Add configuration path explanations

docs/cli.md

@@ -173,6 +173,53 @@ including empty fields, zero coordinates, and synthetic sources without paths.
 An empty inventory is `sources: []`. Text output begins with the scope heading
 and then prints the same source fields, quoting labels and paths.
 
+### Explain a configuration path
+
+`config explain --path POINTER` explains the effective and historical value at a
+JSON Pointer path. `--path` is required; an explicitly empty value selects the
+root. The default scope is `app`; `--format yaml` selects structured output, and
+text is the default. `--scope all` is unsupported.
+
+```text
+example config explain --path /server/addr
+example config explain --path /profiles/team~1summary --format yaml
+example config explain --path= --format yaml
+```
+
+Pointer tokens use JSON Pointer escaping: `~1` represents `/` and `~0`
+represents `~`. A malformed pointer is a usage error with status `2` and is
+rejected before acquisition. A well-formed path that is unknown in the selected
+configuration is an operational error with status `1`. Text output comes from
+the scope's native explanation writer.
+
+YAML output uses these root fields:
+
+```yaml
+scope: app
+path: /server/addr
+effective:
+  present: true
+  redacted: false
+  yaml: "localhost:8080\n"
+origin:
+  layer: base
+  locations:
+    - source_id: source-1
+      line: 4
+      column: 9
+  operation: ""
+  inheritance: []
+history: []
+secret_reference: null
+```
+
+Snapshot `yaml` values remain strings, including null and empty fragments.
+Origin and history retain source locations, operation names, inheritance paths,
+ordered reasons and dependencies. Secret references contain only the owning
+environment-variable name; effective and historical secret fragments remain
+redacted. Empty location, inheritance, history, reason, and dependency lists are
+serialized as `[]`.
+
 ## Outcome status
 
 CommandKit usage failures use status `2`; operational failures use status `1`.

docs/development.md

@@ -5,8 +5,9 @@ decisions, implementation plans, identity and outcome primitives, typed command
 declarations, an instance-owned registry, a Cobra-backed routing and parsing
 adapter, public `App.Execute` coordination, and generated help/version commands.
 Configuration suite registration, scope discovery, ConfigKit integration,
-validation, native effective YAML display, and source inventory reports are
-implemented; other configuration and PromptKit operations remain pending. The
+validation, native effective YAML display, source inventory, and path
+explanation reports are implemented; other configuration and PromptKit
+operations remain pending. The
 [README](../README.md) provides project orientation; the
 [documentation policy](policy/documentation.md#canonical-ownership) assigns
 canonical documentation owners.

docs/roadmap/implementation.md

@@ -1,6 +1,6 @@
 # Initial CommandKit implementation plan
 
-Status: implementation underway; Stages 1-10 complete and Stages 11-14 pending.
+Status: implementation underway; Stages 1-11 complete and Stages 12-14 pending.
 
 Date: 2026-10-07.
 
@@ -676,7 +676,7 @@ describe the report.
 
 ## Stage 11: implement path explanation reports
 
-**Status:** pending. **Prerequisite:** Stage 10.
+**Status:** complete. **Prerequisite:** Stage 10.
 
 1. Implement single-scope `config explain --path POINTER`. Presence is required;
    explicitly empty is the root. Parse with public `configkit.ParsePath` before
@@ -704,6 +704,16 @@ inherited values; malformed versus unknown outcomes; redacted before/after and
 reference-name preservation; YAML snapshot strings and inheritance pointers;
 native text equivalence; writer failure. Update explanation CLI documentation.
 
+**Completion evidence:** installed single-scope `config explain` with required
+JSON Pointer `--path`, text as the native writer output, and explicit YAML DTOs
+for snapshots, origins, history, inheritance, and secret references. Malformed
+pointers return usage before context creation or acquisition; unknown paths are
+operational failures checked before native writing. Checks cover root and escaped
+paths, inherited and historical values, ordered resolution dependencies, secret
+redaction and name-only references, exact native text, missing/invalid/unknown
+paths, and writer failure. `go test ./...` passes; README, development orientation,
+and CLI reference describe the feature.
+
 ## Stage 12: integrate the PromptKit configuration scope
 
 **Status:** pending. **Prerequisite:** Stage 11.