(), "app", helpers)
+	if len(unix) != 14 {
+		t.Fatalf("Unix preset candidate count = %d: %#v", len(unix), unix)
+	}
+	assertCandidatePaths(t, unix, []string{
+		"/usr/local/etc/app/app.yml", "/usr/local/etc/app/app.yaml", "/usr/local/etc/app/config.yml", "/usr/local/etc/app/config.yaml", "/usr/local/etc/app/main.yml", "/usr/local/etc/app/main.yaml",
+		"/etc/app/app.yml", "/etc/app/app.yaml", "/etc/app/config.yml", "/etc/app/config.yaml", "/etc/app/main.yml", "/etc/app/main.yaml",
+		"/etc/app.yml", "/etc/app.yaml",
+	})
+
+	user := collectSearchCandidates(t, UserConfigDirectory(), "app", helpers)
+	assertCandidatePaths(t, user, []string{
+		"/controlled/config/app/app.yml", "/controlled/config/app/app.yaml", "/controlled/config/app/config.yml", "/controlled/config/app/config.yaml", "/controlled/config/app/main.yml", "/controlled/config/app/main.yaml",
+		"/controlled/config/app.yml", "/controlled/config/app.yaml",
+	})
+	home := collectSearchCandidates(t, HomeDirectory(), "app", helpers)
+	assertCandidatePaths(t, home, []string{
+		"/controlled/home/.app/app.yml", "/controlled/home/.app/app.yaml", "/controlled/home/.app/config.yml", "/controlled/home/.app/config.yaml", "/controlled/home/.app/main.yml", "/controlled/home/.app/main.yaml",
+		"/controlled/home/app.yml", "/controlled/home/app.yaml",
+	})
+	working := collectSearchCandidates(t, WorkingDirectory(), "app", helpers)
+	assertCandidatePaths(t, working, []string{"/controlled/work/app.yml", "/controlled/work/app.yaml"})
+}
+
+func TestSearchCandidateExpansionIsLazyAndSkipsEmptyDirectories(t *testing.T) {
+	t.Parallel()
+
+	configCalls := 0
+	helpers := discoveryDirectoryHelpers{
+		userConfigDir: func() (string, error) {
+			configCalls++
+			return "/controlled/config", nil
+		},
+		workingDir:    func() (string, error) { return "/controlled/work", nil },
+		unixSupported: func() bool { return true },
+	}
+	search := Searches(Paths("/selected.yml"), UserConfigDirectory())
+	iterator, diagnostics := newSearchCandidateIterator(search, "app", helpers)
+	if len(diagnostics) != 0 {
+		t.Fatalf("iterator diagnostics = %#v", diagnostics)
+	}
+	if candidate, ok, err := iterator.next(); err != nil || !ok || candidate != "/selected.yml" {
+		t.Fatalf("first candidate = %q, %v, %v", candidate, ok, err)
+	}
+	if configCalls != 0 {
+		t.Fatalf("later user directory resolved before consumption: %d calls", configCalls)
+	}
+
+	emptyOnly := SearchDirectory("should-not-resolve", DirectorySearchOptions{Filenames: []FilenameGroup{}})
+	emptyCandidates := collectSearchCandidates(t, emptyOnly, "", helpers)
+	if len(emptyCandidates) != 0 || configCalls != 0 {
+		t.Fatalf("empty directory candidates = %#v, helper calls = %d", emptyCandidates, configCalls)
+	}
+	continued := collectSearchCandidates(t, Searches(emptyOnly, Paths("later.yml")), "", helpers)
+	assertCandidatePaths(t, continued, []string{filepath.Join("/controlled/work", "later.yml")})
+	if configCalls != 0 {
+		t.Fatalf("empty directory base was resolved: %d calls", configCalls)
+	}
+}
+
+func TestSearchCandidateBaseFailuresAndPlatformApplicability(t *testing.T) {
+	t.Parallel()
+
+	baseFailure := errors.New("controlled base failure")
+	helpers := discoveryDirectoryHelpers{
+		userConfigDir: func() (string, error) { return "", baseFailure },
+		workingDir:    func() (string, error) { return "/controlled/work", nil },
+		unixSupported: func() bool { return false },
+	}
+	iterator, diagnostics := newSearchCandidateIterator(UserConfigDirectory(), "app", helpers)
+	if len(diagnostics) != 0 {
+		t.Fatalf("user preset validation = %#v", diagnostics)
+	}
+	if _, ok, err := iterator.next(); ok || !errors.Is(err, baseFailure) {
+		t.Fatalf("unavailable user base = ok %v, err %v", ok, err)
+	}
+
+	iterator, diagnostics = newSearchCandidateIterator(UnixSystemDirectories(), "app", helpers)
+	if len(diagnostics) != 0 {
+		t.Fatalf("Unix preset validation = %#v", diagnostics)
+	}
+	if _, ok, err := iterator.next(); ok || !errors.Is(err, errUnixSystemPresetUnavailable) {
+		t.Fatalf("unsupported Unix preset = ok %v, err %v", ok, err)
+	}
+
+	iterator, diagnostics = newSearchCandidateIterator(Searches(Paths("/earlier.yml"), UnixSystemDirectories()), "app", helpers)
+	if len(diagnostics) != 0 {
+		t.Fatalf("composed Unix preset validation = %#v", diagnostics)
+	}
+	if candidate, ok, err := iterator.next(); err != nil || !ok || candidate != "/earlier.yml" {
+		t.Fatalf("earlier candidate = %q, %v, %v", candidate, ok, err)
+	}
+}
+
+func TestRelativeAndShellLikeSearchPathsRemainLiteral(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	helpers := discoveryDirectoryHelpers{workingDir: func() (string, error) { return root, nil }}
+	search := Searches(Paths("~/literal.yml", "$CONFIG/*.yaml"), SearchDirectory("./settings", DirectorySearchOptions{Filenames: []FilenameGroup{CustomFilenames("name with spaces.yml")}}))
+	candidates := collectSearchCandidates(t, search, "", helpers)
+	assertCandidatePaths(t, candidates, []string{
+		filepath.Join(root, "~/literal.yml"),
+		filepath.Join(root, "$CONFIG/*.yaml"),
+		filepath.Join(root, "settings", "name with spaces.yml"),
+	})
+}
+
+func collectSearchCandidates(t *testing.T, search Search, application string, helpers discoveryDirectoryHelpers) []string {
+	t.Helper()
+	iterator, diagnostics := newSearchCandidateIterator(search, application, helpers)
+	if len(diagnostics) != 0 {
+		t.Fatalf("search validation = %#v", diagnostics)
+	}
+	var candidates []string
+	for {
+		candidate, ok, err := iterator.next()
+		if err != nil {
+			t.Fatalf("expand candidate: %v", err)
+		}
+		if !ok {
+			return candidates
+		}
+		candidates = append(candidates, candidate)
+	}
+}
+
+func assertCandidatePaths(t *testing.T, got, want []string) {
+	t.Helper()
+	if len(got) != len(want) {
+		t.Fatalf("candidate count = %d, want %d: %#v", len(got), len(want), got)
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Fatalf("candidate %d = %q, want %q", i, got[i], want[i])
+		}
+	}
+}
+
+func TestResolveSearchSelectsFirstExistingCandidate(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	first := filepath.Join(root, "first.yml")
+	second := filepath.Join(root, "second.yml")
+	writeDiscoveryFile(t, first, "value: first\n")
+	writeDiscoveryFile(t, second, "value: second\n")
+	selected, diagnostics := resolveSearchSource(Source{}, ptrSearch(Paths(filepath.Join(root, "missing.yml"), first, second)), "", false, discoveryDirectoryHelpers{}, discoveryHostProbe{})
+	if len(diagnostics) != 0 || selected.kind != sourceFile || selected.path != first {
+		t.Fatalf("selection = %#v, diagnostics %#v", selected, diagnostics)
+	}
+	read, diagnostics := readSource(selected, "source-1", defaultSourceLimits())
+	if len(diagnostics) != 0 || string(read.data) != "value: first\n" || read.info.Path != canonicalTestPath(t, first) {
+		t.Fatalf("selected source read = %#v, diagnostics %#v", read, diagnostics)
+	}
+}
+
+func TestResolveSearchNamedExtensionsAndNonregularSelection(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	writeDiscoveryFile(t, filepath.Join(root, "app.yml"), "value: yml\n")
+	writeDiscoveryFile(t, filepath.Join(root, "app.yaml"), "value: yaml\n")
+	selected, diagnostics := resolveSearchSource(Source{}, ptrSearch(SearchDirectory(root)), "app", false, discoveryDirectoryHelpers{}, discoveryHostProbe{})
+	if len(diagnostics) != 0 || selected.path != filepath.Join(root, "app.yml") {
+		t.Fatalf("named extension selection = %#v, %#v", selected, diagnostics)
+	}
+
+	directory := filepath.Join(root, "subdirectory")
+	if err := os.Mkdir(directory, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	good := filepath.Join(root, "good.yml")
+	writeDiscoveryFile(t, good, "value: later\n")
+	selected, diagnostics = resolveSearchSource(Source{}, ptrSearch(Paths(directory, good)), "", false, discoveryDirectoryHelpers{}, discoveryHostProbe{})
+	if len(diagnostics) != 0 || selected.path != directory {
+		t.Fatalf("directory candidate selection = %#v, %#v", selected, diagnostics)
+	}
+	_, diagnostics = readSource(selected, "source-1", defaultSourceLimits())
+	if len(diagnostics) != 1 || diagnostics[0].Code != CodeSourceNotRegular {
+		t.Fatalf("selected directory read diagnostics = %#v", diagnostics)
+	}
+}
+
+func TestResolveSearchContainedSymlinkAndNoFallbackAfterReadFailure(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	target := filepath.Join(root, "actual.yml")
+	link := filepath.Join(root, "linked.yml")
+	writeDiscoveryFile(t, target, "value: linked\n")
+	if err := os.Symlink(target, link); err != nil {
+		t.Skipf("symlinks unavailable: %v", err)
+	}
+	writeDiscoveryFile(t, filepath.Join(root, "later.yml"), "value: later\n")
+	selected, diagnostics := resolveSearchSource(Source{}, ptrSearch(Paths(link, filepath.Join(root, "later.yml"))), "", false, discoveryDirectoryHelpers{}, discoveryHostProbe{})
+	if len(diagnostics) != 0 || selected.path != link {
+		t.Fatalf("symlink selection = %#v, %#v", selected, diagnostics)
+	}
+	read, diagnostics := readSource(selected, "source-1", defaultSourceLimits())
+	if len(diagnostics) != 0 || string(read.data) != "value: linked\n" || read.info.Path != canonicalTestPath(t, target) {
+		t.Fatalf("symlink read = %#v, %#v", read, diagnostics)
+	}
+	if err := os.Remove(target); err != nil {
+		t.Fatal(err)
+	}
+	_, diagnostics = readSource(selected, "source-1", defaultSourceLimits())
+	if len(diagnostics) != 1 || diagnostics[0].Code != CodeSourceMissing {
+		t.Fatalf("selected source read failure = %#v", diagnostics)
+	}
+}
+
+func TestResolveSearchRequiredAndOptionalExhaustion(t *testing.T) {
+	t.Parallel()
+
+	optional, diagnostics := resolveSearchSource(Source{}, ptrSearch(Search{}), "", false, discoveryDirectoryHelpers{}, discoveryHostProbe{})
+	if len(diagnostics) != 0 || optional.kind != sourceNone {
+		t.Fatalf("optional empty search = %#v, %#v", optional, diagnostics)
+	}
+	_, diagnostics = resolveSearchSource(Source{}, ptrSearch(Search{}), "", true, discoveryDirectoryHelpers{}, discoveryHostProbe{})
+	if len(diagnostics) != 1 || diagnostics[0].Code != CodeSourceMissing || diagnostics[0].Primary != nil || !strings.Contains(diagnostics[0].Message, "search") {
+		t.Fatalf("required empty search = %#v", diagnostics)
+	}
+
+	root := t.TempDir()
+	missing := filepath.Join(root, "missing.yml")
+	optional, diagnostics = resolveSearchSource(Source{}, ptrSearch(Paths(missing)), "", false, discoveryDirectoryHelpers{}, discoveryHostProbe{})
+	if len(diagnostics) != 0 || optional.kind != sourceNone {
+		t.Fatalf("optional missing search = %#v, %#v", optional, diagnostics)
+	}
+	_, diagnostics = resolveSearchSource(Source{}, ptrSearch(Paths(missing)), "", true, discoveryDirectoryHelpers{}, discoveryHostProbe{})
+	if len(diagnostics) != 1 || diagnostics[0].Code != CodeSourceMissing {
+		t.Fatalf("required missing search = %#v", diagnostics)
+	}
+}
+
+func TestResolveSearchLeavesNonSearchSourcesUntouched(t *testing.T) {
+	t.Parallel()
+
+	source := Bytes("memory", []byte("value: unchanged\n"))
+	resolved, diagnostics := resolveSearchSource(source, nil, "", false, discoveryDirectoryHelpers{}, discoveryHostProbe{})
+	if len(diagnostics) != 0 || resolved.kind != sourceBytes || string(resolved.data) != "value: unchanged\n" {
+		t.Fatalf("non-search source = %#v, diagnostics = %#v", resolved, diagnostics)
+	}
+}
+
+func TestResolveSearchStopsOnReachedProbeError(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	first := filepath.Join(root, "first.yml")
+	second := filepath.Join(root, "second.yml")
+	writeDiscoveryFile(t, first, "value: first\n")
+	writeDiscoveryFile(t, second, "value: second\n")
+	statCalls := 0
+	probe := discoveryHostProbe{stat: func(path string) (fs.FileInfo, error) {
+		statCalls++
+		return nil, fs.ErrPermission
+	}}
+	selected, info, diagnostics := resolveSearchInput(SearchConfig("", Paths(first, second)), "source-3", discoveryDirectoryHelpers{}, probe)
+	if len(diagnostics) != 1 || diagnostics[0].Code != CodeSourcePermission || statCalls != 1 {
+		t.Fatalf("probe failure = %#v, stat calls = %d", diagnostics, statCalls)
+	}
+	if selected.kind != sourceFile || info == nil || info.Path != canonicalTestPath(t, first) || info.Label != first || info.Kind != SourceKindFile || info.ID != "source-3" {
+		t.Fatalf("failed candidate evidence = %#v, %#v", selected, info)
+	}
+	if diagnostics[0].Primary == nil || diagnostics[0].Primary.SourceID != info.ID {
+		t.Fatalf("failed candidate diagnostic does not identify its file: %#v", diagnostics)
+	}
+}
+
+func TestResolveSearchLeavesLaterDirectoryUnresolvedAfterSelection(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	first := filepath.Join(root, "selected.yml")
+	writeDiscoveryFile(t, first, "value: selected\n")
+	baseCalls := 0
+	helpers := discoveryDirectoryHelpers{userConfigDir: func() (string, error) {
+		baseCalls++
+		return "", errors.New("later base should not be reached")
+	}}
+	search := ptrSearch(Searches(Paths(first), UserConfigDirectory()))
+	selected, diagnostics := resolveSearchSource(Source{}, search, "app", false, helpers, discoveryHostProbe{})
+	if len(diagnostics) != 0 || selected.path != first || baseCalls != 0 {
+		t.Fatalf("selected = %#v, diagnostics = %#v, later base calls = %d", selected, diagnostics, baseCalls)
+	}
+}
+
+func TestResolveSearchTreatsShellLikeNamesLiterally(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	paths := []string{"~/literal.yml", "$CONFIG/literal.yml", "*.yaml"}
+	for _, name := range paths {
+		writeDiscoveryFile(t, filepath.Join(root, name), "value: literal\n")
+	}
+	helper := discoveryDirectoryHelpers{workingDir: func() (string, error) { return root, nil }}
+	for _, name := range paths {
+		selected, diagnostics := resolveSearchSource(Source{}, ptrSearch(Paths(name)), "", false, helper, discoveryHostProbe{})
+		if len(diagnostics) != 0 || selected.path != filepath.Join(root, name) {
+			t.Fatalf("literal %q selection = %#v, %#v", name, selected, diagnostics)
+		}
+	}
+}
+
+func ptrSearch(search Search) *Search { return &search }
+
+func writeDiscoveryFile(t *testing.T, path, contents string) {
+	t.Helper()
+	if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(path, []byte(contents), 0o600); err != nil {
+		t.Fatal(err)
+	}
+}

internal/engine/discovery_windows_test.go

@@ -0,0 +1,91 @@
+//go:build windows
+
+package engine
+
+import (
+	"errors"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestWindowsSearchRejectsReservedComponentsBeforeAcquisition(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	first := writeImportFile(t, root, "first.yml", "value: first\n")
+	for _, name := range []string{"CONIN$", "CONOUT$"} {
+		for _, source := range []Source{
+			SearchConfig(name, Searches(Paths(first), WorkingDirectory())),
+			SearchConfig("", Searches(Paths(first), SearchDirectory(root, DirectorySearchOptions{
+				Filenames: []FilenameGroup{CustomFilenames(name)},
+			}))),
+		} {
+			result, err := testLoad[discoveryLoadConfig](source, Options[discoveryLoadConfig]{})
+			var failure *LoadError
+			if result != nil || !errors.As(err, &failure) || len(failure.Diagnostics()) != 1 || failure.Diagnostics()[0].Code != CodeOptionsInvalid {
+				t.Fatalf("reserved component %q accepted: %#v, %v", name, result, err)
+			}
+			if len(failure.Sources()) != 0 {
+				t.Fatalf("reserved component %q was checked after acquisition: %#v", name, failure.Sources())
+			}
+		}
+	}
+}
+
+func TestWindowsSearchPathsMatchHostAbsoluteResolution(t *testing.T) {
+	root := t.TempDir()
+	file := writeImportFile(t, root, "settings/config.yml", "value: selected\n")
+	working := t.TempDir()
+	t.Chdir(working)
+	relative, err := filepath.Rel(working, file)
+	if err != nil {
+		t.Fatal(err)
+	}
+	volume := filepath.VolumeName(file)
+	rooted := strings.TrimPrefix(file, volume)
+	for _, entry := range []struct {
+		name string
+		path string
+	}{
+		{"relative", relative},
+		{"drive root relative", rooted},
+		{"slash root relative", filepath.ToSlash(rooted)},
+		{"drive relative", volume + relative},
+		{"absolute", file},
+	} {
+		t.Run(entry.name, func(t *testing.T) {
+			want, err := filepath.Abs(entry.path)
+			if err != nil {
+				t.Fatal(err)
+			}
+			explicit, err := testLoad[discoveryLoadConfig](File(entry.path))
+			if err != nil {
+				t.Fatal(err)
+			}
+			for _, search := range []Search{
+				Paths(entry.path),
+				SearchDirectory(filepath.Dir(entry.path), DirectorySearchOptions{
+					Filenames: []FilenameGroup{CustomFilenames(filepath.Base(entry.path))},
+				}),
+			} {
+				iterator, diagnostics := newSearchCandidateIterator(search, "", discoveryDirectoryHelpers{})
+				if len(diagnostics) != 0 {
+					t.Fatal(diagnostics)
+				}
+				candidate, ok, err := iterator.next()
+				if err != nil || !ok || candidate != want {
+					t.Fatalf("candidate = %q, %v, %v; want %q", candidate, ok, err, want)
+				}
+				result, err := testLoad[discoveryLoadConfig](SearchConfig("", search))
+				if err != nil || result.Config.Value != explicit.Config.Value {
+					t.Fatalf("searched path = %#v, %v; explicit value %q", result, err, explicit.Config.Value)
+				}
+				sources := result.Sources()
+				if len(sources) != 1 || sources[0].Path != explicit.Sources()[0].Path {
+					t.Fatalf("searched source = %#v; explicit source %#v", sources, explicit.Sources())
+				}
+			}
+		})
+	}
+}

internal/engine/explain.go

@@ -76,20 +76,55 @@ func (r *Inspection) Explain(path Path) (Explanation, bool) {
 
 	// Intermediate input replacements do not permanently suppress defaults:
 	// decoding applies them to the final input tree. Show that reconciliation
-	// explicitly, including canonical scalar conversions, before domain changes.
+	// explicitly before typed CLI contributions and domain resolution.
+	decodedInput := r.preCLI
+	decodedOrigins := r.preCLIOrigins
 	replayed, _ := documentAtPath(working, path)
-	decoded, _ := documentAtPathWithLookup(r.input, path, r.immutableLookup)
+	decoded, _ := documentAtPathWithLookup(decodedInput, path, r.immutableLookup)
 	if !configurationValuesEqual(replayed, decoded) {
+		origin := cloneOrigin(decodedOrigins[path.String()])
+		origin.Operation = ChangeDecoding
+		explanation.History = append(explanation.History, ValueChange{
+			Before:  valueSnapshot(working, path, r.secrets),
+			After:   valueSnapshotWithLookup(decodedInput, path, r.secrets, r.immutableLookup),
+			Origin:  origin,
+			Reasons: []string{"applied retained defaults and canonical typed decoding"},
+		})
+	}
+
+	working = document.Clone(decodedInput)
+	for _, application := range r.postDecodeApps {
+		operationPath, relevant := applicationOperationPath(application, path, r.immutableLookup)
+		var before ValueSnapshot
+		if relevant {
+			before = valueSnapshot(working, path, r.secrets)
+		}
+		applyHistoryApplication(&working, application, replayIndex)
+		if !relevant {
+			continue
+		}
+		after := valueSnapshot(working, path, r.secrets)
+		if !before.Present && !after.Present {
+			continue
+		}
+		explanation.History = append(explanation.History, ValueChange{
+			Before: before,
+			After:  after,
+			Origin: historyApplicationOrigin(application, operationPath, r.immutableLookup),
+		})
+	}
+	replayed, _ = documentAtPath(working, path)
+	effectiveInput, _ := documentAtPathWithLookup(r.input, path, r.immutableLookup)
+	if !configurationValuesEqual(replayed, effectiveInput) {
 		origin := cloneOrigin(r.inputOrigins[path.String()])
 		origin.Operation = ChangeDecoding
 		explanation.History = append(explanation.History, ValueChange{
 			Before:  valueSnapshot(working, path, r.secrets),
 			After:   valueSnapshotWithLookup(r.input, path, r.secrets, r.immutableLookup),
 			Origin:  origin,
-			Reasons: []string{"applied retained defaults and canonical typed decoding"},
+			Reasons: []string{"applied the typed CLI assignment"},
 		})
 	}
-
 	working = document.Clone(r.input)
 	for _, snapshot := range r.resolutionReplay {
 		relevant := pathsIntersect(snapshot.change.Path, path)

internal/engine/explain_test.go

@@ -351,6 +351,10 @@ func TestExplanationReconcilesDefaultsAfterInputReplacement(t *testing.T) {
 					opts.Overlay = "p"
 				}
 				result, err := testLoad(File(main), opts)
+				if cli && base == "replaced-text" {
+					requireSecretLoadCode(t, err, CodeDecodeType)
+					return
+				}
 				if err != nil {
 					t.Fatal(err)
 				}
@@ -360,6 +364,18 @@ func TestExplanationReconcilesDefaultsAfterInputReplacement(t *testing.T) {
 						t.Fatal("missing explanation")
 					}
 					last := explanation.History[len(explanation.History)-1]
+					if cli && path.String() == "/m" {
+						if last.After != explanation.Effective || last.Origin.Layer != LayerCLI || last.Origin.Operation != "" {
+							t.Fatalf("CLI assignment was not the final history event: %#v", explanation)
+						}
+						continue
+					}
+					if cli && path.String() == "/m/a" {
+						if explanation.Effective.Present {
+							t.Fatalf("CLI map override retained descendants discarded by source null: %#v", explanation)
+						}
+						continue
+					}
 					if last.After != explanation.Effective || last.Origin.Operation != ChangeDecoding {
 						t.Fatalf("history does not reconcile final value: %#v", explanation)
 					}

internal/engine/filesystem.go

@@ -3,23 +3,66 @@ package engine
 import (
 	"io/fs"
 	"os"
-	"path"
 	"path/filepath"
 	"strings"
 )
 
 func validateFilesystemContext(source Source, context *FilesystemContext, main parsedSource) *Diagnostic {
+	if source.kind == sourceNone && context.FS == nil {
+		return validateAbsentHostFilesystemContext(context)
+	}
 	if nativeContext(source, context) {
-		access, basePath, mainPath, diagnostic := nativeFilesystemAccess(source, context)
+		resolved, diagnostic := resolveNativeFilesystemContext(source, context)
 		if diagnostic != nil {
 			return diagnostic
 		}
-		return validateNativeDirectories(access, basePath, mainPath)
+		return validateResolvedFilesystemDirectories(resolved)
 	}
-	rootPath, _, _, diagnostic := importFilesystem(source, context, main)
+	resolved, diagnostic := resolveHostFilesystemContext(source, context, main, nil)
 	if diagnostic != nil {
 		return diagnostic
 	}
+	if diagnostic := validateResolvedFilesystemDirectories(resolved); diagnostic != nil {
+		return diagnostic
+	}
+	root, err := os.OpenRoot(resolved.rootPath)
+	if err != nil {
+		value := globFilesystemDiagnostic(err, "configuration root could not be opened", Location{})
+		value.Primary = nil
+		return &value
+	}
+	if err := root.Close(); err != nil {
+		value := importDiagnostic(CodeImportRead, "configuration root could not be closed", nil)
+		return &value
+	}
+	return nil
+}
+
+func validateAbsentHostFilesystemContext(context *FilesystemContext) *Diagnostic {
+	rootPath, err := canonicalExistingPath(context.Root)
+	if err != nil {
+		value := importDiagnostic(CodeImportInvalid, "configuration root could not be canonicalized", nil)
+		return &value
+	}
+	basePath := rootPath
+	if context.BaseDir != "" {
+		basePath, err = canonicalExistingPath(context.BaseDir)
+		if err != nil {
+			value := importDiagnostic(CodeImportInvalid, "import base directory could not be canonicalized", nil)
+			return &value
+		}
+	}
+	if !containedPath(rootPath, basePath) {
+		value := importDiagnostic(CodeImportOutsideRoot, "import base must stay inside the configuration root", nil)
+		return &value
+	}
+	for _, candidate := range []string{rootPath, basePath} {
+		info, err := os.Stat(candidate)
+		if err != nil || !info.IsDir() {
+			value := importDiagnostic(CodeImportInvalid, "configuration root and import base must be directories", nil)
+			return &value
+		}
+	}
 	root, err := os.OpenRoot(rootPath)
 	if err != nil {
 		value := globFilesystemDiagnostic(err, "configuration root could not be opened", Location{})
@@ -36,7 +79,16 @@ func validateFilesystemContext(source Source, context *FilesystemContext, main p
 func filesystemOptionDiagnostics(source Source, context *FilesystemContext) []Diagnostic {
 	switch source.kind {
 	case sourceNone:
-		return []Diagnostic{optionDiagnostic(CodeOptionsInvalid, "NoSource cannot use filesystem context")}
+		return absentFilesystemOptionDiagnostics(context)
+	case sourceSearch:
+		if context.FS != nil {
+			return absentFilesystemOptionDiagnostics(context)
+		}
+		// A selected host file can derive its root; absence requires an
+		// explicit root. Check that compatibility only after selection.
+		if context.BaseDir != "" && !filepath.IsAbs(context.BaseDir) {
+			return []Diagnostic{optionDiagnostic(CodeOptionsInvalid, "filesystem base directory must be an absolute host path")}
+		}
 	case sourceFile:
 		if context.FS != nil {
 			return []Diagnostic{optionDiagnostic(CodeOptionsInvalid, "host file sources cannot use a native filesystem context")}
@@ -69,115 +121,19 @@ func filesystemOptionDiagnostics(source Source, context *FilesystemContext) []Di
 	return nil
 }
 
-func nativeContext(source Source, context *FilesystemContext) bool {
-	return source.kind == sourceFilesystem || context != nil && context.FS != nil
-}
-
-// nativeFilesystemAccess resolves namespace context without opening caller
-// resources. File inputs always derive their base from the selected file.
-func nativeFilesystemAccess(source Source, context *FilesystemContext) (*filesystemAccess, string, string, *Diagnostic) {
-	var namespace *nativeNamespace
-	rootPath := "."
-	basePath := "."
-	mainPath := ""
-	if source.kind == sourceFilesystem {
-		namespace = source.namespace
-		mainPath = source.path
-		basePath = path.Dir(source.path)
-		if context != nil && context.Root != "" {
-			rootPath = context.Root
-		}
-	} else if context != nil && context.FS != nil {
-		namespace = context.FS.namespace
-		rootPath, basePath = context.Root, context.BaseDir
-	}
-	if namespace == nil || nilFilesystem(namespace.filesystem) || !fs.ValidPath(rootPath) || !fs.ValidPath(basePath) {
-		value := optionDiagnostic(CodeOptionsInvalid, "filesystem context is invalid")
-		return nil, "", "", &value
-	}
-	access := newNativeAccess(namespace.filesystem, rootPath, namespace.token)
-	access.label = namespace.label
-	if !access.contains(basePath) || mainPath != "" && !access.contains(mainPath) {
-		value := importDiagnostic(CodeImportOutsideRoot, "selected source and import base must stay inside the configuration root", nil)
-		return nil, "", "", &value
-	}
-	return access, basePath, mainPath, nil
-}
-
-func validateNativeDirectories(access *filesystemAccess, basePath, mainPath string) *Diagnostic {
-	if !access.contains(basePath) || mainPath != "" && !access.contains(mainPath) {
-		value := importDiagnostic(CodeImportOutsideRoot, "selected source and import base must stay inside the configuration root", nil)
-		return &value
-	}
-	for _, directory := range []string{access.rootPath, basePath} {
-		info, err := access.stat(directory)
-		if err != nil || !info.IsDir() {
-			value := importDiagnostic(CodeImportInvalid, "configuration root and import base must be directories", nil)
-			return &value
+func absentFilesystemOptionDiagnostics(context *FilesystemContext) []Diagnostic {
+	if context.FS != nil {
+		if context.FS.namespace == nil || nilFilesystem(context.FS.namespace.filesystem) || context.BaseDir == "" || context.Root == "" || !fs.ValidPath(context.BaseDir) || !fs.ValidPath(context.Root) {
+			return []Diagnostic{optionDiagnostic(CodeOptionsInvalid, "native filesystem context requires a namespace, base, and root directory")}
 		}
+	} else if context.Root == "" || !filepath.IsAbs(context.Root) || context.BaseDir != "" && !filepath.IsAbs(context.BaseDir) {
+		return []Diagnostic{optionDiagnostic(CodeOptionsInvalid, "absent-input filesystem root and base directories must be absolute host paths")}
 	}
 	return nil
 }
 
-func importFilesystem(source Source, context *FilesystemContext, main parsedSource) (rootPath, basePath, mainPath string, diagnostic *Diagnostic) {
-	if main.source == nil || main.document == nil {
-		value := importDiagnostic(CodeImportInvalid, "imports require a selected configuration source", nil)
-		return "", "", "", &value
-	}
-
-	if source.kind == sourceFile {
-		if context != nil && context.BaseDir != "" {
-			value := optionDiagnostic(CodeOptionsInvalid, "file sources determine their own import base directory")
-			return "", "", "", &value
-		}
-		canonical, err := canonicalExistingPath(source.path)
-		if err != nil {
-			value := importDiagnostic(CodeImportInvalid, "selected source path could not be canonicalized", nil)
-			return "", "", "", &value
-		}
-		mainPath = canonical
-		basePath = filepath.Dir(canonical)
-		rootPath = basePath
-		if context != nil && context.Root != "" {
-			rootPath, err = canonicalExistingPath(context.Root)
-			if err != nil {
-				value := importDiagnostic(CodeImportInvalid, "configuration root could not be canonicalized", nil)
-				return "", "", "", &value
-			}
-		}
-	} else {
-		if context == nil || context.BaseDir == "" || context.Root == "" {
-			value := optionDiagnostic(CodeOptionsInvalid, "byte and reader imports require absolute base and root directories")
-			return "", "", "", &value
-		}
-		if !filepath.IsAbs(context.BaseDir) || !filepath.IsAbs(context.Root) {
-			value := optionDiagnostic(CodeOptionsInvalid, "byte and reader import base and root directories must be absolute")
-			return "", "", "", &value
-		}
-		var err error
-		basePath, err = canonicalExistingPath(context.BaseDir)
-		if err != nil {
-			value := importDiagnostic(CodeImportInvalid, "import base directory could not be canonicalized", nil)
-			return "", "", "", &value
-		}
-		rootPath, err = canonicalExistingPath(context.Root)
-		if err != nil {
-			value := importDiagnostic(CodeImportInvalid, "configuration root could not be canonicalized", nil)
-			return "", "", "", &value
-		}
-	}
-	if !containedPath(rootPath, basePath) || (mainPath != "" && !containedPath(rootPath, mainPath)) {
-		value := importDiagnostic(CodeImportOutsideRoot, "selected source and import base must stay inside the configuration root", nil)
-		return "", "", "", &value
-	}
-	for _, candidate := range []string{rootPath, basePath} {
-		info, err := os.Stat(candidate)
-		if err != nil || !info.IsDir() {
-			value := importDiagnostic(CodeImportInvalid, "configuration root and import base must be directories", nil)
-			return "", "", "", &value
-		}
-	}
-	return rootPath, basePath, mainPath, nil
+func nativeContext(source Source, context *FilesystemContext) bool {
+	return source.kind == sourceFilesystem || context != nil && context.FS != nil
 }
 
 func canonicalExistingPath(name string) (string, error) {

internal/engine/filesystem_context.go

@@ -0,0 +1,176 @@
+package engine
+
+import (
+	"io/fs"
+	"os"
+	"path"
+	"path/filepath"
+	"strings"
+)
+
+type resolvedFilesystemContext struct {
+	native    *nativeNamespace
+	hostToken *namespaceToken
+	rootPath  string
+	basePath  string
+	mainPath  string
+}
+
+func resolveFilesystemContext(source Source, context *FilesystemContext, main parsedSource, hostToken *namespaceToken) (resolvedFilesystemContext, *Diagnostic) {
+	if source.kind == sourceNone && context != nil {
+		return resolveAbsentFilesystemContext(context)
+	}
+	if nativeContext(source, context) {
+		return resolveNativeFilesystemContext(source, context)
+	}
+	return resolveHostFilesystemContext(source, context, main, hostToken)
+}
+
+func resolveAbsentFilesystemContext(context *FilesystemContext) (resolvedFilesystemContext, *Diagnostic) {
+	if context.FS != nil {
+		return resolveNativeFilesystemContext(Source{kind: sourceNone}, context)
+	}
+	rootPath, err := canonicalExistingPath(context.Root)
+	if err != nil {
+		value := importDiagnostic(CodeImportInvalid, "configuration root could not be canonicalized", nil)
+		return resolvedFilesystemContext{}, &value
+	}
+	basePath := rootPath
+	if context.BaseDir != "" {
+		basePath, err = canonicalExistingPath(context.BaseDir)
+		if err != nil {
+			value := importDiagnostic(CodeImportInvalid, "import base directory could not be canonicalized", nil)
+			return resolvedFilesystemContext{}, &value
+		}
+	}
+	if !containedPath(rootPath, basePath) {
+		value := importDiagnostic(CodeImportOutsideRoot, "selected source and import base must stay inside the configuration root", nil)
+		return resolvedFilesystemContext{}, &value
+	}
+	return resolvedFilesystemContext{rootPath: rootPath, basePath: basePath}, nil
+}
+
+func resolveNativeFilesystemContext(source Source, context *FilesystemContext) (resolvedFilesystemContext, *Diagnostic) {
+	var namespace *nativeNamespace
+	resolved := resolvedFilesystemContext{rootPath: ".", basePath: "."}
+	if source.kind == sourceFilesystem {
+		namespace = source.namespace
+		resolved.mainPath = source.path
+		resolved.basePath = path.Dir(source.path)
+		if context != nil && context.Root != "" {
+			resolved.rootPath = context.Root
+		}
+	} else if context != nil && context.FS != nil {
+		namespace = context.FS.namespace
+		resolved.rootPath, resolved.basePath = context.Root, context.BaseDir
+	}
+	if namespace == nil || nilFilesystem(namespace.filesystem) || !fs.ValidPath(resolved.rootPath) || !fs.ValidPath(resolved.basePath) {
+		value := optionDiagnostic(CodeOptionsInvalid, "filesystem context is invalid")
+		return resolvedFilesystemContext{}, &value
+	}
+	resolved.native = namespace
+	if !containsNativePath(resolved.rootPath, resolved.basePath) || resolved.mainPath != "" && !containsNativePath(resolved.rootPath, resolved.mainPath) {
+		value := importDiagnostic(CodeImportOutsideRoot, "selected source and import base must stay inside the configuration root", nil)
+		return resolvedFilesystemContext{}, &value
+	}
+	return resolved, nil
+}
+
+func resolveHostFilesystemContext(source Source, context *FilesystemContext, main parsedSource, hostToken *namespaceToken) (resolvedFilesystemContext, *Diagnostic) {
+	if main.source == nil {
+		value := importDiagnostic(CodeImportInvalid, "imports require a selected configuration source", nil)
+		return resolvedFilesystemContext{}, &value
+	}
+	resolved := resolvedFilesystemContext{hostToken: hostToken}
+	if source.kind == sourceFile {
+		if context != nil && context.BaseDir != "" {
+			value := optionDiagnostic(CodeOptionsInvalid, "file sources determine their own import base directory")
+			return resolvedFilesystemContext{}, &value
+		}
+		canonical := main.source.Path
+		if canonical == "" {
+			var err error
+			canonical, err = canonicalExistingPath(source.path)
+			if err != nil {
+				value := importDiagnostic(CodeImportInvalid, "selected source path could not be canonicalized", nil)
+				return resolvedFilesystemContext{}, &value
+			}
+		}
+		resolved.mainPath = canonical
+		resolved.basePath = filepath.Dir(canonical)
+		resolved.rootPath = resolved.basePath
+		if context != nil && context.Root != "" {
+			rootPath, err := canonicalExistingPath(context.Root)
+			if err != nil {
+				value := importDiagnostic(CodeImportInvalid, "configuration root could not be canonicalized", nil)
+				return resolvedFilesystemContext{}, &value
+			}
+			resolved.rootPath = rootPath
+		}
+	} else {
+		if context == nil || context.BaseDir == "" || context.Root == "" {
+			value := optionDiagnostic(CodeOptionsInvalid, "byte and reader imports require absolute base and root directories")
+			return resolvedFilesystemContext{}, &value
+		}
+		if !filepath.IsAbs(context.BaseDir) || !filepath.IsAbs(context.Root) {
+			value := optionDiagnostic(CodeOptionsInvalid, "byte and reader import base and root directories must be absolute")
+			return resolvedFilesystemContext{}, &value
+		}
+		var err error
+		resolved.basePath, err = canonicalExistingPath(context.BaseDir)
+		if err != nil {
+			value := importDiagnostic(CodeImportInvalid, "import base directory could not be canonicalized", nil)
+			return resolvedFilesystemContext{}, &value
+		}
+		resolved.rootPath, err = canonicalExistingPath(context.Root)
+		if err != nil {
+			value := importDiagnostic(CodeImportInvalid, "configuration root could not be canonicalized", nil)
+			return resolvedFilesystemContext{}, &value
+		}
+	}
+	if !containedPath(resolved.rootPath, resolved.basePath) || resolved.mainPath != "" && !containedPath(resolved.rootPath, resolved.mainPath) {
+		value := importDiagnostic(CodeImportOutsideRoot, "selected source and import base must stay inside the configuration root", nil)
+		return resolvedFilesystemContext{}, &value
+	}
+	return resolved, nil
+}
+
+func containsNativePath(root, name string) bool {
+	if !fs.ValidPath(name) || !fs.ValidPath(root) {
+		return false
+	}
+	return root == "." || name == root || strings.HasPrefix(name, root+"/")
+}
+
+func validateResolvedFilesystemDirectories(resolved resolvedFilesystemContext) *Diagnostic {
+	for _, directory := range []string{resolved.rootPath, resolved.basePath} {
+		var info fs.FileInfo
+		var err error
+		if resolved.native != nil {
+			info, err = fs.Stat(resolved.native.filesystem, directory)
+		} else {
+			info, err = os.Stat(directory)
+		}
+		if err != nil || !info.IsDir() {
+			value := importDiagnostic(CodeImportInvalid, "configuration root and import base must be directories", nil)
+			return &value
+		}
+	}
+	return nil
+}
+
+func openResolvedFilesystemAccess(resolved resolvedFilesystemContext) (*filesystemAccess, error) {
+	if resolved.native != nil {
+		access := newNativeAccess(resolved.native.filesystem, resolved.rootPath, resolved.native.token)
+		access.label = resolved.native.label
+		return access, nil
+	}
+	access, err := openHostAccess(resolved.rootPath)
+	if err != nil {
+		return nil, err
+	}
+	if resolved.hostToken != nil {
+		access.token = resolved.hostToken
+	}
+	return access, nil
+}

internal/engine/filesystem_links.go

@@ -0,0 +1,247 @@
+package engine
+
+import (
+	"errors"
+	"io/fs"
+	"path"
+	"path/filepath"
+	"strings"
+)
+
+var (
+	errImportDirectoryLinkCycle = errors.New("directory link cycle")
+	errImportPathOutsideRoot    = errors.New("resolved import path is outside the configuration root")
+)
+
+// importEntryTarget describes a discovered entry without changing its lexical
+// candidate spelling. identity is resolved only to detect active traversal loops.
+type importEntryTarget struct {
+	symlink  bool
+	dir      bool
+	identity string
+}
+
+func (a *filesystemAccess) importEntryTarget(name string, entry fs.DirEntry, follow bool) (importEntryTarget, error) {
+	if a.native == nil {
+		relative, err := a.relative(name)
+		if err != nil {
+			return importEntryTarget{}, err
+		}
+		// Root.Lstat cannot follow absolute links in intermediate components,
+		// even when contained. Resolve parents first, leaving the final entry
+		// unexpanded so its discovered-link follow policy still applies.
+		if parent := filepath.Dir(relative); parent != "." {
+			resolvedParent, err := resolveHostImportPath(a, parent)
+			if err != nil {
+				return importEntryTarget{}, err
+			}
+			relative = filepath.Join(filepath.FromSlash(resolvedParent), filepath.Base(relative))
+		}
+		info, err := a.root.Lstat(relative)
+		if err != nil {
+			return importEntryTarget{}, err
+		}
+		symlink := info.Mode()&fs.ModeSymlink != 0
+		if symlink && !follow {
+			return importEntryTarget{symlink: true}, nil
+		}
+		if !symlink && !info.IsDir() {
+			return importEntryTarget{}, nil
+		}
+		resolved, err := resolveHostImportPath(a, relative)
+		if err != nil {
+			return importEntryTarget{}, err
+		}
+		resolvedPath := filepath.Join(a.rootPath, filepath.FromSlash(resolved))
+		info, err = a.root.Stat(filepath.FromSlash(resolved))
+		if err != nil {
+			return importEntryTarget{}, err
+		}
+		resolvedPath = filepath.Clean(resolvedPath)
+		return importEntryTarget{symlink: symlink, dir: info.IsDir(), identity: resolvedPath}, nil
+	}
+
+	linkFS, linksKnown := a.native.(fs.ReadLinkFS)
+	if linksKnown {
+		info, err := linkFS.Lstat(name)
+		if err != nil {
+			return importEntryTarget{}, err
+		}
+		symlink := info.Mode()&fs.ModeSymlink != 0
+		if symlink && !follow {
+			return importEntryTarget{symlink: true}, nil
+		}
+		if !symlink && !info.IsDir() {
+			return importEntryTarget{}, nil
+		}
+		resolved, err := resolveNativeImportPath(a, linkFS, name)
+		if err != nil {
+			return importEntryTarget{}, err
+		}
+		if !a.contains(resolved) {
+			return importEntryTarget{}, errImportPathOutsideRoot
+		}
+		info, err = fs.Stat(a.native, resolved)
+		if err != nil {
+			return importEntryTarget{}, err
+		}
+		return importEntryTarget{symlink: symlink, dir: info.IsDir(), identity: resolved}, nil
+	}
+
+	symlink := entry != nil && entry.Type()&fs.ModeSymlink != 0
+	if symlink && !follow {
+		return importEntryTarget{symlink: true}, nil
+	}
+	if entry != nil && !symlink {
+		mode := entry.Type()
+		if mode == 0 {
+			info, err := entry.Info()
+			if err != nil {
+				return importEntryTarget{}, err
+			}
+			mode = info.Mode()
+			symlink = mode&fs.ModeSymlink != 0
+			if symlink && !follow {
+				return importEntryTarget{symlink: true}, nil
+			}
+		}
+		if !symlink && !mode.IsDir() {
+			return importEntryTarget{}, nil
+		}
+		if !symlink && mode.IsDir() {
+			return importEntryTarget{dir: true, identity: name}, nil
+		}
+	}
+	info, err := fs.Stat(a.native, name)
+	if err != nil {
+		return importEntryTarget{}, err
+	}
+	return importEntryTarget{symlink: symlink, dir: info.IsDir(), identity: name}, nil
+}
+
+// A link stays active until its target has resolved, not until the entire
+// original pathname has resolved. Remaining segments may reuse a finished link.
+type importLinkFrame struct {
+	pending []string
+	link    string
+}
+
+func resolveHostImportPath(access *filesystemAccess, name string) (string, error) {
+	frames := []importLinkFrame{{pending: strings.Split(filepath.ToSlash(name), "/")}}
+	resolved := ""
+	activeLinks := make(map[string]struct{})
+	for len(frames) > 0 {
+		frame := &frames[len(frames)-1]
+		if len(frame.pending) == 0 {
+			delete(activeLinks, frame.link)
+			frames = frames[:len(frames)-1]
+			continue
+		}
+		segment := frame.pending[0]
+		frame.pending = frame.pending[1:]
+		candidate := path.Join(resolved, segment)
+		if candidate == "" {
+			candidate = "."
+		}
+		info, err := access.root.Lstat(filepath.FromSlash(candidate))
+		if err != nil {
+			return "", err
+		}
+		if info.Mode()&fs.ModeSymlink == 0 {
+			resolved = candidate
+			continue
+		}
+		if _, exists := activeLinks[candidate]; exists {
+			return "", errImportDirectoryLinkCycle
+		}
+		activeLinks[candidate] = struct{}{}
+		target, err := access.root.Readlink(filepath.FromSlash(candidate))
+		if err != nil {
+			return "", err
+		}
+		var targetPath string
+		if filepath.IsAbs(target) {
+			relative, err := filepath.Rel(access.rootPath, filepath.Clean(target))
+			if err != nil {
+				return "", errImportPathOutsideRoot
+			}
+			targetPath = path.Clean(filepath.ToSlash(relative))
+		} else {
+			targetPath = path.Clean(path.Join(path.Dir(candidate), filepath.ToSlash(target)))
+		}
+		if !withinPortableRoot(targetPath) {
+			return "", errImportPathOutsideRoot
+		}
+		frames = append(frames, importLinkFrame{pending: strings.Split(targetPath, "/"), link: candidate})
+		resolved = ""
+	}
+	if resolved == "" {
+		resolved = "."
+	}
+	return resolved, nil
+}
+
+func withinPortableRoot(name string) bool {
+	return name == "." || name != ".." && !strings.HasPrefix(name, "../") && !strings.HasPrefix(name, "/")
+}
+
+func resolveNativeImportPath(access *filesystemAccess, filesystem fs.ReadLinkFS, name string) (string, error) {
+	if !fs.ValidPath(name) || !access.contains(name) {
+		return "", fs.ErrInvalid
+	}
+	frames := []importLinkFrame{{pending: strings.Split(name, "/")}}
+	resolved := ""
+	activeLinks := make(map[string]struct{})
+	for len(frames) > 0 {
+		frame := &frames[len(frames)-1]
+		if len(frame.pending) == 0 {
+			delete(activeLinks, frame.link)
+			frames = frames[:len(frames)-1]
+			continue
+		}
+		segment := frame.pending[0]
+		frame.pending = frame.pending[1:]
+		candidate := path.Join(resolved, segment)
+		if candidate == "" {
+			candidate = "."
+		}
+		// Ancestors of a multi-component root are resolution prefixes, not
+		// selected targets. Complete paths and link targets remain contained.
+		if !access.contains(candidate) && !strings.HasPrefix(access.rootPath, candidate+"/") {
+			return "", errImportPathOutsideRoot
+		}
+		info, err := filesystem.Lstat(candidate)
+		if err != nil {
+			return "", err
+		}
+		if info.Mode()&fs.ModeSymlink == 0 {
+			resolved = candidate
+			continue
+		}
+		if _, exists := activeLinks[candidate]; exists {
+			return "", errImportDirectoryLinkCycle
+		}
+		activeLinks[candidate] = struct{}{}
+		target, err := filesystem.ReadLink(candidate)
+		if err != nil {
+			return "", err
+		}
+		if target == "" || strings.HasPrefix(target, "/") {
+			return "", errImportPathOutsideRoot
+		}
+		targetPath := path.Clean(path.Join(path.Dir(candidate), target))
+		if !fs.ValidPath(targetPath) || !access.contains(targetPath) {
+			return "", errImportPathOutsideRoot
+		}
+		frames = append(frames, importLinkFrame{pending: strings.Split(targetPath, "/"), link: candidate})
+		resolved = ""
+	}
+	if resolved == "" {
+		resolved = "."
+	}
+	return resolved, nil
+}
+
+func isImportLinkCycle(err error) bool {
+	return errors.Is(err, errImportDirectoryLinkCycle)
+}

internal/engine/filesystem_links_test.go

@@ -0,0 +1,47 @@
+package engine
+
+import (
+	"errors"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestImportLinkResolutionTracksActiveExpansions(t *testing.T) {
+	root := t.TempDir()
+	if err := os.Mkdir(filepath.Join(root, "parts"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	for name, target := range map[string]string{"parts/up": "..", "self": "self", "first": "second", "second": "first"} {
+		if err := os.Symlink(target, filepath.Join(root, filepath.FromSlash(name))); err != nil {
+			t.Skipf("symlinks unavailable: %v", err)
+		}
+	}
+	host, err := openHostAccess(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer host.close()
+	filesystem := os.DirFS(root)
+	links, ok := filesystem.(fs.ReadLinkFS)
+	if !ok {
+		t.Fatal("native directory filesystem does not expose link inspection")
+	}
+	native := newNativeAccess(filesystem, ".", &namespaceToken{})
+	for name, resolve := range map[string]func(string) (string, error){
+		"host":   func(name string) (string, error) { return resolveHostImportPath(host, name) },
+		"native": func(name string) (string, error) { return resolveNativeImportPath(native, links, name) },
+	} {
+		t.Run(name, func(t *testing.T) {
+			if got, err := resolve("parts/up/parts/up/parts"); err != nil || got != "parts" {
+				t.Errorf("finite link reuse = %q, %v", got, err)
+			}
+			for _, cycle := range []string{"self", "first"} {
+				if _, err := resolve(cycle); !errors.Is(err, errImportDirectoryLinkCycle) {
+					t.Errorf("%s cycle = %v", cycle, err)
+				}
+			}
+		})
+	}
+}

internal/engine/final_identity.go

@@ -0,0 +1,51 @@
+package engine
+
+import "gitea.maximumdirect.net/eric/ConfigKit/internal/document"
+
+func validateFinalSequenceIdentities(root *document.Node, policy sequencePolicy) []Diagnostic {
+	if root == nil || policy.selectorTrie == nil {
+		return nil
+	}
+	var diagnostics []Diagnostic
+	var visit func(*document.Node, Path, []*sequenceSelectorTrie)
+	visit = func(node *document.Node, path Path, states []*sequenceSelectorTrie) {
+		if node == nil {
+			return
+		}
+		if node.Kind == document.Sequence {
+			var fields []string
+			for _, state := range states {
+				if state.terminal {
+					fields = state.fields
+					break
+				}
+			}
+			if fields != nil {
+				_, issues := validateNormalizedSequenceIdentityFrom(node, path, fields, sequenceIdentityDiagnosticCodes{
+					invalid: CodeSequenceInvalid, conflict: CodeSequenceConflict,
+				}, 0, sequencePayloadRecord)
+				diagnostics = append(diagnostics, issues...)
+			}
+			return
+		}
+		if node.Kind != document.Mapping {
+			return
+		}
+		for _, entry := range node.Mapping {
+			next := make([]*sequenceSelectorTrie, 0, len(states)*2)
+			for _, state := range states {
+				if literal := state.literals[entry.Key]; literal != nil {
+					next = append(next, literal)
+				}
+				if state.wildcard != nil {
+					next = append(next, state.wildcard)
+				}
+			}
+			if len(next) != 0 {
+				visit(entry.Value, path.Key(entry.Key), next)
+			}
+		}
+	}
+	visit(root, Path{}, []*sequenceSelectorTrie{policy.selectorTrie})
+	return canonicalDiagnostics(diagnostics)
+}

internal/engine/glob.go

@@ -5,130 +5,223 @@ import (
 	"io/fs"
 	"path"
 	"slices"
+	"sort"
 	"strings"
 )
 
 const globReadBatch = 128
 
-type globCandidate struct {
-	absolute string
-	relative string
-}
-
-func (s *importTraversal) expandImportGlob(basePath string, declaration importDeclaration) ([]string, []Diagnostic) {
-	location := declaration.location
-	segments, valid := validGlobPattern(declaration.glob)
-	if !valid {
-		return nil, []Diagnostic{importDiagnostic(CodeImportInvalid, "import glob pattern is invalid or uses recursive ** syntax", &location)}
+// selectGlobImportCandidates expands path components while retaining the
+// lexical spelling used for filtering and later source admission.
+func selectGlobImportCandidates(access *filesystemAccess, basePath string, spec importDeclarationSpec, policy resolvedImportPolicy, limits importLimits, accounting *importAccounting) (importSelection, []Diagnostic) {
+	site := spec.fieldSites["glob"]
+	segments := spec.globSegments
+	if len(segments) == 0 {
+		var valid bool
+		segments, valid = validGlobPattern(spec.glob)
+		if !valid {
+			return importSelection{}, []Diagnostic{*importSelectionDiagnostic(site, CodeImportInvalid, "import glob pattern is invalid")}
+		}
 	}
-
-	candidates := []globCandidate{{absolute: basePath}}
+	if accounting == nil {
+		accounting = &importAccounting{}
+	}
+	rootPath := normalizedImportCandidatePath(access, basePath)
+	candidates := []selectedImportCandidate{{path: rootPath, accessPath: basePath, site: site}}
 	for index, segment := range segments {
 		last := index == len(segments)-1
 		literal, patterned := globLiteralSegment(segment)
-		var next []globCandidate
-		for _, candidate := range candidates {
-			var names []string
-			if patterned {
-				matched, diagnostics := s.readGlobMatches(candidate.absolute, segment, location)
+		// nextByPath is the set union of candidates reached from each matching
+		// parent at this segment; final exclusions below are set difference.
+		nextByPath := make(map[string]selectedImportCandidate)
+		for _, parent := range candidates {
+			if !patterned {
+				childPath := access.join(parent.path, literal)
+				childAccessPath := access.join(parent.accessPath, literal)
+				candidate, missing, diagnostics := explicitGlobCandidate(access, basePath, childPath, childAccessPath, site, last)
 				if len(diagnostics) != 0 {
-					return nil, diagnostics
+					return importSelection{}, diagnostics
 				}
-				names = matched
-			} else {
-				names = []string{literal}
+				if !missing {
+					nextByPath[candidate.path] = candidate
+				}
+				continue
 			}
-			for _, name := range names {
-				absolute := s.access.join(candidate.absolute, name)
-				relative := path.Join(candidate.relative, name)
-				if !s.access.contains(absolute) {
-					return nil, []Diagnostic{importDiagnostic(CodeImportOutsideRoot, "glob traversal is outside the configuration root", &location)}
-				}
-				canonical, err := s.access.canonical(absolute)
+
+			entries, missing, diagnostics := readGlobEntries(access, parent.accessPath, site.location, limits, accounting)
+			if len(diagnostics) != 0 {
+				return importSelection{}, diagnostics
+			}
+			if missing {
+				continue
+			}
+			for _, entry := range entries {
+				matched, err := path.Match(segment, entry.Name())
 				if err != nil {
-					if errors.Is(err, fs.ErrNotExist) && !patterned {
-						continue
-					}
-					return nil, []Diagnostic{globFilesystemDiagnostic(err, "glob match could not be canonicalized", location)}
+					return importSelection{}, []Diagnostic{*importSelectionDiagnostic(site, CodeImportInvalid, "import glob pattern is invalid")}
 				}
-				if !s.access.contains(canonical) {
-					return nil, []Diagnostic{importDiagnostic(CodeImportOutsideRoot, "glob traversal resolves outside the configuration root", &location)}
-				}
-				if last {
-					next = append(next, globCandidate{absolute: canonical, relative: relative})
-					if s.accounting.sources+len(next) > s.limits.sources {
-						return nil, []Diagnostic{importDiagnostic(CodeImportLimitExceeded, "glob matches exceed the remaining source-count limit", &location)}
-					}
+				if !matched || !policy.hidden && strings.HasPrefix(entry.Name(), ".") {
 					continue
 				}
-				info, err := s.access.stat(canonical)
+				accessPath := access.join(parent.accessPath, entry.Name())
+				lexicalPath := access.join(parent.path, entry.Name())
+				if !access.contains(accessPath) || !access.contains(lexicalPath) {
+					return importSelection{}, []Diagnostic{*importSelectionDiagnostic(site, CodeImportOutsideRoot, "glob traversal is outside the configuration root")}
+				}
+				target, err := access.importEntryTarget(accessPath, entry, policy.follow)
 				if err != nil {
-					return nil, []Diagnostic{globFilesystemDiagnostic(err, "glob traversal target could not be inspected", location)}
+					return importSelection{}, []Diagnostic{globCandidateDiagnostic(err, site.location, "glob match could not be inspected")}
 				}
-				if info.IsDir() {
-					next = append(next, globCandidate{absolute: canonical, relative: relative})
+				if target.symlink && !policy.follow {
+					continue
 				}
+				if !last && !target.dir {
+					continue
+				}
+				physicalPath := target.identity
+				// Native source identity and relative imports use the namespace
+				// spelling; resolved link identities belong only to discovery.
+				if access.native != nil {
+					physicalPath = accessPath
+				}
+				if physicalPath == "" {
+					physicalPath, err = access.canonical(accessPath)
+					if err != nil {
+						return importSelection{}, []Diagnostic{globFilesystemDiagnostic(err, "glob match could not be canonicalized", site.location)}
+					}
+				}
+				candidate := selectedImportCandidate{
+					path: normalizedImportCandidatePath(access, lexicalPath), accessPath: physicalPath,
+					label: relativeImportLabel(access, basePath, lexicalPath), site: site,
+				}
+				nextByPath[candidate.path] = candidate
 			}
 		}
-		candidates = next
+		candidates = candidatesFromMap(nextByPath)
 		if len(candidates) == 0 {
-			return nil, nil
+			break
 		}
 	}
 
-	matches := make([]string, len(candidates))
-	for index, candidate := range candidates {
-		matches[index] = candidate.relative
+	selected := make([]selectedImportCandidate, 0, len(candidates))
+	for _, candidate := range candidates {
+		missing, _, diagnostic := validateNamedImportTarget(access, candidate, false, false)
+		if diagnostic != nil {
+			return importSelection{}, []Diagnostic{*diagnostic}
+		}
+		if missing || excludedBasename(path.Base(candidate.path), policy.exclude) {
+			continue
+		}
+		selected = append(selected, candidate)
 	}
-	slices.Sort(matches)
-	return matches, nil
+	if policy.required && len(selected) == 0 {
+		return importSelection{}, []Diagnostic{*importSelectionDiagnostic(site, CodeImportMissing, "required import glob selected no files")}
+	}
+	// Source allowance is charged by source admission, after this filtered set
+	// reaches the traversal; that preserves repeated-source diagnostics first.
+	selection := importSelection{candidates: selected}
+	if len(selected) != 0 {
+		selection.outcome = importSelectionHasCandidates
+	}
+	return selection, nil
 }
 
-func (s *importTraversal) readGlobMatches(directory, pattern string, location Location) ([]string, []Diagnostic) {
-	canonical, err := s.access.canonical(directory)
+func explicitGlobCandidate(access *filesystemAccess, basePath, candidatePath, accessPath string, site importFieldSite, last bool) (selectedImportCandidate, bool, []Diagnostic) {
+	if !access.contains(candidatePath) || !access.contains(accessPath) {
+		return selectedImportCandidate{}, false, []Diagnostic{*importSelectionDiagnostic(site, CodeImportOutsideRoot, "glob traversal is outside the configuration root")}
+	}
+	target, err := access.importEntryTarget(accessPath, nil, true)
 	if err != nil {
 		if errors.Is(err, fs.ErrNotExist) {
-			return nil, nil
+			return selectedImportCandidate{}, true, nil
 		}
-		return nil, []Diagnostic{globFilesystemDiagnostic(err, "glob directory could not be canonicalized", location)}
+		return selectedImportCandidate{}, false, []Diagnostic{globCandidateDiagnostic(err, site.location, "glob match could not be inspected")}
 	}
-	if !s.access.contains(canonical) {
-		return nil, []Diagnostic{importDiagnostic(CodeImportOutsideRoot, "glob directory resolves outside the configuration root", &location)}
+	canonical, err := access.canonical(accessPath)
+	if err != nil {
+		if errors.Is(err, fs.ErrNotExist) {
+			return selectedImportCandidate{}, true, nil
+		}
+		return selectedImportCandidate{}, false, []Diagnostic{globFilesystemDiagnostic(err, "glob match could not be canonicalized", site.location)}
 	}
-	if _, err := s.access.relative(canonical); err != nil {
-		return nil, []Diagnostic{importDiagnostic(CodeImportOutsideRoot, "glob directory could not be addressed inside the configuration root", &location)}
+	if !access.contains(canonical) {
+		return selectedImportCandidate{}, false, []Diagnostic{*importSelectionDiagnostic(site, CodeImportOutsideRoot, "glob traversal resolves outside the configuration root")}
 	}
-	var matches []string
-	var problem *Diagnostic
-	err = s.access.readDirectory(canonical, func(entry fs.DirEntry) bool {
-		s.accounting.entries++
-		if s.accounting.entries > s.limits.entries {
-			value := importDiagnostic(CodeImportLimitExceeded, "glob traversal exceeds the directory-entry visit limit", &location)
-			problem = &value
-			return false
+	if !last {
+		if !target.dir {
+			return selectedImportCandidate{}, true, nil
 		}
-		matched, matchErr := path.Match(pattern, entry.Name())
-		if matchErr != nil {
-			value := importDiagnostic(CodeImportInvalid, "import glob pattern is invalid", &location)
-			problem = &value
-			return false
+	}
+	return selectedImportCandidate{
+		path: normalizedImportCandidatePath(access, candidatePath), accessPath: canonical,
+		label: relativeImportLabel(access, basePath, candidatePath), site: site,
+	}, false, nil
+}
+
+func readGlobEntries(access *filesystemAccess, directory string, location Location, limits importLimits, accounting *importAccounting) ([]fs.DirEntry, bool, []Diagnostic) {
+	target, err := access.importEntryTarget(directory, nil, true)
+	if err != nil {
+		if errors.Is(err, fs.ErrNotExist) {
+			return nil, true, nil
 		}
-		if matched {
-			matches = append(matches, entry.Name())
+		return nil, false, []Diagnostic{globCandidateDiagnostic(err, location, "glob directory could not be inspected")}
+	}
+	canonical, err := access.canonical(directory)
+	if err != nil {
+		if errors.Is(err, fs.ErrNotExist) {
+			return nil, true, nil
 		}
-		return true
+		return nil, false, []Diagnostic{globFilesystemDiagnostic(err, "glob directory could not be canonicalized", location)}
+	}
+	if !access.contains(canonical) {
+		return nil, false, []Diagnostic{importDiagnostic(CodeImportOutsideRoot, "glob directory resolves outside the configuration root", &location)}
+	}
+	if _, err := access.relative(canonical); err != nil {
+		return nil, false, []Diagnostic{importDiagnostic(CodeImportOutsideRoot, "glob directory could not be addressed inside the configuration root", &location)}
+	}
+	readPath := target.identity
+	if readPath == "" {
+		readPath = canonical
+	}
+	entries := make([]fs.DirEntry, 0)
+	err = visitBoundedImportDirectory(access, readPath, limits.entries, accounting, func(entry fs.DirEntry) error {
+		entries = append(entries, entry)
+		return nil
 	})
-	if problem != nil {
-		return nil, []Diagnostic{*problem}
+	if errors.Is(err, errImportDirectoryEntryLimit) {
+		return nil, false, []Diagnostic{importDiagnostic(CodeImportLimitExceeded, "glob traversal exceeds the directory-entry visit limit", &location)}
 	}
 	if errors.Is(err, fs.ErrNotExist) {
-		return nil, nil
+		return nil, true, nil
 	}
 	if err != nil {
-		return nil, []Diagnostic{globFilesystemDiagnostic(err, "glob directory could not be traversed", location)}
+		return nil, false, []Diagnostic{globFilesystemDiagnostic(err, "glob directory could not be traversed", location)}
 	}
-	slices.Sort(matches)
-	return matches, nil
+	sort.Slice(entries, func(left, right int) bool { return entries[left].Name() < entries[right].Name() })
+	return entries, false, nil
+}
+
+func globCandidateDiagnostic(err error, location Location, message string) Diagnostic {
+	if errors.Is(err, errImportDirectoryLinkCycle) {
+		return importDiagnostic(CodeImportCycle, "directory traversal cycle detected", &location)
+	}
+	if errors.Is(err, errImportPathOutsideRoot) {
+		return importDiagnostic(CodeImportOutsideRoot, "glob traversal resolves outside the configuration root", &location)
+	}
+	return globFilesystemDiagnostic(err, message, location)
+}
+
+func candidatesFromMap(candidates map[string]selectedImportCandidate) []selectedImportCandidate {
+	paths := make([]string, 0, len(candidates))
+	for candidatePath := range candidates {
+		paths = append(paths, candidatePath)
+	}
+	slices.Sort(paths)
+	result := make([]selectedImportCandidate, 0, len(paths))
+	for _, candidatePath := range paths {
+		result = append(result, candidates[candidatePath])
+	}
+	return result
 }
 
 func validGlobPattern(pattern string) ([]string, bool) {

internal/engine/glob_selection_test.go

@@ -0,0 +1,203 @@
+package engine
+
+import (
+	"io/fs"
+	"os"
+	"path/filepath"
+	"testing"
+	"testing/fstest"
+)
+
+func TestSelectGlobFiltersOnlyWildcardDiscoveredEntries(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	for name, content := range map[string]string{
+		".hidden/secret.yaml": "value: hidden\n",
+		"visible/item.yaml":   "value: visible\n",
+		"visible/source.txt":  "value: source\n",
+	} {
+		filename := filepath.Join(root, filepath.FromSlash(name))
+		if err := os.MkdirAll(filepath.Dir(filename), 0o700); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(filename, []byte(content), 0o600); err != nil {
+			t.Fatal(err)
+		}
+	}
+	for alias, target := range map[string]string{
+		"visible-alias":  "visible",
+		"selected.yaml":  "visible/source.txt",
+		"unselected.txt": "visible/item.yaml",
+		".secret.yaml":   "visible/source.txt",
+	} {
+		if err := os.Symlink(target, filepath.Join(root, filepath.FromSlash(alias))); err != nil {
+			t.Skipf("symlinks are unavailable: %v", err)
+		}
+	}
+	access, err := openHostAccess(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer access.close()
+
+	selection := selectGlobForTest(t, access, root, `    - glob: '*/*.yaml'
+      follow: false
+      hidden: false
+`)
+	if got, want := selectedPathsRelativeTo(selection, root), []string{"visible/item.yaml"}; !equalStrings(got, want) {
+		t.Fatalf("filtered glob candidates = %#v, want %#v", got, want)
+	}
+
+	selection = selectGlobForTest(t, access, root, `    - glob: '.hidden/*.yaml'
+      follow: false
+      hidden: false
+`)
+	if got, want := selectedPathsRelativeTo(selection, root), []string{".hidden/secret.yaml"}; !equalStrings(got, want) {
+		t.Fatalf("literal hidden component candidates = %#v, want %#v", got, want)
+	}
+
+	selection = selectGlobForTest(t, access, root, `    - glob: 'visible-alias/*.yaml'
+      follow: false
+      hidden: false
+`)
+	if got, want := selectedPathsRelativeTo(selection, root), []string{"visible-alias/item.yaml"}; !equalStrings(got, want) {
+		t.Fatalf("literal symlink component candidates = %#v, want %#v", got, want)
+	}
+
+	selection = selectGlobForTest(t, access, root, `    - glob: '*.yaml'
+      follow: false
+      hidden: true
+`)
+	if len(selection.candidates) != 0 {
+		t.Fatalf("follow:false selected a discovered file symlink: %#v", selection.candidates)
+	}
+
+	selection = selectGlobForTest(t, access, root, `    - glob: '*.yaml'
+      follow: true
+      hidden: false
+`)
+	if got, want := selectedPathsRelativeTo(selection, root), []string{"selected.yaml"}; !equalStrings(got, want) {
+		t.Fatalf("filename aliases were not filtered by candidate spelling: %#v, want %#v", got, want)
+	}
+}
+
+func TestSelectGlobAppliesExclusionsBeforeSourceAdmissionWithoutOpeningFiles(t *testing.T) {
+	t.Parallel()
+
+	filesystem := &observedGlobFilesystem{files: fstest.MapFS{
+		"parts":                 &fstest.MapFile{Mode: fs.ModeDir | 0o700},
+		"parts/keep.yaml":       &fstest.MapFile{Data: []byte("not parsed: [\n")},
+		"parts/skip-one.yaml":   &fstest.MapFile{Data: []byte("not parsed: [\n")},
+		"parts/skip-two.yaml":   &fstest.MapFile{Data: []byte("not parsed: [\n")},
+		"parts/skip-three.yaml": &fstest.MapFile{Data: []byte("not parsed: [\n")},
+	}}
+	access := newNativeAccess(filesystem, ".", &namespaceToken{})
+	specs, diagnostics := parseImportSpecsYAML(t, `    - glob: 'parts/*.yaml'
+      exclude: 'skip-*.yaml'
+`)
+	if len(diagnostics) != 0 {
+		t.Fatal(diagnostics)
+	}
+	policy, diagnostics := resolveImportPolicy(specs[0], importDefaults{})
+	if len(diagnostics) != 0 {
+		t.Fatal(diagnostics)
+	}
+	limits := defaultImportLimits()
+	limits.sources = 2
+	accounting := &importAccounting{sources: 1}
+	selection, diagnostics := selectGlobImportCandidates(access, ".", specs[0], policy, limits, accounting)
+	if len(diagnostics) != 0 || !equalStrings(selectedPaths(selection), []string{"parts/keep.yaml"}) {
+		t.Fatalf("post-exclusion selection, diagnostics = %#v, %#v", selection, diagnostics)
+	}
+	if len(filesystem.opened) != 1 || filesystem.opened[0] != "parts" {
+		t.Fatalf("glob opened paths = %#v, want only the parts directory", filesystem.opened)
+	}
+	if accounting.sources+len(selection.candidates) > limits.sources {
+		t.Fatalf("final candidate set exceeds the private source limit: accounting=%#v selection=%#v", accounting, selection.candidates)
+	}
+}
+
+func TestSelectGlobRejectsEscapingWildcardLinks(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	outside := t.TempDir()
+	if err := os.WriteFile(filepath.Join(outside, "file.yaml"), []byte("value: outside\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink(outside, filepath.Join(root, "escape")); err != nil {
+		t.Skipf("symlinks are unavailable: %v", err)
+	}
+	access, err := openHostAccess(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer access.close()
+
+	_, diagnostics := selectGlobForTestWithDiagnostics(t, access, root, `    - glob: '*/file.yaml'
+      follow: true
+`)
+	if len(diagnostics) != 1 || diagnostics[0].Code != CodeImportOutsideRoot {
+		t.Fatalf("escaping glob diagnostics = %#v, want import.outside_root", diagnostics)
+	}
+	selection := selectGlobForTest(t, access, root, `    - glob: '*/file.yaml'
+      follow: false
+`)
+	if len(selection.candidates) != 0 {
+		t.Fatalf("follow:false selected an escaping alias: %#v", selection.candidates)
+	}
+}
+
+func TestSelectGlobPreservesMatchedDirectoryValidityBeforeExclusion(t *testing.T) {
+	t.Parallel()
+
+	filesystem := fstest.MapFS{
+		"parts":                &fstest.MapFile{Mode: fs.ModeDir | 0o700},
+		"parts/matched.yaml":   &fstest.MapFile{Mode: fs.ModeDir | 0o700},
+		"parts/matched.yaml/x": &fstest.MapFile{Data: []byte("value: x\n")},
+	}
+	access := newNativeAccess(filesystem, ".", &namespaceToken{})
+	_, diagnostics := selectGlobForTestWithDiagnostics(t, access, ".", `    - glob: 'parts/*.yaml'
+      exclude: '*.yaml'
+`)
+	if len(diagnostics) != 1 || diagnostics[0].Code != CodeSourceNotRegular {
+		t.Fatalf("excluded directory diagnostics = %#v, want source.not_regular", diagnostics)
+	}
+}
+
+func selectGlobForTest(t *testing.T, access *filesystemAccess, base, declaration string) importSelection {
+	t.Helper()
+	selection, diagnostics := selectGlobForTestWithDiagnostics(t, access, base, declaration)
+	if len(diagnostics) != 0 {
+		t.Fatalf("glob selection diagnostics = %#v", diagnostics)
+	}
+	return selection
+}
+
+func selectGlobForTestWithDiagnostics(t *testing.T, access *filesystemAccess, base, declaration string) (importSelection, []Diagnostic) {
+	t.Helper()
+	specs, diagnostics := parseImportSpecsYAML(t, declaration)
+	if len(diagnostics) != 0 {
+		t.Fatalf("parse diagnostics = %#v", diagnostics)
+	}
+	policy, diagnostics := resolveImportPolicy(specs[0], importDefaults{})
+	if len(diagnostics) != 0 {
+		t.Fatalf("policy diagnostics = %#v", diagnostics)
+	}
+	return selectGlobImportCandidates(access, base, specs[0], policy, defaultImportLimits(), &importAccounting{})
+}
+
+type observedGlobFilesystem struct {
+	files  fstest.MapFS
+	opened []string
+}
+
+func (filesystem *observedGlobFilesystem) Open(name string) (fs.File, error) {
+	filesystem.opened = append(filesystem.opened, name)
+	return filesystem.files.Open(name)
+}
+
+func (filesystem *observedGlobFilesystem) Stat(name string) (fs.FileInfo, error) {
+	return fs.Stat(filesystem.files, name)
+}

internal/engine/glob_test.go

@@ -1,6 +1,7 @@
 package engine
 
 import (
+	"errors"
 	"os"
 	"path/filepath"
 	"reflect"
@@ -106,7 +107,7 @@ func TestLoadGlobImportsRejectInvalidAndUnmatchedPatterns(t *testing.T) {
 			if err := os.Mkdir(filepath.Join(directory, "empty"), 0o755); err != nil {
 				t.Fatal(err)
 			}
-			mainPath := writeGlobRoot(t, directory, test.pattern, false)
+			mainPath := writeGlobRoot(t, directory, test.pattern, test.code == CodeImportMissing)
 			requireLoadCode(t, File(mainPath), Options[importTestConfig]{Imports: true}, test.code)
 		})
 	}
@@ -115,7 +116,7 @@ func TestLoadGlobImportsRejectInvalidAndUnmatchedPatterns(t *testing.T) {
 	if err := os.Mkdir(filepath.Join(directory, "empty"), 0o755); err != nil {
 		t.Fatal(err)
 	}
-	mainPath := writeGlobRoot(t, directory, "empty/*.yml", true)
+	mainPath := writeGlobRoot(t, directory, "empty/*.yml", false)
 	result, err := testLoad[importTestConfig](File(mainPath), Options[importTestConfig]{Imports: true})
 	if err != nil || len(result.Sources()) != 1 {
 		t.Fatalf("optional unmatched glob = %#v, %v", result, err)
@@ -139,7 +140,7 @@ func TestLoadGlobImportsPreserveIdentityAndFileRules(t *testing.T) {
 		if err := os.MkdirAll(filepath.Join(directory, "conf/matched.yml"), 0o755); err != nil {
 			t.Fatal(err)
 		}
-		mainPath := writeGlobRoot(t, directory, "conf/*.yml", true)
+		mainPath := writeGlobRoot(t, directory, "conf/*.yml", false)
 		requireLoadCode(t, File(mainPath), Options[importTestConfig]{Imports: true}, CodeSourceNotRegular)
 	})
 
@@ -168,6 +169,10 @@ func TestLoadGlobImportsConfineSymlinkDirectories(t *testing.T) {
 		mainPath := writeGlobRoot(t, root, "linked/*.yml", false)
 		result, err := testLoad[importTestConfig](File(mainPath), Options[importTestConfig]{Imports: true})
 		if err != nil || result.Config.Items["linked"] != "linked" {
+			var loadError *LoadError
+			if errors.As(err, &loadError) {
+				t.Fatalf("contained directory symlink = %#v, diagnostics %#v", result, loadError.Diagnostics())
+			}
 			t.Fatalf("contained directory symlink = %#v, %v", result, err)
 		}
 	})
@@ -179,7 +184,7 @@ func TestLoadGlobImportsConfineSymlinkDirectories(t *testing.T) {
 		if err := os.Symlink(outside, filepath.Join(root, "linked")); err != nil {
 			t.Skipf("symlinks unavailable: %v", err)
 		}
-		mainPath := writeGlobRoot(t, root, "linked/*.yml", true)
+		mainPath := writeGlobRoot(t, root, "linked/*.yml", false)
 		requireLoadCode(t, File(mainPath), Options[importTestConfig]{Imports: true}, CodeImportOutsideRoot)
 	})
 }
@@ -198,7 +203,7 @@ func TestOptionalGlobDoesNotSuppressDirectoryPermissionFailure(t *testing.T) {
 		_ = opened.Close()
 		t.Skip("filesystem does not enforce the unreadable-directory fixture")
 	}
-	mainPath := writeGlobRoot(t, directory, "locked/*.yml", true)
+	mainPath := writeGlobRoot(t, directory, "locked/*.yml", false)
 	requireLoadCode(t, File(mainPath), Options[importTestConfig]{Imports: true}, CodeImportPermission)
 }
 
@@ -207,11 +212,12 @@ func TestGlobTraversalBoundsNonmatchesAndAcceptedCandidates(t *testing.T) {
 	for _, name := range []string{"one.txt", "two.txt", "three.txt"} {
 		writeImportFile(t, directory, "many/"+name, "ignored\n")
 	}
-	mainPath := writeGlobRoot(t, directory, "many/*.yml", true)
+	mainPath := writeGlobRoot(t, directory, "many/*.yml", false)
 	main := parseImportMain(t, mainPath)
 	limits := defaultImportLimits()
 	limits.entries = 2
-	_, _, diagnostics := loadImportedDocuments(File(mainPath), nil, main, nil, limits)
+	request := testImportRequest(File(mainPath), nil, main, Path{}, nil, nil)
+	_, _, diagnostics := testAcquireImportWithLimits(request, limits)
 	if len(diagnostics) != 1 || diagnostics[0].Code != CodeImportLimitExceeded {
 		t.Fatalf("entry-budget diagnostics = %#v", diagnostics)
 	}
@@ -223,7 +229,8 @@ func TestGlobTraversalBoundsNonmatchesAndAcceptedCandidates(t *testing.T) {
 	main = parseImportMain(t, mainPath)
 	limits = defaultImportLimits()
 	limits.sources = 2
-	_, _, diagnostics = loadImportedDocuments(File(mainPath), nil, main, nil, limits)
+	request = testImportRequest(File(mainPath), nil, main, Path{}, nil, nil)
+	_, _, diagnostics = testAcquireImportWithLimits(request, limits)
 	if len(diagnostics) != 1 || diagnostics[0].Code != CodeImportLimitExceeded {
 		t.Fatalf("candidate-budget diagnostics = %#v", diagnostics)
 	}
@@ -263,11 +270,53 @@ func TestFilesystemContextIsValidatedWithoutImportsOrActiveOverlay(t *testing.T)
 	}
 }
 
-func writeGlobRoot(t *testing.T, directory, pattern string, optional bool) string {
-	t.Helper()
-	optionalLine := ""
-	if optional {
-		optionalLine = "\n      optional: true"
+func TestNoSourceImportsAndFilesystemContext(t *testing.T) {
+	t.Parallel()
+
+	directory := t.TempDir()
+	for _, imports := range []bool{false, true} {
+		name := "imports disabled"
+		if imports {
+			name = "imports enabled"
+		}
+		t.Run(name, func(t *testing.T) {
+			result, err := testLoad[importTestConfig](NoSource(), Options[importTestConfig]{
+				Imports: imports, Filesystem: &FilesystemContext{Root: directory},
+			})
+			if err != nil {
+				t.Fatal(err)
+			}
+			if sources := result.Sources(); len(sources) != 0 {
+				t.Fatalf("NoSource sources = %#v", sources)
+			}
+			if _, ok := result.Metadata().Lookup(Keys("items", "root")); ok {
+				t.Fatal("NoSource contributed explicit input")
+			}
+		})
+	}
+
+	outside := t.TempDir()
+	for _, test := range []struct {
+		name    string
+		context FilesystemContext
+		code    Code
+	}{
+		{name: "missing root", context: FilesystemContext{BaseDir: directory}, code: CodeOptionsInvalid},
+		{name: "relative root", context: FilesystemContext{Root: "."}, code: CodeOptionsInvalid},
+		{name: "missing root directory", context: FilesystemContext{Root: filepath.Join(directory, "missing")}, code: CodeImportInvalid},
+		{name: "base outside root", context: FilesystemContext{BaseDir: outside, Root: directory}, code: CodeImportOutsideRoot},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			requireLoadCode(t, NoSource(), Options[importTestConfig]{Filesystem: &test.context}, test.code)
+		})
 	}
-	return writeImportFile(t, directory, "main.yml", "configkit:\n  imports:\n    - glob: '"+pattern+"'"+optionalLine+"\n")
+}
+
+func writeGlobRoot(t *testing.T, directory, pattern string, required bool) string {
+	t.Helper()
+	requiredLine := ""
+	if required {
+		requiredLine = "\n      required: true"
+	}
+	return writeImportFile(t, directory, "main.yml", "configkit:\n  imports:\n    - glob: '"+pattern+"'"+requiredLine+"\n")
 }

internal/engine/history.go

@@ -42,15 +42,15 @@ func (c *retainedNodeCounter) add(root *document.Node) bool {
 
 // History applications borrow immutable policy-validated input trees. Metadata
 // records answer presence and origin queries; replay reconstructs value changes.
-// Replay reconciles with canonical decoding before domain resolution so both
-// contracts agree on the effective result without retaining a tree per field.
+// Replay reconciles with canonical decoding, applies supplied CLI contributions,
+// then records domain resolution without retaining a tree per field.
 type historyApplication struct {
 	layer           Layer
 	path            Path
 	value           *document.Node
 	origin          Origin
 	sequences       []sequenceHistoryContribution
-	sequencesByPath map[string]sequenceHistoryContribution
+	sequencesByPath map[string]sequenceHistoryContributionIndex
 }
 
 func cloneHistoryApplications(values []historyApplication) []historyApplication {
@@ -92,7 +92,14 @@ func walkHistoryApplication(application historyApplication, visit func(local, ef
 			for index, child := range node.Sequence {
 				effectiveIndex := index
 				if projected {
-					effectiveIndex += contribution.offset
+					if contribution.mode == sequenceHistoryMapped {
+						effectiveIndex = contribution.outputForInput(index)
+						if effectiveIndex < 0 {
+							continue
+						}
+					} else {
+						effectiveIndex += contribution.offset
+					}
 				}
 				walk(child, local.Index(index), effective.Index(effectiveIndex))
 			}
@@ -112,7 +119,18 @@ func historyApplicationLocalPath(application historyApplication, effective Path)
 	for _, segment := range relative.segments {
 		if contribution, found := sequenceHistoryAt(application.sequencesByPath, local); found {
 			index, valid := schemaIndex(segment)
-			if !valid || segment.kind == pathSegmentKey || index < contribution.offset || index >= contribution.offset+contribution.length {
+			if !valid || segment.kind == pathSegmentKey {
+				return Path{}, false
+			}
+			if contribution.mode == sequenceHistoryMapped {
+				inputIndex := contribution.inputForOutput(index)
+				if inputIndex < 0 {
+					return Path{}, false
+				}
+				local = local.Index(inputIndex)
+				continue
+			}
+			if index < contribution.offset || index >= contribution.offset+contribution.length {
 				return Path{}, false
 			}
 			local = local.Index(index - contribution.offset)
@@ -149,6 +167,16 @@ func applicationOperationPath(application historyApplication, query Path, lookup
 					return container, true
 				}
 			}
+			indexed, _ := sequenceHistoryAt(application.sequencesByPath, contribution.path)
+			if indexed.mode == sequenceHistoryMapped && len(query.segments) > len(container.segments) {
+				outputIndex, valid := schemaIndex(query.segments[len(container.segments)])
+				_, replaced := indexed.replacedOutputs[outputIndex]
+				if valid && replaced {
+					if _, present := documentAtPathWithLookup(application.value, local, lookup); !ok || !present {
+						return container.Index(outputIndex), true
+					}
+				}
+			}
 			if !ok {
 				continue
 			}
@@ -206,14 +234,14 @@ func applyHistoryApplication(root **document.Node, application historyApplicatio
 		mergeHistoryDocumentAtPath(root, application.value, Path{}, index, application.sequencesByPath)
 		return
 	}
-	mergeHistoryAtPath(root, application.path, application.value, index)
+	mergeHistoryAtPath(root, application.path, application.value, index, application.sequencesByPath)
 }
 
 func mergeHistoryDocument(target **document.Node, incoming *document.Node, index *mappingIndex) {
 	mergeHistoryDocumentAtPath(target, incoming, Path{}, index, nil)
 }
 
-func mergeHistoryDocumentAtPath(target **document.Node, incoming *document.Node, path Path, index *mappingIndex, sequences map[string]sequenceHistoryContribution) {
+func mergeHistoryDocumentAtPath(target **document.Node, incoming *document.Node, path Path, index *mappingIndex, sequences map[string]sequenceHistoryContributionIndex) {
 	if incoming == nil {
 		return
 	}
@@ -238,23 +266,53 @@ func mergeHistoryDocumentAtPath(target **document.Node, incoming *document.Node,
 	}
 }
 
-func sequenceHistoryAt(contributions map[string]sequenceHistoryContribution, path Path) (sequenceHistoryContribution, bool) {
+func sequenceHistoryAt(contributions map[string]sequenceHistoryContributionIndex, path Path) (sequenceHistoryContributionIndex, bool) {
 	contribution, found := contributions[path.String()]
 	return contribution, found
 }
 
-func indexSequenceHistoryContributions(values []sequenceHistoryContribution) map[string]sequenceHistoryContribution {
+type sequenceHistoryContributionIndex struct {
+	sequenceHistoryContribution
+	projection      sequenceItemProjectionIndex
+	replacedOutputs map[int]struct{}
+}
+
+func indexSequenceHistoryContributions(values []sequenceHistoryContribution) map[string]sequenceHistoryContributionIndex {
 	if len(values) == 0 {
 		return nil
 	}
-	index := make(map[string]sequenceHistoryContribution, len(values))
+	index := make(map[string]sequenceHistoryContributionIndex, len(values))
 	for _, value := range values {
-		index[value.path.String()] = value
+		contribution := sequenceHistoryContributionIndex{sequenceHistoryContribution: value}
+		if value.mode == sequenceHistoryMapped {
+			contribution.projection = newSequenceItemProjectionIndex(value.items)
+			contribution.replacedOutputs = make(map[int]struct{}, len(value.replacements))
+			for _, replacement := range value.replacements {
+				contribution.replacedOutputs[replacement.outputIndex] = struct{}{}
+			}
+		}
+		index[value.path.String()] = contribution
 	}
 	return index
 }
 
-func applySequenceHistory(target **document.Node, incoming *document.Node, contribution sequenceHistoryContribution) {
+func (contribution sequenceHistoryContributionIndex) outputForInput(inputIndex int) int {
+	outputIndex, ok := contribution.projection.outputForInput(inputIndex)
+	if !ok {
+		return -1
+	}
+	return outputIndex
+}
+
+func (contribution sequenceHistoryContributionIndex) inputForOutput(outputIndex int) int {
+	inputIndex, ok := contribution.projection.inputForOutput(outputIndex)
+	if !ok {
+		return -1
+	}
+	return inputIndex
+}
+
+func applySequenceHistory(target **document.Node, incoming *document.Node, contribution sequenceHistoryContributionIndex) {
 	if incoming == nil || incoming.Kind != document.Sequence {
 		return
 	}
@@ -262,6 +320,18 @@ func applySequenceHistory(target **document.Node, incoming *document.Node, contr
 		*target = document.Clone(incoming)
 		return
 	}
+	if contribution.mode == sequenceHistoryMapped {
+		for _, projection := range contribution.items {
+			if projection.inputIndex < 0 || projection.inputIndex >= len(incoming.Sequence) || projection.outputIndex < 0 {
+				continue
+			}
+			for len((*target).Sequence) <= projection.outputIndex {
+				(*target).Sequence = append((*target).Sequence, nil)
+			}
+			(*target).Sequence[projection.outputIndex] = document.Clone(incoming.Sequence[projection.inputIndex])
+		}
+		return
+	}
 	for _, item := range incoming.Sequence {
 		(*target).Sequence = append((*target).Sequence, document.Clone(item))
 	}
@@ -275,13 +345,15 @@ func cloneSequenceHistoryContributions(values []sequenceHistoryContribution) []s
 	for index, value := range values {
 		cloned[index] = value
 		cloned[index].path = value.path.clone()
+		cloned[index].items = append([]sequenceItemProjection(nil), value.items...)
+		cloned[index].replacements = append([]sequenceItemReplacement(nil), value.replacements...)
 	}
 	return cloned
 }
 
-func mergeHistoryAtPath(root **document.Node, path Path, incoming *document.Node, index *mappingIndex) {
+func mergeHistoryAtPath(root **document.Node, path Path, incoming *document.Node, index *mappingIndex, sequences map[string]sequenceHistoryContributionIndex) {
 	if root == nil || *root == nil || len(path.segments) == 0 {
-		mergeHistoryDocument(root, incoming, index)
+		mergeHistoryDocumentAtPath(root, incoming, Path{}, index, sequences)
 		return
 	}
 	current := *root
@@ -292,7 +364,7 @@ func mergeHistoryAtPath(root **document.Node, path Path, incoming *document.Node
 				return
 			}
 			if segmentIndex == len(path.segments)-1 {
-				mergeHistoryDocument(&current.Sequence[position], incoming, index)
+				mergeHistoryDocumentAtPath(&current.Sequence[position], incoming, Path{}, index, sequences)
 				return
 			}
 			current = current.Sequence[position]
@@ -306,7 +378,7 @@ func mergeHistoryAtPath(root **document.Node, path Path, incoming *document.Node
 			if position < 0 {
 				index.append(current, document.Entry{Key: segment.key, Value: document.Clone(incoming)})
 			} else {
-				mergeHistoryDocument(&current.Mapping[position].Value, incoming, index)
+				mergeHistoryDocumentAtPath(&current.Mapping[position].Value, incoming, Path{}, index, sequences)
 			}
 			return
 		}