Decode native diff paths without revalidation

docs/roadmap/audit/catalog.md

@@ -1,6 +1,6 @@
 # Consolidated audit catalog
 
-Status: **4 distinct open findings: 4 P3**, consolidated from 30
+Status: **3 distinct open findings: 3 P3**, consolidated from 30
 numbered entries in seven audit documents. Reviewed audit state:
 `db732e3a1de55c844f77870e1c6db683c2685d5d`.
 
@@ -507,6 +507,9 @@ construction becomes linear.
 
 ## F23 — P3: Concise diff rendering validates already-valid native paths
 
+**Complete.** The private decoder accepts ConfigKit's native path and performs
+single-pass token decoding. Focused diff, token and snapshot tests pass.
+
 ckconfig's private pointer decoder validates arbitrary strings even though its
 sole production caller supplies the canonical string of an immutable ConfigKit
 `Path`. Tests sustain malformed-input branches that this boundary cannot reach.

docs/roadmap/implementation.md

@@ -1,6 +1,6 @@
 # Audit remediation implementation plan
 
-Status: in progress; Stages 1–20 complete.
+Status: in progress; Stages 1–21 complete.
 
 Baseline: `d492c7747175c01a53261206c2b4356e53453621`. Before this sprint,
 intervening changes recorded decisions and retired the completed older
@@ -662,6 +662,11 @@ record these outcomes separately.
 
 ## Stage 21 — Decode native diff paths without revalidation
 
+**Complete.** Concise diff adaptation decodes tokens from native ConfigKit paths
+without revalidating arbitrary strings. Focused diff, pointer and snapshot tests
+pass offline in the aligned Go 1.27.0 workspace with `-mod=readonly`, including
+root, empty, Unicode and escaped keys.
+
 Findings: F23. Source: ckconfig `diff_report.go` and diff report tests.
 
 1. Change the private token helper to accept configkit.Path. Split its canonical