Function render_diffs 

pub fn render_diffs(
    plan: &mut Plan,
    rendered: &RenderedTree,
    observed: &ObservedFiles,
)

Fill diff on added, changed and removed entries (--diff).

Each file of the entry whose live and desired sha256 differ contributes one section, in path order:

• a .json member whose present sides both parse (classify) and carry no secret-bearing location on either side is a unified text diff (similar, 3 lines of context, headers live/<path> and desired/<path>; an absent side is empty);
• a .json member where scan_secrets (config.json) or scan_embedded (every other .json, and tag files) reports any refused location or warning on either side, or where the diff-only key check ([sensitive_key_hits]) finds a non-empty string or non-null scalar at or beneath an object key named like password, passwd, secret, token, apikey, api_key, credential, privatekey or private_key (ASCII case-insensitive substring, any file, with or without an OpenAPI description) on either side, is <path>: withheld: contains secret-bearing locations (<n>); live <sha|->, desired <sha|->, where <n> counts locations only;
• any other member, and a .json member that does not parse, is <path>: differs (live <sha|->, desired <sha|->).

The text diff is the only place file bytes reach the plan, and only after both sides passed the scan and the key check, so Embedded ciphertext and plaintext secrets never leave it. The key check exists because the render lints cover the desired (repo) side: the live side is gateway-written and never linted, so --diff is deliberately stricter than render. It does not touch the render lints or what render accepts. An entry’s text is capped at DIFF_MAX_BYTES and then ends with a truncation marker. The live side of an entry is its effective copy (the mode collection when the unit exists there, else core), the same basis the digests use.