Fix the five resilience review findings

docs/internal/diagnostics-reporting.md

@@ -29,7 +29,10 @@ when debug is off. With debug on, source/normalized snapshots, invocation,
 effective settings, origins, profiles, initial chunk summary, correction ledger,
 indexed execution/utilization, and model interactions are written. Runner
 candidate capture includes proposals later rejected or interrupted. Debug
-write failures produce safe stderr messages and do not abort processing.
+write failures reach the CLI through an explicit concurrency-safe diagnostic
+callback and produce redacted stderr messages without aborting processing.
+Completed validator decisions returned with a fatal batch error remain available
+to the debug ledger; they never authorize applying an incompletely validated edit.
 Every debug writer uses all configured backend secrets for redaction, including
 unselected backend credentials and source snapshots. Debug can still contain
 sensitive transcript and prompt content.

docs/internal/pipeline.md

@@ -14,9 +14,10 @@ formats; [configuration](../config.md) owns settings; the
 4. Module instances execute in configured order. Sections may propose
    concurrently, but proposal indices follow section order and response order.
 5. Deterministic validators precede LLM-backed validators. Every submitted
-   candidate receives one decision per validator. Recoverable failed batches
-   mark their candidates unavailable; successful survivors continue through
-   all required validators.
+   candidate receives one decision per validator on a normal return. Fatal returns
+   may preserve a checked subset of completed decisions as diagnostic evidence.
+   Recoverable failed batches mark their candidates unavailable; successful
+   survivors continue through all required validators.
 6. Only fully approved proposals reach application. Corrections apply in
    proposal-index order within their owning section. Existing replacement
    policies and apply-time safety checks resolve stale conflicts.