Fix the five resilience review findings

docs/cli.md

@@ -45,6 +45,8 @@ validation. The shared setting flags are:
 | Debug | `--debug[=true\|false]`, `--work-dir DIR` |
 
 `process` alone accepts `--glossary` (required) and `--output`.
+An omitted or empty output value selects stdout. Nonempty output filenames are
+used literally, including whitespace.
 Reporting defaults to enabled. `--reporting=false` disables all three ordinary
 reports; an explicit false overrides a true file or overlay setting. With file
 output, reports go beside the transcript and `--report-dir` has no effect. With

docs/internal/diagnostics-reporting.md

@@ -29,7 +29,10 @@ when debug is off. With debug on, source/normalized snapshots, invocation,
 effective settings, origins, profiles, initial chunk summary, correction ledger,
 indexed execution/utilization, and model interactions are written. Runner
 candidate capture includes proposals later rejected or interrupted. Debug
-write failures produce safe stderr messages and do not abort processing.
+write failures reach the CLI through an explicit concurrency-safe diagnostic
+callback and produce redacted stderr messages without aborting processing.
+Completed validator decisions returned with a fatal batch error remain available
+to the debug ledger; they never authorize applying an incompletely validated edit.
 Every debug writer uses all configured backend secrets for redaction, including
 unselected backend credentials and source snapshots. Debug can still contain
 sensitive transcript and prompt content.

docs/internal/pipeline.md

@@ -14,9 +14,10 @@ formats; [configuration](../config.md) owns settings; the
 4. Module instances execute in configured order. Sections may propose
    concurrently, but proposal indices follow section order and response order.
 5. Deterministic validators precede LLM-backed validators. Every submitted
-   candidate receives one decision per validator. Recoverable failed batches
-   mark their candidates unavailable; successful survivors continue through
-   all required validators.
+   candidate receives one decision per validator on a normal return. Fatal returns
+   may preserve a checked subset of completed decisions as diagnostic evidence.
+   Recoverable failed batches mark their candidates unavailable; successful
+   survivors continue through all required validators.
 6. Only fully approved proposals reach application. Corrections apply in
    proposal-index order within their owning section. Existing replacement
    policies and apply-time safety checks resolve stale conflicts.

docs/operations.md

@@ -28,11 +28,12 @@ Audita checks active destinations against input, configuration, and selected
 profile files before model dispatch. It preflights file transcript output
 without truncating an existing file. With reporting enabled, all three reports
 are initialized as `in_progress` before input processing. Output is encoded
-fully before publication. Each file is replaced through a temporary file in
-its destination directory: transcript first, then `errors.yml`,
+fully before publication. Each file is replaced through a temporary file on
+its destination filesystem: transcript first, then `errors.yml`,
 `recoveries.yml`, and `report.md`. This is per-file replacement, not a
-multi-file transaction. A late report error may leave the transcript published;
-the process exits nonzero and attempts failed-status reports. On fatal processing
+multi-file transaction. New files honor the process umask; replacing an existing
+file preserves its permission bits. A late report error may leave the transcript
+published; the process exits nonzero and attempts failed-status reports. On fatal processing
 or cancellation, no completed transcript is published, but partial reports are
 finalized where possible. An uncatchable termination can leave `in_progress`.
 

docs/roadmap/remediation.md

@@ -4,7 +4,8 @@
 **Scope:** The fourteen implementation commits after `8ffbf41`, compared with
 [implementation.md](implementation.md), [resilience.md](resilience.md), and the
 current architecture and output contracts.
-**Status:** Five open findings, R6–R10. This review implements no fixes.
+**Status:** R6–R10 addressed and verified. The findings below describe the reviewed
+source; their line references are historical. See the resolution record below.
 
 The earlier library-adoption findings R1–R5 were resolved before this work.
 Their findings and resolution evidence remain in the
@@ -192,8 +193,49 @@ one assembled CLI case is sufficient. Debug-off must still create no artifacts.
 - A temporary runner probe reproduced R9; its expected evidence-preservation
   assertion failed. The probe and all temporary artifacts were removed.
 
-Passing retained tests do not cover the five failures above. Add proportionate
-regression coverage with their fixes. This review changes only this document;
+At review time, the retained tests did not cover the five failures above.
+The initial review changed only this document;
 application fixes, upstream changes, deferred feature work, and release publication
 remain outside scope. Target-platform release builds were not repeated for this
 review; the native temporary CLI build succeeded.
+
+
+## Resolution Record
+
+All five findings are addressed without changing retry budgets, library ownership,
+correction acceptance, or the independent reporting/debug selections.
+
+- **R6:** Per-file replacement uses ordinary file creation inside a private
+  temporary directory in the destination parent. Creation applies the umask;
+  existing permission bits are restored only for existing destinations. Temporary
+  files/directories are removed on success and failure. The subprocess permission
+  test covers both restrictive and ordinary masks and subsequent replacement of
+  restrictive files; existing output-session failure/cleanup tests still pass.
+- **R7:** File selection uses the literal nonempty output path throughout report
+  placement and output preparation. Final CLI stream selection uses the prepared
+  output session. `TestSubprocessWhitespaceOutputIsALiteralFile` proves the output
+  and reports are produced; the existing stdout integration test remains passing.
+- **R8:** Every CLI report/debug location announcement uses the shared configured-
+  secret string redactor. `TestSubprocessPathAnnouncementsAreRedacted` covers
+  success and failure with selected and unselected credentials in real paths,
+  while confirming that the real destinations are used.
+- **R9:** Fatal validator returns use partial identity/cardinality validation,
+  retain completed decisions and rejection details, and never return application
+  approvals. `TestFatalBatchRetainsEarlierDecisionsInLedger` exercises the real
+  runner and batching validator with two completed batches and a third fatal
+  failure, retaining their decisions and all operation facts in the debug ledger.
+  A separate runner regression rejects unknown/duplicate partial identities while
+  retaining the originating failure. Existing cancellation/joining tests pass.
+- **R10:** An explicit diagnostic-error callback connects proposal and validator
+  writers to the CLI's synchronized, redacted nonfatal diagnostics. Origin/profile
+  serialization failures use the same path. Narrow proposal/validator tests and
+  `TestSubprocessInteractionWriteFailureIsVisibleAndNonfatal` verify visible
+  failures, unchanged transcript/counts/exit status, and no fabricated artifact
+  paths. Existing reporting/debug-selection tests verify debug-off persistence
+  remains disabled.
+
+Validation completed: full `go test ./...`, `go vet ./...`, focused race tests for
+runner, validators, proposal generation, report assembly, diagnostics/output, CLI,
+and subprocess integration; required Linux amd64/arm64 builds in a temporary
+output directory; and documentation link/whitespace checks. No live provider,
+upstream change, tag, or publication was involved.