Render native configuration differences as YAML

docs/roadmap/implementation.md

@@ -1,6 +1,6 @@
 # Implement ConfigKit adoption and configuration comparison
 
-Status: implementation in progress; Stages 1–6 are complete.
+Status: implementation in progress; Stages 1–7 are complete.
 
 ## Scope and authority
 
@@ -355,11 +355,16 @@ Stage 6's helpers, ready for delivery in Stage 8.
    handling rather than adding a general provider
    schema-validation framework or new restrictions on legitimate native records.
 
-**Completion evidence:** semantic YAML checks for all three categories and the
-empty document; deletion versus null and mapping-to-empty deletions. Cover
-atomic sequences, structural replacements, native masks, literal
-marker-looking public values, and concealed-only changes. Protect ordered root
-keys and types, without freezing incidental emitter spelling or mapping styles.
+**Completion evidence — complete:** `renderDiffReport` now classifies native
+records into ordered additions, changes, and deletions and encodes the complete
+three-category YAML document before returning bytes. Semantic node checks cover
+all categories, category order, the empty document, root values, explicit null
+versus deletion, mapping-to-empty deletions, atomic sequences, and structural
+values. Real ConfigKit results cover native redaction, a public string matching
+the upstream redaction marker, and a concealed-only change; the report retains
+safe values without exposing secret contents or native mask metadata. Malformed
+present snapshots return an error without report bytes. `go test -count=1 ./...`
+passes in ckconfig.
 
 ## Stage 8: Execute comparison through existing outcomes and delivery