Track unavailable validator decisions in reports and debug records

docs/integrations/output-files.md

@@ -11,7 +11,7 @@ With reporting enabled, Audita produces three ordinary files:
 
 - `errors.yml`: affected work units and run-level failures;
 - `recoveries.yml`: successful logical model operations with repair, service
-  retry, or defective-proposal filtering;
+  retry, or response filtering;
 - `report.md`: a concise overview and complete per-chunk matrices.
 
 The YAML documents have Audita-owned schemas `audita-errors` and
@@ -55,6 +55,9 @@ work unit form one error record. `scope: run` instead records phase, safe reason
 and message, optional origin, and output path where relevant. It can describe
 a fatal error or secondary output-write failure without inventing a failed
 model work unit. Raw provider errors and transcript text are absent.
+For `validation_decisions_invalid`, proposal indices identify only candidates
+whose required decisions were unavailable. Other candidates in the same batch
+may still be approved or rejected normally.
 
 Each recovery identifies its work unit and successful operation, with sorted
 `reasons`, a safe message, available execution counts, and sorted
@@ -65,6 +68,11 @@ ordinary editorial rejection, and an apply-time conflict caused by an earlier
 accepted correction are not filtering recoveries. Failed operations are errors,
 not recoveries. The initial chunk identity remains stable even if earlier
 modules change its text.
+`validation_decisions_filtered` records unexpected validator decision indices
+ignored from a successful validation batch. It may accompany repair or service
+recovery reasons, but it does not add `filtered_proposals` or increment
+`proposal_responses_with_filtering`. A batch with unavailable requested decisions
+is an error even when unexpected indices were also ignored.
 
 ## Markdown Overview
 
@@ -91,8 +99,14 @@ These files are diagnostic evidence, not an alternate ordinary report schema.
 Each candidate-backed ledger entry includes `proposed_corrected_text`, the
 literal replacement span, even when it is `""` for a deletion. Applied entries
 also include `applied_corrected_text`, likewise `""` for an applied deletion.
-Rejected, skipped, and interrupted entries omit the applied field; a module
+Rejected, unavailable, skipped, and interrupted entries omit the applied field; a module
 failure without a candidate omits both. These fields are replacement spans,
 not full resulting-segment text. Deterministic decision records now identify
 the blank-result guard as `non_empty_resulting_segment` (formerly
 `non_empty_corrected_text`); its `empty_resulting_segment` reason is unchanged.
+Validator decision records carry `disposition`: `approved`, `rejected`, or
+`unavailable`. A missing or duplicate required decision is `unavailable`, not
+an editorial rejection. The candidate ledger uses the same distinction in its
+top-level disposition. Interaction response artifacts retain supplied model
+decisions and the reconciliation result, including unavailable and ignored
+indices; unexpected indices never create candidate ledger entries.

docs/internal/diagnostics-reporting.md

@@ -15,6 +15,11 @@ Audita's versioned YAML DTOs, fixed Markdown rendering, and brief CLI
 completion formatter. YAML redaction walks serialized string nodes so numeric
 and boolean values retain their types. Ordinary reports omit raw causes,
 transcript text, complete decisions, and token/timing payloads.
+Validation operations with unavailable decisions report only affected requested
+indices, even when other candidates in the batch continue. Ignored extra
+validator entries yield `validation_decisions_filtered` only for a successful
+operation; they do not count as filtered correction proposals. Failed operations
+retain their execution counts and never produce a recovery record.
 
 `internal/core/diagnostics.OutputSession` owns active destination checks,
 transcript preflight, report initialization, regular-file replacement, and direct
@@ -40,6 +45,12 @@ Debug write failures reach the CLI through an explicit concurrency-safe diagnost
 callback and produce redacted stderr messages without aborting processing.
 Completed validator decisions returned with a fatal batch error remain available
 to the debug ledger; they never authorize applying an incompletely validated edit.
+Runner decision records carry the validator's explicit approved, rejected, or
+unavailable disposition into the ledger. Unavailable candidates have a distinct
+top-level ledger disposition, while fatal interruptions remain interrupted when
+no rejection or unavailable decision was returned. Successful validation
+interaction payloads contain the full decoded response, final content, and
+reconciliation outcomes; ignored indices do not become ledger candidates.
 Every debug writer uses all configured backend secrets for redaction, including
 unselected backend credentials and source snapshots. Debug can still contain
 sensitive transcript and prompt content.

docs/roadmap/implementation.md

@@ -192,6 +192,12 @@ successful extra filtering. No extra model generation is introduced.
 
 ## Stage 2 — Carry Dispositions Through Debug and Report Partial Outcomes
 
+**Completed:** 2026-09-25. Runner and ledger records carry explicit
+dispositions; ordinary reports distinguish unavailable decision errors from
+extra-index filtering recoveries. Focused report, ledger, runner, and YAML
+checks passed with `go test ./internal/framework/runner
+./internal/framework/processreport ./internal/core/reporting`.
+
 **Work**
 
 1. Add and populate disposition fields through the runner and ledger as selected