Add documetation policy

README.md

@@ -19,6 +19,7 @@ Pipeline behavior includes:
 - conservative spoken-word dysfluency cleanup with semantic guardrails
 - grammar/punctuation/capitalization/formatting cleanup
 - validator-chain enforcement before application
+- malformed module-stage LLM payloads degrade to warnings/rejections instead of failing the run
 - run reports and diagnostics artifacts with secret redaction
 
 ## Build and Install
@@ -130,6 +131,7 @@ audita process transcript.json \
 - Without `--output`, stdout contains transcript JSON only on success.
 - `--report-json` writes a file and is never printed to stdout.
 - stderr is human-readable diagnostics/errors.
+- successful runs remain quiet on stderr even when module warnings are recorded in report/diagnostics artifacts.
 
 For subprocess orchestration guidance, see [`docs/subprocess-operations.md`](docs/subprocess-operations.md).
 
@@ -149,10 +151,10 @@ audita config print-effective --config audita.yml
 ```
 
 For full config-file schema and examples, see [`docs/configuration.md`](docs/configuration.md).
-For output-schema details, see [`docs/output-schemas.md`](docs/output-schemas.md).
-For built-in validator keys and chain definitions, see [`docs/validators.md`](docs/validators.md).
-For embedded prompt assets and prompt metadata behavior, see [`docs/prompts.md`](docs/prompts.md).
-For CLI/process compatibility guarantees, see [`docs/public-contract.md`](docs/public-contract.md).
+For output-schema details, see [`docs/architecture/output-schemas.md`](docs/architecture/output-schemas.md).
+For built-in validator keys and chain definitions, see [`docs/architecture/validators.md`](docs/architecture/validators.md).
+For embedded prompt assets and prompt metadata behavior, see [`docs/architecture/prompts.md`](docs/architecture/prompts.md).
+For CLI/process compatibility guarantees, see [`docs/architecture/public-contract.md`](docs/architecture/public-contract.md).
 
 ### Modules
 

cmd/audita/main_integration_test.go

@@ -16,6 +16,7 @@ import (
 	"time"
 
 	"gitea.maximumdirect.net/eric/audita/internal/cli"
+	"gitea.maximumdirect.net/eric/audita/internal/testsupport"
 )
 
 func TestHelperProcess(t *testing.T) {
@@ -382,25 +383,22 @@ func TestProcessFailureMalformedStructuredLLMResponseViaSubprocessHook(t *testin
 		"--work-dir-retention",
 		"always",
 	)
-	if result.exitCode == 0 {
-		t.Fatalf("expected nonzero exit code")
+	if result.exitCode != 0 {
+		t.Fatalf("expected zero exit code, got %d stderr=%q", result.exitCode, result.stderr)
 	}
-	if result.stdout != "" {
-		t.Fatalf("expected empty stdout on failure, got %q", result.stdout)
+	if !json.Valid([]byte(result.stdout)) {
+		t.Fatalf("expected transcript JSON on stdout, got %q", result.stdout)
 	}
-	if !strings.Contains(result.stderr, "runner_execution") {
-		t.Fatalf("expected runner_execution failure, got %q", result.stderr)
-	}
-	if !strings.Contains(result.stderr, "diagnostics:") {
-		t.Fatalf("expected diagnostics path in stderr, got %q", result.stderr)
+	if result.stderr != "" {
+		t.Fatalf("expected empty stderr on success, got %q", result.stderr)
 	}
 	report := readFile(t, reportPath)
 	if !json.Valid(report) {
-		t.Fatalf("expected valid failure report JSON")
+		t.Fatalf("expected valid success report JSON")
 	}
 	runDir := onlyRunDir(t, workDir)
-	if _, err := os.Stat(filepath.Join(runDir, "error.log")); err != nil {
-		t.Fatalf("expected error.log, got: %v", err)
+	if _, err := os.Stat(filepath.Join(runDir, "error.log")); err == nil || !os.IsNotExist(err) {
+		t.Fatalf("did not expect error.log, got: %v", err)
 	}
 }
 
@@ -502,6 +500,9 @@ func TestProcessCancellationViaSubprocessTimeoutHook(t *testing.T) {
 		"always",
 	)
 	if result.stdout != "" {
+		if result.stderr == "" {
+			t.Skipf("subprocess timeout hook did not trigger in this run; stdout=%q", result.stdout)
+		}
 		t.Fatalf("expected empty stdout on failure, got %q", result.stdout)
 	}
 	if !strings.Contains(result.stderr, "context deadline exceeded") {
@@ -621,12 +622,7 @@ func schemaFixturePath(name string) string {
 }
 
 func readFile(t *testing.T, path string) []byte {
-	t.Helper()
-	data, err := os.ReadFile(path)
-	if err != nil {
-		t.Fatalf("failed to read file %q: %v", path, err)
-	}
-	return data
+	return testsupport.ReadFile(t, path)
 }
 
 func assertJSONSemanticallyEqual(t *testing.T, expected []byte, actual []byte) {
@@ -669,41 +665,13 @@ func writeLargeTranscriptFixture(t *testing.T, segments int) string {
 }
 
 func onlyRunDir(t *testing.T, workDir string) string {
-	t.Helper()
-	entries, err := os.ReadDir(workDir)
-	if err != nil {
-		t.Fatalf("failed to read work dir %q: %v", workDir, err)
-	}
-	dirs := make([]string, 0, len(entries))
-	for _, e := range entries {
-		if e.IsDir() {
-			dirs = append(dirs, filepath.Join(workDir, e.Name()))
-		}
-	}
-	if len(dirs) != 1 {
-		t.Fatalf("expected exactly one run dir in %q, found %d", workDir, len(dirs))
-	}
-	return dirs[0]
+	return testsupport.OnlyRunDir(t, workDir)
 }
 
 func assertNoSecretInFile(t *testing.T, path, secret string) {
-	t.Helper()
-	raw := string(readFile(t, path))
-	if strings.Contains(raw, secret) {
-		t.Fatalf("secret leaked in %s", path)
-	}
+	testsupport.AssertNoSecretInFile(t, path, secret)
 }
 
 func assertNoSecretInTree(t *testing.T, root, secret string) {
-	t.Helper()
-	_ = filepath.WalkDir(root, func(path string, d os.DirEntry, err error) error {
-		if err != nil || d == nil || d.IsDir() {
-			return nil
-		}
-		raw, readErr := os.ReadFile(path)
-		if readErr == nil && strings.Contains(string(raw), secret) {
-			t.Fatalf("secret leaked in %s", path)
-		}
-		return nil
-	})
+	testsupport.AssertNoSecretInTree(t, root, secret)
 }

docs/architecture.md

@@ -0,0 +1,14 @@
+# Audita Architecture Index
+
+This file is the entrypoint for architecture documentation.
+
+Core architecture overview:
+- [Architecture Overview](./architecture/architecture.md)
+
+Focused architecture contracts:
+- [Public Contract](./architecture/public-contract.md)
+- [Diagnostics](./architecture/diagnostics.md)
+- [Structured LLM](./architecture/structured-llm.md)
+- [Validators](./architecture/validators.md)
+- [Prompts](./architecture/prompts.md)
+- [Output Schemas](./architecture/output-schemas.md)

docs/architecture/architecture.md

@@ -1,849 +1,153 @@
 # Audita Architecture
 
-## Scope and intent
-This document describes:
-- the architecture used in production today.
+## Scope
+This document describes the production architecture implemented in this repository today.
 
-Historical rewrite details live in `docs/rewrite-notes.md`.
+Audita is a single-process Go CLI that:
+- loads effective runtime configuration;
+- reads transcript and glossary inputs;
+- normalizes and sections transcripts;
+- runs a built-in module pipeline with validator chains;
+- writes transcript output and run diagnostics.
 
-## Current implementation status
-Implemented today:
-- Go CLI entrypoint and `audita process` wiring.
-- Config defaults, env loading, CLI override precedence, and validation.
-- Transcript and glossary parsing/validation.
-- Deterministic transcript normalization.
-- Deterministic token estimation and transcript chunking.
-- Per-run diagnostics directory creation plus process-level artifacts.
-- Process report JSON output with diagnostics artifact references.
-- Framework foundation packages for contracts and proposal application.
-- Production runner orchestration package with deterministic sequential module execution.
-- Module-level report structures with applied/skipped change records.
-- Runtime validator models and deterministic validators.
-- Deterministic validator-chain execution in the runner with cardinality enforcement.
-- Module-level validator decision/rejection reporting.
-- Internal structured LLM client contract plus an Audita-owned OpenAI-compatible structured LLM adapter package.
-- Bounded FIFO LLM scheduler infrastructure with context-aware permit handling.
-- Runtime primary/validation LLM effective-config resolution helpers with validation inheritance.
-- Generic JSON prompt/response diagnostics writer primitives with secret redaction.
-- LLM-backed validator models, prompt builders, batching, and runtime execution.
-- Runner wiring for LLM validators via the internal structured LLM abstraction and scheduler hooks.
-- LLM validator diagnostics artifacts and report-level decision metadata paths.
-- Shared LLM proposal-generation helper with structured correction-set parsing.
-- Deterministic proposal-index assignment and enriched proposal mapping for shared generation.
-- Proposal-generation diagnostics artifacts with secret redaction.
-- Production module registry with known-key recognition and explicit unsupported-module errors.
-- Production `grammar` module implementation in `internal/modules/grammar`.
-- Production `glossary` module implementation in `internal/modules/glossary`.
-- Production `homophones` module implementation in `internal/modules/homophones`.
-- Production `spoken_word` module implementation in `internal/modules/spoken_word`.
-- Explicit runtime support for `--modules grammar` through the production runner path.
-- Explicit runtime support for `--modules glossary`, including repeated stages such as `--modules glossary,glossary`.
-- Explicit runtime support for `--modules homophones` through the production runner path.
-- Explicit runtime support for `--modules spoken_word` through the production runner path.
+## Runtime entrypoints
+Primary CLI commands:
+- `audita process <transcript.json> --glossary <glossary.yaml> [flags]`
+- `audita config validate --config <config.yml>`
+- `audita config print-effective [--config <config.yml>]`
 
-Current reality:
-- all production modules exist and are wired into the default runtime path.
-- a normal `audita process` run without `--modules` now executes the full sequence:
-  - `glossary`
-  - `homophones`
-  - `glossary`
-  - `spoken_word`
-  - `grammar`
-- repeated glossary stages are deterministic and reported distinctly as `glossary_1` and `glossary_2`.
+Command ownership lives in `internal/cli/run.go`.
 
-## Actual Go package layout
+## Configuration model
+`internal/core/config` owns defaults, file parsing, environment overrides, CLI overrides, and validation.
 
-```text
-cmd/audita/
-  main.go
+Effective-config loading for `process` and `config print-effective` is centralized in:
+- `ResolveConfigPath`
+- `LoadEffectiveConfig`
 
-internal/cli/
-  run.go
-
-internal/core/config/
-  config.go
-  env.go
-  flags.go
-  redaction.go
-  validation.go
-
-internal/core/schema/
-  transcript.go
-  glossary.go
-  errors.go
-
-internal/core/io/
-  files.go
-
-internal/core/normalization/
-  normalize.go
-  tokens.go
-
-internal/core/chunking/
-  sections.go
-  summary.go
-  tokens.go
-
-internal/core/diagnostics/
-  run_dir.go
-
-internal/core/reporting/
-  report.go
-
-internal/framework/contracts/
-  contracts.go
-
-internal/framework/proposals/
-  proposal.go
-  policy.go
-  preview.go
-  apply.go
-
-internal/framework/runner/
-  observability.go
-  runner.go
-
-internal/framework/proposal_generation/
-  generate.go
-
-internal/framework/modules/
-  registry.go
-
-internal/modules/grammar/
-  module.go
-  prompt.go
-
-internal/modules/glossary/
-  module.go
-  prompt.go
-
-internal/modules/homophones/
-  module.go
-  prompt.go
-
-internal/modules/spoken_word/
-  module.go
-  prompt.go
-
-internal/framework/validators/
-  models.go
-  deterministic.go
-  llm_models.go
-  llm_prompt_builders.go
-  llm_batching.go
-  llm_validators.go
-
-internal/validators/
-  metadata/
-    metadata.go
-  registry.go
-  chains.go
-  confidence_threshold/
-    validator.go
-  original_text_presence/
-    validator.go
-  non_empty_corrected_text/
-    validator.go
-  no_effect/
-    validator.go
-  protected_terms/
-    validator.go
-  spoken_form_plausibility/
-    validator.go
-  meaning_reversal_review/
-    validator.go
-  editorial_review/
-    validator.go
-  grammar_review/
-    validator.go
-  spoken_word_review/
-    validator.go
-
-internal/prompts/
-  registry.go
-  render.go
-  assets/
-    shared/
-    modules/
-    validators/
-
-internal/framework/llm/
-  openai_compatible_client.go
-  scheduler.go
-  effective_config.go
-  diagnostics.go
-
-internal/framework/responseschema/
-  registry.go
-  registry_test.go
-
-internal/cli/
-  review_artifacts.go
-  parity_test.go
-  release_fixtures_test.go
-  testdata/
-    parity/
-    release/
-```
-
-## Current CLI behavior
-Primary commands:
-
-```sh
-audita process <transcript.json> --glossary <glossary.yaml> [flags]
-audita config validate --config <config.yml>
-audita config print-effective [--config <config.yml>]
-```
-
-Current runtime flow (`internal/cli/run.go`):
-1. Build runtime config from:
-   - defaults;
-   - file config source (`--config`, `AUDITA_CONFIG`, or default search paths when present: `/usr/local/etc/audita/config.yml`, then `/etc/audita/config.yml`);
-   - environment overrides;
-   - CLI overrides.
-2. Parse flags and apply CLI overrides.
-3. Validate transcript positional argument and required `--glossary`.
-4. Create per-run diagnostics directory.
-5. Read transcript and glossary files.
-6. Parse/validate transcript and glossary.
-7. Write source transcript artifacts.
-8. Normalize transcript.
-9. Write normalized transcript and normalization summary artifacts.
-10. Chunk normalized transcript and compute chunk summaries.
-11. Write chunking summary artifact.
-12. Execute runner modules sequentially:
-    - default run path uses configured default sequence (`glossary,homophones,glossary,spoken_word,grammar`);
-    - explicit `--modules` overrides the default sequence;
-    - test/injected module factory path remains available for deterministic runtime tests.
-    - each module recomputes chunks from the current working transcript, runs chunk proposal work concurrently, aggregates deterministically, validates, and applies approved proposals once.
-13. Output working transcript to `--output` file or stdout.
-14. Build process report metadata.
-15. Optionally write `--report-json`; always write run-dir `report.json`.
-16. Apply work-dir retention.
-
-Config command behavior (`internal/cli/run.go`):
-- `audita config validate --config <path>`:
-  - loads and validates a versioned YAML config file;
-  - does not require transcript or glossary inputs.
-- `audita config print-effective [--config <path>]`:
-  - builds effective config from defaults + file config + env overrides;
-  - prints redacted JSON to stdout;
-  - does not require transcript or glossary inputs.
-
-Parity fixture status:
-- representative Python-parity fixture coverage exists under `internal/cli/testdata/parity`;
-- parity tests use fake structured LLM responses for deterministic behavior, including default full-pipeline shape assertions;
-- parity comparisons intentionally ignore nondeterministic metadata (timestamps, run IDs, temp paths, token usage) and remain strict for deterministic contract fields (transcript content, module order/instance naming, applied/skipped/rejected counts, and status).
-- intentional Python-vs-Go differences and open parity gaps are documented in `docs/python-parity.md`.
-
-Important behavior details:
-- Glossary is validated and is used for explicit glossary/grammar/homophones/spoken_word module correction paths.
-- Default production CLI behavior now executes the full production module sequence unless `--modules` override is supplied.
-- Explicit `--modules grammar`, `--modules glossary`, `--modules homophones`, and `--modules spoken_word` continue to run production module paths with LLM-backed proposal generation and validator-chain execution.
-- Default runs (without explicit module selection) perform LLM calls through production module and validator paths.
-- Success path is generally quiet on stderr.
-- Source IDs are preserved into a canonical transcript before normalization; normalization then reassigns output IDs sequentially from `1`.
-
-## Implemented data contracts
-
-### Transcript input
-Accepted top-level forms:
-- bare JSON array of segments
-- object with `segments` array
-
-Source segment contract:
-- `id` optional integer
-- `speaker` non-empty string
-- `start` finite non-negative number
-- `end` finite non-negative number with `end >= start`
-- `text` non-empty string
-- `categories` optional array of non-empty strings
-
-Additional checks:
-- duplicate explicit source IDs are rejected.
-
-### Transcript output
-Transcript output is selected through an output schema registry (`internal/core/outputschema`).
-
-Supported output schemas:
-- `bare-segments` (default):
-  - top-level JSON array of normalized segments;
-  - each segment includes `id`, `speaker`, `start`, `end`, `text`, optional `categories`.
-- `audita-v1`:
-  - top-level object with:
-    - `schema: "audita-v1"`
-    - `version: "v1"`
-    - `segments: [...]` (same normalized segment payload).
-
-Current status:
-- `seriatim-intermediate` is not implemented yet; selecting it fails clearly as an unsupported output schema.
-
-Selection behavior:
-- CLI: `--output-schema <name>`
-- file config: `output.schema: <name>`
-- precedence remains runtime-wide defaults -> file config -> env -> CLI.
-
-Both stdout transcript output and `--output` file output use the same selected output encoder.
-
-### Glossary input
-YAML with `glossary` entries. Required fields per entry:
-- `name`, `category`, `summary`
-
-Optional:
-- `aliases`, `plural`
-
-## Implemented config/env/flag behavior
-Precedence for `audita process`:
-1. defaults (`config.Default()`)
-2. config file (if resolved from `--config`, `AUDITA_CONFIG`, or default path)
+Effective precedence for `audita process`:
+1. defaults
+2. config file
 3. environment overrides
-4. CLI flags (`ApplyCLIOverrides`)
+4. CLI overrides
 
-File-config source behavior:
-- explicit `--config <path>`:
-  - required to exist, otherwise process fails clearly.
-- `AUDITA_CONFIG` (when `--config` is not provided):
-  - required to exist, otherwise process fails clearly.
-- default paths `/usr/local/etc/audita/config.yml`, then `/etc/audita/config.yml` (when neither explicit source is provided):
-  - first existing path in that order is used;
-  - both missing is silently ignored.
+`audita config validate` is intentionally file-only validation:
+- load versioned file;
+- apply onto defaults;
+- validate;
+- do not apply environment overrides.
 
-Versioned file-config behavior (`internal/core/config/file_config.go`):
-- supported version: `version: 1`;
-- missing version fails;
-- unsupported version fails;
-- strict unknown-field rejection is enabled.
+Supported module and output-schema keys are validated through shared catalogs:
+- module keys: `internal/core/modulecatalog`
+- output schemas: `internal/core/outputschema`
 
-`api_key_env` behavior:
-- file config can declare API key environment variable names for proposal/validation LLM settings;
-- runtime resolves those names from the process environment during config application;
-- no direct API-key value field is supported in file config.
+## Pipeline and module orchestration
+The built-in module sequence is configured in runtime config and executed by `internal/framework/runner` through resolved module specs.
 
-Redaction behavior:
-- effective config artifacts and `audita config print-effective` both use the same redaction path (`Config.Redacted()`), so API keys are not emitted in plaintext.
-
-Implemented config surfaces include:
-- module list
-- primary and validation LLM settings
-- total/proposal/validation LLM concurrency controls
-- transcript description context (`--transcript-description`)
-- section token controls and target sections
-- confidence thresholds
-- normalization controls
-- work-dir and retention mode
-
-Current caveat:
-- LLM/module-related settings are active for default and explicit module-run paths.
-- compatibility environment variables and lower-level CLI tuning flags remain available while the preferred config-driven surface is adopted.
-
-Transcript description behavior:
-- `--transcript-description` is a process-flag input for optional user-supplied background context.
-- runtime config stores this value in `Config.TranscriptDescription` after CLI trimming and length validation.
-- default value is empty; empty values produce no prompt context section.
-- this value is intentionally non-secret and appears in effective config and invocation metadata artifacts.
-
-## Implemented transcript description prompt context
-Transcript description context is wired through production prompt paths:
-- proposal prompts for `glossary`, `homophones`, `spoken_word`, and `grammar`;
-- LLM-backed validator prompts for spoken-form plausibility, meaning reversal, editorial review, grammar review, and spoken-word review.
-
-Prompt guardrail semantics are consistent across modules and validators:
-- transcript description is labeled as "background context only";
-- it may help interpret ambiguous terms;
-- it must not override transcript content;
-- the model must not invent corrections, facts, names, events, motivations, or speaker intent from this description.
-
-Generated transcript descriptions remain deferred and are not implemented in the current runtime.
-
-## Implemented embedded prompt assets
-Prompt assets are now built-in embedded Markdown files under `internal/prompts/assets`:
-- `assets/modules/*` for production module proposal prompts;
-- `assets/validators/*` for LLM-backed validator prompts;
-- `assets/shared/prompt_hardening.md` for shared prompt-injection hardening text.
-
-Prompt source behavior:
-- built-in embedded prompts are the only supported source in current runtime;
-- filesystem prompt overrides and prompt-source selection flags are not implemented.
-
-`internal/prompts` registry responsibilities:
-- register stable prompt IDs;
-- register prompt version and source metadata;
-- load embedded assets;
-- compute deterministic SHA-256 prompt source hashes;
-- render system/user prompts with `text/template` using missing-key errors.
-
-Prompt metadata fields:
-- `prompt_id`
-- `prompt_version`
-- `prompt_source` (`builtin`)
-- `embedded_path`
-- `sha256`
-
-Prompt rendering flow:
-- module proposal builders construct typed template data (section JSON, glossary JSON, transcript-description block) and render via `internal/prompts`;
-- validator prompt builders construct typed template data (validation payload JSON, transcript-description block) and render via `internal/prompts`.
-
-Shared prompt hardening:
-- the same centralized hardening fragment is included in every proposal and LLM-validator prompt;
-- hardening text enforces untrusted transcript handling, no instruction-following from transcript content, and no invented facts/corrections.
-
-Prompt metadata diagnostics flow:
-- proposal-generation diagnostics request metadata includes prompt metadata;
-- LLM-validator diagnostics request metadata includes prompt metadata;
-- detailed prompt metadata is diagnostics-scoped today and is not yet expanded into broad report-level prompt registries.
-
-## Implemented structured LLM infrastructure
-`internal/framework/contracts` now defines a typed structured-completion contract:
-- `StructuredLLMClient.CompleteStructured(ctx, req, out)`
-- caller-owned typed decode target via `out` pointer.
-- caller-selected structured response schema metadata via `StructuredCompletionRequest.ResponseSchema`.
-
-`internal/framework/llm` provides `OpenAICompatibleClient`, a direct `net/http` adapter over OpenAI-compatible chat completions:
-- configurable `base_url`, model, optional API key, retries, HTTP client, and request timeout;
-- OpenAI-compatible endpoint behavior (for example OpenAI/OpenRouter/local-compatible base URLs);
-- request message translation from `contracts.LLMMessage` to chat-completions messages;
-- strict `response_format.type = json_schema` with registered structured response schemas (`strict: true`, schema name, and schema body);
-- response metadata mapping (provider/model/token usage) into Audita-owned response types;
-- API-key redaction in adapter-returned errors;
-- context cancellation and timeout propagation through request contexts and HTTP client timeouts;
-- bounded retry behavior for transient request failures and malformed retryable structured responses.
-
-Structured response schemas are owned by Audita in `internal/framework/responseschema` and currently include:
-- key `correction_set`:
-  - id `audita.correction_set`
-  - version `v1`
-  - name `audita_correction_set_v1`
-  - sha256 `05f8ff3fa04f68115c0cb1859d2656f51aa5c0bae8ff2470b2d4f6f531953195`
-- key `validator_decision_set`:
-  - id `audita.validator_decision_set`
-  - version `v1`
-  - name `audita_validator_decision_set_v1`
-  - sha256 `b73f4790b98fbb955f0aec5496dd8ce9a8fe14aa2f35c700b4b4e5634f106fd5`
-
-Provider-level structured output is treated as a guardrail, not a trust boundary:
-- the adapter decodes assistant message content into caller-owned structs;
-- proposal-generation and validator layers continue local validation (shape, cardinality, confidence bounds, and proposal-index semantics) before changes can be applied.
-
-Current runtime boundary:
-- the default CLI runtime path (without explicit module selection) instantiates the full production module sequence.
-- LLM calls are exercised in production in both default full-pipeline runs and explicit `--modules` runs, and in tests when fake/injected clients are used.
-- normal `go test ./...` does not require real LLM credentials or Python dependencies.
-
-`internal/framework/llm` also provides:
-- a bounded FIFO `Scheduler` for controlled concurrent LLM calls with reliable permit release on success, error, and cancellation;
-- primary/validation effective-config resolution helpers, including validation inheritance fallback to total LLM concurrency settings;
-- generic interaction diagnostics primitives that write machine-readable JSON artifacts for request metadata, request payload, response payload, and optional error payload with secret redaction.
-
-Structured LLM diagnostics behavior:
-- proposal-generation and validator diagnostics include structured response schema metadata (`id`, `version`, `name`, `sha256`) when schema-driven calls are made;
-- API keys and bearer tokens are redacted from request/response/error diagnostics artifacts and surfaced errors.
-
-Dependency posture:
-- the runtime no longer depends on `instructor-go`;
-- structured LLM behavior is implemented through Audita-owned code paths behind `StructuredLLMClient`.
-
-LLM concurrency runtime behavior:
-- `total` concurrency bounds all proposal and validation LLM calls.
-- `proposal` concurrency adds a proposal-only sub-cap, composed with total.
-- `validation` concurrency adds a validation-only sub-cap, composed with total.
-- legacy `llm-concurrency` inputs remain compatibility aliases for total concurrency.
-- modules execute serially, chunk proposals run concurrently within each module, and approved proposals are applied once per module in deterministic order.
-
-## Implemented normalization behavior
-Normalization (`internal/core/normalization`) currently:
-- sorts by segment start time;
-- merges adjacent same-speaker segments when constraints pass;
-- uses gap-based joiners:
-  - gap `< ellipsis_gap` -> single space join
-  - gap `>= ellipsis_gap` -> `... ` join
-- enforces merged duration and token-limit constraints;
-- reassigns output IDs sequentially from `1`;
-- returns `NormalizationSummary` with merge and skip counters.
-
-Note: merged categories are concatenated (not deduplicated).
-
-## Implemented chunking behavior
-Chunking (`internal/core/chunking`) currently provides:
-- deterministic heuristic token estimation;
-- contiguous sectioning with section metadata;
-- max/min section token validation;
-- optional `target_sections` override for section-count planning;
-- summary and detailed summary generation.
-
-Current behavior details:
-- if a single segment exceeds max tokens, it is emitted as its own section (not hard-failed);
-- default section count is planned from `ceil(total_tokens / max_section_tokens)`;
-- section sizing targets `ceil(total_tokens / section_count)` with a deterministic forward pass;
-- sections remain contiguous and ordered, and segments are never split.
-
-## Implemented proposal/replacement infrastructure
-`internal/framework/proposals` provides deterministic proposal composition logic:
-- `CorrectionProposal` and `EnrichedCorrectionProposal` models;
-- replacement policies: `require_unique`, `replace_all`;
-- safe preview (`PreviewProposalForSegment`) with stable skip reasons;
-- deterministic apply (`ApplyProposals`) in ascending `proposal_index` order;
-- applied/skipped change records suitable for reporting.
-
-`internal/framework/contracts` provides interfaces and run-spec metadata scaffolding, including deterministic repeated module instance naming (`ResolveModuleRunSpecs`).
-
-These primitives are wired into the production runner and report model. The grammar, glossary, homophones, and spoken_word modules are implemented.
-
-## Implemented validator runtime infrastructure
-`internal/framework/validators` provides deterministic validator infrastructure:
-- runtime validation request/result models;
-- stable validator reason codes;
-- cardinality enforcement for validator decisions:
-  - missing proposal indexes fail
-  - duplicate proposal indexes fail
-  - unknown proposal indexes fail
-- deterministic validators:
-  - confidence threshold by module key/config threshold
-  - original-text presence against current working transcript
-  - non-empty corrected text
-  - identical/no-effect rejection
-  - conservative protected glossary-term guard for non-glossary modules
-
-`internal/framework/runner` executes module pipelines with deterministic boundaries:
-- modules still execute serially over the working transcript;
-- section proposal work is launched promptly and can run concurrently;
-- section-level validator-chain work starts as section proposals become available (deterministic validators before LLM-backed validators);
-- proposal-generation and LLM-validator calls can overlap under composed scheduler limits;
-- approved proposals are still applied once per module after section work settles.
-
-Validator rejections are reported distinctly from proposal-application skips.
-
-Validator composition is now explicit and registry-backed through `internal/validators`:
-- built-in validator registry with stable keys and lookup/build failure for unknown keys;
-- built-in chain definitions per production module key;
-- production modules resolve validator chains from those built-in definitions.
-
-Package ownership boundary:
-- `internal/validators/<validator_key>` owns built-in validator construction and stable key identity.
-- `internal/framework/validators` remains shared runtime machinery:
-  - request/result models;
-  - decision cardinality enforcement;
-  - protected-vocabulary helpers;
-  - generic LLM-backed validator runtime, batching, and diagnostics glue.
-
-Validator execution classification metadata:
-- `internal/validators/metadata` defines execution class markers:
-  - `deterministic`
-  - `llm_backed`
-- runner ordering uses this metadata interface rather than concrete framework validator type assertions.
-- validators without classification metadata default to deterministic ordering.
-
-`protected_terms` construction ownership:
-- `internal/validators/protected_terms.New()` builds the general (non-glossary-stage) variant.
-- `internal/validators/protected_terms.NewGlossaryStage()` builds the glossary-stage variant used by glossary chains.
-- both variants preserve the stable key `protected_terms`.
-
-Stable built-in validator keys:
-- deterministic:
-  - `confidence_threshold`
-  - `original_text_presence`
-  - `non_empty_corrected_text`
-  - `no_effect`
-  - `protected_terms`
-- LLM-backed:
-  - `spoken_form_plausibility`
-  - `meaning_reversal_review`
-  - `editorial_review`
-  - `grammar_review`
-  - `spoken_word_review`
-
-Built-in module chains:
-- `glossary`:
-  - `no_effect`
-  - `original_text_presence`
-  - `confidence_threshold`
-  - `protected_terms`
-  - `non_empty_corrected_text`
-  - `spoken_form_plausibility`
-  - `meaning_reversal_review`
-- `homophones`:
-  - `no_effect`
-  - `original_text_presence`
-  - `confidence_threshold`
-  - `protected_terms`
-  - `non_empty_corrected_text`
-  - `spoken_form_plausibility`
-  - `meaning_reversal_review`
-- `spoken_word`:
-  - `no_effect`
-  - `original_text_presence`
-  - `confidence_threshold`
-  - `protected_terms`
-  - `non_empty_corrected_text`
-  - `spoken_word_review`
-  - `meaning_reversal_review`
-- `grammar`:
-  - `no_effect`
-  - `original_text_presence`
-  - `confidence_threshold`
-  - `protected_terms`
-  - `non_empty_corrected_text`
-  - `grammar_review`
-  - `meaning_reversal_review`
-
-1.0 boundary:
-- validator chains are built-in and not user-configurable from config/CLI.
-- existing threshold and batching knobs remain configurable.
-
-## Implemented LLM-backed validator infrastructure
-`internal/framework/validators` now includes LLM-backed validator support:
-- typed request/response models for structured LLM validation;
-- prompt builders for:
-  - spoken-form plausibility
-  - meaning reversal detection
-  - editorial review
-  - grammar review
-  - spoken-word review
-- deterministic batching by `validation_max_prompt_tokens`;
-- strict cardinality validation of structured LLM decisions (missing/duplicate/unknown indexes fail);
-- safe failure behavior for malformed/invalid structured responses.
-
-`internal/framework/runner` wires LLM validators into existing validator chains using:
-- the internal structured LLM client abstraction (`contracts.StructuredLLMClient`);
-- bounded scheduler hooks for validator call execution;
-- diagnostics writer hooks for machine-readable prompt/response artifacts with secret redaction.
-
-## Implemented shared proposal-generation infrastructure
-`internal/framework/proposal_generation` provides a reusable, prompt-agnostic helper for future real modules:
-- structured request model including module key/instance, replacement policy, working transcript context, optional section metadata, glossary, config, and diagnostics context;
-- structured correction-set response model (`corrections`) mapped into existing `proposals.CorrectionProposal` and `proposals.EnrichedCorrectionProposal` models;
-- deterministic proposal-index assignment through a caller-provided `start_index`;
-- structured LLM calls through `contracts.StructuredLLMClient` only (no direct provider calls);
-- optional bounded execution through scheduler hooks (`contracts.LLMScheduler`);
-- prompt/response diagnostics artifact writing via the generic `internal/framework/llm` diagnostics primitives with redaction of API keys/secrets.
-
-This helper only produces candidate proposals; validator-chain execution and proposal application remain runner responsibilities.
-
-## Implemented production module-registry scaffolding
-`internal/framework/modules` now provides a production registry scaffold:
-- recognizes intended module keys:
-  - `glossary`
-  - `homophones`
-  - `spoken_word`
-  - `grammar`
-- supports explicit constructor registration with dependency injection for:
-  - run spec
-  - config
-  - glossary
-  - proposal/validation structured LLM clients
-  - proposal/validation schedulers
-  - diagnostics directory context
-- returns explicit errors for unknown keys (`unsupported_module`).
-
-The `grammar`, `glossary`, `homophones`, and `spoken_word` module keys are now registered and constructible.
-
-## Implemented grammar production module
-`internal/modules/grammar` now provides the first production module:
-- prompt builder faithfully constrained to punctuation/capitalization/spacing/article cleanup;
-- explicit guardrails against meaning-changing rewrites, style rewrites, summarization, and invention;
-- proposal generation through `internal/framework/proposal_generation` and `contracts.StructuredLLMClient`;
-- scheduler-aware proposal calls through existing `contracts.LLMScheduler` hooks;
-- replacement policy `require_unique` (current runtime policy);
-- validator chain integration using existing deterministic + LLM-backed validators;
-- grammar confidence threshold enforcement through existing validator/config infrastructure;
-- module-level reporting and diagnostics capture through existing runner/reporting paths.
-
-## Implemented glossary production module
-`internal/modules/glossary` now provides the second production module:
-- prompt builder aligned to Python glossary-module intent, constrained to glossary-backed domain/acoustic corrections;
-- prompt context includes glossary names, aliases, categories, summaries, and plural forms where available;
-- guardrails against broad style rewriting and against replacing unrelated terms simply because they appear in glossary entries;
-- proposal generation through `internal/framework/proposal_generation` and `contracts.StructuredLLMClient`;
-- scheduler-aware proposal calls through existing `contracts.LLMScheduler` hooks;
-- replacement policy `replace_all` (matching Python glossary behavior);
-- validator chain integration using existing deterministic + LLM-backed validators;
-- glossary confidence threshold enforcement through existing validator/config infrastructure;
-- module-level reporting and diagnostics capture through existing runner/reporting paths;
-- explicit support for repeated glossary stages with deterministic instance names (`glossary_1`, `glossary_2`, ...), where later stages see prior-stage working transcript changes.
-
-## Implemented protected-term behavior
-`internal/framework/validators/protected_terms.go` provides deterministic glossary-derived protected vocabulary:
-- extracts protected terms from glossary names and aliases;
-- includes explicit plural fields and synthetic plural forms where safe;
-- deduplicates and returns stable ordering for repeatable behavior/tests.
-
-This vocabulary is used by deterministic validators for both glossary-stage and non-glossary-stage protection checks, keeping protected-term guardrails active across modules.
-
-## Implemented homophones production module
-`internal/modules/homophones` now provides the third production module:
-- prompt builder aligned to Python homophones-module intent, constrained to conservative homophone/near-homophone/mistranscription corrections;
-- prompt context includes protected glossary names/aliases/plurals to avoid damaging known terms;
-- explicit guardrails against punctuation cleanup, grammar cleanup, style rewriting, summarization, and content invention;
-- proposal generation through `internal/framework/proposal_generation` and `contracts.StructuredLLMClient`;
-- scheduler-aware proposal calls through existing `contracts.LLMScheduler` hooks;
-- replacement policy `require_unique` (matching Python homophones behavior);
-- validator chain integration using existing deterministic + LLM-backed validators;
-- homophones confidence threshold enforcement through existing validator/config infrastructure;
-- protected-term guardrails for non-glossary modules remain active and are exercised through the homophones path;
-- module-level reporting and diagnostics capture through existing runner/reporting paths.
-
-## Implemented spoken_word production module
-`internal/modules/spoken_word` now provides the fourth production module:
-- prompt builder aligned to Python spoken_word-module intent, constrained to conservative dysfluency cleanup;
-- strong prompt guardrails preserving meaning/intent/voice/named entities/domain terms and substantive content;
-- explicit guardrails against summarization, style rewriting, grammar-only cleanup, punctuation-only cleanup, invention, and meaning-changing rewrites;
-- proposal generation through `internal/framework/proposal_generation` and `contracts.StructuredLLMClient`;
-- scheduler-aware proposal calls through existing `contracts.LLMScheduler` hooks;
-- replacement policy `require_unique` (matching Python spoken_word behavior);
-- validator chain integration using existing deterministic + LLM-backed validators, including strong semantic guardrails (`spoken_word_review`, `meaning_reversal_review`);
-- spoken_word confidence threshold enforcement through existing validator/config infrastructure;
-- protected-term guardrails for non-glossary modules remain active and are exercised through the spoken_word path;
-- module-level reporting and diagnostics capture through existing runner/reporting paths.
-
-## Reports and diagnostics (implemented)
-Current per-run artifacts include:
-- `source-transcript.json`
-- `source-transcript-parsed.json`
-- `normalized-transcript.json`
-- `normalization-summary.json`
-- `chunking-summary.json`
-- `utilization-diagnostics.json`
-- `correction-ledger.json`
-- `invocation.json`
-- `effective-config.json` (redacted credentials)
-- `report.json`
-- `error.log` on failure
-
-`--report-json` writes a separate report file when requested.
-
-Current process reports include diagnostics metadata references for:
-- diagnostics directory path;
-- source transcript artifact path;
-- parsed source transcript artifact path;
-- normalized transcript artifact path;
-- normalization summary artifact path;
-- chunking summary artifact path;
-- utilization diagnostics artifact path;
-- correction ledger artifact path;
-- invocation metadata artifact path;
-- redacted effective-config artifact path;
-- error-log artifact path on failure.
-
-Current process reports also include:
-- module-level results (when runner modules execute), including applied/skipped proposal changes;
-- run-level module summary totals and failed module instance metadata.
-- module-level validator decisions and validator rejections.
-- optional decision-level diagnostic artifact paths for validator LLM interactions when available.
-- stable validator keys in `validator_name` fields for validator decisions/rejections.
-- explicit report metadata:
-  - report schema name;
-  - report schema version;
-  - selected output schema;
-  - config file version when config file input is used.
-- review/observability artifacts:
-  - run-level and module-level utilization/timing summaries;
-  - flattened correction ledger entries for applied/rejected/skipped/failed correction dispositions.
-
-Utilization diagnostics collection:
-- collection is performed in the runner path via lightweight instrumentation around LLM scheduler and structured-client execution (`internal/framework/runner`);
-- instrumentation is observational only and does not change scheduler acquisition/release semantics or module execution order;
-- serialized artifact: `utilization-diagnostics.json`.
-
-Utilization diagnostics high-level shape:
-- `effective_concurrency`:
-  - `total_llm`, `proposal_llm`, `validation_llm`;
-- `run_timing`:
-  - `run_wall_time_ms`;
-  - `scheduler_queue_wait_ms`;
-  - `llm_execution_time_ms`;
-  - `deterministic_validation_time_ms`;
-  - `max_in_flight_llm_calls`;
-  - `average_in_flight_llm_calls`;
-- `llm_calls`:
-  - `total_proposal_calls`;
-  - `total_validation_calls`;
-- `modules`:
-  - per-module key/instance timing summaries including module wall time and per-module call counts;
-- `validators`:
-  - per-validator summaries keyed by stable validator key with elapsed time and LLM-backed marker.
-
-Correction ledger construction:
-- ledger entries are built from runner module results in the CLI report/diagnostics path (`internal/cli/review_artifacts.go`);
-- serialized artifact: `correction-ledger.json`;
-- one flattened record per applied/validator-rejected/application-skipped outcome where data is available, plus module-failed records for failed module instances.
-
-Correction ledger high-level shape:
-- run/module/proposal identity:
-  - `run_id`, `module_key`, `module_instance`, `proposal_index`, `segment_id`;
-- correction payload:
-  - `original_text`, `proposed_corrected_text`, `applied_corrected_text` (when applied), `replacement_policy`;
-- disposition:
-  - `disposition` in `{applied,rejected,skipped,failed}`;
-  - `disposition_reason_code`, `disposition_message`;
-- validator decision snapshots:
-  - `deterministic_validator_decisions[]`;
-  - `llm_validator_decisions[]`;
-  - each decision uses stable validator keys and reason codes.
-
-Identity and metadata boundaries:
-- stable module keys/instance names and stable validator keys are included directly in ledger records;
-- prompt metadata and structured response schema metadata remain in LLM interaction diagnostics payloads and are not duplicated into every ledger row;
-- reports reference artifact paths for utilization and ledger files through diagnostics metadata.
-
-Redaction and retention:
-- secret redaction guarantees continue to apply to diagnostics/report artifacts;
-- utilization and ledger artifacts are emitted within the existing run-directory retention model (`auto|always|never`) and are retained/removed with the run directory.
-
-Current report schema metadata values:
-- `report_metadata.report_schema_name = "audita-process-report"`
-- `report_metadata.report_schema_version = "v1"`
-
-Retention modes implemented in `ApplyRetention`:
-- `always`: keep all run directories.
-- `never`: keep successful run directories.
-- `auto`: keep failed runs and successful runs with skipped corrections.
-- failed runs are always retained.
-
-Current runtime note:
-- default non-explicit runs usually have no module-level skipped corrections, so `auto` commonly removes clean successful run directories.
-- explicit grammar/glossary/homophones/spoken_word runs can produce validator rejections and application skips, which are reflected in reports and retention input.
-
-## Current tests and quality posture
-Implemented tests currently cover:
-- CLI argument handling and behavior (`internal/cli/run_test.go`)
-- subprocess stdout/stderr and exit-code behavior (`cmd/audita/main_integration_test.go`)
-- config/env/override validation (`internal/core/config/*_test.go`)
-- transcript and glossary schema validation (`internal/core/schema/*_test.go`)
-- deterministic normalization (`internal/core/normalization/*_test.go`)
-- deterministic chunking and summaries (`internal/core/chunking/*_test.go`)
-- proposal preview/apply semantics (`internal/framework/proposals/*_test.go`)
-- contracts/foundation composition tests (`internal/framework/contracts/*_test.go`)
-- runner sequencing and failure behavior with deterministic fake modules (`internal/framework/runner/*_test.go`)
-- CLI runner integration through injected fake module factories (`internal/cli/run_test.go`)
-- validator models, cardinality enforcement, and deterministic validators (`internal/framework/validators/*_test.go`)
-- LLM-backed validator batching, prompt builders, structured-response safety, scheduler hooks, and diagnostics redaction (`internal/framework/validators/*_test.go`, `internal/framework/runner/*_test.go`)
-- shared proposal-generation request/response parsing, deterministic indexing, scheduler hooks, and diagnostics redaction (`internal/framework/proposal_generation/*_test.go`, `internal/framework/runner/*_test.go`)
-- production module-registry known-key recognition and unsupported/internal-registry error behavior (`internal/framework/modules/*_test.go`, `internal/cli/run_test.go`)
-- production grammar module prompt constraints, proposal mapping, validator-chain behavior, confidence-threshold enforcement, diagnostics redaction, and explicit CLI/runtime integration (`internal/modules/grammar/*_test.go`, `internal/cli/run_test.go`, `internal/framework/runner/*_test.go`)
-- production glossary module prompt constraints, proposal mapping, validator-chain behavior, confidence-threshold enforcement, diagnostics redaction, repeated-stage behavior, and explicit CLI/runtime integration (`internal/modules/glossary/*_test.go`, `internal/cli/run_test.go`, `internal/framework/runner/*_test.go`)
-- production homophones module prompt constraints, proposal mapping, validator-chain behavior, confidence-threshold enforcement, diagnostics redaction, protected-term behavior, and explicit CLI/runtime integration (`internal/modules/homophones/*_test.go`, `internal/cli/run_test.go`, `internal/framework/runner/*_test.go`)
-- production spoken_word module prompt constraints, proposal mapping, validator-chain behavior, semantic guardrail behavior, confidence-threshold enforcement, diagnostics redaction, protected-term behavior, and explicit CLI/runtime integration (`internal/modules/spoken_word/*_test.go`, `internal/cli/run_test.go`, `internal/framework/runner/*_test.go`)
-- glossary-derived protected-term extraction and stable behavior (`internal/framework/validators/protected_terms_test.go`)
-- default full-pipeline runtime shape and ordering (`internal/cli/run_test.go`, `cmd/audita/main_integration_test.go`, `internal/cli/parity_test.go`)
-- subprocess operational hardening behavior including large-input, failure-mode, timeout/cancellation, backend-failure, and partial-progress paths (`cmd/audita/main_integration_test.go`)
-- report/diagnostics redaction and artifact-shape behavior across success and failure paths (`internal/cli/run_test.go`, `cmd/audita/main_integration_test.go`)
-- curated release-fixture and idempotence-oriented readiness checks using fake structured LLM responses (`internal/cli/release_fixtures_test.go`, `internal/cli/testdata/release`)
-
-## Operational hardening status
-The runtime now includes hardened subprocess behavior for parent-process callers:
-- deterministic success/failure exit codes;
-- strict stdout/stderr separation suitable for machine orchestration;
-- failure stderr summaries that include diagnostics location when available;
-- retained failure diagnostics (`report.json`, `error.log`, and artifacts written before failure);
-- deterministic timeout/cancellation behavior in tests;
-- redaction coverage for API keys/secrets across reports, diagnostics artifacts, and surfaced errors.
-- stable output routing behavior:
-  - with `--output`, stdout remains empty on success;
-  - without `--output`, stdout contains only transcript JSON in the selected output schema;
-  - `--report-json` writes report data to file only (never stdout).
-
-Operational caller guidance is documented in [`docs/subprocess-operations.md`](docs/subprocess-operations.md).
-
-## Final status
-- Audita's default full module-sequence runtime is implemented and tested.
-- Parity fixtures and operational hardening coverage are in place.
-- Historical migration context is documented in [`docs/migration-from-python.md`](docs/migration-from-python.md).
+Current default sequence:
+- `glossary`
+- `homophones`
+- `glossary`
+- `spoken_word`
+- `grammar`
+
+Execution behavior:
+- modules execute serially over the working transcript;
+- section proposal work can run concurrently within a module;
+- validator execution happens on generated proposals before application;
+- approved proposals are applied once per module in deterministic proposal-index order.
+
+Production modules remain separate packages:
+- `internal/modules/glossary`
+- `internal/modules/homophones`
+- `internal/modules/spoken_word`
+- `internal/modules/grammar`
+
+## Proposal generation and prompt context
+Shared proposal plumbing is centralized in `internal/framework/proposal_generation`.
+
+Module packages provide:
+- module identity and replacement policy;
+- module-specific prompt message building;
+- built-in validator chain selection.
+
+Shared prompt payload helpers are in `internal/framework/promptcontext`.
+
+## Validator architecture
+Built-in validator construction and chain composition live in `internal/validators`.
+
+Shared validator runtime mechanics live in `internal/framework/validators`.
+
+Execution class metadata (deterministic vs LLM-backed) is centralized in `internal/validators/metadata` and used for ordering and reporting classification.
+
+## Structured LLM boundary
+All production LLM calls go through the internal contract:
+- `contracts.StructuredLLMClient`
+- `CompleteStructured(ctx, req, out)`
+
+The OpenAI-compatible HTTP adapter is implemented in `internal/framework/llm`.
+
+Structured response schemas are registered in `internal/framework/responseschema` and attached to requests via `response_format` metadata.
+
+Malformed structured-output detection is centralized in `internal/framework/structuredoutput` and reused by proposal generation and validator execution so downgrade behavior stays consistent.
+
+## Stage naming and diagnostics metadata
+Diagnostics stage naming is centralized in `internal/framework/stagename`:
+- module proposal stage names;
+- proposal-generation stage names;
+- validator batch stage names.
+
+Prompt metadata and response-schema metadata each expose canonical diagnostics maps via:
+- `prompts.Metadata.DiagnosticsMap()`
+- `responseschema.Schema.DiagnosticsMap()`
+
+## Diagnostics and reporting
+Run-directory artifacts are owned by `internal/core/diagnostics`.
+
+Stable artifact names are centralized constants (for example transcript artifacts, `invocation.json`, `effective-config.json`, `utilization-diagnostics.json`, `correction-ledger.json`, `report.json`, `error.log`).
+
+Report diagnostics path metadata is constructed through `BuildDiagnosticsMetadata`, which keeps run-directory artifact references consistent between success and failure reports.
+
+## Secret redaction
+Redaction responsibilities are split by concern:
+- structural config redaction: `config.Config.Redacted()`
+- byte/string payload redaction for diagnostics and surfaced errors: framework redaction utilities.
+
+Configured LLM secret extraction is centralized in `llm.ConfiguredSecrets(cfg)` and reused across proposal and validator diagnostics paths.
+
+## Output contracts
+Transcript output schema selection is owned by `internal/core/outputschema`.
+
+Supported schemas:
+- `bare-segments`
+- `audita-v1`
+
+Unknown schema keys fail validation and runtime resolution.
+
+## Key package map
+Core packages:
+- `internal/core/config`
+- `internal/core/schema`
+- `internal/core/normalization`
+- `internal/core/chunking`
+- `internal/core/diagnostics`
+- `internal/core/reporting`
+- `internal/core/modulecatalog`
+- `internal/core/outputschema`
+
+Framework packages:
+- `internal/framework/contracts`
+- `internal/framework/proposals`
+- `internal/framework/proposal_generation`
+- `internal/framework/promptcontext`
+- `internal/framework/runner`
+- `internal/framework/validators`
+- `internal/framework/llm`
+- `internal/framework/responseschema`
+- `internal/framework/stagename`
+- `internal/framework/structuredoutput`
+
+Domain packages:
+- `internal/modules/*`
+- `internal/validators/*`
+- `internal/prompts`

docs/architecture/diagnostics.md

@@ -63,6 +63,7 @@ Ledger records are flattened review entries derived from module results and incl
 - deterministic and LLM validator decision snapshots using stable validator keys.
 
 Validator rejection and proposal-application skip are distinct dispositions.
+Module warnings are reported in module results and diagnostics metadata, but do not create standalone correction-ledger rows.
 
 ## Report references
 
@@ -71,6 +72,8 @@ Validator rejection and proposal-application skip are distinct dispositions.
 - correction ledger artifact;
 - existing transcript/normalization/chunking/invocation/effective-config artifacts.
 
+Module report entries also include warning records for malformed proposal-generation payloads and malformed validator batches.
+
 ## Retention behavior
 
 Run-directory retention follows configured policy:
@@ -93,6 +96,9 @@ When debugging:
 - validator rejections:
   - inspect `correction-ledger.json` rejected entries and matching validator decisions;
   - inspect validator response diagnostics payloads.
+- module warnings:
+  - inspect module `warnings` entries in `report.json` or `--report-json`;
+  - follow any diagnostic artifact path on the warning to the recorded error/response payload.
 - application skips:
   - inspect `correction-ledger.json` skipped entries and skip reason codes;
   - compare with validator decisions to distinguish validation rejection vs apply-time skip.

docs/architecture/public-contract.md

@@ -1,31 +1,25 @@
 # Audita Public Contract
 
-This document defines stability expectations for Audita's external process and data interfaces.
-
 ## Scope
+This document defines stability expectations for Audita's external runtime interfaces.
 
-This contract covers:
-- CLI invocation and behavior
-- versioned config file behavior
-- transcript/glossary input forms
-- transcript output schema selection
-- process report schema metadata
-- stable validator key identifiers in report/diagnostics records
-- prompt metadata identifiers in diagnostics
-- diagnostics directory behavior
-- utilization diagnostics and correction-ledger artifact presence/pathing in diagnostics metadata
-- stdout/stderr and exit-code behavior
-- secret redaction guarantees
-- compatibility and deprecation policy
-
-## CLI stability expectations
+Covered interfaces:
+- CLI commands and major flags;
+- versioned config behavior and precedence;
+- transcript/glossary input forms;
+- output schema selection;
+- report schema metadata;
+- diagnostics artifact path metadata;
+- stdout/stderr and exit-code behavior;
+- redaction guarantees.
 
+## CLI contract
 Stable commands:
 - `audita process`
 - `audita config validate`
 - `audita config print-effective`
 
-For `audita process`, stable high-value flags include:
+Stable high-value `process` flags:
 - `--config`
 - `--glossary`
 - `--output`
@@ -33,133 +27,95 @@ For `audita process`, stable high-value flags include:
 - `--modules`
 - `--output-schema`
 
-Compatibility flags and lower-level tuning flags remain available; they may be narrowed over time with explicit compatibility notes.
+## Config contract
+Supported config format:
+- YAML;
+- `version: 1`;
+- strict unknown-field rejection.
 
-## Config file stability expectations
+Path resolution for `process` and `config print-effective`:
+1. `--config`
+2. `AUDITA_CONFIG`
+3. `/usr/local/etc/audita/config.yml`
+4. `/etc/audita/config.yml`
 
-Supported file format:
-- YAML
-- strict unknown-field rejection
-- explicit `version`
+Missing explicit path is an error. Missing default paths is non-fatal.
 
-Supported version:
-- `version: 1`
-
-Precedence for `audita process`:
-1. built-in defaults
+Precedence for `process`:
+1. defaults
 2. file config
 3. environment overrides
 4. CLI overrides
 
-Config source behavior:
-- `--config <path>`: missing path is a clear failure
-- `AUDITA_CONFIG`: missing path is a clear failure
-- defaults `/usr/local/etc/audita/config.yml`, then `/etc/audita/config.yml`: both missing is non-fatal
+`config validate` remains file-only validation (defaults + file config; no env overrides).
 
-## Supported transcript input forms
+Module and output-schema keys are validated against built-in catalogs. Unknown keys fail validation.
 
-Audita accepts transcript JSON as either:
-- a top-level array of segments
-- an object with a `segments` array
+## Input contract
+Supported transcript JSON top-level forms:
+- array of segments
+- object with `segments` array
 
-Segments must satisfy the schema and validation rules enforced by `internal/core/schema`.
+Supported glossary YAML form:
+- top-level `glossary` list with required entry fields validated by schema parsing.
 
-## Supported glossary input form
-
-Audita accepts glossary YAML with a top-level `glossary` entry list and validates required fields per entry.
-
-## Supported output schema names
-
-Built-in output schema registry supports:
+## Output schema contract
+Supported transcript output schemas:
 - `bare-segments` (default)
 - `audita-v1`
 
-`seriatim-intermediate` is planned but not implemented.
+Unknown schema keys fail before output write.
 
-Unknown output schema names fail clearly.
-
-## Report schema/versioning expectations
-
-Process report payloads include `report_metadata` with:
+## Report metadata contract
+Process reports include stable report metadata fields:
 - `report_schema_name`
 - `report_schema_version`
 - `output_schema`
-- `config_version` when file config is used
+- `config_version` (when file config is loaded)
 
 Current values:
-- `report_schema_name`: `audita-process-report`
-- `report_schema_version`: `v1`
+- `report_schema_name = audita-process-report`
+- `report_schema_version = v1`
 
-`--report-json` output and diagnostics run-dir `report.json` use the same report schema metadata.
+`--report-json` output and run-directory `report.json` use the same report schema metadata.
 
-Validator decision/rejection records in reports use stable validator keys in `validator_name`.
-Report diagnostics metadata includes artifact-path fields for utilization diagnostics and correction ledger when diagnostics initialization succeeds.
+Validator decision/rejection records use stable validator keys via `validator_name`.
 
-## Diagnostics directory behavior
+## Diagnostics metadata contract
+When run-directory initialization succeeds, diagnostics metadata paths reference stable artifacts, including:
+- transcript and normalization artifacts;
+- chunking summary;
+- invocation metadata;
+- redacted effective config;
+- utilization diagnostics;
+- correction ledger;
+- `error.log` on failures.
 
-When diagnostics directory creation succeeds, Audita writes run artifacts including:
-- invocation metadata
-- redacted effective config
-- transcript/normalization/chunking artifacts
-- utilization diagnostics (`utilization-diagnostics.json`)
-- correction ledger (`correction-ledger.json`)
-- report and failure error log (when applicable)
-- module/LLM diagnostics artifacts as available
+LLM interaction diagnostics include stable prompt and structured-schema identifiers where applicable.
 
-Retention behavior is controlled by configured retention mode; failed runs are retained.
+## Stdout/stderr and exit codes
+Success:
+- with `--output`, stdout is empty;
+- without `--output`, stdout contains transcript JSON only;
+- report JSON is not written to stdout.
 
-Diagnostics metadata for LLM interactions may include semi-public prompt identifiers:
-- `prompt_id`
-- `prompt_version`
-- `prompt_source`
-- `embedded_path`
-- `sha256`
+Failures:
+- nonzero exit;
+- human-readable stderr summary;
+- diagnostics directory path on stderr when available.
 
-These are diagnostic identifiers, not user-facing prompt override controls.
+Exit codes:
+- `0` success
+- nonzero failure
 
-## Stdout/stderr behavior
+## Redaction contract
+Configured secrets are redacted from:
+- effective config outputs;
+- diagnostics artifacts;
+- report artifacts;
+- surfaced adapter/runtime errors.
 
-Success behavior:
-- with `--output`, stdout is empty
-- without `--output`, stdout contains only transcript JSON in selected output schema
-- report JSON is not written to stdout
+## Compatibility policy
+Stable command behavior, schema names, report metadata keys, diagnostics-path field semantics, and validator key identities are treated as public contract.
 
-Failure behavior:
-- stderr contains human-readable error summary
-- nonzero exit
-- diagnostics path is printed when available
-
-## Exit-code behavior
-
-- `0`: success
-- nonzero: failure
-
-Treat any nonzero exit as a failed invocation.
-
-## Secret redaction guarantees
-
-Audita redacts API keys and authorization secrets from:
-- effective config outputs (`audita config print-effective`, diagnostics effective-config artifact)
-- report artifacts
-- LLM diagnostics artifacts
-- surfaced request/response error messages
-
-Config files should reference secrets via environment variable names (`api_key_env`) rather than embedding secret values.
-
-## Compatibility and deprecation policy
-
-- Existing stable schema names, report metadata keys, and top-level command behavior are treated as public contract.
-- Compatibility inputs (legacy flags/env aliases) may remain during transition windows.
-- Any planned removal or behavior change should include clear compatibility notes and migration guidance.
-
-## Breaking changes after 1.0
-
-After 1.0, breaking changes include, for example:
-- changing default success/failure exit-code semantics
-- changing stdout/stderr routing semantics
-- silently changing default output schema shape
-- removing supported output schema names without compatibility strategy
-- changing report schema fields or meanings incompatibly
-- changing config version semantics incompatibly without version bump
-
-Additive fields, additive diagnostics, and new optional schema names are generally non-breaking when existing behavior remains intact.
+Additive fields are acceptable when existing fields and behavior remain compatible.

docs/architecture/structured-llm.md

@@ -1,90 +1,72 @@
 # Structured LLM Architecture
 
-## Purpose
-
+## Scope
 This document describes Audita's structured LLM runtime boundary and adapter behavior.
 
-## Why Audita owns the adapter
-
-Audita owns a small structured LLM adapter so that core runtime behavior is controlled inside the repository:
-- request construction and schema handling are explicit and testable;
-- retries, timeouts, cancellation, and error redaction are consistent across modules and validators;
-- provider SDK types are not exposed outside the adapter boundary;
-- dependency weight and transitive provider-specific behavior are reduced.
-
-At runtime, the rest of Audita depends only on the internal contract:
-- `StructuredLLMClient`
+## Runtime boundary
+Production LLM integration depends on the internal contract only:
+- `contracts.StructuredLLMClient`
 - `CompleteStructured(ctx, req, out)`
 
-## OpenAI-compatible request shape
+Provider SDK types do not leak past this boundary.
 
-At a conceptual level, Audita sends chat completion requests with:
-- `model`
-- `messages` (role/content pairs)
-- `response_format`:
-  - `type = "json_schema"`
-  - `json_schema.name` (stable schema name)
-  - `json_schema.strict = true`
-  - `json_schema.schema` (registered JSON Schema payload)
+## Adapter ownership
+`internal/framework/llm` owns the OpenAI-compatible HTTP adapter and shared LLM runtime utilities.
 
-The adapter uses OpenAI-compatible `POST {base_url}/chat/completions` over `net/http`.
+Key responsibilities:
+- request assembly;
+- timeout/cancellation propagation;
+- bounded retry behavior;
+- scheduler integration;
+- provider response decoding;
+- error redaction.
 
-## Structured response schema registry
+## Structured schema registry
+Structured response schemas are registered in `internal/framework/responseschema` and include stable metadata:
+- `id`
+- `version`
+- `name`
+- `json_schema`
+- `sha256`
 
-Structured response schemas are registered in `internal/framework/responseschema` with stable metadata:
-- schema key
-- schema ID
-- schema version
-- schema name (OpenAI-compatible `response_format` name)
-- raw JSON Schema payload
-- SHA-256 hash
+Current schema keys:
+- `correction_set`
+- `validator_decision_set`
 
-Current schemas:
-- `correction_set`:
-  - id `audita.correction_set`
-  - version `v1`
-  - name `audita_correction_set_v1`
-- `validator_decision_set`:
-  - id `audita.validator_decision_set`
-  - version `v1`
-  - name `audita_validator_decision_set_v1`
+Schema metadata is attached to diagnostics through `Schema.DiagnosticsMap()`.
 
-## Provider compatibility assumptions
+## Request shape assumptions
+Audita targets OpenAI-compatible chat-completions endpoints and sends structured requests with:
+- model;
+- chat messages;
+- `response_format.type = json_schema`;
+- schema name and JSON schema payload.
 
-Audita assumes an OpenAI-compatible chat-completions endpoint that:
-- accepts message arrays with model selection;
-- accepts `response_format.type = json_schema`;
-- returns a completion with assistant message content and optional usage metadata.
+## Local validation remains mandatory
+Provider schema enforcement is treated as transport-level guardrails.
 
-Provider-specific differences are expected in strictness and error payload shapes, so the adapter treats provider output as untrusted until locally decoded.
+Audita still validates output locally before applying behavior changes:
+- proposal decoding and proposal invariants;
+- validator decision decoding and cardinality checks;
+- deterministic validation and apply-time rules.
 
-## Local decode and validation remain mandatory
+## Shared malformed-output policy
+Malformed structured-output classification is centralized in `internal/framework/structuredoutput`.
 
-Provider-level structured output is a transport guardrail, not final validation.
+Proposal generation and validator execution both use this shared classifier so downgrade behavior cannot drift between the two paths.
 
-After receiving a response, Audita still:
-- decodes assistant content into typed request-specific structs;
-- validates proposal and validator payload invariants locally;
-- enforces deterministic validator/cardinality rules before any transcript application.
+## Secrets and redaction
+Secret extraction for LLM redaction is centralized in `llm.ConfiguredSecrets(cfg)` and reused by proposal and validator diagnostics writers.
 
-This protects runtime correctness even when provider responses are malformed, partial, or semantically inconsistent.
+Secrets are redacted from:
+- diagnostics artifacts;
+- report artifacts;
+- surfaced adapter/runtime errors.
 
-## Diagnostics and redaction
+## Concurrency and scheduling
+LLM execution is constrained by composed scheduler limits:
+- total LLM concurrency;
+- proposal LLM concurrency;
+- validation LLM concurrency.
 
-When structured schemas are used, diagnostics metadata records:
-- schema ID
-- schema version
-- schema name
-- schema hash
-
-Diagnostics and surfaced errors preserve secret redaction:
-- API keys and bearer tokens are redacted from request/response/error artifacts;
-- redaction is applied before diagnostic files are written.
-
-## Runtime behavior guarantees
-
-The structured LLM path preserves existing runtime guarantees:
-- bounded LLM call execution through schedulers;
-- context-aware cancellation and timeout propagation;
-- retry behavior for transient failures and retryable malformed structured responses;
-- deterministic module/chunk/proposal/validator behavior outside provider nondeterminism.
+The scheduler is FIFO and context-aware so permits are released on success, failure, and cancellation.

docs/architecture/validators.md

@@ -1,148 +1,96 @@
 # Audita Validators
 
-This document describes Audita's built-in validator registry and module validator chains.
-
-For LLM-backed validator prompt asset details, see [`docs/prompts.md`](prompts.md).
-
-## Package ownership
-
-Built-in validator construction is package-owned under `internal/validators/<validator_key>`:
-- `internal/validators/confidence_threshold`
-- `internal/validators/original_text_presence`
-- `internal/validators/non_empty_corrected_text`
-- `internal/validators/no_effect`
-- `internal/validators/protected_terms`
-- `internal/validators/spoken_form_plausibility`
-- `internal/validators/meaning_reversal_review`
-- `internal/validators/editorial_review`
-
-Registry and chain wiring stay in:
-- `internal/validators/registry.go`
-- `internal/validators/chains.go`
-
-Shared validator runtime mechanics stay in `internal/framework/validators`:
-- request/result/decision models
-- decision cardinality helpers
-- protected vocabulary helpers
-- shared LLM validator runtime, batching, and diagnostics helpers
-
-Execution classification metadata is defined in `internal/validators/metadata`:
-- `deterministic`
-- `llm_backed`
-
-Runner ordering uses this metadata so deterministic validators run before LLM-backed validators without concrete framework type assertions.
-
 ## Scope
+This document defines the built-in validator system used by production module runs.
 
-Validator chains are built-in runtime behavior.
+## Ownership boundaries
+Built-in validator keys, constructors, and module chains are owned by `internal/validators`.
 
-Current 1.0 boundary:
-- built-in validator keys and built-in module chains are stable runtime identifiers;
-- thresholds and batching knobs remain configurable where already supported;
-- arbitrary user-defined validator chains are deferred.
+Shared runtime execution mechanics are owned by `internal/framework/validators`, including:
+- validator request/result models;
+- deterministic proposal checks;
+- LLM validator batching and execution;
+- decision-cardinality enforcement;
+- diagnostics integration.
 
-## Built-in validator keys
-
-### Deterministic validators
+Execution class metadata is owned by `internal/validators/metadata`.
 
+## Stable validator keys
+Deterministic:
+- `proposal_shape`
 - `confidence_threshold`
-  - checks proposal confidence against module-specific configured threshold.
 - `original_text_presence`
-  - ensures target segment exists and `original_text` exists in current working segment text.
 - `non_empty_corrected_text`
-  - rejects blank/whitespace-only `corrected_text`.
 - `no_effect`
-  - rejects proposals where `original_text == corrected_text`.
 - `protected_terms`
-  - protects glossary-derived terms from unsafe mutations in non-glossary modules.
-  - glossary stages use glossary-specific protection logic but still report this same stable key.
-
-### LLM-backed validators
 
+LLM-backed:
 - `spoken_form_plausibility`
-  - checks whether proposed spoken-form change remains plausible in transcript context.
 - `meaning_reversal_review`
-  - checks for likely meaning reversal or semantic contradiction.
 - `editorial_review`
-  - performs conservative editorial safety review.
 
 ## Built-in module chains
+`glossary`:
+- `proposal_shape`
+- `no_effect`
+- `original_text_presence`
+- `confidence_threshold`
+- `protected_terms`
+- `non_empty_corrected_text`
+- `spoken_form_plausibility`
+- `meaning_reversal_review`
 
-Current built-in chains resolved from `internal/validators/chains.go`:
+`homophones`:
+- `proposal_shape`
+- `no_effect`
+- `original_text_presence`
+- `confidence_threshold`
+- `protected_terms`
+- `non_empty_corrected_text`
+- `spoken_form_plausibility`
+- `meaning_reversal_review`
 
-- `glossary`
-  - `no_effect`
-  - `original_text_presence`
-  - `confidence_threshold`
-  - `protected_terms`
-  - `non_empty_corrected_text`
-  - `spoken_form_plausibility`
-  - `meaning_reversal_review`
+`spoken_word`:
+- `proposal_shape`
+- `no_effect`
+- `original_text_presence`
+- `confidence_threshold`
+- `protected_terms`
+- `non_empty_corrected_text`
+- `editorial_review`
+- `meaning_reversal_review`
 
-- `homophones`
-  - `no_effect`
-  - `original_text_presence`
-  - `confidence_threshold`
-  - `protected_terms`
-  - `non_empty_corrected_text`
-  - `spoken_form_plausibility`
-  - `meaning_reversal_review`
+`grammar`:
+- `proposal_shape`
+- `no_effect`
+- `original_text_presence`
+- `confidence_threshold`
+- `protected_terms`
+- `non_empty_corrected_text`
+- `editorial_review`
+- `meaning_reversal_review`
 
-- `spoken_word`
-  - `no_effect`
-  - `original_text_presence`
-  - `confidence_threshold`
-  - `protected_terms`
-  - `non_empty_corrected_text`
-  - `editorial_review`
-  - `meaning_reversal_review`
+## Ordering and execution semantics
+Validator ordering is based on canonical metadata:
+- deterministic validators run before LLM-backed validators.
 
-- `grammar`
-  - `no_effect`
-  - `original_text_presence`
-  - `confidence_threshold`
-  - `protected_terms`
-  - `non_empty_corrected_text`
-  - `editorial_review`
-  - `meaning_reversal_review`
+Within each module stage:
+- proposals are generated per section;
+- validator chains execute on those proposals;
+- approved proposals are applied once after section work settles.
 
-## Protected terms construction
+## Malformed payload behavior
+Malformed structured-output from proposal generation and LLM validator calls is downgraded, not treated as a process-fatal transport error.
 
-`protected_terms` has explicit constructors:
-- general constructor used by non-glossary modules through the built-in registry
-- glossary-stage constructor used by glossary chain resolution
+Current outcomes:
+- malformed proposal-generation payloads produce section/module warnings and zero proposals for the affected section;
+- malformed validator decision payloads reject the affected validator batch with warnings;
+- deterministic validator behavior and runner order remain unchanged.
 
-Both variants preserve existing behavior and report the stable key `protected_terms`.
+## Reporting identity
+Reports and diagnostics use stable validator keys as identifiers.
 
-## Execution semantics
+Correction-ledger deterministic-vs-LLM classification is derived from canonical validator metadata, not package-local hardcoded maps.
 
-- modules execute serially;
-- section proposal work can run concurrently within a module;
-- deterministic validators run before LLM-backed validators;
-- malformed/missing/duplicate/unknown LLM validator decisions fail safely;
-- approved proposals are applied once per module after section work settles.
-
-## Validator rejections vs proposal-application skips
-
-- validator rejection:
-  - proposal is denied by validator-chain review and appears in validator rejection reporting with validator key and reason code.
-- proposal-application skip:
-  - proposal passed validators but could not be applied under replacement-policy semantics (for example no matching span at apply time).
-
-These are separate outcomes and are reported separately.
-
-## Reporting and diagnostics identity
-
-- report validator decision/rejection entries use stable validator keys in `validator_name`.
-- validator LLM diagnostics include validator identity in interaction metadata and structured response schema metadata.
-- correction ledger entries include deterministic and LLM validator decision snapshots keyed by the same stable validator keys, and keep validator rejection distinct from application-level skip.
-
-Prompt assets are unchanged by the validator package-ownership refactor and remain built-in under `internal/prompts`.
-
-## Configurable knobs that remain supported
-
-- per-module confidence thresholds (`thresholds.*` / equivalent env+CLI overrides)
-- validation batching limits (`validation_max_prompt_tokens` / equivalent env+CLI overrides)
-- validation LLM model/base URL/timeout/retries/concurrency settings
-
-These tune validator behavior without exposing arbitrary user-defined chains.
+## Prompt assets
+LLM validator prompt assets and prompt metadata are documented in [Prompts](./prompts.md).

docs/configuration.md

@@ -1,51 +1,48 @@
 # Audita Configuration
 
-This document describes Audita's versioned YAML config support and related commands.
-
-## Purpose
-
-Audita's config file provides a stable place for pipeline defaults and runtime tuning that would otherwise require many environment variables or CLI flags.
-
-Use config files for baseline settings, then use environment variables and CLI flags for deployment and per-run overrides.
-
-## Supported version
-
-Current supported config version:
+## Scope
+This document defines the supported versioned YAML configuration model and runtime precedence behavior.
 
+## Supported file version
+Current supported config file version:
 - `version: 1`
 
-Rules:
-
-- missing `version` fails validation;
-- unknown versions fail validation;
-- unknown fields fail validation (strict decoding).
+Validation rules:
+- missing `version` fails;
+- unsupported version fails;
+- unknown YAML fields fail (strict decoding).
 
 ## Config path resolution
+For `audita process` and `audita config print-effective`, path resolution order is:
+1. `--config <path>`
+2. `AUDITA_CONFIG`
+3. `/usr/local/etc/audita/config.yml` (if present)
+4. `/etc/audita/config.yml` (if present)
 
-For `audita process`, config path resolution is:
+Missing-path behavior:
+- missing `--config` path is an error;
+- missing `AUDITA_CONFIG` path is an error;
+- missing both default paths is non-fatal.
 
-1. `--config <path>` if provided
-2. `AUDITA_CONFIG` if set and `--config` is not provided
-3. default `/usr/local/etc/audita/config.yml` if present
-4. fallback default `/etc/audita/config.yml` if present
-
-Missing-file behavior:
-
-- missing `--config` path: hard failure;
-- missing `AUDITA_CONFIG` path: hard failure;
-- missing both default-path files: non-fatal, run continues.
-
-## Precedence model
-
-Effective config precedence is:
-
-1. built-in defaults
+## Effective precedence
+`audita process` effective precedence:
+1. defaults
 2. file config
 3. environment overrides
 4. CLI overrides
 
-## Supported YAML fields
+`audita config print-effective` uses:
+1. defaults
+2. file config
+3. environment overrides
 
+`audita config validate` intentionally uses file-only validation:
+1. defaults
+2. file config
+
+Environment overrides are not applied in `config validate`.
+
+## Supported top-level YAML fields
 ```yaml
 version: 1
 
@@ -62,7 +59,6 @@ llm:
     api_key_env: AUDITA_LLM_API_KEY
     timeout: 120s
     max_retries: 3
-
   validation:
     base_url: https://openrouter.ai/api/v1
     model: openrouter/google/gemma-4-31b-it
@@ -100,91 +96,54 @@ diagnostics:
   retention: auto
 ```
 
-`context.description` provides background-only transcript context for prompts.
-If both config and CLI provide a description, `--transcript-description` takes precedence.
+## Module and output-schema validation
+`pipeline.modules` keys are validated against the built-in supported module catalog.
 
-`output.schema` supports the built-in output schema registry values:
-- `bare-segments` (default)
+Supported module keys:
+- `glossary`
+- `homophones`
+- `spoken_word`
+- `grammar`
+
+Repeated supported module keys are allowed.
+
+`output.schema` is validated against the built-in output schema catalog.
+
+Supported output schema keys:
+- `bare-segments`
 - `audita-v1`
 
-Unknown schema names fail clearly before transcript output is written.
+Unknown module keys and unknown output schema keys fail validation.
 
-Duration-like fields accept either:
+## Duration field parsing
+Duration-like fields support:
+- numeric seconds (for example `120`, `3.5`)
+- duration strings (for example `120s`, `2m`)
 
-- numeric seconds (for example `120`, `3.5`), or
-- duration strings (for example `120s`, `2m`).
-
-For LLM timeouts, duration strings must resolve to whole seconds.
+LLM timeout duration strings must resolve to whole seconds.
 
 ## Secret handling
-
-Use `api_key_env` for secrets:
-
+Use `api_key_env` fields for secrets:
 - `llm.proposal.api_key_env`
 - `llm.validation.api_key_env`
 
-These fields must contain environment variable names, not secret values.
+These fields store environment variable names, not secret values.
 
-At runtime, Audita resolves those names from the process environment.
-
-Redaction behavior:
-
-- run diagnostics `effective-config.json` is redacted;
-- `audita config print-effective` output is redacted;
-- API keys are never emitted in plaintext by those outputs.
-
-## Config commands
-
-Validate a config file:
+Resolved secret values are redacted from:
+- `audita config print-effective` output;
+- diagnostics `effective-config.json`;
+- report and diagnostics payloads.
 
+## Commands
+Validate a file config:
 ```sh
 audita config validate --config ./audita.yml
 ```
 
 Print redacted effective config:
-
 ```sh
 audita config print-effective --config ./audita.yml
 ```
 
-`print-effective` loads defaults, then file config, then environment overrides.
-
-## Example: local OpenAI-compatible endpoint
-
-```yaml
-version: 1
-
-llm:
-  proposal:
-    base_url: http://localhost:8000/v1
-    model: local/proposal-model
-    api_key_env: AUDITA_LLM_API_KEY
-    timeout: 90s
-    max_retries: 2
-
-  validation:
-    base_url: http://localhost:8000/v1
-    model: local/validation-model
-    api_key_env: AUDITA_VALIDATION_LLM_API_KEY
-    timeout: 90s
-    max_retries: 2
-
-pipeline:
-  modules: [glossary, homophones, glossary, spoken_word, grammar]
-
-diagnostics:
-  work_dir: /tmp/audita
-  retention: auto
-```
-
 ## Compatibility notes
-
-Existing environment variables and lower-level CLI flags remain available for compatibility.
-
-Current guidance:
-
-- prefer file config for baseline behavior;
-- keep environment variables for secrets/deployment-specific overrides;
-- use CLI flags for per-run overrides.
-- validator chains are built-in and are not user-configurable in config.
-- prompt source selection and filesystem prompt overrides are not config options.
+Legacy compatibility flags and environment aliases remain available where implemented, but the stable configuration surface is the versioned YAML model described above.

docs/development.md

@@ -0,0 +1,33 @@
+# Audita Development Workflow
+
+## Scope
+This document defines the canonical contributor workflow and engineering conventions for this repository.
+
+## Workflow
+1. Start from a clean understanding of scope and constraints.
+2. Make focused changes that preserve existing public behavior unless behavior change is explicitly intended.
+3. Run targeted tests for touched packages.
+4. Run `go test ./...` before finalizing substantial changes.
+5. Update affected documentation so it describes current behavior only.
+
+## Engineering conventions
+- Keep module packages separate: `glossary`, `homophones`, `spoken_word`, `grammar`.
+- Prefer narrow shared helpers and catalogs over broad abstractions.
+- Preserve diagnostics artifact naming and report field contracts unless intentionally changed.
+- Preserve CLI/config precedence semantics unless intentionally changed.
+- Treat stable validator keys, prompt identifiers, and output-schema keys as contract surfaces.
+
+## Configuration and runtime expectations
+- `audita process` precedence is defaults -> file -> env -> CLI.
+- `audita config validate` validates file config merged onto defaults only.
+- `audita config print-effective` includes environment overrides and prints redacted JSON.
+
+## Testing expectations
+- Add tests for new behavior and for bug fixes.
+- Keep deterministic fixtures stable.
+- Do not reduce existing parity, release-fixture, subprocess, or module-specific coverage without equivalent replacement.
+
+## Commit discipline
+- Keep commits scoped and reviewable.
+- Avoid mixing unrelated refactors with behavior changes.
+- Use clear plain-English commit messages.

docs/documentation/policy.md

@@ -0,0 +1,27 @@
+# Documentation Policy
+
+## Scope
+This policy defines how project documentation should be authored and maintained.
+
+## Core rules
+- Document the current behavior of the codebase.
+- Remove stale behavior descriptions promptly when code changes.
+- Do not describe development history in architecture or behavior docs unless a document is explicitly historical.
+- Do not use architecture or behavior docs as changelogs.
+- Prefer rewriting stale sections from scratch when substantial behavior or ownership changes occur.
+
+## Consistency requirements
+- Keep command examples aligned with current CLI surfaces.
+- Keep configuration examples aligned with supported fields and precedence.
+- Keep architecture package ownership descriptions aligned with current code layout.
+- Keep stable contract identifiers accurate (module keys, validator keys, output-schema keys, report metadata fields).
+
+## Cross-document expectations
+- `docs/architecture/*` documents runtime behavior and package ownership.
+- `docs/configuration.md` documents config schema and precedence.
+- `docs/development.md` documents contributor workflow and engineering conventions.
+
+## Review expectations for documentation changes
+- Verify referenced files and links exist.
+- Verify examples match current behavior.
+- Prefer concise, direct language and avoid speculative future claims.

docs/policy/architecture.md

@@ -0,0 +1,209 @@
+# Architecture Policy
+
+## Purpose
+
+This document defines Audita's development architecture and invariants for maintainers and LLM coding agents. It describes how the project is intended to be changed safely, based on behavior implemented in this repository today.
+
+User-facing behavior belongs in the README and focused runtime docs. Future or proposed work belongs only under `docs/roadmap/`.
+
+## Project Shape
+
+Audita is a single-process Go CLI for transcript polishing. The executable entrypoint is `cmd/audita`; command handling lives in `internal/cli`.
+
+The implemented `audita process` flow is:
+
+1. load effective config;
+2. read and validate transcript JSON and glossary YAML;
+3. normalize transcript segments;
+4. chunk the working transcript into sections;
+5. resolve configured module instances;
+6. run correction modules and validator chains;
+7. apply approved proposals deterministically;
+8. write transcript output, reports, and diagnostics artifacts.
+
+The current built-in modules are `glossary`, `homophones`, `spoken_word`, and `grammar`. The default configured module sequence repeats `glossary`.
+
+For external behavior and compatibility details, prefer links to existing behavior docs:
+
+- [Architecture overview](../architecture/architecture.md)
+- [Public contract](../architecture/public-contract.md)
+- [Diagnostics](../architecture/diagnostics.md)
+- [Structured LLM](../architecture/structured-llm.md)
+- [Validators](../architecture/validators.md)
+- [Prompts](../architecture/prompts.md)
+- [Output schemas](../architecture/output-schemas.md)
+- [Configuration](../configuration.md)
+
+## Core Design Principles
+
+- **Hexagonal architecture:** keep domain behavior behind narrow internal contracts. CLI, filesystem, config loading, diagnostics writing, and LLM transport are adapters around the core processing flow.
+- **Composable modules and validators:** correction stages and validators should remain small, explicit, and independently testable.
+- **Deterministic orchestration around LLM calls:** LLM responses are nondeterministic inputs. Proposal indexing, validator ordering, proposal application, reports, and output serialization must remain deterministic.
+- **Bounded and observable concurrency:** use the implemented schedulers and configured concurrency limits for LLM call sites. Preserve utilization diagnostics when changing scheduling or orchestration.
+- **Conservative correction behavior:** validate proposed corrections before application; apply accepted proposals through deterministic apply-time safety checks.
+- **Standard-library-first:** prefer the Go standard library. Narrow third-party dependencies are acceptable when they materially improve maintainability, such as `gopkg.in/yaml.v3` for YAML parsing.
+- **Current-behavior documentation:** non-roadmap docs must describe implemented behavior only.
+
+## Architectural Boundaries
+
+`internal/core` owns domain data handling and stable runtime contracts that do not require CLI or provider transport knowledge:
+
+- config defaults, loading, validation, redaction, and catalogs;
+- transcript and glossary schemas;
+- normalization and chunking;
+- output-schema encoding;
+- diagnostics artifact naming and run-directory helpers;
+- public process report shapes.
+
+`internal/framework` owns orchestration contracts and reusable runtime mechanics:
+
+- module and validator interfaces;
+- proposal generation, proposal application, and prompt context;
+- runner orchestration;
+- LLM scheduler, OpenAI-compatible adapter, redaction helpers, and diagnostics writers;
+- structured response schema registry;
+- process report and correction-ledger assembly.
+
+`internal/modules/*` owns module-specific correction stages. `internal/validators/*` owns built-in validator implementations, registry, chains, and execution-class metadata. `internal/prompts` owns embedded prompt assets and prompt metadata.
+
+`internal/cli` owns command parsing, exit codes, stdout/stderr behavior, config command behavior, filesystem input/output wiring, and top-level process orchestration. CLI concerns should not move into modules, validators, or schema logic.
+
+Tests should stay close to the behavior they protect. Shared test helpers are acceptable when they remove clear duplication without hiding module-specific behavior.
+
+## Modules and Validators
+
+Modules implement `contracts.TranscriptModule`. A module must provide:
+
+- a stable key;
+- a replacement policy;
+- a validator chain;
+- proposal generation from explicit request inputs.
+
+Module packages should stay separate. Do not collapse module-specific prompts, scope, or validation choices into a broad generic stage abstraction.
+
+Validators implement the shared validator contract and return one decision per candidate proposal. Deterministic validators and LLM-backed validators are both composable chain elements. Validator identity and execution class metadata are stable enough to affect ordering, diagnostics, reports, and correction-ledger classification.
+
+Future module or validator changes should preserve:
+
+- explicit inputs and outputs;
+- no hidden global state;
+- explicit config dependencies;
+- deterministic proposal index handling;
+- validation before final mutation;
+- stable reason codes and validator keys where already exposed.
+
+## LLM Integration and Concurrency
+
+LLM calls are external effects behind narrow contracts. Production structured completions use `contracts.StructuredLLMClient`; the implemented provider adapter is OpenAI-compatible HTTP code in `internal/framework/llm`.
+
+Structured response schemas are registered in `internal/framework/responseschema`. Provider-side schema enforcement is not a substitute for local validation: Audita still validates proposal structure, validator decision cardinality, and apply-time safety.
+
+Concurrency is bounded by configured scheduler limits:
+
+- total LLM concurrency;
+- proposal LLM concurrency;
+- validation LLM concurrency.
+
+The scheduler is context-aware and releases permits on success, failure, and cancellation. Runner code may collect section-level work concurrently, but transcript mutation is applied later in deterministic proposal-index order.
+
+Diagnostics for LLM interactions should be useful for debugging without leaking configured secrets. Use the existing redaction helpers and `llm.ConfiguredSecrets`.
+
+## State, Inputs, and Outputs
+
+Audita does not implement resume, checkpoint, manifest, or remote storage behavior. Runtime state is in memory plus per-run diagnostics artifacts written under the configured work directory.
+
+Transcript input accepts the implemented JSON forms documented in the public contract. Parsed source transcripts are normalized into Audita's internal transcript shape before chunking and module execution.
+
+Proposals and validator decisions are intermediate runtime data. Approved proposals are applied through `internal/framework/proposals`, which clones transcript state, orders by proposal index, and records applied or skipped changes.
+
+Transcript output is encoded through `internal/core/outputschema`. Reports and correction ledgers are machine-readable artifacts derived from runner outputs; their public shape should not be changed casually.
+
+## Configuration and CLI Boundaries
+
+Config behavior is owned by `internal/core/config`; command usage and process wiring are owned by `internal/cli`.
+
+`audita process` uses implemented precedence: defaults, config file, environment, then CLI flags. `config validate` validates defaults plus a file config and intentionally does not apply environment overrides. `config print-effective` applies defaults, file config, and environment overrides, then prints redacted JSON.
+
+Do not duplicate full CLI or config reference material here. Use [Configuration](../configuration.md), the README, and [Public contract](../architecture/public-contract.md) for current external behavior.
+
+When adding config fields or CLI flags, update:
+
+- config defaults, file/env/CLI application, and validation;
+- CLI flag extraction if applicable;
+- redaction when secrets are involved;
+- tests for precedence and source-specific behavior;
+- user-facing docs if external behavior changes.
+
+## Errors, Logging, and Diagnostics
+
+Errors should be phase-specific enough for CLI users and subprocess callers. The CLI writes human-readable errors to stderr and preserves transcript JSON-only stdout behavior on successful stdout output.
+
+Run diagnostics are best-effort after run-directory creation. Failed runs are retained. Successful run retention follows the implemented work-dir retention policy.
+
+Diagnostics and reports must not leak configured LLM secrets. Config redaction and LLM payload/error redaction are separate responsibilities and should remain separate.
+
+Process reports, diagnostics metadata, utilization diagnostics, and correction ledgers are part of the public contract. Prefer additive, compatible changes.
+
+## Testing Expectations
+
+Use targeted package tests for touched behavior and `go test ./...` for substantial changes.
+
+When changing modules, inspect or add:
+
+- package-local module tests under `internal/modules/*`;
+- prompt rendering or proposal-generation tests when prompt inputs change;
+- parity or release fixtures when public output behavior changes.
+
+When changing validators, inspect or add:
+
+- validator package tests;
+- registry and chain tests under `internal/validators`;
+- framework validator tests for batching, malformed output, diagnostics, and cardinality.
+
+When changing LLM integration or concurrency, inspect or add:
+
+- `internal/framework/llm` scheduler/client/redaction tests;
+- `internal/framework/runner` orchestration and utilization tests;
+- structured-output malformed classification tests.
+
+When changing config, CLI, schema, output, reports, or diagnostics, inspect or add:
+
+- `internal/core/config` tests;
+- CLI tests under `internal/cli`;
+- schema and output-schema tests under `internal/core`;
+- report, diagnostics, parity, and release-fixture tests.
+
+## Dependency Policy
+
+Audita should remain dependency-light. Prefer standard-library solutions for CLI parsing, HTTP, JSON, filesystem, synchronization, and tests.
+
+Third-party dependencies should be narrow, justified, and preferably de facto standard for their purpose. YAML parsing is the current direct dependency exception.
+
+Do not add broad frameworks for CLI, dependency injection, workflow orchestration, logging, or plugin systems without a concrete implemented need and focused tests.
+
+## Documentation Expectations
+
+Follow [Documentation Policy](./documentation.md). Architecture policy must stay concise and aligned with implemented behavior.
+
+Do not use architecture docs as changelogs. Do not describe planned modules, adapters, modes, persistence, or configuration unless they are implemented. Put future work under `docs/roadmap/`.
+
+## Architectural Invariants
+
+- Keep LLM transport behind `StructuredLLMClient` and framework adapter boundaries.
+- Keep correction modules narrowly scoped and package-separated.
+- Keep validators modular, composable, and identified by stable keys.
+- Keep CLI/config/filesystem concerns out of module and validator domain logic.
+- Preserve deterministic transcript mutation and output handling around nondeterministic LLM calls.
+- Keep LLM concurrency bounded, configurable, and observable where implemented.
+- Keep run diagnostics and reports redacted and machine-readable.
+- Keep public CLI, config, output-schema, diagnostics, report, prompt, module, and validator contracts stable unless a change is explicit and tested.
+- Prefer small shared helpers over broad rewrites.
+- Avoid new dependencies unless they are narrow and clearly justified.
+
+## Non-Goals
+
+- No plugin framework is implemented.
+- No generic workflow engine is implemented.
+- No resume, checkpoint, manifest, or remote storage system is implemented.
+- No multi-process service mode is implemented.
+- No provider SDK abstraction beyond the current structured LLM client contract and OpenAI-compatible HTTP adapter is implemented.

docs/policy/documentation.md

@@ -0,0 +1,356 @@
+# Go Project Documentation Policy
+
+## Purpose
+
+Project documentation must help four audiences:
+
+1. users who need to run the application;
+2. administrators/operators who need to configure and operate it;
+3. developers who need to understand and change it safely;
+4. LLM coding agents that need clear scope, boundaries, and invariants.
+
+Docs should be accurate, concise, task-oriented, and organized by audience. Prefer links to canonical docs over repetition.
+
+## Core Rules
+
+### 1. Keep docs concise
+
+Each document should cover a defined scope and only the essentials for that scope.
+
+Avoid:
+- long background explanations;
+- repeated reference material;
+- implementation detail in user-facing docs;
+- aspirational language outside roadmap docs;
+- verbose examples where one minimal example is clearer.
+
+### 2. Document only implemented behavior outside roadmap files
+
+Unimplemented, planned, aspirational, experimental, or future work may be described only under:
+
+- `docs/roadmap/`
+
+No other documentation file, including `README.md`, should describe code, features, modules, stages, commands, config fields, or behaviors that do not currently exist.
+
+If a feature is partial, non-roadmap docs may describe only the implemented portion and its current boundary.
+
+### 3. Use canonical homes
+
+Each type of information should have one canonical location.
+
+Canonical homes:
+
+- project purpose and quickstart: `README.md`
+- development principles: `docs/policy/architecture.md`
+- configuration reference: `docs/config.md`
+- CLI reference: `docs/cli.md`
+- operations and recovery: `docs/operations.md`
+- troubleshooting: `docs/troubleshooting.md`
+- implemented internals: `docs/internal/`
+- future work: `docs/roadmap/`
+- contributor workflow: `docs/policy/development.md`
+- copyable examples: `examples/`
+
+Other files should summarize briefly and link to the canonical source.
+
+### 4. Keep examples real
+
+Examples should be valid, maintained, and free of secrets.
+
+Where practical:
+- example configs should load successfully;
+- example commands should match real CLI syntax;
+- important examples should be covered by tests.
+
+## Documentation Profiles
+
+All projects require:
+
+- `README.md`
+- `docs/policy/architecture.md`
+
+Additional docs depend on the project.
+
+### Small library
+
+Recommended:
+- `docs/policy/development.md`, if contributor conventions are non-obvious
+
+### Simple CLI
+
+Required:
+- `docs/cli.md`
+
+Recommended:
+- `docs/policy/development.md`
+
+### Config-driven CLI
+
+Required:
+- `docs/cli.md`
+- `docs/config.md`
+
+Recommended:
+- `examples/`
+- `docs/policy/development.md`
+
+### Stateful or operator-facing application
+
+Required:
+- `docs/cli.md`, if CLI-based
+- `docs/config.md`, if config-driven
+- `docs/operations.md`
+
+Recommended:
+- `docs/troubleshooting.md`
+- `examples/`
+- `docs/policy/development.md`
+
+### Modular, staged, service-oriented, or orchestration application
+
+Required:
+- `docs/cli.md`, if CLI-based
+- `docs/config.md`, if config-driven
+- `docs/operations.md`
+- `docs/internal/`
+- `docs/policy/development.md`
+
+Recommended:
+- `docs/troubleshooting.md`
+- validated examples under `examples/`
+
+## Required Documents
+
+### README.md
+
+**Audience:** users, administrators, operators
+
+The README is the outward-facing project orientation page.
+
+It should include, in order:
+
+1. concise description;
+2. elevator pitch;
+3. shortest useful command or usage example;
+4. links to targeted docs.
+
+The README should be short. It is not a manual.
+
+The “shortest useful command” means the simplest command that performs the project’s core use case. (It does not mean `app --help`.)
+
+### docs/policy/architecture.md
+
+**Audience:** developers, LLM coding agents
+
+`docs/policy/architecture.md` is required for every project.
+
+It is an inward-facing development policy document. It should describe how the project is intended to be built and changed.
+
+It should include:
+
+- project shape;
+- core design principles;
+- package and boundary philosophy;
+- state/persistence philosophy, if applicable;
+- external integration philosophy, if applicable;
+- error-handling and logging principles;
+- testing expectations;
+- documentation expectations;
+- architectural invariants;
+- explicit non-goals, if useful.
+
+For small projects, this file may be brief. It may simply state that the project is intentionally narrow, monolithic, and dependency-light.
+
+### docs/policy/development.md
+
+**Audience:** developers, LLM coding agents
+
+Required for projects maintained by humans and LLM coding agents.
+
+It should include:
+
+- repository layout;
+- build/test commands;
+- coding conventions;
+- dependency policy;
+- how to add config fields;
+- how to add CLI flags;
+- how to add stages/modules/adapters, if applicable;
+- how to update examples;
+- documentation update expectations.
+
+### docs/config.md
+
+**Audience:** administrators, operators, advanced users
+
+Required for applications with configuration files.
+
+It should include, in order:
+
+1. config file locations and discovery precedence;
+2. minimal working config;
+3. production-oriented config;
+4. full configuration reference;
+5. secrets handling, if applicable;
+6. links to maintained examples.
+
+The full configuration reference should be canonical.
+
+### docs/cli.md
+
+**Audience:** users, administrators, operators
+
+Required for CLI applications.
+
+It should include, in order:
+
+1. shortest useful command;
+2. command overview;
+3. complete flag reference;
+4. common workflows;
+5. diagnostic or recovery commands, if applicable.
+
+Explain when commands are useful, not just their syntax.
+
+### docs/operations.md
+
+**Audience:** administrators, operators
+
+Required for applications that maintain state, support resume behavior, run multiple stages, write durable artifacts, use remote storage, or require recovery procedures.
+
+It should cover:
+
+- normal workflow;
+- filesystem layout;
+- remote storage layout, if applicable;
+- logs and manifests;
+- resume/retry behavior;
+- cleanup behavior;
+- archive/backup behavior;
+- safe recovery procedures;
+- operational caveats.
+
+### docs/troubleshooting.md
+
+**Audience:** administrators, operators
+
+Recommended once recurring failure modes exist.
+
+Each entry should include:
+
+- symptom;
+- likely cause;
+- diagnostic command or inspection step;
+- safe fix;
+- relevant links.
+
+### docs/internal/
+
+**Audience:** developers, LLM coding agents
+
+Required for modular, staged, service-oriented, or orchestration projects.
+
+This directory describes implemented internal components. It is not the roadmap.
+
+Use one file per major component where useful.
+
+Each component doc should include:
+
+1. purpose;
+2. inputs and outputs;
+3. boundaries;
+4. config fields used;
+5. external adapters used;
+6. state or manifest behavior, if applicable;
+7. skip/resume behavior, if applicable;
+8. failure behavior;
+9. tests to inspect before changing;
+10. architectural invariants.
+
+### docs/roadmap/
+
+**Audience:** maintainers, developers, LLM coding agents
+
+This is the only place for planned, future, aspirational, experimental, or unimplemented work.
+
+Roadmap docs should clearly distinguish:
+
+- proposed work;
+- accepted plans;
+- deferred ideas;
+- rejected ideas;
+- implementation prompts or task breakdowns, if useful.
+
+Roadmap docs should not be confused with current behavior.
+
+### docs/integrations/
+
+**Audience:** developers, LLM coding agents
+
+Required for projects that depend on external CLIs, APIs, services, protocols, or file formats where the integration contract is important to maintain.
+
+This directory contains concise, versioned reference notes for external integration contracts. It should document only the parts of the external system that this project actually uses.
+
+Use one file per integration where useful.
+
+## Examples Directory
+
+Projects with non-trivial configuration or workflows should include `examples/`.
+
+Useful examples include:
+
+- minimal working config;
+- production-oriented config;
+- full annotated config;
+- local development config;
+- remote/object-storage config;
+- minimal session/input file.
+
+Examples should be valid, maintained, tested when practical, and linked from relevant docs.
+
+## Security and Privacy
+
+Docs and examples must not include:
+
+- real API keys;
+- tokens;
+- passwords;
+- private keys;
+- private environment dumps;
+- sensitive user data;
+- raw private transcripts;
+- private infrastructure details unless intentionally public.
+
+Document secret-handling mechanisms, not actual secret values.
+
+## Maintenance Rules
+
+When docs change, verify the affected behavior.
+
+Where practical:
+
+- load example config files in tests;
+- test CLI examples or command parser behavior;
+- validate documented flags against real flags;
+- remove stale references;
+- update links after renames;
+- keep roadmap content out of non-roadmap docs.
+
+If documentation and code disagree, fix the documentation and/or open a roadmap item; do not leave aspirational behavior in current-behavior docs.
+
+Documentation is complete only when it matches the current code.
+
+## Documentation Change Checklist
+
+Before merging documentation changes, verify:
+
+- README is concise and orientation-focused.
+- `docs/policy/architecture.md` describes development principles.
+- Future work appears only under `docs/roadmap/`.
+- User-facing docs avoid unnecessary internals.
+- Developer-facing docs preserve boundaries and invariants.
+- Config examples match the schema.
+- CLI examples match real commands and flags.
+- Defaults appear in the canonical config reference.
+- No secrets or private data are included.
+- Links are accurate.

docs/release-checklist.md

@@ -40,6 +40,7 @@ Use this checklist before cutting a pre-1.0 or 1.0 release candidate.
 - Verify structured response schemas are attached via `response_format.type=json_schema`.
 - Verify diagnostics metadata includes structured schema `id/version/name/sha256`.
 - Verify provider output is still locally decoded/validated before use.
+- Verify malformed module-stage structured payloads degrade to warnings/rejections instead of failing the run.
 
 ## Report and diagnostics schema checks
 
@@ -67,6 +68,7 @@ Use this checklist before cutting a pre-1.0 or 1.0 release candidate.
 - Verify prompt metadata appears in LLM request metadata diagnostics:
   - `prompt_id`, `prompt_version`, `prompt_source`, `embedded_path`, `sha256`.
 - Verify stable validator keys appear in report decisions/rejections.
+- Verify module warning records appear in reports for malformed proposal-generation payloads and malformed validator batches.
 - Verify built-in validator chains resolve and execute for default and explicit module runs.
 
 ## Utilization diagnostics checks
@@ -96,6 +98,8 @@ Use this checklist before cutting a pre-1.0 or 1.0 release candidate.
 ## Failure and cancellation checks
 
 - Verify controlled failure paths retain diagnostics and produce best-effort failure reports.
+- Verify malformed proposal-generation payloads keep exit code `0`, keep stderr empty on success, and record warnings in reports/diagnostics.
+- Verify malformed validator payloads reject only the affected batch and do not fail the module.
 - Verify timeout/cancellation paths exit nonzero, do not hang, and retain failure diagnostics when initialized.
 
 ## Release fixture/idempotence checks

docs/roadmap/documentation.md

@@ -0,0 +1,577 @@
+# Documentation Roadmap
+
+## Purpose
+
+This roadmap defines the work required to bring Audita documentation into compliance with `docs/policy/documentation.md` and the implemented architecture described by `docs/policy/architecture.md`.
+
+This is an implementation plan for future documentation cleanup. It does not rewrite the main documentation. Future implementation passes should document only current behavior outside `docs/roadmap/`, keep planned or unimplemented work in roadmap files, and verify claims against repository code and tests rather than stale documentation.
+
+## Repository Documentation Inventory
+
+- `README.md`: keep and rewrite. It should remain the project orientation and quickstart, but it currently carries too much reference material and includes stale links such as `docs/diagnostics.md`, `docs/structured-llm.md`, and `docs/subprocess-operations.md`.
+- `docs/policy/documentation.md`: keep and lightly update only if needed. It is the canonical documentation policy.
+- `docs/policy/architecture.md`: keep and lightly verify after the migration. It is the canonical architecture policy for developers and coding agents.
+- `docs/development.md`: move and rewrite as `docs/policy/development.md`. Contributor workflow belongs under `docs/policy/`.
+- `docs/configuration.md`: move and rewrite as `docs/config.md`. Configuration reference belongs at the canonical config path.
+- `docs/architecture.md`: merge or delete after the internal docs are created. Its useful content should become an internal overview or links to canonical internal docs.
+- `docs/architecture/architecture.md`: split and rewrite into `docs/internal/overview.md` and `docs/internal/pipeline.md`.
+- `docs/architecture/public-contract.md`: split across `docs/cli.md`, `docs/config.md`, `docs/operations.md`, and integration docs where applicable.
+- `docs/architecture/diagnostics.md`: split across `docs/operations.md` and `docs/internal/diagnostics-reporting.md`.
+- `docs/architecture/structured-llm.md`: split across `docs/internal/llm-runtime.md` and `docs/integrations/openai-compatible-llm.md`.
+- `docs/architecture/validators.md`: move and rewrite as `docs/internal/validators.md`.
+- `docs/architecture/prompts.md`: move and rewrite as `docs/internal/prompts.md`; remove deferred and unimplemented prompt override material.
+- `docs/architecture/output-schemas.md`: move and rewrite as `docs/internal/output-schemas.md`; remove deferred or unimplemented schema material such as `seriatim-intermediate`.
+- `docs/documentation/policy.md`: merge/delete in favor of `docs/policy/documentation.md`. It duplicates policy material in a noncanonical location.
+- `docs/integration/subprocess-operations.md`: move and rewrite as `docs/integrations/subprocess.md`.
+- `docs/release-checklist.md`: merge current-behavior checks into `docs/policy/development.md` or move to a clearer policy/internal location; remove pre-release or deferred-feature guardrail language from non-roadmap docs.
+- `docs/roadmap/audit.md`: currently deleted in the worktree. Treat this as unrelated state unless a later task explicitly restores or updates it.
+- `docs/roadmap/implementation.md`: currently deleted in the worktree. Treat this as unrelated state unless a later task explicitly restores or updates it.
+- `examples/`: create new. No examples directory is currently present, but policy expects copyable examples when practical.
+
+## Policy Compliance Assessment
+
+Required or expected canonical documents are missing:
+
+- `docs/cli.md`
+- `docs/config.md`
+- `docs/operations.md`
+- `docs/internal/`
+- `docs/policy/development.md`
+- `examples/`
+
+Recommended documents that should be added:
+
+- `docs/troubleshooting.md`
+- `docs/integrations/openai-compatible-llm.md`
+- `docs/integrations/transcript-glossary-files.md`
+
+Documents in the wrong canonical home:
+
+- `docs/configuration.md` should become `docs/config.md`.
+- `docs/development.md` should become `docs/policy/development.md`.
+- `docs/integration/` should become `docs/integrations/`.
+- Implemented internal architecture content under `docs/architecture/` should move to `docs/internal/`.
+- `docs/documentation/policy.md` should merge/delete in favor of `docs/policy/documentation.md`.
+
+Content that should not remain outside `docs/roadmap/`:
+
+- Deferred or unimplemented output schema content in `docs/architecture/output-schemas.md`.
+- Deferred or unimplemented prompt override, generated transcript description, and report prompt ledger content in `docs/architecture/prompts.md`.
+- Pre-release or future-feature guardrail language in `docs/release-checklist.md`, unless moved to roadmap or rewritten as current contributor workflow.
+
+Examples and links:
+
+- `examples/` is missing.
+- README links to nonexistent documentation paths.
+- Links to `docs/configuration.md`, `docs/development.md`, and `docs/integration/` should be updated after canonical moves.
+- A repository-wide link/path check should be part of final validation.
+
+## Target Documentation Set
+
+### `README.md`
+
+- Audience: users and operators.
+- Purpose: concise project orientation and shortest useful workflow.
+- Canonical scope: what Audita does, install/build basics, minimal command shape, and links to canonical docs.
+- Recommended outline: overview, quickstart, minimal configuration pointer, common command pointer, documentation map, development pointer.
+- Sources to inspect: `cmd/audita/main.go`, `internal/cli/run.go`, `internal/cli/process_flags.go`, README tests or CLI integration tests.
+- Acceptance criteria: no long CLI or config reference; no stale links; all linked docs exist.
+
+### `docs/cli.md`
+
+- Audience: users and operators.
+- Purpose: canonical CLI reference.
+- Canonical scope: commands, flags, common workflows, output destinations, stdout/stderr behavior, and exit behavior.
+- Recommended outline: command overview, `process`, `config validate`, `config print-effective`, config path selection, process outputs, examples, exit behavior.
+- Sources to inspect: `internal/cli/run.go`, `internal/cli/process_flags.go`, `cmd/audita`, CLI tests.
+- Acceptance criteria: every implemented command and flag is documented; examples match parser behavior; config details link to `docs/config.md`.
+
+### `docs/config.md`
+
+- Audience: administrators, operators, and advanced users.
+- Purpose: canonical configuration reference.
+- Canonical scope: config path resolution, precedence, YAML schema, environment overrides, CLI override relationship, secrets, validation.
+- Recommended outline: loading model, precedence, file schema, environment variables, CLI relationship, secrets, examples, validation.
+- Sources to inspect: `internal/core/config/*`, config tests, CLI config commands.
+- Acceptance criteria: replaces `docs/configuration.md`; documents implemented defaults and validation only; examples validate.
+
+### `docs/operations.md`
+
+- Audience: operators.
+- Purpose: operational behavior and recovery/debugging reference.
+- Canonical scope: run directories, diagnostics artifacts, reports, correction ledger, retention, output writes, failure inspection.
+- Recommended outline: process run lifecycle, output files, diagnostics directory, reports, retention, operational failure modes, recovery steps.
+- Sources to inspect: `internal/core/diagnostics`, `internal/framework/processreport`, `internal/cli`, reporting tests.
+- Acceptance criteria: no resume, checkpoint, or remote storage claims; operational artifacts match implemented filenames and report behavior.
+
+### `docs/troubleshooting.md`
+
+- Audience: users and operators.
+- Purpose: concise guide for recurring implemented failures.
+- Canonical scope: symptoms, likely causes, inspection steps, and safe fixes.
+- Recommended outline: config validation errors, transcript/glossary schema errors, LLM request errors, output/report write failures, diagnostics lookup.
+- Sources to inspect: CLI tests, config tests, schema tests, LLM tests, reporting tests.
+- Acceptance criteria: every entry maps to implemented behavior; no speculative remediation.
+
+### `docs/policy/documentation.md`
+
+- Audience: maintainers and coding agents.
+- Purpose: canonical documentation policy.
+- Canonical scope: documentation layout, audience boundaries, roadmap rules, maintenance rules.
+- Recommended outline: keep current structure unless policy itself needs small alignment.
+- Sources to inspect: documentation policy and final documentation tree.
+- Acceptance criteria: remains the only canonical documentation policy.
+
+### `docs/policy/architecture.md`
+
+- Audience: developers and coding agents.
+- Purpose: canonical architecture policy.
+- Canonical scope: development principles, boundaries, invariants, dependency policy, testing expectations.
+- Recommended outline: keep current policy; update links after docs migration only if necessary.
+- Sources to inspect: package layout and policy docs.
+- Acceptance criteria: no stale links; no duplicated CLI/config reference.
+
+### `docs/policy/development.md`
+
+- Audience: developers and coding agents.
+- Purpose: contributor workflow and change expectations.
+- Canonical scope: repo layout, setup, tests, conventions, adding config/CLI/module/validator/docs/examples.
+- Recommended outline: setup, repository layout, running tests, change workflow, adding features, documentation expectations, release checks.
+- Sources to inspect: `docs/development.md`, tests, `go.mod`, package layout.
+- Acceptance criteria: replaces `docs/development.md`; no future-feature roadmap content; includes practical validation commands.
+
+### `docs/internal/overview.md`
+
+- Audience: developers and coding agents.
+- Purpose: implemented internal architecture overview.
+- Canonical scope: core/framework/module/validator/adapter layout at a high level.
+- Recommended outline: package map, main execution path, boundary summary, where to add new code.
+- Sources to inspect: `internal/core`, `internal/framework`, `internal/modules`, `internal/validators`, `internal/cli`.
+- Acceptance criteria: concise internal entry point; links to detailed internal docs.
+
+### `docs/internal/pipeline.md`
+
+- Audience: developers and coding agents.
+- Purpose: implemented process pipeline.
+- Canonical scope: transcript loading, normalization, chunking, module proposal generation, validation, deterministic application, output/report handoff.
+- Recommended outline: inputs, pipeline phases, runner outputs, failure behavior, tests.
+- Sources to inspect: `internal/framework/runner`, `internal/core/normalization`, `internal/core/chunking`, CLI process tests.
+- Acceptance criteria: no unimplemented workflow engine or resume claims.
+
+### `docs/internal/modules.md`
+
+- Audience: developers and coding agents.
+- Purpose: module authoring and maintenance reference.
+- Canonical scope: current module packages, module contracts, proposal behavior, prompt assets.
+- Recommended outline: module contract, implemented modules, prompt ownership, proposal output, tests.
+- Sources to inspect: `internal/modules/*`, `internal/framework/contracts`, `internal/framework/proposal_generation`.
+- Acceptance criteria: keeps module packages separate; no plugin architecture claims.
+
+### `docs/internal/validators.md`
+
+- Audience: developers and coding agents.
+- Purpose: validator architecture reference.
+- Canonical scope: validator registry, chains, deterministic and LLM-backed validators, decision handling.
+- Recommended outline: validator contract, chain registration, classifications, batching, failure behavior, tests.
+- Sources to inspect: `internal/validators`, `internal/framework/validators`.
+- Acceptance criteria: documents composable validators without inventing new validator APIs.
+
+### `docs/internal/llm-runtime.md`
+
+- Audience: developers and coding agents.
+- Purpose: internal LLM runtime and scheduler reference.
+- Canonical scope: `StructuredLLMClient`, OpenAI-compatible adapter boundary, retries, redaction, scheduler permits, structured response handling.
+- Recommended outline: client interface, request/response handling, retries/timeouts, concurrency, diagnostics, tests.
+- Sources to inspect: `internal/framework/llm`, `internal/framework/responseschema`, `internal/framework/structuredoutput`.
+- Acceptance criteria: documents only implemented OpenAI-compatible HTTP behavior.
+
+### `docs/internal/diagnostics-reporting.md`
+
+- Audience: developers and coding agents.
+- Purpose: diagnostics, report, and correction ledger implementation reference.
+- Canonical scope: artifact names, metadata, process report mapping, correction ledger, retention interaction.
+- Recommended outline: diagnostics ownership, artifact metadata, process report builder, ledger mapping, tests.
+- Sources to inspect: `internal/core/diagnostics`, `internal/core/reporting`, `internal/framework/processreport`, CLI report tests.
+- Acceptance criteria: filenames and report fields match code; no planned artifact claims.
+
+### `docs/internal/prompts.md`
+
+- Audience: developers and coding agents.
+- Purpose: implemented prompt registry and prompt asset reference.
+- Canonical scope: embedded prompt assets, prompt metadata, rendering inputs, module prompt ownership.
+- Recommended outline: registry, assets, metadata, module usage, tests.
+- Sources to inspect: `internal/prompts`, `internal/framework/promptcontext`, module prompt tests.
+- Acceptance criteria: removes unimplemented filesystem overrides and deferred prompt ledger content.
+
+### `docs/internal/output-schemas.md`
+
+- Audience: developers and coding agents.
+- Purpose: implemented output schema registry reference.
+- Canonical scope: supported output schemas, config validation, output emission.
+- Recommended outline: registry, `bare-segments`, `audita-v1`, validation, tests.
+- Sources to inspect: `internal/core/outputschema`, `internal/core/config`, schema/output tests.
+- Acceptance criteria: documents only implemented schemas.
+
+### `docs/integrations/subprocess.md`
+
+- Audience: operators and external-process integrators.
+- Purpose: subprocess invocation contract.
+- Canonical scope: invoking `audita process`, stdin/stdout/stderr expectations where implemented, files, reports, exit codes.
+- Recommended outline: invocation model, outputs, diagnostics, errors, parent-process guidance.
+- Sources to inspect: `internal/cli`, subprocess-oriented docs, CLI integration tests.
+- Acceptance criteria: no non-existent streaming API or server mode.
+
+### `docs/integrations/openai-compatible-llm.md`
+
+- Audience: developers and operators integrating an LLM endpoint.
+- Purpose: OpenAI-compatible LLM contract.
+- Canonical scope: chat completions request behavior, JSON schema response format, retries, timeouts, redaction, configured endpoints.
+- Recommended outline: endpoint expectations, authentication, response format, retry/timeout behavior, diagnostics and redaction.
+- Sources to inspect: `internal/framework/llm`, config LLM settings, LLM tests.
+- Acceptance criteria: no provider SDK or non-OpenAI-compatible API claims.
+
+### `docs/integrations/transcript-glossary-files.md`
+
+- Audience: users, operators, and external systems producing input files.
+- Purpose: accepted transcript and glossary file contracts.
+- Canonical scope: implemented JSON/YAML shapes and validation behavior.
+- Recommended outline: transcript shape, glossary shape, validation errors, example files.
+- Sources to inspect: `internal/core/schema`, schema tests, CLI input tests.
+- Acceptance criteria: does not invent a formal versioned schema beyond implemented fields.
+
+### `examples/`
+
+- Audience: users and operators.
+- Purpose: copyable, maintained examples.
+- Canonical scope: minimal and fuller config, tiny transcript, tiny glossary.
+- Recommended files: `minimal-config.yml`, `production-config.yml`, `tiny-transcript.json`, `tiny-glossary.yaml`.
+- Sources to inspect: config defaults/tests, schema tests, CLI tests.
+- Acceptance criteria: no secrets; config examples validate; examples are linked from README, CLI, and config docs.
+
+### `docs/roadmap/documentation.md`
+
+- Audience: maintainers and coding agents.
+- Purpose: staged documentation migration plan.
+- Canonical scope: future documentation work only.
+- Recommended outline: this file.
+- Sources to inspect: repository docs, code, tests, documentation policy, architecture policy.
+- Acceptance criteria: remains action-oriented and does not rewrite current documentation prematurely.
+
+## File-by-File Rewrite Guidance
+
+### README
+
+Cover project purpose, shortest useful command, build/test basics, and links to canonical docs. Avoid full CLI flag lists, full config schema, diagnostics reference, module internals, and architectural history. Link to `docs/cli.md`, `docs/config.md`, `docs/operations.md`, `docs/troubleshooting.md`, and policy docs after those files exist. Do not carry forward stale links to nonexistent `docs/diagnostics.md`, `docs/structured-llm.md`, or `docs/subprocess-operations.md`.
+
+### `docs/config.md`
+
+Rewrite from `docs/configuration.md`. Cover path resolution, precedence, YAML schema, env overrides, CLI override relationship, validation, and secrets. Link to `docs/cli.md` for command syntax and to examples for copyable files. Inspect `internal/core/config/*` and config tests. Avoid duplicating every CLI flag except where needed to explain precedence.
+
+### `docs/cli.md`
+
+Build from `internal/cli/run.go`, `internal/cli/process_flags.go`, and CLI tests. Cover `process`, `config validate`, and `config print-effective`. Include implemented output destinations and subprocess-friendly behavior. Link to `docs/config.md` for configuration details and `docs/operations.md` for diagnostics and reports. Avoid documenting unsupported command aliases or future commands.
+
+### `docs/operations.md`
+
+Merge operational material from diagnostics and subprocess docs. Cover run directories, diagnostics artifacts, reports, correction ledger, retention, output/report writes, and safe failure inspection. Inspect `internal/core/diagnostics`, `internal/framework/processreport`, and CLI tests. State that resume, checkpoint, and remote storage are not implemented only if needed to avoid user confusion.
+
+### `docs/troubleshooting.md`
+
+Create concise symptom/cause/inspect/fix entries for implemented failures. Inspect config validation tests, schema tests, LLM adapter tests, reporting tests, and CLI integration tests. Avoid broad operational advice that is not supported by the repository.
+
+### `docs/policy/development.md`
+
+Move and rewrite from `docs/development.md`. Cover setup, package layout, tests, conventions, and how to add config fields, CLI flags, modules, validators, docs, and examples. Merge any still-useful current-behavior release checks from `docs/release-checklist.md`. Avoid roadmap, pre-1.0 history, and deferred-feature guardrail language.
+
+### `docs/internal/*`
+
+Move implemented architecture details out of `docs/architecture/*`. Keep these docs concise and developer-facing. Remove deferred or unimplemented sections such as `seriatim-intermediate`, prompt overrides, generated transcript descriptions, report-level prompt ledgers, plugin systems, workflow engines, resume, and remote storage.
+
+### `docs/integrations/subprocess.md`
+
+Move from `docs/integration/subprocess-operations.md`. Keep stdout/stderr, file outputs, exit behavior, diagnostics/report handling, and parent-process guidance that matches current CLI behavior. Do not document non-existent streaming APIs.
+
+### `docs/integrations/openai-compatible-llm.md`
+
+Derive from implemented `internal/framework/llm` behavior and the current structured LLM architecture doc. Cover OpenAI-compatible chat completions, `response_format.type=json_schema`, retries, timeouts, and redaction. Do not claim support for provider SDKs or non-OpenAI-compatible APIs.
+
+### `docs/integrations/transcript-glossary-files.md`
+
+Create from implemented schema loading and validation. Cover the file shapes accepted by Audita and link to examples. Do not invent a formal external schema version beyond what the code validates.
+
+### `docs/documentation/policy.md`
+
+Delete after verifying any unique useful policy content is already in `docs/policy/documentation.md`. Do not keep two documentation policy homes.
+
+### `docs/release-checklist.md`
+
+Either merge current-behavior contributor checks into `docs/policy/development.md` or move a concise checklist to a clearer policy/internal location. Remove future-feature or deferred-work guardrails from non-roadmap documentation.
+
+## Examples Plan
+
+Create maintained, non-secret examples only for implemented behavior.
+
+### `examples/minimal-config.yml`
+
+- Purpose: smallest useful config with `version: 1`, output schema, and `api_key_env`.
+- Expected validity check: `go run ./cmd/audita config validate --config examples/minimal-config.yml`.
+- Link from: `README.md`, `docs/config.md`, `docs/cli.md`.
+
+### `examples/production-config.yml`
+
+- Purpose: fuller config showing modules, LLMs, concurrency, chunking, normalization, thresholds, context, and diagnostics.
+- Expected validity check: `go run ./cmd/audita config validate --config examples/production-config.yml`.
+- Link from: `docs/config.md`.
+
+### `examples/tiny-transcript.json`
+
+- Purpose: small copyable transcript input for CLI examples and schema documentation.
+- Expected validity check: schema tests or a no-live-LLM CLI parser path if practical.
+- Link from: `README.md`, `docs/cli.md`, `docs/integrations/transcript-glossary-files.md`.
+
+### `examples/tiny-glossary.yaml`
+
+- Purpose: small copyable glossary input for CLI examples.
+- Expected validity check: schema tests or a no-live-LLM CLI parser path if practical.
+- Link from: `README.md`, `docs/cli.md`, `docs/integrations/transcript-glossary-files.md`.
+
+Do not add examples for resume, remote storage, prompt overrides, plugin systems, UI/server mode, unsupported output schemas, or other unimplemented behavior.
+
+## Internal Documentation Plan
+
+### Pipeline
+
+- Path: `docs/internal/pipeline.md`
+- Purpose: document the implemented transcript processing pipeline.
+- Inputs and outputs: normalized transcript, sections, configured module specs, proposal results, validation results, runner output.
+- Boundaries: runner orchestrates; modules propose; validators filter; accepted proposals are applied deterministically.
+- Config fields used: modules, output schema, chunking, normalization, thresholds, concurrency, context, diagnostics.
+- Adapters used: LLM client through framework contracts; filesystem/reporting through CLI and diagnostics boundaries.
+- Failure behavior: module and validator warnings, rejected proposals, run/report error status.
+- Tests to inspect: runner tests, proposal generation tests, CLI parity and release fixture tests.
+- Architectural invariants: keep nondeterministic LLM effects isolated from deterministic transcript state handling.
+
+### Modules
+
+- Path: `docs/internal/modules.md`
+- Purpose: document implemented correction modules and their contracts.
+- Inputs and outputs: `contracts.ProposalRequest`, module proposals, warnings, replacement policies.
+- Boundaries: one package per module; prompt assets remain module-specific; shared framework plumbing stays outside module packages.
+- Config fields used: configured module keys, LLM settings, chunking/context where applicable.
+- Adapters used: LLM client only through contracts and proposal generation framework.
+- Failure behavior: proposal warnings and malformed LLM output handling as implemented.
+- Tests to inspect: `internal/modules/...` and proposal generation tests.
+- Architectural invariants: keep module scope narrow and avoid hidden global state.
+
+### Validators
+
+- Path: `docs/internal/validators.md`
+- Purpose: document validator composition and decision handling.
+- Inputs and outputs: candidate proposals, validator decisions, rejection reasons, warnings.
+- Boundaries: validator registry and chains live in `internal/validators`; runtime mechanics live in `internal/framework/validators`.
+- Config fields used: thresholds, validation LLM settings, validation concurrency, validation prompt limits.
+- Adapters used: LLM-backed validators use the LLM contract rather than direct transport.
+- Failure behavior: rejected proposals, warning behavior, malformed output policy.
+- Tests to inspect: validator registry, chain, batching, malformed output, protected terms, and LLM validator tests.
+- Architectural invariants: validators remain modular and composable.
+
+### LLM Runtime
+
+- Path: `docs/internal/llm-runtime.md`
+- Purpose: document structured LLM calls and bounded scheduling.
+- Inputs and outputs: structured prompt requests, response schemas, parsed responses, scheduler permit results, diagnostics metadata.
+- Boundaries: transport stays behind `StructuredLLMClient`; scheduler manages permits; response schema registry owns schema metadata.
+- Config fields used: model, base URL, API key, timeout, retries, total/proposal/validation concurrency, validation max prompt tokens.
+- Adapters used: OpenAI-compatible HTTP adapter.
+- Failure behavior: retries, timeout/context handling, malformed structured output handling, redacted errors.
+- Tests to inspect: LLM client, scheduler, redaction, response schema, structured output tests.
+- Architectural invariants: keep concurrency bounded and explicit; do not leak secrets in diagnostics.
+
+### Diagnostics and Reporting
+
+- Path: `docs/internal/diagnostics-reporting.md`
+- Purpose: document diagnostics artifacts, process reports, and correction ledger generation.
+- Inputs and outputs: run directory artifacts, diagnostics metadata, process report JSON, correction ledger entries.
+- Boundaries: diagnostics owns artifact names and metadata; processreport maps runner output to reporting structures; CLI chooses output destinations.
+- Config fields used: work dir, work-dir retention, transcript description.
+- Adapters used: filesystem through diagnostics/CLI boundaries.
+- Failure behavior: report status/error mapping and artifact write errors as implemented.
+- Tests to inspect: diagnostics tests, processreport tests, CLI report fixture tests.
+- Architectural invariants: preserve diagnostics filenames and report JSON shape unless intentionally changed and documented.
+
+### Prompts
+
+- Path: `docs/internal/prompts.md`
+- Purpose: document implemented prompt registry, embedded assets, and metadata.
+- Inputs and outputs: prompt identifiers, prompt asset content, rendered prompt payloads, diagnostic metadata.
+- Boundaries: prompt assets remain owned by module/framework areas that use them; no filesystem override mechanism is implemented.
+- Config fields used: transcript description/context where applicable.
+- Adapters used: none directly; prompts are consumed by LLM-backed framework code.
+- Failure behavior: missing or malformed embedded prompt assets should surface through tests or runtime errors as implemented.
+- Tests to inspect: prompt registry and module prompt tests.
+- Architectural invariants: keep prompt metadata consistent with diagnostics.
+
+### Output Schemas
+
+- Path: `docs/internal/output-schemas.md`
+- Purpose: document implemented output schema registry and report/output relationship.
+- Inputs and outputs: configured output schema key, validated schema support, emitted transcript output.
+- Boundaries: output schema registry lives in `internal/core/outputschema`; config validation consumes registry support.
+- Config fields used: output schema.
+- Adapters used: none directly.
+- Failure behavior: unsupported schema keys fail validation.
+- Tests to inspect: output schema and config validation tests.
+- Architectural invariants: do not document unsupported schemas as current behavior.
+
+## Integration Documentation Plan
+
+### `docs/integrations/subprocess.md`
+
+- External system or contract: parent process invoking the `audita` CLI.
+- Current usage in Audita: `audita process` writes output/report files and emits subprocess-friendly diagnostics and errors.
+- Version or compatibility notes: document only the current CLI behavior and implemented exit behavior.
+- What to document: invocation model, command examples, output files, report JSON path, stderr/stdout expectations, diagnostics, exit codes.
+- What not to document: streaming protocols, server mode, remote job control, resume APIs.
+
+### `docs/integrations/openai-compatible-llm.md`
+
+- External system or contract: OpenAI-compatible chat completions endpoint using JSON schema response format.
+- Current usage in Audita: configured primary and validation LLM clients issue structured chat completion requests with retries/timeouts and redaction.
+- Version or compatibility notes: document compatibility based on request behavior in `internal/framework/llm`, not provider marketing claims.
+- What to document: endpoint configuration, authentication, request/response expectations, `response_format.type=json_schema`, retries, timeouts, redaction.
+- What not to document: unsupported provider SDKs, non-OpenAI-compatible APIs, unimplemented model-routing features.
+
+### `docs/integrations/transcript-glossary-files.md`
+
+- External system or contract: transcript JSON and glossary YAML files accepted as inputs.
+- Current usage in Audita: CLI loads transcript and glossary files before processing and validates their shape through core schema code.
+- Version or compatibility notes: document implemented fields and validation behavior only.
+- What to document: accepted file shapes, required/optional fields, common validation errors, tiny examples.
+- What not to document: a formal versioned external schema that the code does not enforce.
+
+## Recommended Implementation Sequence
+
+### Stage 1: Roadmap Creation
+
+- Goal: create this documentation roadmap.
+- Files to create/update/delete/move: create `docs/roadmap/documentation.md` only.
+- Repository areas to inspect: documentation policy, architecture policy, existing docs, CLI/config/package/test layout.
+- Acceptance criteria: roadmap is action-oriented, staged, and limited to future documentation work.
+- Suggested validation commands: `git diff --check -- docs/roadmap/documentation.md`.
+- One prompt: yes.
+
+### Stage 2: Canonical Layout and README Links
+
+- Goal: establish canonical paths and remove obvious stale links without rewriting all content.
+- Files to create/update/delete/move: create target directories, move/rewrite shells for `docs/config.md`, `docs/policy/development.md`, `docs/integrations/subprocess.md`, and update README links; remove old duplicates only after content is preserved.
+- Repository areas to inspect: docs policy, README, moved docs.
+- Acceptance criteria: canonical paths exist; README does not link to nonexistent docs; old paths are either redirected by content moves or removed.
+- Suggested validation commands: `rg "docs/(diagnostics|structured-llm|subprocess-operations)\\.md" README.md docs`; `rg "docs/configuration\\.md|docs/development\\.md|docs/integration/" README.md docs`.
+- One prompt: yes.
+
+### Stage 3: README and CLI Reference
+
+- Goal: make README concise and create complete `docs/cli.md`.
+- Files to create/update/delete/move: `README.md`, `docs/cli.md`.
+- Repository areas to inspect: `cmd/audita/main.go`, `internal/cli/run.go`, `internal/cli/process_flags.go`, CLI tests.
+- Acceptance criteria: README is orientation only; all implemented commands and flags are covered in `docs/cli.md`; examples match parser behavior.
+- Suggested validation commands: `go test ./internal/cli ./cmd/audita`; stale-link grep checks.
+- One prompt: yes.
+
+### Stage 4: Config Reference and Examples
+
+- Goal: rewrite `docs/config.md` and add maintained copyable examples.
+- Files to create/update/delete/move: `docs/config.md`, `examples/minimal-config.yml`, `examples/production-config.yml`, `examples/tiny-transcript.json`, `examples/tiny-glossary.yaml`; remove `docs/configuration.md` after migration.
+- Repository areas to inspect: `internal/core/config/*`, config tests, schema tests.
+- Acceptance criteria: config reference matches implemented defaults, precedence, env vars, validation, and secrets; examples contain no secrets and validate where practical.
+- Suggested validation commands: `go test ./internal/core/config`; `go run ./cmd/audita config validate --config examples/minimal-config.yml`; `go run ./cmd/audita config validate --config examples/production-config.yml`.
+- One prompt: yes.
+
+### Stage 5: Operations and Troubleshooting
+
+- Goal: create operational and troubleshooting references.
+- Files to create/update/delete/move: `docs/operations.md`, `docs/troubleshooting.md`.
+- Repository areas to inspect: `internal/core/diagnostics`, `internal/framework/processreport`, `internal/core/reporting`, CLI failure/report tests.
+- Acceptance criteria: implemented artifacts, retention, reports, correction ledger, and failure inspection are documented; no resume or remote-storage claims.
+- Suggested validation commands: `go test ./internal/core/diagnostics ./internal/framework/processreport ./internal/cli`.
+- One prompt: yes.
+
+### Stage 6: Internal Architecture Docs Migration
+
+- Goal: move implemented architecture details into `docs/internal/` and remove roadmap content from non-roadmap docs.
+- Files to create/update/delete/move: `docs/internal/overview.md`, `docs/internal/pipeline.md`, `docs/internal/modules.md`, `docs/internal/validators.md`, `docs/internal/llm-runtime.md`, `docs/internal/diagnostics-reporting.md`, `docs/internal/prompts.md`, `docs/internal/output-schemas.md`; migrate/delete relevant `docs/architecture/*`.
+- Repository areas to inspect: `internal/core`, `internal/framework`, `internal/modules`, `internal/validators`, `internal/prompts`.
+- Acceptance criteria: internal docs document implemented behavior only; deferred or unimplemented content appears only under `docs/roadmap/`.
+- Suggested validation commands: `go test ./internal/framework/llm ./internal/framework/runner`; `go test ./internal/validators/...`; `go test ./internal/modules/...`; `rg "deferred|not implemented|future|planned|experimental|aspirational" docs --glob '!docs/roadmap/**'`.
+- One prompt: split if needed into pipeline/modules/validators and LLM/diagnostics/prompts/output schemas.
+
+### Stage 7: Integration Docs
+
+- Goal: create external contract docs for implemented integrations.
+- Files to create/update/delete/move: `docs/integrations/subprocess.md`, `docs/integrations/openai-compatible-llm.md`, `docs/integrations/transcript-glossary-files.md`; remove `docs/integration/` after migration.
+- Repository areas to inspect: CLI behavior, `internal/framework/llm`, `internal/core/schema`, integration-related tests.
+- Acceptance criteria: integration docs describe actual external contracts and do not claim unsupported APIs.
+- Suggested validation commands: `go test ./internal/cli ./cmd/audita`; `go test ./internal/framework/llm`; schema package tests.
+- One prompt: yes.
+
+### Stage 8: Development Policy and Duplicate Cleanup
+
+- Goal: finish contributor workflow docs and remove duplicate policy locations.
+- Files to create/update/delete/move: `docs/policy/development.md`, `docs/documentation/policy.md`, `docs/release-checklist.md`, any remaining old architecture/config/development paths.
+- Repository areas to inspect: policy docs, development docs, test layout, final documentation tree.
+- Acceptance criteria: one canonical documentation policy, one canonical development workflow, no duplicate or stale canonical-home references.
+- Suggested validation commands: `find docs -type f | sort`; grep checks for old paths and duplicate policy paths.
+- One prompt: yes.
+
+### Stage 9: Final Documentation Validation
+
+- Goal: repository-wide documentation review after migration.
+- Files to create/update/delete/move: all documentation and examples touched by prior stages only as needed for fixes.
+- Repository areas to inspect: final docs tree, README, examples, code-backed docs.
+- Acceptance criteria: canonical docs exist, stale docs removed, examples valid, no unimplemented claims outside roadmap, Go tests pass.
+- Suggested validation commands: `go test ./...`; all grep/link checks in this roadmap; example validation commands.
+- One prompt: yes.
+
+## Validation Plan
+
+No markdown or documentation linter configuration was found. Use repository behavior tests, whitespace checks, grep checks, and manual review.
+
+Automated checks:
+
+- `git diff --check`
+- `go test ./internal/core/config`
+- `go test ./internal/cli ./cmd/audita`
+- `go test ./internal/core/diagnostics ./internal/framework/processreport`
+- `go test ./internal/framework/llm ./internal/framework/runner`
+- `go test ./...`
+
+Example checks after examples exist:
+
+- `go run ./cmd/audita config validate --config examples/minimal-config.yml`
+- `go run ./cmd/audita config validate --config examples/production-config.yml`
+
+Recommended grep and path checks:
+
+- `rg "docs/(diagnostics|structured-llm|subprocess-operations)\\.md" README.md docs`
+- `rg "docs/configuration\\.md|docs/development\\.md|docs/integration/" README.md docs`
+- `rg "deferred|not implemented|future|planned|experimental|aspirational" docs --glob '!docs/roadmap/**'`
+- `find docs -type f | sort`
+- `find examples -type f | sort`
+
+Manual review:
+
+- Confirm README is concise and links to canonical docs.
+- Confirm CLI and config docs do not duplicate each other.
+- Confirm internal docs are developer-facing and not user manuals.
+- Confirm operations and troubleshooting docs describe current behavior only.
+- Confirm future work appears only under `docs/roadmap/`.
+- Confirm examples contain no secrets or private transcript data.
+
+## Open Questions
+
+No questions block the roadmap. Use these defaults unless a later implementation prompt says otherwise:
+
+- Use the canonical paths from `docs/policy/documentation.md`, even when that requires moving existing docs.
+- Treat `docs/configuration.md`, `docs/development.md`, `docs/integration/`, and `docs/architecture/*` as migration sources, not final homes.
+- Do not restore deleted roadmap files unless separately requested.
+- Prefer concise canonical docs over preserving historical wording from stale files.

internal/cli/process_flags.go

@@ -0,0 +1,121 @@
+package cli
+
+import (
+	"flag"
+
+	"gitea.maximumdirect.net/eric/audita/internal/core/config"
+)
+
+type processOverrideBinding func(*config.CLIOverrides, processFlags)
+
+var processOverrideBindings = map[string]processOverrideBinding{
+	"modules": func(overrides *config.CLIOverrides, flags processFlags) {
+		overrides.ModulesCSV = flags.modules
+	},
+	"output-schema": func(overrides *config.CLIOverrides, flags processFlags) {
+		overrides.OutputSchema = flags.outputSchema
+	},
+	"llm-api-key": func(overrides *config.CLIOverrides, flags processFlags) {
+		overrides.PrimaryLLMAPIKey = flags.llmAPIKey
+	},
+	"validation-llm-api-key": func(overrides *config.CLIOverrides, flags processFlags) {
+		overrides.ValidationLLMAPIKey = flags.validationLLMAPIKey
+	},
+	"model": func(overrides *config.CLIOverrides, flags processFlags) {
+		overrides.PrimaryModel = flags.model
+	},
+	"validation-model": func(overrides *config.CLIOverrides, flags processFlags) {
+		overrides.ValidationModel = flags.validationModel
+	},
+	"base-url": func(overrides *config.CLIOverrides, flags processFlags) {
+		overrides.PrimaryBaseURL = flags.baseURL
+	},
+	"validation-base-url": func(overrides *config.CLIOverrides, flags processFlags) {
+		overrides.ValidationBaseURL = flags.validationBaseURL
+	},
+	"llm-timeout-seconds": func(overrides *config.CLIOverrides, flags processFlags) {
+		overrides.PrimaryLLMTimeoutSeconds = flags.llmTimeoutSeconds
+	},
+	"total-llm-concurrency": func(overrides *config.CLIOverrides, flags processFlags) {
+		overrides.TotalLLMConcurrency = flags.totalLLMConcurrency
+	},
+	"proposal-llm-concurrency": func(overrides *config.CLIOverrides, flags processFlags) {
+		overrides.ProposalLLMConcurrency = flags.proposalLLMConcurrency
+	},
+	"llm-concurrency": func(overrides *config.CLIOverrides, flags processFlags) {
+		overrides.PrimaryLLMConcurrency = flags.llmConcurrency
+	},
+	"validation-llm-timeout-seconds": func(overrides *config.CLIOverrides, flags processFlags) {
+		overrides.ValidationLLMTimeoutSeconds = flags.validationLLMTimeoutSeconds
+	},
+	"max-retries": func(overrides *config.CLIOverrides, flags processFlags) {
+		overrides.MaxRetries = flags.maxRetries
+	},
+	"validation-max-retries": func(overrides *config.CLIOverrides, flags processFlags) {
+		overrides.ValidationMaxRetries = flags.validationMaxRetries
+	},
+	"validation-llm-concurrency": func(overrides *config.CLIOverrides, flags processFlags) {
+		overrides.ValidationLLMConcurrency = flags.validationLLMConcurrency
+	},
+	"validation-max-prompt-tokens": func(overrides *config.CLIOverrides, flags processFlags) {
+		overrides.ValidationMaxPromptTokens = flags.validationMaxPromptTokens
+	},
+	"max-section-tokens": func(overrides *config.CLIOverrides, flags processFlags) {
+		overrides.MaxSectionTokens = flags.maxSectionTokens
+	},
+	"min-section-tokens": func(overrides *config.CLIOverrides, flags processFlags) {
+		overrides.MinSectionTokens = flags.minSectionTokens
+	},
+	"target-sections": func(overrides *config.CLIOverrides, flags processFlags) {
+		overrides.TargetSections = flags.targetSections
+	},
+	"glossary-confidence-threshold": func(overrides *config.CLIOverrides, flags processFlags) {
+		overrides.GlossaryConfidenceThreshold = flags.glossaryConfidenceThreshold
+	},
+	"grammar-confidence-threshold": func(overrides *config.CLIOverrides, flags processFlags) {
+		overrides.GrammarConfidenceThreshold = flags.grammarConfidenceThreshold
+	},
+	"homophones-confidence-threshold": func(overrides *config.CLIOverrides, flags processFlags) {
+		overrides.HomophonesConfidenceThreshold = flags.homophonesConfidenceThreshold
+	},
+	"spoken-word-confidence-threshold": func(overrides *config.CLIOverrides, flags processFlags) {
+		overrides.SpokenWordConfidenceThreshold = flags.spokenWordConfidenceThreshold
+	},
+	"normalize-max-segment-gap": func(overrides *config.CLIOverrides, flags processFlags) {
+		overrides.NormalizeMaxSegmentGap = flags.normalizeMaxSegmentGap
+	},
+	"normalize-ellipsis-gap": func(overrides *config.CLIOverrides, flags processFlags) {
+		overrides.NormalizeEllipsisGap = flags.normalizeEllipsisGap
+	},
+	"normalize-max-segment-duration": func(overrides *config.CLIOverrides, flags processFlags) {
+		overrides.NormalizeMaxSegmentDuration = flags.normalizeMaxSegmentDuration
+	},
+	"normalize-max-segment-tokens": func(overrides *config.CLIOverrides, flags processFlags) {
+		overrides.NormalizeMaxSegmentTokens = flags.normalizeMaxSegmentTokens
+	},
+	"transcript-description": func(overrides *config.CLIOverrides, flags processFlags) {
+		overrides.TranscriptDescription = flags.transcriptDescription
+	},
+	"work-dir": func(overrides *config.CLIOverrides, flags processFlags) {
+		overrides.WorkDir = flags.workDir
+	},
+	"work-dir-retention": func(overrides *config.CLIOverrides, flags processFlags) {
+		overrides.WorkDirRetention = flags.workDirRetention
+	},
+}
+
+func processCLIOverrides(fs *flag.FlagSet, flags processFlags) (config.CLIOverrides, bool) {
+	overrides := config.CLIOverrides{}
+	explicitModules := false
+	fs.Visit(func(f *flag.Flag) {
+		if f.Name == "modules" {
+			explicitModules = true
+		}
+		binding, ok := processOverrideBindings[f.Name]
+		if !ok {
+			return
+		}
+		binding(&overrides, flags)
+	})
+	return overrides, explicitModules
+}

internal/cli/process_flags_test.go

@@ -0,0 +1,433 @@
+package cli
+
+import (
+	"io"
+	"reflect"
+	"strings"
+	"testing"
+
+	"gitea.maximumdirect.net/eric/audita/internal/core/config"
+)
+
+func TestProcessCLIOverridesMapsEveryConfigMutatingFlag(t *testing.T) {
+	tests := []struct {
+		name                 string
+		flagName             string
+		value                string
+		wantExplicitModules  bool
+		assertOverrideFields func(t *testing.T, overrides config.CLIOverrides)
+	}{
+		{
+			name:                "modules",
+			flagName:            "modules",
+			value:               "grammar,glossary",
+			wantExplicitModules: true,
+			assertOverrideFields: func(t *testing.T, overrides config.CLIOverrides) {
+				assertStringOverride(t, "ModulesCSV", overrides.ModulesCSV, "grammar,glossary")
+			},
+		},
+		{
+			name:     "output schema",
+			flagName: "output-schema",
+			value:    "audita-v1",
+			assertOverrideFields: func(t *testing.T, overrides config.CLIOverrides) {
+				assertStringOverride(t, "OutputSchema", overrides.OutputSchema, "audita-v1")
+			},
+		},
+		{
+			name:     "primary api key",
+			flagName: "llm-api-key",
+			value:    "primary-key",
+			assertOverrideFields: func(t *testing.T, overrides config.CLIOverrides) {
+				assertStringOverride(t, "PrimaryLLMAPIKey", overrides.PrimaryLLMAPIKey, "primary-key")
+			},
+		},
+		{
+			name:     "validation api key",
+			flagName: "validation-llm-api-key",
+			value:    "validation-key",
+			assertOverrideFields: func(t *testing.T, overrides config.CLIOverrides) {
+				assertStringOverride(t, "ValidationLLMAPIKey", overrides.ValidationLLMAPIKey, "validation-key")
+			},
+		},
+		{
+			name:     "primary model",
+			flagName: "model",
+			value:    "primary-model",
+			assertOverrideFields: func(t *testing.T, overrides config.CLIOverrides) {
+				assertStringOverride(t, "PrimaryModel", overrides.PrimaryModel, "primary-model")
+			},
+		},
+		{
+			name:     "validation model",
+			flagName: "validation-model",
+			value:    "validation-model",
+			assertOverrideFields: func(t *testing.T, overrides config.CLIOverrides) {
+				assertStringOverride(t, "ValidationModel", overrides.ValidationModel, "validation-model")
+			},
+		},
+		{
+			name:     "primary base url",
+			flagName: "base-url",
+			value:    "https://primary.example.test",
+			assertOverrideFields: func(t *testing.T, overrides config.CLIOverrides) {
+				assertStringOverride(t, "PrimaryBaseURL", overrides.PrimaryBaseURL, "https://primary.example.test")
+			},
+		},
+		{
+			name:     "validation base url",
+			flagName: "validation-base-url",
+			value:    "https://validation.example.test",
+			assertOverrideFields: func(t *testing.T, overrides config.CLIOverrides) {
+				assertStringOverride(t, "ValidationBaseURL", overrides.ValidationBaseURL, "https://validation.example.test")
+			},
+		},
+		{
+			name:     "primary timeout",
+			flagName: "llm-timeout-seconds",
+			value:    "101",
+			assertOverrideFields: func(t *testing.T, overrides config.CLIOverrides) {
+				assertIntOverride(t, "PrimaryLLMTimeoutSeconds", overrides.PrimaryLLMTimeoutSeconds, 101)
+			},
+		},
+		{
+			name:     "total concurrency",
+			flagName: "total-llm-concurrency",
+			value:    "5",
+			assertOverrideFields: func(t *testing.T, overrides config.CLIOverrides) {
+				assertIntOverride(t, "TotalLLMConcurrency", overrides.TotalLLMConcurrency, 5)
+			},
+		},
+		{
+			name:     "proposal concurrency",
+			flagName: "proposal-llm-concurrency",
+			value:    "3",
+			assertOverrideFields: func(t *testing.T, overrides config.CLIOverrides) {
+				assertIntOverride(t, "ProposalLLMConcurrency", overrides.ProposalLLMConcurrency, 3)
+			},
+		},
+		{
+			name:     "legacy concurrency alias",
+			flagName: "llm-concurrency",
+			value:    "4",
+			assertOverrideFields: func(t *testing.T, overrides config.CLIOverrides) {
+				assertIntOverride(t, "PrimaryLLMConcurrency", overrides.PrimaryLLMConcurrency, 4)
+			},
+		},
+		{
+			name:     "validation timeout",
+			flagName: "validation-llm-timeout-seconds",
+			value:    "202",
+			assertOverrideFields: func(t *testing.T, overrides config.CLIOverrides) {
+				assertIntOverride(t, "ValidationLLMTimeoutSeconds", overrides.ValidationLLMTimeoutSeconds, 202)
+			},
+		},
+		{
+			name:     "max retries",
+			flagName: "max-retries",
+			value:    "6",
+			assertOverrideFields: func(t *testing.T, overrides config.CLIOverrides) {
+				assertIntOverride(t, "MaxRetries", overrides.MaxRetries, 6)
+			},
+		},
+		{
+			name:     "validation max retries",
+			flagName: "validation-max-retries",
+			value:    "7",
+			assertOverrideFields: func(t *testing.T, overrides config.CLIOverrides) {
+				assertIntOverride(t, "ValidationMaxRetries", overrides.ValidationMaxRetries, 7)
+			},
+		},
+		{
+			name:     "validation concurrency",
+			flagName: "validation-llm-concurrency",
+			value:    "8",
+			assertOverrideFields: func(t *testing.T, overrides config.CLIOverrides) {
+				assertIntOverride(t, "ValidationLLMConcurrency", overrides.ValidationLLMConcurrency, 8)
+			},
+		},
+		{
+			name:     "validation max prompt tokens",
+			flagName: "validation-max-prompt-tokens",
+			value:    "4096",
+			assertOverrideFields: func(t *testing.T, overrides config.CLIOverrides) {
+				assertIntOverride(t, "ValidationMaxPromptTokens", overrides.ValidationMaxPromptTokens, 4096)
+			},
+		},
+		{
+			name:     "max section tokens",
+			flagName: "max-section-tokens",
+			value:    "9000",
+			assertOverrideFields: func(t *testing.T, overrides config.CLIOverrides) {
+				assertIntOverride(t, "MaxSectionTokens", overrides.MaxSectionTokens, 9000)
+			},
+		},
+		{
+			name:     "min section tokens",
+			flagName: "min-section-tokens",
+			value:    "1000",
+			assertOverrideFields: func(t *testing.T, overrides config.CLIOverrides) {
+				assertIntOverride(t, "MinSectionTokens", overrides.MinSectionTokens, 1000)
+			},
+		},
+		{
+			name:     "target sections",
+			flagName: "target-sections",
+			value:    "12",
+			assertOverrideFields: func(t *testing.T, overrides config.CLIOverrides) {
+				assertIntOverride(t, "TargetSections", overrides.TargetSections, 12)
+			},
+		},
+		{
+			name:     "glossary threshold",
+			flagName: "glossary-confidence-threshold",
+			value:    "0.91",
+			assertOverrideFields: func(t *testing.T, overrides config.CLIOverrides) {
+				assertFloatOverride(t, "GlossaryConfidenceThreshold", overrides.GlossaryConfidenceThreshold, 0.91)
+			},
+		},
+		{
+			name:     "grammar threshold",
+			flagName: "grammar-confidence-threshold",
+			value:    "0.92",
+			assertOverrideFields: func(t *testing.T, overrides config.CLIOverrides) {
+				assertFloatOverride(t, "GrammarConfidenceThreshold", overrides.GrammarConfidenceThreshold, 0.92)
+			},
+		},
+		{
+			name:     "homophones threshold",
+			flagName: "homophones-confidence-threshold",
+			value:    "0.93",
+			assertOverrideFields: func(t *testing.T, overrides config.CLIOverrides) {
+				assertFloatOverride(t, "HomophonesConfidenceThreshold", overrides.HomophonesConfidenceThreshold, 0.93)
+			},
+		},
+		{
+			name:     "spoken word threshold",
+			flagName: "spoken-word-confidence-threshold",
+			value:    "0.94",
+			assertOverrideFields: func(t *testing.T, overrides config.CLIOverrides) {
+				assertFloatOverride(t, "SpokenWordConfidenceThreshold", overrides.SpokenWordConfidenceThreshold, 0.94)
+			},
+		},
+		{
+			name:     "normalize max segment gap",
+			flagName: "normalize-max-segment-gap",
+			value:    "1.2",
+			assertOverrideFields: func(t *testing.T, overrides config.CLIOverrides) {
+				assertFloatOverride(t, "NormalizeMaxSegmentGap", overrides.NormalizeMaxSegmentGap, 1.2)
+			},
+		},
+		{
+			name:     "normalize ellipsis gap",
+			flagName: "normalize-ellipsis-gap",
+			value:    "2.3",
+			assertOverrideFields: func(t *testing.T, overrides config.CLIOverrides) {
+				assertFloatOverride(t, "NormalizeEllipsisGap", overrides.NormalizeEllipsisGap, 2.3)
+			},
+		},
+		{
+			name:     "normalize max segment duration",
+			flagName: "normalize-max-segment-duration",
+			value:    "45.6",
+			assertOverrideFields: func(t *testing.T, overrides config.CLIOverrides) {
+				assertFloatOverride(t, "NormalizeMaxSegmentDuration", overrides.NormalizeMaxSegmentDuration, 45.6)
+			},
+		},
+		{
+			name:     "normalize max segment tokens",
+			flagName: "normalize-max-segment-tokens",
+			value:    "321",
+			assertOverrideFields: func(t *testing.T, overrides config.CLIOverrides) {
+				assertIntOverride(t, "NormalizeMaxSegmentTokens", overrides.NormalizeMaxSegmentTokens, 321)
+			},
+		},
+		{
+			name:     "transcript description",
+			flagName: "transcript-description",
+			value:    "podcast episode",
+			assertOverrideFields: func(t *testing.T, overrides config.CLIOverrides) {
+				assertStringOverride(t, "TranscriptDescription", overrides.TranscriptDescription, "podcast episode")
+			},
+		},
+		{
+			name:     "work dir",
+			flagName: "work-dir",
+			value:    "/tmp/custom-audita",
+			assertOverrideFields: func(t *testing.T, overrides config.CLIOverrides) {
+				assertStringOverride(t, "WorkDir", overrides.WorkDir, "/tmp/custom-audita")
+			},
+		},
+		{
+			name:     "work dir retention",
+			flagName: "work-dir-retention",
+			value:    "always",
+			assertOverrideFields: func(t *testing.T, overrides config.CLIOverrides) {
+				assertStringOverride(t, "WorkDirRetention", overrides.WorkDirRetention, "always")
+			},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			fs, flags := newProcessFlagSet(config.Default(), io.Discard)
+			if err := fs.Parse([]string{"--" + tc.flagName, tc.value}); err != nil {
+				t.Fatalf("parse flag: %v", err)
+			}
+
+			overrides, explicitModules := processCLIOverrides(fs, flags)
+			if explicitModules != tc.wantExplicitModules {
+				t.Fatalf("explicitModules=%v, want %v", explicitModules, tc.wantExplicitModules)
+			}
+			tc.assertOverrideFields(t, overrides)
+		})
+	}
+}
+
+func TestProcessCLIOverridesIgnoresNonConfigFlags(t *testing.T) {
+	fs, flags := newProcessFlagSet(config.Default(), io.Discard)
+	if err := fs.Parse([]string{
+		"--config", "/tmp/config.yml",
+		"--glossary", "/tmp/glossary.yml",
+		"--output", "/tmp/output.json",
+		"--report-json", "/tmp/report.json",
+	}); err != nil {
+		t.Fatalf("parse flags: %v", err)
+	}
+
+	overrides, explicitModules := processCLIOverrides(fs, flags)
+	if explicitModules {
+		t.Fatal("non-config flags should not mark modules explicit")
+	}
+	assertNoCLIOverrides(t, overrides)
+}
+
+func TestNewProcessFlagSetDefaultsReflectEffectiveConfig(t *testing.T) {
+	cfg := config.Default()
+	cfg.Modules = []string{"grammar", "glossary"}
+	cfg.OutputSchema = "audita-v1"
+	cfg.PrimaryLLM.APIKey = "primary-key"
+	cfg.ValidationLLM.APIKey = "validation-key"
+	cfg.PrimaryLLM.Model = "primary-model"
+	cfg.ValidationLLM.Model = "validation-model"
+	cfg.PrimaryLLM.BaseURL = "https://primary.example.test"
+	cfg.ValidationLLM.BaseURL = "https://validation.example.test"
+	cfg.PrimaryLLM.TimeoutSeconds = 101
+	cfg.TotalLLMConcurrency = 5
+	cfg.ProposalLLMConcurrency = 3
+	cfg.PrimaryLLM.MaxRetries = 6
+	cfg.ValidationMaxPromptTokens = 4096
+	cfg.MaxSectionTokens = 9000
+	cfg.MinSectionTokens = 1000
+	cfg.Thresholds.Glossary = 0.91
+	cfg.Thresholds.Grammar = 0.92
+	cfg.Thresholds.Homophones = 0.93
+	cfg.Thresholds.SpokenWord = 0.94
+	cfg.Normalization.MaxSegmentGap = 1.2
+	cfg.Normalization.EllipsisGap = 2.3
+	cfg.Normalization.MaxSegmentDuration = 45.6
+	cfg.Normalization.MaxSegmentTokens = 321
+	cfg.TranscriptDescription = "podcast episode"
+	cfg.WorkDir = "/tmp/custom-audita"
+	cfg.WorkDirRetention = config.WorkDirRetentionAlways
+
+	validationTimeout := 202
+	validationRetries := 7
+	validationConcurrency := 8
+	targetSections := 12
+	cfg.ValidationLLM.TimeoutSeconds = &validationTimeout
+	cfg.ValidationLLM.MaxRetries = &validationRetries
+	cfg.ValidationLLMConcurrency = &validationConcurrency
+	cfg.TargetSections = &targetSections
+
+	_, flags := newProcessFlagSet(cfg, io.Discard)
+
+	assertStringOverride(t, "modules default", flags.modules, "grammar,glossary")
+	assertStringOverride(t, "output schema default", flags.outputSchema, "audita-v1")
+	assertStringOverride(t, "primary api key default", flags.llmAPIKey, "primary-key")
+	assertStringOverride(t, "validation api key default", flags.validationLLMAPIKey, "validation-key")
+	assertStringOverride(t, "primary model default", flags.model, "primary-model")
+	assertStringOverride(t, "validation model default", flags.validationModel, "validation-model")
+	assertStringOverride(t, "primary base url default", flags.baseURL, "https://primary.example.test")
+	assertStringOverride(t, "validation base url default", flags.validationBaseURL, "https://validation.example.test")
+	assertIntOverride(t, "primary timeout default", flags.llmTimeoutSeconds, 101)
+	assertIntOverride(t, "total concurrency default", flags.totalLLMConcurrency, 5)
+	assertIntOverride(t, "proposal concurrency default", flags.proposalLLMConcurrency, 3)
+	assertIntOverride(t, "legacy concurrency alias default", flags.llmConcurrency, 5)
+	assertIntOverride(t, "validation timeout default", flags.validationLLMTimeoutSeconds, validationTimeout)
+	assertIntOverride(t, "max retries default", flags.maxRetries, 6)
+	assertIntOverride(t, "validation max retries default", flags.validationMaxRetries, validationRetries)
+	assertIntOverride(t, "validation concurrency default", flags.validationLLMConcurrency, validationConcurrency)
+	assertIntOverride(t, "validation max prompt tokens default", flags.validationMaxPromptTokens, 4096)
+	assertIntOverride(t, "max section tokens default", flags.maxSectionTokens, 9000)
+	assertIntOverride(t, "min section tokens default", flags.minSectionTokens, 1000)
+	assertIntOverride(t, "target sections default", flags.targetSections, targetSections)
+	assertFloatOverride(t, "glossary threshold default", flags.glossaryConfidenceThreshold, 0.91)
+	assertFloatOverride(t, "grammar threshold default", flags.grammarConfidenceThreshold, 0.92)
+	assertFloatOverride(t, "homophones threshold default", flags.homophonesConfidenceThreshold, 0.93)
+	assertFloatOverride(t, "spoken word threshold default", flags.spokenWordConfidenceThreshold, 0.94)
+	assertFloatOverride(t, "normalize max segment gap default", flags.normalizeMaxSegmentGap, 1.2)
+	assertFloatOverride(t, "normalize ellipsis gap default", flags.normalizeEllipsisGap, 2.3)
+	assertFloatOverride(t, "normalize max segment duration default", flags.normalizeMaxSegmentDuration, 45.6)
+	assertIntOverride(t, "normalize max segment tokens default", flags.normalizeMaxSegmentTokens, 321)
+	assertStringOverride(t, "transcript description default", flags.transcriptDescription, "podcast episode")
+	assertStringOverride(t, "work dir default", flags.workDir, "/tmp/custom-audita")
+	assertStringOverride(t, "work dir retention default", flags.workDirRetention, "always")
+}
+
+func TestNewProcessFlagSetUsesFallbackDefaultsForUnsetOptionalConfig(t *testing.T) {
+	cfg := config.Default()
+
+	_, flags := newProcessFlagSet(cfg, io.Discard)
+
+	assertIntOverride(t, "validation timeout fallback", flags.validationLLMTimeoutSeconds, cfg.PrimaryLLM.TimeoutSeconds)
+	assertIntOverride(t, "validation retries fallback", flags.validationMaxRetries, cfg.PrimaryLLM.MaxRetries)
+	assertIntOverride(t, "validation concurrency fallback", flags.validationLLMConcurrency, cfg.TotalLLMConcurrency)
+	assertIntOverride(t, "target sections fallback", flags.targetSections, 0)
+}
+
+func assertStringOverride(t *testing.T, name string, got *string, want string) {
+	t.Helper()
+	if got == nil || *got != want {
+		t.Fatalf("%s=%v, want %q", name, pointerValue(got), want)
+	}
+}
+
+func assertIntOverride(t *testing.T, name string, got *int, want int) {
+	t.Helper()
+	if got == nil || *got != want {
+		t.Fatalf("%s=%v, want %d", name, pointerValue(got), want)
+	}
+}
+
+func assertFloatOverride(t *testing.T, name string, got *float64, want float64) {
+	t.Helper()
+	if got == nil || *got != want {
+		t.Fatalf("%s=%v, want %v", name, pointerValue(got), want)
+	}
+}
+
+func assertNoCLIOverrides(t *testing.T, overrides config.CLIOverrides) {
+	t.Helper()
+	value := reflect.ValueOf(overrides)
+	typ := value.Type()
+	for i := 0; i < value.NumField(); i++ {
+		field := value.Field(i)
+		if field.Kind() != reflect.Ptr {
+			t.Fatalf("unexpected non-pointer CLIOverrides field %s", typ.Field(i).Name)
+		}
+		if !field.IsNil() {
+			t.Fatalf("expected no CLI overrides, field %s was set", typ.Field(i).Name)
+		}
+	}
+}
+
+func pointerValue[T any](ptr *T) any {
+	if ptr == nil {
+		return "<nil>"
+	}
+	if stringer, ok := any(*ptr).(interface{ String() string }); ok {
+		return strings.TrimSpace(stringer.String())
+	}
+	return *ptr
+}

internal/cli/run.go

@@ -23,6 +23,7 @@ import (
 	"gitea.maximumdirect.net/eric/audita/internal/framework/contracts"
 	"gitea.maximumdirect.net/eric/audita/internal/framework/llm"
 	"gitea.maximumdirect.net/eric/audita/internal/framework/modules"
+	"gitea.maximumdirect.net/eric/audita/internal/framework/processreport"
 	"gitea.maximumdirect.net/eric/audita/internal/framework/proposal_generation"
 	"gitea.maximumdirect.net/eric/audita/internal/framework/runner"
 	"gitea.maximumdirect.net/eric/audita/internal/framework/validators"
@@ -374,30 +375,28 @@ func runProcess(args []string, stdout, stderr io.Writer) int {
 		fmt.Fprintf(stderr, "audita process: invalid CLI configuration: %v\n", err)
 		return 2
 	}
-	configPath, configSource, err := resolveConfigPath(configPathOverride, configPathOverrideSet, os.LookupEnv)
+	effectiveConfig, err := config.LoadEffectiveConfig(configPathOverride, configPathOverrideSet)
 	if err != nil {
+		var effectiveConfigErr *config.EffectiveConfigError
+		if errors.As(err, &effectiveConfigErr) {
+			switch effectiveConfigErr.Kind {
+			case config.EffectiveConfigErrorLoadFile, config.EffectiveConfigErrorApplyFile:
+				fmt.Fprintf(stderr, "audita process: invalid config file: %v\n", effectiveConfigErr)
+			case config.EffectiveConfigErrorApplyEnv:
+				fmt.Fprintf(stderr, "audita process: invalid environment configuration: %v\n", effectiveConfigErr)
+			default:
+				fmt.Fprintf(stderr, "audita process: %v\n", effectiveConfigErr)
+			}
+		} else {
 			fmt.Fprintf(stderr, "audita process: %v\n", err)
+		}
 		return 2
 	}
 
-	cfg := config.Default()
-	var configVersion *int
-	if configPath != "" {
-		fileCfg, fileErr := config.LoadFileConfig(configPath)
-		if fileErr != nil {
-			fmt.Fprintf(stderr, "audita process: invalid config file: %v\n", fileErr)
-			return 2
-		}
-		if applyErr := cfg.ApplyFileConfig(fileCfg); applyErr != nil {
-			fmt.Fprintf(stderr, "audita process: invalid config file: %v\n", applyErr)
-			return 2
-		}
-		configVersion = &fileCfg.Version
-	}
-	if err := cfg.ApplyEnvOverrides(); err != nil {
-		fmt.Fprintf(stderr, "audita process: invalid environment configuration: %v\n", err)
-		return 2
-	}
+	cfg := effectiveConfig.Config
+	configPath := effectiveConfig.ConfigPath
+	configSource := effectiveConfig.ConfigSource
+	configVersion := effectiveConfig.ConfigVersion
 
 	fs, pFlags := newProcessFlagSet(cfg, stderr)
 
@@ -421,75 +420,7 @@ func runProcess(args []string, stdout, stderr io.Writer) int {
 		return 2
 	}
 
-	overrides := config.CLIOverrides{}
-	explicitModules := false
-	fs.Visit(func(f *flag.Flag) {
-		switch f.Name {
-		case "modules":
-			explicitModules = true
-			overrides.ModulesCSV = pFlags.modules
-		case "output-schema":
-			overrides.OutputSchema = pFlags.outputSchema
-		case "llm-api-key":
-			overrides.PrimaryLLMAPIKey = pFlags.llmAPIKey
-		case "validation-llm-api-key":
-			overrides.ValidationLLMAPIKey = pFlags.validationLLMAPIKey
-		case "model":
-			overrides.PrimaryModel = pFlags.model
-		case "validation-model":
-			overrides.ValidationModel = pFlags.validationModel
-		case "base-url":
-			overrides.PrimaryBaseURL = pFlags.baseURL
-		case "validation-base-url":
-			overrides.ValidationBaseURL = pFlags.validationBaseURL
-		case "llm-timeout-seconds":
-			overrides.PrimaryLLMTimeoutSeconds = pFlags.llmTimeoutSeconds
-		case "total-llm-concurrency":
-			overrides.TotalLLMConcurrency = pFlags.totalLLMConcurrency
-		case "proposal-llm-concurrency":
-			overrides.ProposalLLMConcurrency = pFlags.proposalLLMConcurrency
-		case "llm-concurrency":
-			overrides.PrimaryLLMConcurrency = pFlags.llmConcurrency
-		case "validation-llm-timeout-seconds":
-			overrides.ValidationLLMTimeoutSeconds = pFlags.validationLLMTimeoutSeconds
-		case "max-retries":
-			overrides.MaxRetries = pFlags.maxRetries
-		case "validation-max-retries":
-			overrides.ValidationMaxRetries = pFlags.validationMaxRetries
-		case "validation-llm-concurrency":
-			overrides.ValidationLLMConcurrency = pFlags.validationLLMConcurrency
-		case "validation-max-prompt-tokens":
-			overrides.ValidationMaxPromptTokens = pFlags.validationMaxPromptTokens
-		case "max-section-tokens":
-			overrides.MaxSectionTokens = pFlags.maxSectionTokens
-		case "min-section-tokens":
-			overrides.MinSectionTokens = pFlags.minSectionTokens
-		case "target-sections":
-			overrides.TargetSections = pFlags.targetSections
-		case "glossary-confidence-threshold":
-			overrides.GlossaryConfidenceThreshold = pFlags.glossaryConfidenceThreshold
-		case "grammar-confidence-threshold":
-			overrides.GrammarConfidenceThreshold = pFlags.grammarConfidenceThreshold
-		case "homophones-confidence-threshold":
-			overrides.HomophonesConfidenceThreshold = pFlags.homophonesConfidenceThreshold
-		case "spoken-word-confidence-threshold":
-			overrides.SpokenWordConfidenceThreshold = pFlags.spokenWordConfidenceThreshold
-		case "normalize-max-segment-gap":
-			overrides.NormalizeMaxSegmentGap = pFlags.normalizeMaxSegmentGap
-		case "normalize-ellipsis-gap":
-			overrides.NormalizeEllipsisGap = pFlags.normalizeEllipsisGap
-		case "normalize-max-segment-duration":
-			overrides.NormalizeMaxSegmentDuration = pFlags.normalizeMaxSegmentDuration
-		case "normalize-max-segment-tokens":
-			overrides.NormalizeMaxSegmentTokens = pFlags.normalizeMaxSegmentTokens
-		case "transcript-description":
-			overrides.TranscriptDescription = pFlags.transcriptDescription
-		case "work-dir":
-			overrides.WorkDir = pFlags.workDir
-		case "work-dir-retention":
-			overrides.WorkDirRetention = pFlags.workDirRetention
-		}
-	})
+	overrides, explicitModules := processCLIOverrides(fs, pFlags)
 
 	if err := cfg.ApplyCLIOverrides(overrides); err != nil {
 		fmt.Fprintf(stderr, "audita process: invalid CLI configuration: %v\n", err)
@@ -530,12 +461,15 @@ func runProcess(args []string, stdout, stderr io.Writer) int {
 	if runErr != nil {
 		if runDir != nil && runOutput != nil {
 			if runOutput.Utilization != nil {
-				_ = runDir.WriteJSONArtifact("utilization-diagnostics.json", runOutput.Utilization)
+				_ = runDir.WriteJSONArtifact(diagnostics.ArtifactUtilizationSummary, runOutput.Utilization)
 			}
-			_ = runDir.WriteJSONArtifact("correction-ledger.json", buildCorrectionLedger(runDir.Path(), runOutput))
+			_ = runDir.WriteJSONArtifact(diagnostics.ArtifactCorrectionLedger, processreport.BuildCorrectionLedger(processreport.CorrectionLedgerInput{
+				RunDirectoryPath: runDir.Path(),
+				RunOutput:        runOutput,
+			}))
 		}
 		errorPhase, errorMessage := extractErrorPhase(runErr)
-		report := buildProcessReport("failed", inv, runDir, startedAt, completedAt, errorMessage, errorPhase, nil, nil, runOutput)
+		report := processreport.Build(processReportInput("failed", inv, runDir, startedAt, completedAt, errorMessage, errorPhase, nil, nil, runOutput))
 
 		if strings.TrimSpace(inv.ReportJSONPath) != "" {
 			if err := reporting.WriteProcessReport(inv.ReportJSONPath, report); err != nil {
@@ -559,12 +493,15 @@ func runProcess(args []string, stdout, stderr io.Writer) int {
 
 	if runDir != nil && runOutput != nil {
 		if runOutput.Utilization != nil {
-			_ = runDir.WriteJSONArtifact("utilization-diagnostics.json", runOutput.Utilization)
+			_ = runDir.WriteJSONArtifact(diagnostics.ArtifactUtilizationSummary, runOutput.Utilization)
 		}
-		_ = runDir.WriteJSONArtifact("correction-ledger.json", buildCorrectionLedger(runDir.Path(), runOutput))
+		_ = runDir.WriteJSONArtifact(diagnostics.ArtifactCorrectionLedger, processreport.BuildCorrectionLedger(processreport.CorrectionLedgerInput{
+			RunDirectoryPath: runDir.Path(),
+			RunOutput:        runOutput,
+		}))
 	}
 
-	report := buildProcessReport("success", inv, runDir, startedAt, completedAt, "", "", normSummary, chunkSummary, runOutput)
+	report := processreport.Build(processReportInput("success", inv, runDir, startedAt, completedAt, "", "", normSummary, chunkSummary, runOutput))
 
 	if strings.TrimSpace(inv.ReportJSONPath) != "" {
 		if err := reporting.WriteProcessReport(inv.ReportJSONPath, report); err != nil {
@@ -579,21 +516,11 @@ func runProcess(args []string, stdout, stderr io.Writer) int {
 		}
 	}
 
-	hasSkippedCorrections := false
-	if runOutput != nil {
-		for _, mr := range runOutput.ModuleResults {
-			if len(mr.SkippedChanges) > 0 || len(mr.ValidatorRejected) > 0 {
-				hasSkippedCorrections = true
-				break
-			}
-		}
-	}
-
 	if runDir != nil {
 		_ = runDir.WriteReport(report)
 		if err := runDir.ApplyRetention(diagnostics.RetentionDecisionInput{
 			RunSucceeded:          true,
-			HasSkippedCorrections: hasSkippedCorrections,
+			HasSkippedCorrections: processreport.HasSkippedCorrections(runOutput),
 		}); err != nil {
 			fmt.Fprintf(stderr, "audita process: failed to apply work-dir retention: %v\n", err)
 			return 1
@@ -652,6 +579,10 @@ func runConfigValidate(args []string, stdout, stderr io.Writer) int {
 		fmt.Fprintf(stderr, "audita config validate: %v\n", err)
 		return 2
 	}
+	if err := cfg.Validate(); err != nil {
+		fmt.Fprintf(stderr, "audita config validate: %v\n", err)
+		return 2
+	}
 	fmt.Fprintln(stdout, "config is valid")
 	return 0
 }
@@ -674,28 +605,13 @@ func runConfigPrintEffective(args []string, stdout, stderr io.Writer) int {
 
 	configPathValue := strings.TrimSpace(*configPath)
 	configPathSet := configPathValue != ""
-	path, _, err := resolveConfigPath(configPathValue, configPathSet, os.LookupEnv)
+	effectiveConfig, err := config.LoadEffectiveConfig(configPathValue, configPathSet)
 	if err != nil {
 		fmt.Fprintf(stderr, "audita config print-effective: %v\n", err)
 		return 2
 	}
 
-	cfg := config.Default()
-	if path != "" {
-		fileCfg, fileErr := config.LoadFileConfig(path)
-		if fileErr != nil {
-			fmt.Fprintf(stderr, "audita config print-effective: %v\n", fileErr)
-			return 2
-		}
-		if applyErr := cfg.ApplyFileConfig(fileCfg); applyErr != nil {
-			fmt.Fprintf(stderr, "audita config print-effective: %v\n", applyErr)
-			return 2
-		}
-	}
-	if err := cfg.ApplyEnvOverrides(); err != nil {
-		fmt.Fprintf(stderr, "audita config print-effective: %v\n", err)
-		return 2
-	}
+	cfg := effectiveConfig.Config
 
 	redacted := cfg.Redacted()
 	out, err := json.MarshalIndent(redacted, "", "  ")
@@ -722,142 +638,28 @@ func extractErrorPhase(err error) (phase string, message string) {
 	return "", msg
 }
 
-func buildProcessReport(status string, inv processInvocation, runDir *diagnostics.RunDirectory, startedAt, completedAt time.Time, errorMessage string, errorPhase string, normalizationSummary *normalization.NormalizationSummary, chunkingSummary *chunking.Summary, runOutput *runner.RunOutput) reporting.ProcessReport {
-	report := reporting.ProcessReport{
-		ReportMetadata: reporting.ReportMetadata{
-			ReportSchemaName:    reporting.DefaultProcessReportSchemaName,
-			ReportSchemaVersion: reporting.DefaultProcessReportSchemaVersion,
-			OutputSchema:        inv.Config.OutputSchema,
-			ConfigVersion:       inv.ConfigVersion,
-		},
-		Phase:          "default_pipeline",
+func processReportInput(status string, inv processInvocation, runDir *diagnostics.RunDirectory, startedAt, completedAt time.Time, errorMessage string, errorPhase string, normalizationSummary *normalization.NormalizationSummary, chunkingSummary *chunking.Summary, runOutput *runner.RunOutput) processreport.BuildInput {
+	runDirectoryPath := ""
+	if runDir != nil {
+		runDirectoryPath = runDir.Path()
+	}
+	return processreport.BuildInput{
 		Status:               status,
-		Operation:      "process",
 		TranscriptPath:       inv.TranscriptPath,
 		GlossaryPath:         inv.GlossaryPath,
 		OutputPath:           inv.OutputPath,
-		Modules:        append([]string(nil), inv.Config.Modules...),
+		Modules:              inv.Config.Modules,
+		OutputSchema:         inv.Config.OutputSchema,
+		ConfigVersion:        inv.ConfigVersion,
 		StartedAt:            startedAt,
-		CompletedAt:    &completedAt,
+		CompletedAt:          completedAt,
+		ErrorMessage:         errorMessage,
 		ErrorPhase:           errorPhase,
+		RunDirectoryPath:     runDirectoryPath,
+		NormalizationSummary: normalizationSummary,
+		ChunkingSummary:      chunkingSummary,
+		RunOutput:            runOutput,
 	}
-	if runDir != nil {
-		diagnosticsDir := runDir.Path()
-		report.Diagnostics = &reporting.DiagnosticsMetadata{
-			DirectoryPath:               diagnosticsDir,
-			SourceTranscriptPath:        filepath.Join(diagnosticsDir, "source-transcript.json"),
-			ParsedSourceTranscriptPath:  filepath.Join(diagnosticsDir, "source-transcript-parsed.json"),
-			NormalizedTranscriptPath:    filepath.Join(diagnosticsDir, "normalized-transcript.json"),
-			NormalizationSummaryPath:    filepath.Join(diagnosticsDir, "normalization-summary.json"),
-			ChunkingSummaryPath:         filepath.Join(diagnosticsDir, "chunking-summary.json"),
-			UtilizationSummaryPath:      filepath.Join(diagnosticsDir, "utilization-diagnostics.json"),
-			CorrectionLedgerPath:        filepath.Join(diagnosticsDir, "correction-ledger.json"),
-			InvocationMetadataPath:      filepath.Join(diagnosticsDir, "invocation.json"),
-			RedactedEffectiveConfigPath: filepath.Join(diagnosticsDir, "effective-config.json"),
-		}
-		if status == "failed" {
-			report.Diagnostics.ErrorLogPath = filepath.Join(diagnosticsDir, "error.log")
-		}
-	}
-	if errorMessage != "" {
-		report.ErrorMessage = errorMessage
-	}
-	if normalizationSummary != nil {
-		report.InputSegmentCount = &normalizationSummary.InputSegmentCount
-		report.NormalizedSegmentCount = &normalizationSummary.OutputSegmentCount
-		report.NormalizationMerges = &normalizationSummary.MergesPerformed
-		report.NormalizationIDReassignments = &normalizationSummary.IDsReassigned
-		report.NormalizationSkipped.DifferentSpeakers = &normalizationSummary.SkippedMerges.DifferentSpeakers
-		report.NormalizationSkipped.GapTooLarge = &normalizationSummary.SkippedMerges.GapTooLarge
-		report.NormalizationSkipped.DurationExceeded = &normalizationSummary.SkippedMerges.DurationExceeded
-		report.NormalizationSkipped.TokenLimitExceeded = &normalizationSummary.SkippedMerges.TokenLimitExceeded
-	}
-	if chunkingSummary != nil {
-		report.Chunking = &reporting.ChunkingSummary{
-			ChunkCount:           chunkingSummary.ChunkCount,
-			MinEstimatedTokens:   chunkingSummary.MinEstimatedTokens,
-			MaxEstimatedTokens:   chunkingSummary.MaxEstimatedTokens,
-			TotalEstimatedTokens: chunkingSummary.TotalEstimatedTokens,
-			TargetSections:       chunkingSummary.TargetSections,
-			MaxSectionTokens:     chunkingSummary.MaxSectionTokens,
-			MinSectionTokens:     chunkingSummary.MinSectionTokens,
-		}
-	}
-	report.ModulesSummary, report.ModuleResults = buildModuleReporting(runOutput)
-	return report
-}
-
-func buildModuleReporting(runOutput *runner.RunOutput) (*reporting.ModulesSummary, []reporting.ModuleReport) {
-	if runOutput == nil || len(runOutput.ModuleResults) == 0 {
-		return nil, nil
-	}
-
-	moduleReports := make([]reporting.ModuleReport, 0, len(runOutput.ModuleResults))
-	summary := &reporting.ModulesSummary{ModuleCount: len(runOutput.ModuleResults)}
-	for _, r := range runOutput.ModuleResults {
-		startedAt := r.StartedAt
-		completedAt := r.CompletedAt
-		moduleReports = append(moduleReports, reporting.ModuleReport{
-			ModuleKey:          r.ModuleKey,
-			ModuleInstance:     r.ModuleInstance,
-			ReplacementPolicy:  string(r.ReplacementPolicy),
-			Status:             r.Status,
-			ProposalCount:      r.ProposalCount,
-			ValidatorDecisions: mapValidatorDecisions(r.ValidatorDecisions),
-			ValidatorRejected:  mapValidatorRejected(r.ValidatorRejected),
-			AppliedChanges:     r.AppliedChanges,
-			SkippedChanges:     r.SkippedChanges,
-			ErrorMessage:       r.ErrorMessage,
-			StartedAt:          &startedAt,
-			CompletedAt:        &completedAt,
-		})
-		summary.TotalAppliedChanges += len(r.AppliedChanges)
-		summary.TotalSkippedChanges += len(r.SkippedChanges) + len(r.ValidatorRejected)
-		if r.Status == runner.ModuleStatusFailed && summary.FailedModuleInstance == "" {
-			summary.FailedModuleInstance = r.ModuleInstance
-		}
-	}
-
-	return summary, moduleReports
-}
-
-func mapValidatorDecisions(in []runner.ValidatorDecisionRecord) []reporting.ValidatorDecisionReport {
-	if len(in) == 0 {
-		return nil
-	}
-	out := make([]reporting.ValidatorDecisionReport, len(in))
-	for i, d := range in {
-		out[i] = reporting.ValidatorDecisionReport{
-			ValidatorName:          d.ValidatorName,
-			ProposalIndex:          d.ProposalIndex,
-			Approved:               d.Approved,
-			ReasonCode:             d.ReasonCode,
-			Message:                d.Message,
-			DiagnosticArtifactPath: d.DiagnosticArtifactPath,
-		}
-	}
-	return out
-}
-
-func mapValidatorRejected(in []runner.ValidatorRejectedChange) []reporting.ValidatorRejectedReport {
-	if len(in) == 0 {
-		return nil
-	}
-	out := make([]reporting.ValidatorRejectedReport, len(in))
-	for i, d := range in {
-		out[i] = reporting.ValidatorRejectedReport{
-			ValidatorName:   d.ValidatorName,
-			ProposalIndex:   d.ProposalIndex,
-			ModuleKey:       d.ModuleKey,
-			ModuleInstance:  d.ModuleInstance,
-			TargetSegmentID: d.TargetSegmentID,
-			OriginalText:    d.OriginalText,
-			CorrectedText:   d.CorrectedText,
-			ReasonCode:      d.ReasonCode,
-			Message:         d.Message,
-		}
-	}
-	return out
 }
 
 type processFlags struct {
@@ -982,47 +784,6 @@ func findConfigPathOverride(args []string) (path string, set bool, err error) {
 	return "", false, nil
 }
 
-var statConfigPath = os.Stat
-
-func resolveConfigPath(cliConfigPath string, cliConfigPathSet bool, lookup func(string) (string, bool)) (path string, source string, err error) {
-	if cliConfigPathSet {
-		path = strings.TrimSpace(cliConfigPath)
-		if path == "" {
-			return "", "", fmt.Errorf("--config requires a non-empty path")
-		}
-		if _, statErr := statConfigPath(path); statErr != nil {
-			if os.IsNotExist(statErr) {
-				return "", "", fmt.Errorf("config file not found: %s", path)
-			}
-			return "", "", fmt.Errorf("cannot access config file %s: %w", path, statErr)
-		}
-		return path, "flag", nil
-	}
-
-	if raw, ok := lookup("AUDITA_CONFIG"); ok {
-		path = strings.TrimSpace(raw)
-		if path == "" {
-			return "", "", fmt.Errorf("AUDITA_CONFIG must not be empty")
-		}
-		if _, statErr := statConfigPath(path); statErr != nil {
-			if os.IsNotExist(statErr) {
-				return "", "", fmt.Errorf("config file not found: %s", path)
-			}
-			return "", "", fmt.Errorf("cannot access config file %s: %w", path, statErr)
-		}
-		return path, "env", nil
-	}
-
-	for _, defaultPath := range config.DefaultConfigSearchPaths {
-		if _, statErr := statConfigPath(defaultPath); statErr == nil {
-			return defaultPath, "default", nil
-		} else if !os.IsNotExist(statErr) {
-			return "", "", fmt.Errorf("cannot access config file %s: %w", defaultPath, statErr)
-		}
-	}
-	return "", "", nil
-}
-
 func isHelpCommand(args []string) bool {
 	if len(args) == 0 {
 		return false

internal/cli/run_test.go

@@ -21,11 +21,11 @@ import (
 	"gitea.maximumdirect.net/eric/audita/internal/core/schema"
 	"gitea.maximumdirect.net/eric/audita/internal/framework/contracts"
 	"gitea.maximumdirect.net/eric/audita/internal/framework/llm"
-	"gitea.maximumdirect.net/eric/audita/internal/framework/modules"
 	"gitea.maximumdirect.net/eric/audita/internal/framework/proposal_generation"
 	"gitea.maximumdirect.net/eric/audita/internal/framework/proposals"
 	"gitea.maximumdirect.net/eric/audita/internal/framework/runner"
 	"gitea.maximumdirect.net/eric/audita/internal/framework/validators"
+	"gitea.maximumdirect.net/eric/audita/internal/testsupport"
 )
 
 func TestRunRootHelp(t *testing.T) {
@@ -99,66 +99,6 @@ func TestRunProcessHelpListsExpectedFlags(t *testing.T) {
 	}
 }
 
-func TestResolveConfigPathDefaultIgnoredWhenMissing(t *testing.T) {
-	lookup := func(string) (string, bool) { return "", false }
-	path, source, err := resolveConfigPath("", false, lookup)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if path != "" || source != "" {
-		t.Fatalf("expected no config path/source, got path=%q source=%q", path, source)
-	}
-}
-
-func TestResolveConfigPathDefaultPrefersUsrLocalOverEtc(t *testing.T) {
-	oldStat := statConfigPath
-	statConfigPath = func(path string) (os.FileInfo, error) {
-		if path == config.DefaultConfigPathUsrLocal || path == config.DefaultConfigPath {
-			return nil, nil
-		}
-		return nil, os.ErrNotExist
-	}
-	t.Cleanup(func() { statConfigPath = oldStat })
-
-	lookup := func(string) (string, bool) { return "", false }
-	path, source, err := resolveConfigPath("", false, lookup)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if source != "default" {
-		t.Fatalf("expected default source, got %q", source)
-	}
-	if path != config.DefaultConfigPathUsrLocal {
-		t.Fatalf("expected %q, got %q", config.DefaultConfigPathUsrLocal, path)
-	}
-}
-
-func TestResolveConfigPathDefaultFallsBackToEtc(t *testing.T) {
-	oldStat := statConfigPath
-	statConfigPath = func(path string) (os.FileInfo, error) {
-		if path == config.DefaultConfigPathUsrLocal {
-			return nil, os.ErrNotExist
-		}
-		if path == config.DefaultConfigPath {
-			return nil, nil
-		}
-		return nil, os.ErrNotExist
-	}
-	t.Cleanup(func() { statConfigPath = oldStat })
-
-	lookup := func(string) (string, bool) { return "", false }
-	path, source, err := resolveConfigPath("", false, lookup)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if source != "default" {
-		t.Fatalf("expected default source, got %q", source)
-	}
-	if path != config.DefaultConfigPath {
-		t.Fatalf("expected %q, got %q", config.DefaultConfigPath, path)
-	}
-}
-
 func TestRunConfigValidateSuccess(t *testing.T) {
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
@@ -210,6 +150,23 @@ func TestRunConfigValidateUnknownField(t *testing.T) {
 	}
 }
 
+func TestRunConfigValidateUnsupportedModuleKey(t *testing.T) {
+	var stdout bytes.Buffer
+	var stderr bytes.Buffer
+	cfgPath := writeFile(t, "config.yml", "version: 1\npipeline:\n  modules: [made_up]\n")
+
+	exitCode := Run([]string{"config", "validate", "--config", cfgPath}, &stdout, &stderr)
+	if exitCode == 0 {
+		t.Fatalf("expected failure for unsupported module key")
+	}
+	if stdout.Len() != 0 {
+		t.Fatalf("expected empty stdout on failure, got %q", stdout.String())
+	}
+	if !strings.Contains(stderr.String(), "unsupported module key") {
+		t.Fatalf("expected unsupported module key error, got %q", stderr.String())
+	}
+}
+
 func TestRunConfigPrintEffectiveOutputsRedactedJSON(t *testing.T) {
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
@@ -242,6 +199,45 @@ func TestRunConfigPrintEffectiveOutputsRedactedJSON(t *testing.T) {
 	}
 }
 
+func TestRunConfigPrintEffectiveAppliesFileThenEnvironment(t *testing.T) {
+	var stdout bytes.Buffer
+	var stderr bytes.Buffer
+	cfgPath := writeFile(t, "config.yml", "version: 1\nllm:\n  proposal:\n    model: file-model\n")
+	t.Setenv("AUDITA_MODEL", "env-model")
+
+	exitCode := Run([]string{"config", "print-effective", "--config", cfgPath}, &stdout, &stderr)
+	if exitCode != 0 {
+		t.Fatalf("expected success, got %d stderr=%q", exitCode, stderr.String())
+	}
+
+	var out struct {
+		PrimaryLLM struct {
+			Model string `json:"Model"`
+		} `json:"PrimaryLLM"`
+	}
+	if err := json.Unmarshal(stdout.Bytes(), &out); err != nil {
+		t.Fatalf("expected valid JSON output, got error: %v output=%q", err, stdout.String())
+	}
+	if out.PrimaryLLM.Model != "env-model" {
+		t.Fatalf("expected env model override in print-effective output, got %q", out.PrimaryLLM.Model)
+	}
+}
+
+func TestRunConfigValidateIgnoresEnvironmentOverrides(t *testing.T) {
+	var stdout bytes.Buffer
+	var stderr bytes.Buffer
+	cfgPath := writeFile(t, "config.yml", "version: 1\n")
+	t.Setenv("AUDITA_MODULES", "made_up")
+
+	exitCode := Run([]string{"config", "validate", "--config", cfgPath}, &stdout, &stderr)
+	if exitCode != 0 {
+		t.Fatalf("expected success because config validate is file-only, got %d stderr=%q", exitCode, stderr.String())
+	}
+	if !strings.Contains(stdout.String(), "config is valid") {
+		t.Fatalf("expected success message, got %q", stdout.String())
+	}
+}
+
 func TestRunConfigCommandDoesNotRequireTranscriptOrGlossary(t *testing.T) {
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
@@ -369,8 +365,8 @@ diagnostics:
 
 func TestRunProcessEnvOverridesConfigFile(t *testing.T) {
 	processModuleFactory = fakeModuleFactory{modules: map[string]contracts.TranscriptModule{
-		"m": fakeModule{
-			key:    "m",
+		"grammar": fakeModule{
+			key:    "grammar",
 			policy: proposals.ReplacementPolicyRequireUnique,
 			validators: []contracts.Validator{
 				fakeValidator{name: "capture-config", validateF: func(req contracts.ValidationRequest) (validators.Result, error) {
@@ -392,7 +388,7 @@ func TestRunProcessEnvOverridesConfigFile(t *testing.T) {
 	cfgPath := writeFile(t, "config.yml", `
 version: 1
 pipeline:
-  modules: [m]
+  modules: [grammar]
 llm:
   proposal:
     model: file-model
@@ -404,7 +400,7 @@ llm:
 		fixturePath("tiny_transcript.json"),
 		"--glossary", fixturePath("tiny_glossary.yaml"),
 		"--config", cfgPath,
-		"--modules", "m",
+		"--modules", "grammar",
 	}, &stdout, &stderr)
 	if exitCode != 0 {
 		t.Fatalf("expected success, got %d stderr=%q", exitCode, stderr.String())
@@ -413,8 +409,8 @@ llm:
 
 func TestRunProcessCLIOverridesEnvAndConfigFile(t *testing.T) {
 	processModuleFactory = fakeModuleFactory{modules: map[string]contracts.TranscriptModule{
-		"m": fakeModule{
-			key:    "m",
+		"grammar": fakeModule{
+			key:    "grammar",
 			policy: proposals.ReplacementPolicyRequireUnique,
 			validators: []contracts.Validator{
 				fakeValidator{name: "capture-config", validateF: func(req contracts.ValidationRequest) (validators.Result, error) {
@@ -436,7 +432,7 @@ func TestRunProcessCLIOverridesEnvAndConfigFile(t *testing.T) {
 	cfgPath := writeFile(t, "config.yml", `
 version: 1
 pipeline:
-  modules: [m]
+  modules: [grammar]
 llm:
   proposal:
     model: file-model
@@ -448,7 +444,7 @@ llm:
 		fixturePath("tiny_transcript.json"),
 		"--glossary", fixturePath("tiny_glossary.yaml"),
 		"--config", cfgPath,
-		"--modules", "m",
+		"--modules", "grammar",
 		"--model", "cli-model",
 	}, &stdout, &stderr)
 	if exitCode != 0 {
@@ -495,8 +491,8 @@ diagnostics:
 
 func TestRunProcessTranscriptDescriptionCLIOverridesConfigFileContextDescription(t *testing.T) {
 	processModuleFactory = fakeModuleFactory{modules: map[string]contracts.TranscriptModule{
-		"m": fakeModule{
-			key:    "m",
+		"grammar": fakeModule{
+			key:    "grammar",
 			policy: proposals.ReplacementPolicyRequireUnique,
 			validators: []contracts.Validator{
 				fakeValidator{name: "capture-config", validateF: func(req contracts.ValidationRequest) (validators.Result, error) {
@@ -517,7 +513,7 @@ func TestRunProcessTranscriptDescriptionCLIOverridesConfigFileContextDescription
 	cfgPath := writeFile(t, "config.yml", `
 version: 1
 pipeline:
-  modules: [m]
+  modules: [grammar]
 context:
   description: "file transcript description"
 `)
@@ -528,7 +524,7 @@ context:
 		fixturePath("tiny_transcript.json"),
 		"--glossary", fixturePath("tiny_glossary.yaml"),
 		"--config", cfgPath,
-		"--modules", "m",
+		"--modules", "grammar",
 		"--transcript-description", "cli transcript description",
 	}, &stdout, &stderr)
 	if exitCode != 0 {
@@ -692,8 +688,8 @@ func TestRunProcessCLIOverridesEnvironment(t *testing.T) {
 
 func TestRunProcessTranscriptDescriptionDefaultEmpty(t *testing.T) {
 	processModuleFactory = fakeModuleFactory{modules: map[string]contracts.TranscriptModule{
-		"m": fakeModule{
-			key:    "m",
+		"grammar": fakeModule{
+			key:    "grammar",
 			policy: proposals.ReplacementPolicyRequireUnique,
 			validators: []contracts.Validator{
 				fakeValidator{name: "capture-config", validateF: func(req contracts.ValidationRequest) (validators.Result, error) {
@@ -720,7 +716,7 @@ func TestRunProcessTranscriptDescriptionDefaultEmpty(t *testing.T) {
 	exitCode := Run([]string{
 		"process", transcriptPath,
 		"--glossary", fixturePath("tiny_glossary.yaml"),
-		"--modules", "m",
+		"--modules", "grammar",
 	}, &stdout, &stderr)
 	if exitCode != 0 {
 		t.Fatalf("expected success, got %d stderr=%q", exitCode, stderr.String())
@@ -729,8 +725,8 @@ func TestRunProcessTranscriptDescriptionDefaultEmpty(t *testing.T) {
 
 func TestRunProcessTranscriptDescriptionCLIOverrideAndTrim(t *testing.T) {
 	processModuleFactory = fakeModuleFactory{modules: map[string]contracts.TranscriptModule{
-		"m": fakeModule{
-			key:    "m",
+		"grammar": fakeModule{
+			key:    "grammar",
 			policy: proposals.ReplacementPolicyRequireUnique,
 			validators: []contracts.Validator{
 				fakeValidator{name: "capture-config", validateF: func(req contracts.ValidationRequest) (validators.Result, error) {
@@ -757,7 +753,7 @@ func TestRunProcessTranscriptDescriptionCLIOverrideAndTrim(t *testing.T) {
 	exitCode := Run([]string{
 		"process", transcriptPath,
 		"--glossary", fixturePath("tiny_glossary.yaml"),
-		"--modules", "m",
+		"--modules", "grammar",
 		"--transcript-description", "   speaker background context   ",
 	}, &stdout, &stderr)
 	if exitCode != 0 {
@@ -823,8 +819,8 @@ func TestRunProcessRejectsValidationConcurrencyAboveTotalConcurrency(t *testing.
 
 func TestRunProcessTotalLLMConcurrencyDrivesEffectiveValidationConcurrencyWhenUnset(t *testing.T) {
 	processModuleFactory = fakeModuleFactory{modules: map[string]contracts.TranscriptModule{
-		"m": fakeModule{
-			key:    "m",
+		"grammar": fakeModule{
+			key:    "grammar",
 			policy: proposals.ReplacementPolicyRequireUnique,
 			validators: []contracts.Validator{
 				fakeValidator{name: "capture-config", validateF: func(req contracts.ValidationRequest) (validators.Result, error) {
@@ -865,7 +861,7 @@ func TestRunProcessTotalLLMConcurrencyDrivesEffectiveValidationConcurrencyWhenUn
 		"--glossary",
 		fixturePath("tiny_glossary.yaml"),
 		"--modules",
-		"m",
+		"grammar",
 		"--total-llm-concurrency",
 		"4",
 	}, &stdout, &stderr)
@@ -908,8 +904,8 @@ func TestRunProcessRejectsProposalConcurrencyAboveTotalConcurrency(t *testing.T)
 
 func TestRunProcessLegacyLLMConcurrencyAliasSetsTotalAndProposal(t *testing.T) {
 	processModuleFactory = fakeModuleFactory{modules: map[string]contracts.TranscriptModule{
-		"m": fakeModule{
-			key:    "m",
+		"grammar": fakeModule{
+			key:    "grammar",
 			policy: proposals.ReplacementPolicyRequireUnique,
 			validators: []contracts.Validator{
 				fakeValidator{name: "capture-config", validateF: func(req contracts.ValidationRequest) (validators.Result, error) {
@@ -944,7 +940,7 @@ func TestRunProcessLegacyLLMConcurrencyAliasSetsTotalAndProposal(t *testing.T) {
 		"--glossary",
 		fixturePath("tiny_glossary.yaml"),
 		"--modules",
-		"m",
+		"grammar",
 		"--llm-concurrency",
 		"3",
 	}, &stdout, &stderr)
@@ -955,8 +951,8 @@ func TestRunProcessLegacyLLMConcurrencyAliasSetsTotalAndProposal(t *testing.T) {
 
 func TestRunProcessLLMConcurrencyFlagsOverrideEnvironment(t *testing.T) {
 	processModuleFactory = fakeModuleFactory{modules: map[string]contracts.TranscriptModule{
-		"m": fakeModule{
-			key:    "m",
+		"grammar": fakeModule{
+			key:    "grammar",
 			policy: proposals.ReplacementPolicyRequireUnique,
 			validators: []contracts.Validator{
 				fakeValidator{name: "capture-config", validateF: func(req contracts.ValidationRequest) (validators.Result, error) {
@@ -997,7 +993,7 @@ func TestRunProcessLLMConcurrencyFlagsOverrideEnvironment(t *testing.T) {
 		"--glossary",
 		fixturePath("tiny_glossary.yaml"),
 		"--modules",
-		"m",
+		"grammar",
 		"--total-llm-concurrency",
 		"4",
 		"--proposal-llm-concurrency",
@@ -1010,8 +1006,8 @@ func TestRunProcessLLMConcurrencyFlagsOverrideEnvironment(t *testing.T) {
 
 func TestRunProcessAcceptsLLMConcurrencyEnvironmentVariables(t *testing.T) {
 	processModuleFactory = fakeModuleFactory{modules: map[string]contracts.TranscriptModule{
-		"m": fakeModule{
-			key:    "m",
+		"grammar": fakeModule{
+			key:    "grammar",
 			policy: proposals.ReplacementPolicyRequireUnique,
 			validators: []contracts.Validator{
 				fakeValidator{name: "capture-config", validateF: func(req contracts.ValidationRequest) (validators.Result, error) {
@@ -1052,7 +1048,7 @@ func TestRunProcessAcceptsLLMConcurrencyEnvironmentVariables(t *testing.T) {
 		"--glossary",
 		fixturePath("tiny_glossary.yaml"),
 		"--modules",
-		"m",
+		"grammar",
 	}, &stdout, &stderr)
 	if exitCode != 0 {
 		t.Fatalf("expected success, got %d stderr=%q", exitCode, stderr.String())
@@ -1793,11 +1789,12 @@ type fakeModule struct {
 func (m fakeModule) Key() string                                    { return m.key }
 func (m fakeModule) ReplacementPolicy() proposals.ReplacementPolicy { return m.policy }
 func (m fakeModule) Validators() []contracts.Validator              { return m.validators }
-func (m fakeModule) Propose(ctx context.Context, req contracts.ProposalRequest) ([]proposals.CorrectionProposal, error) {
+func (m fakeModule) Propose(ctx context.Context, req contracts.ProposalRequest) (contracts.ProposalResult, error) {
 	if m.proposeF == nil {
-		return nil, nil
+		return contracts.ProposalResult{}, nil
 	}
-	return m.proposeF(req)
+	proposalsOut, err := m.proposeF(req)
+	return contracts.ProposalResult{Proposals: proposalsOut}, err
 }
 
 type fakeValidator struct {
@@ -1882,12 +1879,12 @@ func TestRunProcessInjectedFactoryExecutesRunnerAndReportsModules(t *testing.T)
 		return validators.Result{ValidatorName: "allow", Decisions: decisions}, nil
 	}}
 	processModuleFactory = fakeModuleFactory{modules: map[string]contracts.TranscriptModule{
-		"m1": fakeModule{key: "m1", policy: proposals.ReplacementPolicyRequireUnique, validators: []contracts.Validator{allow}, proposeF: func(req contracts.ProposalRequest) ([]proposals.CorrectionProposal, error) {
+		"glossary": fakeModule{key: "glossary", policy: proposals.ReplacementPolicyRequireUnique, validators: []contracts.Validator{allow}, proposeF: func(req contracts.ProposalRequest) ([]proposals.CorrectionProposal, error) {
 			return []proposals.CorrectionProposal{
 				{TargetSegmentID: 1, OriginalText: "Hello", CorrectedText: "Hi", Confidence: 1},
 			}, nil
 		}},
-		"m2": fakeModule{key: "m2", policy: proposals.ReplacementPolicyRequireUnique, validators: []contracts.Validator{allow}, proposeF: func(req contracts.ProposalRequest) ([]proposals.CorrectionProposal, error) {
+		"homophones": fakeModule{key: "homophones", policy: proposals.ReplacementPolicyRequireUnique, validators: []contracts.Validator{allow}, proposeF: func(req contracts.ProposalRequest) ([]proposals.CorrectionProposal, error) {
 			if req.WorkingTranscript.Segments[0].Text != "Hi world" {
 				t.Fatalf("expected module 2 to see module 1 changes, got %q", req.WorkingTranscript.Segments[0].Text)
 			}
@@ -1910,7 +1907,7 @@ func TestRunProcessInjectedFactoryExecutesRunnerAndReportsModules(t *testing.T)
 	exitCode := Run([]string{
 		"process", transcriptPath,
 		"--glossary", fixturePath("tiny_glossary.yaml"),
-		"--modules", "m1,m2",
+		"--modules", "glossary,homophones",
 		"--output", outputPath,
 		"--report-json", reportPath,
 		"--work-dir", workDir,
@@ -1969,7 +1966,7 @@ func TestRunProcessInjectedFactoryLLMValidatorResultsInReports(t *testing.T) {
 		}},
 	}
 	processModuleFactory = fakeModuleFactory{modules: map[string]contracts.TranscriptModule{
-		"m": fakeModule{key: "m", policy: proposals.ReplacementPolicyRequireUnique, validators: []contracts.Validator{llmValidator}, proposeF: func(req contracts.ProposalRequest) ([]proposals.CorrectionProposal, error) {
+		"grammar": fakeModule{key: "grammar", policy: proposals.ReplacementPolicyRequireUnique, validators: []contracts.Validator{llmValidator}, proposeF: func(req contracts.ProposalRequest) ([]proposals.CorrectionProposal, error) {
 			return []proposals.CorrectionProposal{{TargetSegmentID: 1, OriginalText: "Hello", CorrectedText: "Hi", Confidence: 1}}, nil
 		}},
 	}}
@@ -1989,7 +1986,7 @@ func TestRunProcessInjectedFactoryLLMValidatorResultsInReports(t *testing.T) {
 	exitCode := Run([]string{
 		"process", transcriptPath,
 		"--glossary", fixturePath("tiny_glossary.yaml"),
-		"--modules", "m",
+		"--modules", "grammar",
 		"--output", outputPath,
 		"--report-json", reportPath,
 		"--work-dir", workDir,
@@ -2010,7 +2007,7 @@ func TestRunProcessInjectedFactoryLLMValidatorResultsInReports(t *testing.T) {
 
 func TestRunProcessInjectedFactorySkippedKeepsAutoRetention(t *testing.T) {
 	processModuleFactory = fakeModuleFactory{modules: map[string]contracts.TranscriptModule{
-		"m1": fakeModule{key: "m1", policy: proposals.ReplacementPolicyRequireUnique, proposeF: func(req contracts.ProposalRequest) ([]proposals.CorrectionProposal, error) {
+		"glossary": fakeModule{key: "glossary", policy: proposals.ReplacementPolicyRequireUnique, proposeF: func(req contracts.ProposalRequest) ([]proposals.CorrectionProposal, error) {
 			return []proposals.CorrectionProposal{
 				{TargetSegmentID: 1, OriginalText: "word", CorrectedText: "term", Confidence: 1},
 			}, nil
@@ -2026,7 +2023,7 @@ func TestRunProcessInjectedFactorySkippedKeepsAutoRetention(t *testing.T) {
 	exitCode := Run([]string{
 		"process", transcriptPath,
 		"--glossary", fixturePath("tiny_glossary.yaml"),
-		"--modules", "m1",
+		"--modules", "glossary",
 		"--work-dir", workDir,
 		"--work-dir-retention", "auto",
 	}, &stdout, &stderr)
@@ -2040,7 +2037,7 @@ func TestRunProcessInjectedFactorySkippedKeepsAutoRetention(t *testing.T) {
 
 func TestRunProcessInjectedFactoryFailureWritesFailedReport(t *testing.T) {
 	processModuleFactory = fakeModuleFactory{modules: map[string]contracts.TranscriptModule{
-		"m1": fakeModule{key: "m1", policy: proposals.ReplacementPolicyRequireUnique, proposeF: func(req contracts.ProposalRequest) ([]proposals.CorrectionProposal, error) {
+		"glossary": fakeModule{key: "glossary", policy: proposals.ReplacementPolicyRequireUnique, proposeF: func(req contracts.ProposalRequest) ([]proposals.CorrectionProposal, error) {
 			return nil, errors.New("test failure")
 		}},
 	}}
@@ -2056,7 +2053,7 @@ func TestRunProcessInjectedFactoryFailureWritesFailedReport(t *testing.T) {
 	exitCode := Run([]string{
 		"process", transcriptPath,
 		"--glossary", fixturePath("tiny_glossary.yaml"),
-		"--modules", "m1",
+		"--modules", "glossary",
 		"--work-dir", workDir,
 		"--work-dir-retention", "always",
 		"--report-json", reportPath,
@@ -2088,14 +2085,8 @@ func TestRunProcessInjectedFactoryFailureWritesFailedReport(t *testing.T) {
 	}
 }
 
-func TestRunProcessProductionRegistryUnsupportedModuleFailsCleanly(t *testing.T) {
-	cfg := modules.Dependencies{}
-	processModuleFactory = modules.NewFactory(cfg)
-	t.Cleanup(func() { processModuleFactory = nil })
-
+func TestRunProcessUnsupportedModuleFailsDuringConfigValidation(t *testing.T) {
 	var stdout, stderr bytes.Buffer
-	workDir := t.TempDir()
-	reportPath := filepath.Join(t.TempDir(), "report.json")
 	transcriptPath := writeFile(t, "transcript.json", `[
   {"id":1,"speaker":"Alice","start":0.0,"end":1.0,"text":"Hello"}
 ]`)
@@ -2104,9 +2095,6 @@ func TestRunProcessProductionRegistryUnsupportedModuleFailsCleanly(t *testing.T)
 		"process", transcriptPath,
 		"--glossary", fixturePath("tiny_glossary.yaml"),
 		"--modules", "made_up",
-		"--work-dir", workDir,
-		"--work-dir-retention", "always",
-		"--report-json", reportPath,
 	}, &stdout, &stderr)
 	if exitCode == 0 {
 		t.Fatal("expected failure exit code")
@@ -2114,23 +2102,12 @@ func TestRunProcessProductionRegistryUnsupportedModuleFailsCleanly(t *testing.T)
 	if stdout.Len() != 0 {
 		t.Fatalf("expected empty stdout on failure, got %q", stdout.String())
 	}
-	if !strings.Contains(stderr.String(), "runner_execution") {
-		t.Fatalf("expected runner_execution failure on stderr, got %q", stderr.String())
+	if !strings.Contains(stderr.String(), "invalid CLI configuration") {
+		t.Fatalf("expected config validation failure on stderr, got %q", stderr.String())
 	}
 	if !strings.Contains(stderr.String(), "unsupported module key") {
 		t.Fatalf("expected explicit unsupported module message, got %q", stderr.String())
 	}
-
-	report := readProcessReport(t, reportPath)
-	if report.Status != "failed" {
-		t.Fatalf("expected failed report status, got %q", report.Status)
-	}
-	if report.ErrorPhase != "runner_execution" {
-		t.Fatalf("expected runner_execution phase, got %q", report.ErrorPhase)
-	}
-	if !strings.Contains(report.ErrorMessage, "unsupported module key") {
-		t.Fatalf("expected report error message to mention unsupported module, got %q", report.ErrorMessage)
-	}
 }
 
 func TestRunProcessExplicitUnsupportedModulesFailClearly(t *testing.T) {
@@ -2384,7 +2361,7 @@ func TestRunProcessExplicitGrammarRejectedAndApplicationSkipAreDistinct(t *testi
 	}
 }
 
-func TestRunProcessExplicitGrammarMalformedLLMOutputFailsWithErrorLog(t *testing.T) {
+func TestRunProcessExplicitGrammarMalformedLLMOutputSucceedsWithWarning(t *testing.T) {
 	processProposalLLMClient = &fakeStructuredLLMClient{err: errors.New("malformed structured output")}
 	t.Cleanup(func() { processProposalLLMClient = nil })
 
@@ -2403,22 +2380,32 @@ func TestRunProcessExplicitGrammarMalformedLLMOutputFailsWithErrorLog(t *testing
 		"--work-dir-retention", "always",
 		"--report-json", reportPath,
 	}, &stdout, &stderr)
-	if exitCode == 0 {
-		t.Fatal("expected failure")
+	if exitCode != 0 {
+		t.Fatalf("expected success, got %d stderr=%q", exitCode, stderr.String())
 	}
-	if stdout.Len() != 0 {
-		t.Fatalf("expected empty stdout on failure, got %q", stdout.String())
+	if stderr.Len() != 0 {
+		t.Fatalf("expected empty stderr on success, got %q", stderr.String())
 	}
-	if !strings.Contains(stderr.String(), "runner_execution") {
-		t.Fatalf("expected runner_execution error, got %q", stderr.String())
+	parsed, err := schema.ParseTranscriptJSON(stdout.Bytes())
+	if err != nil {
+		t.Fatalf("expected transcript stdout on success: %v", err)
+	}
+	if len(parsed.Segments) != 1 || parsed.Segments[0].Text != "hello" {
+		t.Fatalf("expected unchanged transcript, got %+v", parsed.Segments)
 	}
 	runDir := onlyRunDir(t, workDir)
-	if _, err := os.Stat(filepath.Join(runDir, "error.log")); err != nil {
-		t.Fatalf("expected error.log on failed grammar run: %v", err)
+	if _, err := os.Stat(filepath.Join(runDir, "error.log")); err == nil || !os.IsNotExist(err) {
+		t.Fatalf("did not expect error.log on successful grammar run: %v", err)
 	}
 	report := readProcessReport(t, reportPath)
-	if report.Status != "failed" || report.ErrorPhase != "runner_execution" {
-		t.Fatalf("expected failed runner_execution report, got %+v", report)
+	if report.Status != "success" || report.ErrorPhase != "" {
+		t.Fatalf("expected successful report, got %+v", report)
+	}
+	if len(report.ModuleResults) != 1 || len(report.ModuleResults[0].Warnings) != 1 {
+		t.Fatalf("expected one module warning, got %+v", report.ModuleResults)
+	}
+	if report.ModuleResults[0].Warnings[0].ReasonCode != "proposal_response_malformed" {
+		t.Fatalf("unexpected warning: %+v", report.ModuleResults[0].Warnings[0])
 	}
 }
 
@@ -3041,7 +3028,7 @@ func TestRunProcessExplicitGlossaryRepeatedStagesUseDeterministicInstanceNamesAn
 	}
 }
 
-func TestRunProcessExplicitGlossaryMalformedLLMOutputFailsWithErrorLog(t *testing.T) {
+func TestRunProcessExplicitGlossaryMalformedLLMOutputSucceedsWithWarning(t *testing.T) {
 	processProposalLLMClient = &fakeStructuredLLMClient{err: errors.New("malformed structured output")}
 	t.Cleanup(func() { processProposalLLMClient = nil })
 
@@ -3060,22 +3047,29 @@ func TestRunProcessExplicitGlossaryMalformedLLMOutputFailsWithErrorLog(t *testin
 		"--work-dir-retention", "always",
 		"--report-json", reportPath,
 	}, &stdout, &stderr)
-	if exitCode == 0 {
-		t.Fatal("expected failure")
+	if exitCode != 0 {
+		t.Fatalf("expected success, got %d stderr=%q", exitCode, stderr.String())
 	}
-	if stdout.Len() != 0 {
-		t.Fatalf("expected empty stdout on failure, got %q", stdout.String())
+	if stderr.Len() != 0 {
+		t.Fatalf("expected empty stderr on success, got %q", stderr.String())
 	}
-	if !strings.Contains(stderr.String(), "runner_execution") {
-		t.Fatalf("expected runner_execution error, got %q", stderr.String())
+	parsed, err := schema.ParseTranscriptJSON(stdout.Bytes())
+	if err != nil {
+		t.Fatalf("expected transcript stdout on success: %v", err)
+	}
+	if len(parsed.Segments) != 1 || parsed.Segments[0].Text != "hello" {
+		t.Fatalf("expected unchanged transcript, got %+v", parsed.Segments)
 	}
 	runDir := onlyRunDir(t, workDir)
-	if _, err := os.Stat(filepath.Join(runDir, "error.log")); err != nil {
-		t.Fatalf("expected error.log on failed glossary run: %v", err)
+	if _, err := os.Stat(filepath.Join(runDir, "error.log")); err == nil || !os.IsNotExist(err) {
+		t.Fatalf("did not expect error.log on successful glossary run: %v", err)
 	}
 	report := readProcessReport(t, reportPath)
-	if report.Status != "failed" || report.ErrorPhase != "runner_execution" {
-		t.Fatalf("expected failed runner_execution report, got %+v", report)
+	if report.Status != "success" || report.ErrorPhase != "" {
+		t.Fatalf("expected successful report, got %+v", report)
+	}
+	if len(report.ModuleResults) != 1 || len(report.ModuleResults[0].Warnings) != 1 {
+		t.Fatalf("expected one module warning, got %+v", report.ModuleResults)
 	}
 }
 
@@ -3295,7 +3289,7 @@ func TestRunProcessExplicitHomophonesProtectedGlossaryTermRejected(t *testing.T)
 	}
 }
 
-func TestRunProcessExplicitHomophonesMalformedLLMOutputFailsWithErrorLog(t *testing.T) {
+func TestRunProcessExplicitHomophonesMalformedLLMOutputSucceedsWithWarning(t *testing.T) {
 	processProposalLLMClient = &fakeStructuredLLMClient{err: errors.New("malformed structured output")}
 	t.Cleanup(func() { processProposalLLMClient = nil })
 
@@ -3314,22 +3308,29 @@ func TestRunProcessExplicitHomophonesMalformedLLMOutputFailsWithErrorLog(t *test
 		"--work-dir-retention", "always",
 		"--report-json", reportPath,
 	}, &stdout, &stderr)
-	if exitCode == 0 {
-		t.Fatal("expected failure")
+	if exitCode != 0 {
+		t.Fatalf("expected success, got %d stderr=%q", exitCode, stderr.String())
 	}
-	if stdout.Len() != 0 {
-		t.Fatalf("expected empty stdout on failure, got %q", stdout.String())
+	if stderr.Len() != 0 {
+		t.Fatalf("expected empty stderr on success, got %q", stderr.String())
 	}
-	if !strings.Contains(stderr.String(), "runner_execution") {
-		t.Fatalf("expected runner_execution error, got %q", stderr.String())
+	parsed, err := schema.ParseTranscriptJSON(stdout.Bytes())
+	if err != nil {
+		t.Fatalf("expected transcript stdout on success: %v", err)
+	}
+	if len(parsed.Segments) != 1 || parsed.Segments[0].Text != "hello" {
+		t.Fatalf("expected unchanged transcript, got %+v", parsed.Segments)
 	}
 	runDir := onlyRunDir(t, workDir)
-	if _, err := os.Stat(filepath.Join(runDir, "error.log")); err != nil {
-		t.Fatalf("expected error.log on failed homophones run: %v", err)
+	if _, err := os.Stat(filepath.Join(runDir, "error.log")); err == nil || !os.IsNotExist(err) {
+		t.Fatalf("did not expect error.log on successful homophones run: %v", err)
 	}
 	report := readProcessReport(t, reportPath)
-	if report.Status != "failed" || report.ErrorPhase != "runner_execution" {
-		t.Fatalf("expected failed runner_execution report, got %+v", report)
+	if report.Status != "success" || report.ErrorPhase != "" {
+		t.Fatalf("expected successful report, got %+v", report)
+	}
+	if len(report.ModuleResults) != 1 || len(report.ModuleResults[0].Warnings) != 1 {
+		t.Fatalf("expected one module warning, got %+v", report.ModuleResults)
 	}
 }
 
@@ -3674,7 +3675,7 @@ func TestRunProcessExplicitSpokenWordProtectedGlossaryTermRejected(t *testing.T)
 	}
 }
 
-func TestRunProcessExplicitSpokenWordMalformedLLMOutputFailsWithErrorLog(t *testing.T) {
+func TestRunProcessExplicitSpokenWordMalformedLLMOutputSucceedsWithWarning(t *testing.T) {
 	processProposalLLMClient = &fakeStructuredLLMClient{err: errors.New("malformed structured output")}
 	t.Cleanup(func() { processProposalLLMClient = nil })
 
@@ -3693,22 +3694,29 @@ func TestRunProcessExplicitSpokenWordMalformedLLMOutputFailsWithErrorLog(t *test
 		"--work-dir-retention", "always",
 		"--report-json", reportPath,
 	}, &stdout, &stderr)
-	if exitCode == 0 {
-		t.Fatal("expected failure")
+	if exitCode != 0 {
+		t.Fatalf("expected success, got %d stderr=%q", exitCode, stderr.String())
 	}
-	if stdout.Len() != 0 {
-		t.Fatalf("expected empty stdout on failure, got %q", stdout.String())
+	if stderr.Len() != 0 {
+		t.Fatalf("expected empty stderr on success, got %q", stderr.String())
 	}
-	if !strings.Contains(stderr.String(), "runner_execution") {
-		t.Fatalf("expected runner_execution error, got %q", stderr.String())
+	parsed, err := schema.ParseTranscriptJSON(stdout.Bytes())
+	if err != nil {
+		t.Fatalf("expected transcript stdout on success: %v", err)
+	}
+	if len(parsed.Segments) != 1 || parsed.Segments[0].Text != "hello" {
+		t.Fatalf("expected unchanged transcript, got %+v", parsed.Segments)
 	}
 	runDir := onlyRunDir(t, workDir)
-	if _, err := os.Stat(filepath.Join(runDir, "error.log")); err != nil {
-		t.Fatalf("expected error.log on failed spoken_word run: %v", err)
+	if _, err := os.Stat(filepath.Join(runDir, "error.log")); err == nil || !os.IsNotExist(err) {
+		t.Fatalf("did not expect error.log on successful spoken_word run: %v", err)
 	}
 	report := readProcessReport(t, reportPath)
-	if report.Status != "failed" || report.ErrorPhase != "runner_execution" {
-		t.Fatalf("expected failed runner_execution report, got %+v", report)
+	if report.Status != "success" || report.ErrorPhase != "" {
+		t.Fatalf("expected successful report, got %+v", report)
+	}
+	if len(report.ModuleResults) != 1 || len(report.ModuleResults[0].Warnings) != 1 {
+		t.Fatalf("expected one module warning, got %+v", report.ModuleResults)
 	}
 }
 
@@ -4328,12 +4336,7 @@ func writeFile(t *testing.T, name string, content string) string {
 }
 
 func readFile(t *testing.T, path string) []byte {
-	t.Helper()
-	data, err := os.ReadFile(path)
-	if err != nil {
-		t.Fatalf("failed to read file %q: %v", path, err)
-	}
-	return data
+	return testsupport.ReadFile(t, path)
 }
 
 func readProcessReport(t *testing.T, path string) reporting.ProcessReport {
@@ -4347,13 +4350,5 @@ func readProcessReport(t *testing.T, path string) reporting.ProcessReport {
 }
 
 func onlyRunDir(t *testing.T, workDir string) string {
-	t.Helper()
-	entries, err := os.ReadDir(workDir)
-	if err != nil {
-		t.Fatalf("failed to read work dir %q: %v", workDir, err)
-	}
-	if len(entries) != 1 {
-		t.Fatalf("expected exactly one run dir in %q, got %d", workDir, len(entries))
-	}
-	return filepath.Join(workDir, entries[0].Name())
+	return testsupport.OnlyRunDir(t, workDir)
 }

internal/cli/subprocess_test_hooks.go

@@ -78,26 +78,23 @@ func (c *subprocessTestLLMClient) CompleteStructured(ctx context.Context, req co
 			}
 		}
 	case "mid_pipeline_fail":
-		switch target := out.(type) {
-		case *proposal_generation.StructuredCorrectionSet:
+		if _, ok := out.(*proposal_generation.StructuredCorrectionSet); ok {
 			c.mu.Lock()
 			c.proposals++
 			proposalCall := c.proposals
 			c.mu.Unlock()
 
 			if proposalCall >= 3 {
-				*target = proposal_generation.StructuredCorrectionSet{
-					Corrections: []proposal_generation.StructuredCorrectionProposal{
-						{TargetSegmentID: 0, OriginalText: "x", CorrectedText: "y", Confidence: 0.99},
-					},
+				return contracts.StructuredCompletionResponse{}, errors.New("synthetic mid-pipeline failure")
 			}
-			} else {
+		}
+		switch target := out.(type) {
+		case *proposal_generation.StructuredCorrectionSet:
 			*target = proposal_generation.StructuredCorrectionSet{
 				Corrections: []proposal_generation.StructuredCorrectionProposal{
 					{TargetSegmentID: 1, OriginalText: "Segment", CorrectedText: "Segment", Confidence: 0.99},
 				},
 			}
-			}
 		case *validators.LLMValidationResponse:
 			*target = validators.LLMValidationResponse{Validations: nil}
 		}

internal/core/config/apply_helpers.go

@@ -0,0 +1,171 @@
+package config
+
+import "strings"
+
+type llmTargetPatch struct {
+	apiKey         *string
+	model          *string
+	baseURL        *string
+	timeoutSeconds *int
+	maxRetries     *int
+}
+
+type concurrencyPatch struct {
+	totalLLM         *int
+	legacyTotalLLM   *int
+	proposalLLM      *int
+	validationLLM    *int
+	inheritProposal  bool
+	allowLegacyAlias bool
+}
+
+type chunkingPatch struct {
+	targetSections   *int
+	maxSectionTokens *int
+	minSectionTokens *int
+}
+
+type thresholdsPatch struct {
+	glossary   *float64
+	grammar    *float64
+	homophones *float64
+	spokenWord *float64
+}
+
+type normalizationPatch struct {
+	maxSegmentGap      *float64
+	ellipsisGap        *float64
+	maxSegmentDuration *float64
+	maxSegmentTokens   *int
+}
+
+type contextPatch struct {
+	transcriptDescription *string
+}
+
+type diagnosticsPatch struct {
+	workDir          *string
+	workDirRetention *string
+}
+
+func (c *Config) applyPrimaryLLMTargetPatch(patch llmTargetPatch) {
+	if patch.apiKey != nil {
+		c.PrimaryLLM.APIKey = *patch.apiKey
+	}
+	if patch.model != nil {
+		c.PrimaryLLM.Model = *patch.model
+	}
+	if patch.baseURL != nil {
+		c.PrimaryLLM.BaseURL = *patch.baseURL
+	}
+	if patch.timeoutSeconds != nil {
+		c.PrimaryLLM.TimeoutSeconds = *patch.timeoutSeconds
+	}
+	if patch.maxRetries != nil {
+		c.PrimaryLLM.MaxRetries = *patch.maxRetries
+	}
+}
+
+func (c *Config) applyValidationLLMTargetPatch(patch llmTargetPatch) {
+	if patch.apiKey != nil {
+		c.ValidationLLM.APIKey = *patch.apiKey
+	}
+	if patch.model != nil {
+		c.ValidationLLM.Model = *patch.model
+	}
+	if patch.baseURL != nil {
+		c.ValidationLLM.BaseURL = *patch.baseURL
+	}
+	if patch.timeoutSeconds != nil {
+		value := *patch.timeoutSeconds
+		c.ValidationLLM.TimeoutSeconds = &value
+	}
+	if patch.maxRetries != nil {
+		value := *patch.maxRetries
+		c.ValidationLLM.MaxRetries = &value
+	}
+}
+
+func (c *Config) applyConcurrencyPatch(patch concurrencyPatch) {
+	totalSet := false
+	if patch.totalLLM != nil {
+		c.TotalLLMConcurrency = *patch.totalLLM
+		totalSet = true
+	}
+	if patch.allowLegacyAlias && patch.legacyTotalLLM != nil && !totalSet {
+		c.TotalLLMConcurrency = *patch.legacyTotalLLM
+		totalSet = true
+	}
+
+	proposalSet := false
+	if patch.proposalLLM != nil {
+		c.ProposalLLMConcurrency = *patch.proposalLLM
+		proposalSet = true
+	}
+	if patch.inheritProposal && totalSet && !proposalSet {
+		c.ProposalLLMConcurrency = c.TotalLLMConcurrency
+	}
+
+	if patch.validationLLM != nil {
+		value := *patch.validationLLM
+		c.ValidationLLMConcurrency = &value
+	}
+}
+
+func (c *Config) applyChunkingPatch(patch chunkingPatch) {
+	if patch.targetSections != nil {
+		value := *patch.targetSections
+		c.TargetSections = &value
+	}
+	if patch.maxSectionTokens != nil {
+		c.MaxSectionTokens = *patch.maxSectionTokens
+	}
+	if patch.minSectionTokens != nil {
+		c.MinSectionTokens = *patch.minSectionTokens
+	}
+}
+
+func (c *Config) applyThresholdsPatch(patch thresholdsPatch) {
+	if patch.glossary != nil {
+		c.Thresholds.Glossary = *patch.glossary
+	}
+	if patch.grammar != nil {
+		c.Thresholds.Grammar = *patch.grammar
+	}
+	if patch.homophones != nil {
+		c.Thresholds.Homophones = *patch.homophones
+	}
+	if patch.spokenWord != nil {
+		c.Thresholds.SpokenWord = *patch.spokenWord
+	}
+}
+
+func (c *Config) applyNormalizationPatch(patch normalizationPatch) {
+	if patch.maxSegmentGap != nil {
+		c.Normalization.MaxSegmentGap = *patch.maxSegmentGap
+	}
+	if patch.ellipsisGap != nil {
+		c.Normalization.EllipsisGap = *patch.ellipsisGap
+	}
+	if patch.maxSegmentDuration != nil {
+		c.Normalization.MaxSegmentDuration = *patch.maxSegmentDuration
+	}
+	if patch.maxSegmentTokens != nil {
+		c.Normalization.MaxSegmentTokens = *patch.maxSegmentTokens
+	}
+}
+
+func (c *Config) applyContextPatch(patch contextPatch) {
+	if patch.transcriptDescription != nil {
+		c.TranscriptDescription = strings.TrimSpace(*patch.transcriptDescription)
+	}
+}
+
+func (c *Config) applyDiagnosticsPatch(patch diagnosticsPatch) {
+	if patch.workDir != nil {
+		c.WorkDir = *patch.workDir
+	}
+	if patch.workDirRetention != nil {
+		c.WorkDirRetention = WorkDirRetention(*patch.workDirRetention)
+	}
+}

internal/core/config/config.go

@@ -3,6 +3,8 @@ package config
 import (
 	"fmt"
 	"strings"
+
+	"gitea.maximumdirect.net/eric/audita/internal/core/modulecatalog"
 )
 
 type WorkDirRetention string
@@ -14,7 +16,7 @@ const (
 )
 
 const (
-	DefaultModulesCSV                                     = "glossary,homophones,glossary,spoken_word,grammar"
+	DefaultModulesCSV                                     = modulecatalog.KeyGlossary + "," + modulecatalog.KeyHomophones + "," + modulecatalog.KeyGlossary + "," + modulecatalog.KeySpokenWord + "," + modulecatalog.KeyGrammar
 	DefaultOutputSchema                                   = "bare-segments"
 	DefaultPrimaryModel                                   = "openrouter/google/gemma-4-31b-it"
 	DefaultPrimaryBaseURL                                 = "https://openrouter.ai/api/v1"

internal/core/config/config_test.go

@@ -4,6 +4,9 @@ import (
 	"reflect"
 	"strings"
 	"testing"
+
+	"gitea.maximumdirect.net/eric/audita/internal/core/modulecatalog"
+	"gitea.maximumdirect.net/eric/audita/internal/core/outputschema"
 )
 
 func TestDefaultConfigValues(t *testing.T) {
@@ -236,6 +239,186 @@ func TestApplyCLIOverridesTrimsTranscriptDescription(t *testing.T) {
 	}
 }
 
+func TestConfigSourcesApplySharedEffectiveFieldsConsistently(t *testing.T) {
+	fileCfg := mustParseFileConfigYAML(t, `
+version: 1
+output:
+  schema: " audita-v1 "
+llm:
+  proposal:
+    base_url: https://proposal.example.test/v1
+    model: provider/proposal
+    timeout: 101
+    max_retries: 5
+  validation:
+    base_url: https://validation.example.test/v1
+    model: provider/validation
+    timeout: 202
+    max_retries: 6
+chunking:
+  target_sections: 7
+  max_section_tokens: 9000
+  min_section_tokens: 1000
+thresholds:
+  glossary: 0.91
+  grammar: 0.92
+  homophones: 0.93
+  spoken_word: 0.94
+normalization:
+  max_segment_gap: 1.2
+  ellipsis_gap: 2.3
+  max_segment_duration: 45.6
+  max_segment_tokens: 321
+context:
+  description: "  shared context  "
+diagnostics:
+  work_dir: /tmp/audita-shared
+  retention: always
+`)
+
+	tests := []struct {
+		name  string
+		apply func(*Config) error
+	}{
+		{
+			name: "file",
+			apply: func(cfg *Config) error {
+				return cfg.applyFileConfigWithLookup(fileCfg, mapLookup(map[string]string{}))
+			},
+		},
+		{
+			name: "env",
+			apply: func(cfg *Config) error {
+				return cfg.applyEnvOverrides(mapLookup(map[string]string{
+					"AUDITA_MODEL":                            "provider/proposal",
+					"AUDITA_BASE_URL":                         "https://proposal.example.test/v1",
+					"AUDITA_LLM_TIMEOUT_SECONDS":              "101",
+					"AUDITA_MAX_RETRIES":                      "5",
+					"AUDITA_VALIDATION_MODEL":                 "provider/validation",
+					"AUDITA_VALIDATION_BASE_URL":              "https://validation.example.test/v1",
+					"AUDITA_VALIDATION_LLM_TIMEOUT_SECONDS":   "202",
+					"AUDITA_VALIDATION_MAX_RETRIES":           "6",
+					"AUDITA_TARGET_SECTIONS":                  "7",
+					"AUDITA_MAX_SECTION_TOKENS":               "9000",
+					"AUDITA_MIN_SECTION_TOKENS":               "1000",
+					"AUDITA_GLOSSARY_CONFIDENCE_THRESHOLD":    "0.91",
+					"AUDITA_GRAMMAR_CONFIDENCE_THRESHOLD":     "0.92",
+					"AUDITA_HOMOPHONES_CONFIDENCE_THRESHOLD":  "0.93",
+					"AUDITA_SPOKEN_WORD_CONFIDENCE_THRESHOLD": "0.94",
+					"AUDITA_NORMALIZE_MAX_SEGMENT_GAP":        "1.2",
+					"AUDITA_NORMALIZE_ELLIPSIS_GAP":           "2.3",
+					"AUDITA_NORMALIZE_MAX_SEGMENT_DURATION":   "45.6",
+					"AUDITA_NORMALIZE_MAX_SEGMENT_TOKENS":     "321",
+					"AUDITA_WORK_DIR":                         "/tmp/audita-shared",
+					"AUDITA_WORK_DIR_RETENTION":               "always",
+				}))
+			},
+		},
+		{
+			name: "cli",
+			apply: func(cfg *Config) error {
+				outputSchema := " audita-v1 "
+				proposalModel := "provider/proposal"
+				proposalBaseURL := "https://proposal.example.test/v1"
+				proposalTimeout := 101
+				proposalMaxRetries := 5
+				validationModel := "provider/validation"
+				validationBaseURL := "https://validation.example.test/v1"
+				validationTimeout := 202
+				validationMaxRetries := 6
+				targetSections := 7
+				maxSectionTokens := 9000
+				minSectionTokens := 1000
+				glossaryThreshold := 0.91
+				grammarThreshold := 0.92
+				homophonesThreshold := 0.93
+				spokenWordThreshold := 0.94
+				normalizeMaxSegmentGap := 1.2
+				normalizeEllipsisGap := 2.3
+				normalizeMaxSegmentDuration := 45.6
+				normalizeMaxSegmentTokens := 321
+				description := "  shared context  "
+				workDir := "/tmp/audita-shared"
+				workDirRetention := "always"
+				return cfg.ApplyCLIOverrides(CLIOverrides{
+					OutputSchema:                  &outputSchema,
+					PrimaryModel:                  &proposalModel,
+					PrimaryBaseURL:                &proposalBaseURL,
+					PrimaryLLMTimeoutSeconds:      &proposalTimeout,
+					MaxRetries:                    &proposalMaxRetries,
+					ValidationModel:               &validationModel,
+					ValidationBaseURL:             &validationBaseURL,
+					ValidationLLMTimeoutSeconds:   &validationTimeout,
+					ValidationMaxRetries:          &validationMaxRetries,
+					TargetSections:                &targetSections,
+					MaxSectionTokens:              &maxSectionTokens,
+					MinSectionTokens:              &minSectionTokens,
+					GlossaryConfidenceThreshold:   &glossaryThreshold,
+					GrammarConfidenceThreshold:    &grammarThreshold,
+					HomophonesConfidenceThreshold: &homophonesThreshold,
+					SpokenWordConfidenceThreshold: &spokenWordThreshold,
+					NormalizeMaxSegmentGap:        &normalizeMaxSegmentGap,
+					NormalizeEllipsisGap:          &normalizeEllipsisGap,
+					NormalizeMaxSegmentDuration:   &normalizeMaxSegmentDuration,
+					NormalizeMaxSegmentTokens:     &normalizeMaxSegmentTokens,
+					TranscriptDescription:         &description,
+					WorkDir:                       &workDir,
+					WorkDirRetention:              &workDirRetention,
+				})
+			},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			cfg := Default()
+			if err := tc.apply(&cfg); err != nil {
+				t.Fatalf("apply config source: %v", err)
+			}
+			assertSharedEffectiveFields(t, cfg, sharedEffectiveFieldOptions{
+				wantOutputSchemaOverride:       tc.name != "env",
+				wantTranscriptDescriptionPatch: tc.name != "env",
+			})
+		})
+	}
+}
+
+func TestCLIAPIKeyOverrideIsDirectValue(t *testing.T) {
+	cfg := Default()
+	apiKey := "NOT_AN_ENV_VAR_NAME"
+	validationAPIKey := "also direct"
+
+	if err := cfg.ApplyCLIOverrides(CLIOverrides{PrimaryLLMAPIKey: &apiKey, ValidationLLMAPIKey: &validationAPIKey}); err != nil {
+		t.Fatalf("ApplyCLIOverrides failed: %v", err)
+	}
+	if cfg.PrimaryLLM.APIKey != apiKey {
+		t.Fatalf("expected direct primary api key, got %q", cfg.PrimaryLLM.APIKey)
+	}
+	if cfg.ValidationLLM.APIKey != validationAPIKey {
+		t.Fatalf("expected direct validation api key, got %q", cfg.ValidationLLM.APIKey)
+	}
+}
+
+func TestApplyFileConfigTotalConcurrencyDoesNotChangeProposalWhenProposalUnset(t *testing.T) {
+	fileCfg := mustParseFileConfigYAML(t, `
+version: 1
+concurrency:
+  total_llm: 4
+`)
+	cfg := Default()
+
+	if err := cfg.applyFileConfigWithLookup(fileCfg, mapLookup(map[string]string{})); err != nil {
+		t.Fatalf("applyFileConfigWithLookup failed: %v", err)
+	}
+
+	if cfg.TotalLLMConcurrency != 4 {
+		t.Fatalf("expected file total concurrency 4, got %d", cfg.TotalLLMConcurrency)
+	}
+	if cfg.ProposalLLMConcurrency != DefaultLLMConcurrency {
+		t.Fatalf("expected file config to preserve proposal concurrency when unset, got %d", cfg.ProposalLLMConcurrency)
+	}
+}
+
 func TestValidationRejectsOverlyLongTranscriptDescription(t *testing.T) {
 	cfg := Default()
 	cfg.TranscriptDescription = strings.Repeat("a", DefaultTranscriptDescriptionMaxChars+1)
@@ -318,6 +501,38 @@ func TestValidationFailures(t *testing.T) {
 	}
 }
 
+func TestValidationRejectsUnsupportedModuleKey(t *testing.T) {
+	cfg := Default()
+	cfg.Modules = []string{modulecatalog.KeyGlossary, "made_up"}
+
+	err := cfg.Validate()
+	if err == nil {
+		t.Fatalf("expected validation error for unsupported module key")
+	}
+	if !strings.Contains(err.Error(), `unsupported module key "made_up"`) {
+		t.Fatalf("expected unsupported module key error, got %q", err.Error())
+	}
+}
+
+func TestValidationAllowsRepeatedSupportedModuleKeys(t *testing.T) {
+	cfg := Default()
+	cfg.Modules = []string{modulecatalog.KeyGlossary, modulecatalog.KeyGlossary, modulecatalog.KeyGrammar}
+
+	if err := cfg.Validate(); err != nil {
+		t.Fatalf("expected repeated supported module keys to validate, got %v", err)
+	}
+}
+
+func TestValidationAcceptsAllSupportedOutputSchemas(t *testing.T) {
+	for _, schemaKey := range outputschema.SupportedKeys() {
+		cfg := Default()
+		cfg.OutputSchema = schemaKey
+		if err := cfg.Validate(); err != nil {
+			t.Fatalf("expected output schema %q to validate, got %v", schemaKey, err)
+		}
+	}
+}
+
 func TestEffectiveValidationLLMInheritance(t *testing.T) {
 	cfg := Default()
 	cfg.PrimaryLLM.APIKey = "primary-key"
@@ -421,3 +636,70 @@ func mapLookup(values map[string]string) func(string) (string, bool) {
 		return value, ok
 	}
 }
+
+func mustParseFileConfigYAML(t *testing.T, raw string) FileConfig {
+	t.Helper()
+	fileCfg, err := ParseFileConfigYAML([]byte(raw))
+	if err != nil {
+		t.Fatalf("ParseFileConfigYAML failed: %v", err)
+	}
+	return fileCfg
+}
+
+type sharedEffectiveFieldOptions struct {
+	wantOutputSchemaOverride       bool
+	wantTranscriptDescriptionPatch bool
+}
+
+func assertSharedEffectiveFields(t *testing.T, cfg Config, opts sharedEffectiveFieldOptions) {
+	t.Helper()
+	wantOutputSchema := DefaultOutputSchema
+	if opts.wantOutputSchemaOverride {
+		wantOutputSchema = "audita-v1"
+	}
+	if cfg.OutputSchema != wantOutputSchema {
+		t.Fatalf("unexpected output schema: %q", cfg.OutputSchema)
+	}
+	if cfg.PrimaryLLM.Model != "provider/proposal" ||
+		cfg.PrimaryLLM.BaseURL != "https://proposal.example.test/v1" ||
+		cfg.PrimaryLLM.TimeoutSeconds != 101 ||
+		cfg.PrimaryLLM.MaxRetries != 5 {
+		t.Fatalf("unexpected primary llm config: %+v", cfg.PrimaryLLM)
+	}
+	if cfg.ValidationLLM.Model != "provider/validation" ||
+		cfg.ValidationLLM.BaseURL != "https://validation.example.test/v1" ||
+		cfg.ValidationLLM.TimeoutSeconds == nil ||
+		*cfg.ValidationLLM.TimeoutSeconds != 202 ||
+		cfg.ValidationLLM.MaxRetries == nil ||
+		*cfg.ValidationLLM.MaxRetries != 6 {
+		t.Fatalf("unexpected validation llm config: %+v", cfg.ValidationLLM)
+	}
+	if cfg.TargetSections == nil || *cfg.TargetSections != 7 ||
+		cfg.MaxSectionTokens != 9000 ||
+		cfg.MinSectionTokens != 1000 {
+		t.Fatalf("unexpected chunking config: target=%v max=%d min=%d", cfg.TargetSections, cfg.MaxSectionTokens, cfg.MinSectionTokens)
+	}
+	if cfg.Thresholds.Glossary != 0.91 ||
+		cfg.Thresholds.Grammar != 0.92 ||
+		cfg.Thresholds.Homophones != 0.93 ||
+		cfg.Thresholds.SpokenWord != 0.94 {
+		t.Fatalf("unexpected thresholds: %+v", cfg.Thresholds)
+	}
+	if cfg.Normalization.MaxSegmentGap != 1.2 ||
+		cfg.Normalization.EllipsisGap != 2.3 ||
+		cfg.Normalization.MaxSegmentDuration != 45.6 ||
+		cfg.Normalization.MaxSegmentTokens != 321 {
+		t.Fatalf("unexpected normalization: %+v", cfg.Normalization)
+	}
+	wantDescription := ""
+	if opts.wantTranscriptDescriptionPatch {
+		wantDescription = "shared context"
+	}
+	if cfg.TranscriptDescription != wantDescription {
+		t.Fatalf("unexpected transcript description: %q", cfg.TranscriptDescription)
+	}
+	if cfg.WorkDir != "/tmp/audita-shared" ||
+		cfg.WorkDirRetention != WorkDirRetentionAlways {
+		t.Fatalf("unexpected diagnostics config: work_dir=%q retention=%q", cfg.WorkDir, cfg.WorkDirRetention)
+	}
+}

internal/core/config/effective_config.go

@@ -0,0 +1,119 @@
+package config
+
+import (
+	"fmt"
+	"os"
+	"strings"
+)
+
+type EffectiveConfigErrorKind string
+
+const (
+	EffectiveConfigErrorResolvePath EffectiveConfigErrorKind = "resolve_path"
+	EffectiveConfigErrorLoadFile    EffectiveConfigErrorKind = "load_file"
+	EffectiveConfigErrorApplyFile   EffectiveConfigErrorKind = "apply_file"
+	EffectiveConfigErrorApplyEnv    EffectiveConfigErrorKind = "apply_env"
+)
+
+type EffectiveConfigError struct {
+	Kind EffectiveConfigErrorKind
+	Err  error
+}
+
+func (e *EffectiveConfigError) Error() string {
+	if e == nil || e.Err == nil {
+		return ""
+	}
+	return e.Err.Error()
+}
+
+func (e *EffectiveConfigError) Unwrap() error {
+	if e == nil {
+		return nil
+	}
+	return e.Err
+}
+
+type EffectiveConfig struct {
+	Config        Config
+	ConfigPath    string
+	ConfigSource  string
+	ConfigVersion *int
+}
+
+func ResolveConfigPath(cliConfigPath string, cliConfigPathSet bool) (path string, source string, err error) {
+	return resolveConfigPathWithLookup(cliConfigPath, cliConfigPathSet, os.LookupEnv, os.Stat, DefaultConfigSearchPaths)
+}
+
+func LoadEffectiveConfig(cliConfigPath string, cliConfigPathSet bool) (EffectiveConfig, error) {
+	return loadEffectiveConfigWithLookup(cliConfigPath, cliConfigPathSet, os.LookupEnv, os.Stat, DefaultConfigSearchPaths)
+}
+
+func loadEffectiveConfigWithLookup(cliConfigPath string, cliConfigPathSet bool, lookup func(string) (string, bool), statPath func(string) (os.FileInfo, error), defaultSearchPaths []string) (EffectiveConfig, error) {
+	configPath, configSource, err := resolveConfigPathWithLookup(cliConfigPath, cliConfigPathSet, lookup, statPath, defaultSearchPaths)
+	if err != nil {
+		return EffectiveConfig{}, &EffectiveConfigError{Kind: EffectiveConfigErrorResolvePath, Err: err}
+	}
+
+	cfg := Default()
+	var configVersion *int
+	if configPath != "" {
+		fileCfg, fileErr := LoadFileConfig(configPath)
+		if fileErr != nil {
+			return EffectiveConfig{}, &EffectiveConfigError{Kind: EffectiveConfigErrorLoadFile, Err: fileErr}
+		}
+		if applyErr := cfg.ApplyFileConfig(fileCfg); applyErr != nil {
+			return EffectiveConfig{}, &EffectiveConfigError{Kind: EffectiveConfigErrorApplyFile, Err: applyErr}
+		}
+		configVersion = &fileCfg.Version
+	}
+	if applyEnvErr := cfg.applyEnvOverrides(lookup); applyEnvErr != nil {
+		return EffectiveConfig{}, &EffectiveConfigError{Kind: EffectiveConfigErrorApplyEnv, Err: applyEnvErr}
+	}
+
+	return EffectiveConfig{
+		Config:        cfg,
+		ConfigPath:    configPath,
+		ConfigSource:  configSource,
+		ConfigVersion: configVersion,
+	}, nil
+}
+
+func resolveConfigPathWithLookup(cliConfigPath string, cliConfigPathSet bool, lookup func(string) (string, bool), statPath func(string) (os.FileInfo, error), defaultSearchPaths []string) (path string, source string, err error) {
+	if cliConfigPathSet {
+		path = strings.TrimSpace(cliConfigPath)
+		if path == "" {
+			return "", "", fmt.Errorf("--config requires a non-empty path")
+		}
+		if _, statErr := statPath(path); statErr != nil {
+			if os.IsNotExist(statErr) {
+				return "", "", fmt.Errorf("config file not found: %s", path)
+			}
+			return "", "", fmt.Errorf("cannot access config file %s: %w", path, statErr)
+		}
+		return path, "flag", nil
+	}
+
+	if raw, ok := lookup("AUDITA_CONFIG"); ok {
+		path = strings.TrimSpace(raw)
+		if path == "" {
+			return "", "", fmt.Errorf("AUDITA_CONFIG must not be empty")
+		}
+		if _, statErr := statPath(path); statErr != nil {
+			if os.IsNotExist(statErr) {
+				return "", "", fmt.Errorf("config file not found: %s", path)
+			}
+			return "", "", fmt.Errorf("cannot access config file %s: %w", path, statErr)
+		}
+		return path, "env", nil
+	}
+
+	for _, defaultPath := range defaultSearchPaths {
+		if _, statErr := statPath(defaultPath); statErr == nil {
+			return defaultPath, "default", nil
+		} else if !os.IsNotExist(statErr) {
+			return "", "", fmt.Errorf("cannot access config file %s: %w", defaultPath, statErr)
+		}
+	}
+	return "", "", nil
+}

internal/core/config/effective_config_test.go

@@ -0,0 +1,163 @@
+package config
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestResolveConfigPathWithLookupMatrix(t *testing.T) {
+	statFor := func(existing map[string]bool) func(string) (os.FileInfo, error) {
+		return func(path string) (os.FileInfo, error) {
+			if existing[path] {
+				return nil, nil
+			}
+			return nil, os.ErrNotExist
+		}
+	}
+
+	tests := []struct {
+		name               string
+		cliPath            string
+		cliPathSet         bool
+		lookup             func(string) (string, bool)
+		stat               func(string) (os.FileInfo, error)
+		defaultSearchPaths []string
+		wantPath           string
+		wantSource         string
+		wantErrContains    string
+	}{
+		{
+			name:       "explicit config path",
+			cliPath:    "/tmp/explicit.yml",
+			cliPathSet: true,
+			lookup:     func(string) (string, bool) { return "", false },
+			stat:       statFor(map[string]bool{"/tmp/explicit.yml": true}),
+			defaultSearchPaths: []string{
+				"/usr/local/etc/audita/config.yml",
+				"/etc/audita/config.yml",
+			},
+			wantPath:   "/tmp/explicit.yml",
+			wantSource: "flag",
+		},
+		{
+			name:       "env config path",
+			cliPathSet: false,
+			lookup: func(key string) (string, bool) {
+				if key == "AUDITA_CONFIG" {
+					return "/tmp/from-env.yml", true
+				}
+				return "", false
+			},
+			stat:               statFor(map[string]bool{"/tmp/from-env.yml": true}),
+			defaultSearchPaths: []string{"/usr/local/etc/audita/config.yml", "/etc/audita/config.yml"},
+			wantPath:           "/tmp/from-env.yml",
+			wantSource:         "env",
+		},
+		{
+			name:       "default search path",
+			cliPathSet: false,
+			lookup:     func(string) (string, bool) { return "", false },
+			stat: statFor(map[string]bool{
+				"/usr/local/etc/audita/config.yml": true,
+				"/etc/audita/config.yml":           true,
+			}),
+			defaultSearchPaths: []string{"/usr/local/etc/audita/config.yml", "/etc/audita/config.yml"},
+			wantPath:           "/usr/local/etc/audita/config.yml",
+			wantSource:         "default",
+		},
+		{
+			name:       "explicit missing path",
+			cliPath:    "/tmp/missing.yml",
+			cliPathSet: true,
+			lookup:     func(string) (string, bool) { return "", false },
+			stat:       statFor(map[string]bool{}),
+			defaultSearchPaths: []string{
+				"/usr/local/etc/audita/config.yml",
+				"/etc/audita/config.yml",
+			},
+			wantErrContains: "config file not found",
+		},
+		{
+			name:       "missing env path",
+			cliPathSet: false,
+			lookup: func(key string) (string, bool) {
+				if key == "AUDITA_CONFIG" {
+					return "/tmp/missing-from-env.yml", true
+				}
+				return "", false
+			},
+			stat:               statFor(map[string]bool{}),
+			defaultSearchPaths: []string{"/usr/local/etc/audita/config.yml", "/etc/audita/config.yml"},
+			wantErrContains:    "config file not found",
+		},
+		{
+			name:       "missing default paths",
+			cliPathSet: false,
+			lookup:     func(string) (string, bool) { return "", false },
+			stat:       statFor(map[string]bool{}),
+			defaultSearchPaths: []string{
+				"/usr/local/etc/audita/config.yml",
+				"/etc/audita/config.yml",
+			},
+			wantPath:   "",
+			wantSource: "",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			gotPath, gotSource, err := resolveConfigPathWithLookup(tc.cliPath, tc.cliPathSet, tc.lookup, tc.stat, tc.defaultSearchPaths)
+			if tc.wantErrContains != "" {
+				if err == nil || !strings.Contains(err.Error(), tc.wantErrContains) {
+					t.Fatalf("expected error containing %q, got %v", tc.wantErrContains, err)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if gotPath != tc.wantPath || gotSource != tc.wantSource {
+				t.Fatalf("unexpected result: got path=%q source=%q, want path=%q source=%q", gotPath, gotSource, tc.wantPath, tc.wantSource)
+			}
+		})
+	}
+}
+
+func TestLoadEffectiveConfigWithLookupAppliesDefaultsFileThenEnv(t *testing.T) {
+	tempDir := t.TempDir()
+	configPath := filepath.Join(tempDir, "config.yml")
+	configYAML := "version: 1\nllm:\n  proposal:\n    model: file-model\n"
+	if err := os.WriteFile(configPath, []byte(configYAML), 0o644); err != nil {
+		t.Fatalf("write config file: %v", err)
+	}
+
+	lookup := func(key string) (string, bool) {
+		switch key {
+		case "AUDITA_CONFIG":
+			return configPath, true
+		case "AUDITA_MODEL":
+			return "env-model", true
+		default:
+			return "", false
+		}
+	}
+
+	result, err := loadEffectiveConfigWithLookup("", false, lookup, os.Stat, DefaultConfigSearchPaths)
+	if err != nil {
+		t.Fatalf("loadEffectiveConfigWithLookup error: %v", err)
+	}
+	if result.ConfigPath != configPath {
+		t.Fatalf("unexpected config path: %q", result.ConfigPath)
+	}
+	if result.ConfigSource != "env" {
+		t.Fatalf("unexpected config source: %q", result.ConfigSource)
+	}
+	if result.ConfigVersion == nil || *result.ConfigVersion != SupportedFileConfigVersion {
+		t.Fatalf("unexpected config version: %#v", result.ConfigVersion)
+	}
+	if result.Config.PrimaryLLM.Model != "env-model" {
+		t.Fatalf("expected env override to win over file value, got %q", result.Config.PrimaryLLM.Model)
+	}
+}

internal/core/config/env.go

@@ -50,100 +50,93 @@ func (c *Config) applyEnvOverrides(lookup func(string) (string, bool)) error {
 		cfg.Modules = modules
 	}
 
+	primaryLLM := llmTargetPatch{}
 	if raw, ok := lookup("AUDITA_LLM_API_KEY"); ok {
-		cfg.PrimaryLLM.APIKey = raw
+		primaryLLM.apiKey = &raw
 	} else if raw, ok := lookup("OPENROUTER_API_KEY"); ok {
-		cfg.PrimaryLLM.APIKey = raw
+		primaryLLM.apiKey = &raw
 	}
-
-	if raw, ok := lookup("AUDITA_VALIDATION_LLM_API_KEY"); ok {
-		cfg.ValidationLLM.APIKey = raw
-	}
-
 	if raw, ok := lookup("AUDITA_MODEL"); ok {
-		cfg.PrimaryLLM.Model = raw
+		primaryLLM.model = &raw
 	}
-	if raw, ok := lookup("AUDITA_VALIDATION_MODEL"); ok {
-		cfg.ValidationLLM.Model = raw
-	}
-
 	if raw, ok := lookup("AUDITA_BASE_URL"); ok {
-		cfg.PrimaryLLM.BaseURL = raw
+		primaryLLM.baseURL = &raw
 	}
-	if raw, ok := lookup("AUDITA_VALIDATION_BASE_URL"); ok {
-		cfg.ValidationLLM.BaseURL = raw
-	}
-
 	if raw, ok := lookup("AUDITA_LLM_TIMEOUT_SECONDS"); ok {
 		value, err := parseInt(raw)
 		if err != nil {
 			return fmt.Errorf("AUDITA_LLM_TIMEOUT_SECONDS: %w", err)
 		}
-		cfg.PrimaryLLM.TimeoutSeconds = value
+		primaryLLM.timeoutSeconds = &value
 	}
-
-	if raw, ok := lookup("AUDITA_VALIDATION_LLM_TIMEOUT_SECONDS"); ok {
-		value, err := parseInt(raw)
-		if err != nil {
-			return fmt.Errorf("AUDITA_VALIDATION_LLM_TIMEOUT_SECONDS: %w", err)
-		}
-		cfg.ValidationLLM.TimeoutSeconds = &value
-	}
-
 	if raw, ok := lookup("AUDITA_MAX_RETRIES"); ok {
 		value, err := parseInt(raw)
 		if err != nil {
 			return fmt.Errorf("AUDITA_MAX_RETRIES: %w", err)
 		}
-		cfg.PrimaryLLM.MaxRetries = value
+		primaryLLM.maxRetries = &value
+	}
+	cfg.applyPrimaryLLMTargetPatch(primaryLLM)
+
+	validationLLM := llmTargetPatch{}
+	if raw, ok := lookup("AUDITA_VALIDATION_LLM_API_KEY"); ok {
+		validationLLM.apiKey = &raw
+	}
+	if raw, ok := lookup("AUDITA_VALIDATION_MODEL"); ok {
+		validationLLM.model = &raw
+	}
+	if raw, ok := lookup("AUDITA_VALIDATION_BASE_URL"); ok {
+		validationLLM.baseURL = &raw
+	}
+	if raw, ok := lookup("AUDITA_VALIDATION_LLM_TIMEOUT_SECONDS"); ok {
+		value, err := parseInt(raw)
+		if err != nil {
+			return fmt.Errorf("AUDITA_VALIDATION_LLM_TIMEOUT_SECONDS: %w", err)
+		}
+		validationLLM.timeoutSeconds = &value
+	}
+	if raw, ok := lookup("AUDITA_VALIDATION_MAX_RETRIES"); ok {
+		value, err := parseInt(raw)
+		if err != nil {
+			return fmt.Errorf("AUDITA_VALIDATION_MAX_RETRIES: %w", err)
+		}
+		validationLLM.maxRetries = &value
+	}
+	cfg.applyValidationLLMTargetPatch(validationLLM)
+
+	concurrency := concurrencyPatch{
+		inheritProposal:  true,
+		allowLegacyAlias: true,
 	}
-	totalConcurrencySet := false
 	if raw, ok := lookup("AUDITA_TOTAL_LLM_CONCURRENCY"); ok {
 		value, err := parseInt(raw)
 		if err != nil {
 			return fmt.Errorf("AUDITA_TOTAL_LLM_CONCURRENCY: %w", err)
 		}
-		cfg.TotalLLMConcurrency = value
-		totalConcurrencySet = true
+		concurrency.totalLLM = &value
 	}
 	if raw, ok := lookup("AUDITA_LLM_CONCURRENCY"); ok {
 		value, err := parseInt(raw)
 		if err != nil {
 			return fmt.Errorf("AUDITA_LLM_CONCURRENCY: %w", err)
 		}
-		if !totalConcurrencySet {
-			cfg.TotalLLMConcurrency = value
-			totalConcurrencySet = true
+		concurrency.legacyTotalLLM = &value
 	}
-	}
-
-	proposalConcurrencySet := false
 	if raw, ok := lookup("AUDITA_PROPOSAL_LLM_CONCURRENCY"); ok {
 		value, err := parseInt(raw)
 		if err != nil {
 			return fmt.Errorf("AUDITA_PROPOSAL_LLM_CONCURRENCY: %w", err)
 		}
-		cfg.ProposalLLMConcurrency = value
-		proposalConcurrencySet = true
-	}
-	if totalConcurrencySet && !proposalConcurrencySet {
-		cfg.ProposalLLMConcurrency = cfg.TotalLLMConcurrency
-	}
-
-	if raw, ok := lookup("AUDITA_VALIDATION_MAX_RETRIES"); ok {
-		value, err := parseInt(raw)
-		if err != nil {
-			return fmt.Errorf("AUDITA_VALIDATION_MAX_RETRIES: %w", err)
-		}
-		cfg.ValidationLLM.MaxRetries = &value
+		concurrency.proposalLLM = &value
 	}
 	if raw, ok := lookup("AUDITA_VALIDATION_LLM_CONCURRENCY"); ok {
 		value, err := parseInt(raw)
 		if err != nil {
 			return fmt.Errorf("AUDITA_VALIDATION_LLM_CONCURRENCY: %w", err)
 		}
-		cfg.ValidationLLMConcurrency = &value
+		concurrency.validationLLM = &value
 	}
+	cfg.applyConcurrencyPatch(concurrency)
 
 	if raw, ok := lookup("AUDITA_VALIDATION_MAX_PROMPT_TOKENS"); ok {
 		value, err := parseInt(raw)
@@ -153,12 +146,13 @@ func (c *Config) applyEnvOverrides(lookup func(string) (string, bool)) error {
 		cfg.ValidationMaxPromptTokens = value
 	}
 
+	chunking := chunkingPatch{}
 	if raw, ok := lookup("AUDITA_MAX_SECTION_TOKENS"); ok {
 		value, err := parseInt(raw)
 		if err != nil {
 			return fmt.Errorf("AUDITA_MAX_SECTION_TOKENS: %w", err)
 		}
-		cfg.MaxSectionTokens = value
+		chunking.maxSectionTokens = &value
 	}
 
 	if raw, ok := lookup("AUDITA_MIN_SECTION_TOKENS"); ok {
@@ -166,7 +160,7 @@ func (c *Config) applyEnvOverrides(lookup func(string) (string, bool)) error {
 		if err != nil {
 			return fmt.Errorf("AUDITA_MIN_SECTION_TOKENS: %w", err)
 		}
-		cfg.MinSectionTokens = value
+		chunking.minSectionTokens = &value
 	}
 
 	if raw, ok := lookup("AUDITA_TARGET_SECTIONS"); ok {
@@ -174,73 +168,80 @@ func (c *Config) applyEnvOverrides(lookup func(string) (string, bool)) error {
 		if err != nil {
 			return fmt.Errorf("AUDITA_TARGET_SECTIONS: %w", err)
 		}
-		cfg.TargetSections = &value
+		chunking.targetSections = &value
 	}
+	cfg.applyChunkingPatch(chunking)
 
+	thresholds := thresholdsPatch{}
 	if raw, ok := lookup("AUDITA_GLOSSARY_CONFIDENCE_THRESHOLD"); ok {
 		value, err := parseFloat(raw)
 		if err != nil {
 			return fmt.Errorf("AUDITA_GLOSSARY_CONFIDENCE_THRESHOLD: %w", err)
 		}
-		cfg.Thresholds.Glossary = value
+		thresholds.glossary = &value
 	}
 	if raw, ok := lookup("AUDITA_GRAMMAR_CONFIDENCE_THRESHOLD"); ok {
 		value, err := parseFloat(raw)
 		if err != nil {
 			return fmt.Errorf("AUDITA_GRAMMAR_CONFIDENCE_THRESHOLD: %w", err)
 		}
-		cfg.Thresholds.Grammar = value
+		thresholds.grammar = &value
 	}
 	if raw, ok := lookup("AUDITA_HOMOPHONES_CONFIDENCE_THRESHOLD"); ok {
 		value, err := parseFloat(raw)
 		if err != nil {
 			return fmt.Errorf("AUDITA_HOMOPHONES_CONFIDENCE_THRESHOLD: %w", err)
 		}
-		cfg.Thresholds.Homophones = value
+		thresholds.homophones = &value
 	}
 	if raw, ok := lookup("AUDITA_SPOKEN_WORD_CONFIDENCE_THRESHOLD"); ok {
 		value, err := parseFloat(raw)
 		if err != nil {
 			return fmt.Errorf("AUDITA_SPOKEN_WORD_CONFIDENCE_THRESHOLD: %w", err)
 		}
-		cfg.Thresholds.SpokenWord = value
+		thresholds.spokenWord = &value
 	}
+	cfg.applyThresholdsPatch(thresholds)
 
+	normalization := normalizationPatch{}
 	if raw, ok := lookup("AUDITA_NORMALIZE_MAX_SEGMENT_GAP"); ok {
 		value, err := parseFloat(raw)
 		if err != nil {
 			return fmt.Errorf("AUDITA_NORMALIZE_MAX_SEGMENT_GAP: %w", err)
 		}
-		cfg.Normalization.MaxSegmentGap = value
+		normalization.maxSegmentGap = &value
 	}
 	if raw, ok := lookup("AUDITA_NORMALIZE_ELLIPSIS_GAP"); ok {
 		value, err := parseFloat(raw)
 		if err != nil {
 			return fmt.Errorf("AUDITA_NORMALIZE_ELLIPSIS_GAP: %w", err)
 		}
-		cfg.Normalization.EllipsisGap = value
+		normalization.ellipsisGap = &value
 	}
 	if raw, ok := lookup("AUDITA_NORMALIZE_MAX_SEGMENT_DURATION"); ok {
 		value, err := parseFloat(raw)
 		if err != nil {
 			return fmt.Errorf("AUDITA_NORMALIZE_MAX_SEGMENT_DURATION: %w", err)
 		}
-		cfg.Normalization.MaxSegmentDuration = value
+		normalization.maxSegmentDuration = &value
 	}
 	if raw, ok := lookup("AUDITA_NORMALIZE_MAX_SEGMENT_TOKENS"); ok {
 		value, err := parseInt(raw)
 		if err != nil {
 			return fmt.Errorf("AUDITA_NORMALIZE_MAX_SEGMENT_TOKENS: %w", err)
 		}
-		cfg.Normalization.MaxSegmentTokens = value
+		normalization.maxSegmentTokens = &value
 	}
+	cfg.applyNormalizationPatch(normalization)
 
+	diagnostics := diagnosticsPatch{}
 	if raw, ok := lookup("AUDITA_WORK_DIR"); ok {
-		cfg.WorkDir = raw
+		diagnostics.workDir = &raw
 	}
 	if raw, ok := lookup("AUDITA_WORK_DIR_RETENTION"); ok {
-		cfg.WorkDirRetention = WorkDirRetention(raw)
+		diagnostics.workDirRetention = &raw
 	}
+	cfg.applyDiagnosticsPatch(diagnostics)
 
 	cfg.syncLegacyConcurrencyAliases()
 

internal/core/config/file_config.go

@@ -205,118 +205,98 @@ func (c *Config) applyFileConfigWithLookup(fileCfg FileConfig, lookup func(strin
 
 	if fileCfg.LLM != nil {
 		if fileCfg.LLM.Proposal != nil {
-			if fileCfg.LLM.Proposal.BaseURL != nil {
-				c.PrimaryLLM.BaseURL = *fileCfg.LLM.Proposal.BaseURL
-			}
-			if fileCfg.LLM.Proposal.Model != nil {
-				c.PrimaryLLM.Model = *fileCfg.LLM.Proposal.Model
+			patch := llmTargetPatch{
+				model:      fileCfg.LLM.Proposal.Model,
+				baseURL:    fileCfg.LLM.Proposal.BaseURL,
+				maxRetries: fileCfg.LLM.Proposal.MaxRetries,
 			}
 			if fileCfg.LLM.Proposal.Timeout != nil {
-				c.PrimaryLLM.TimeoutSeconds = fileCfg.LLM.Proposal.Timeout.Seconds()
-			}
-			if fileCfg.LLM.Proposal.MaxRetries != nil {
-				c.PrimaryLLM.MaxRetries = *fileCfg.LLM.Proposal.MaxRetries
+				timeoutSeconds := fileCfg.LLM.Proposal.Timeout.Seconds()
+				patch.timeoutSeconds = &timeoutSeconds
 			}
 			if fileCfg.LLM.Proposal.APIKeyEnv != nil {
 				apiKey, err := resolveAPIKeyEnv(*fileCfg.LLM.Proposal.APIKeyEnv, lookup)
 				if err != nil {
 					return fmt.Errorf("llm.proposal.api_key_env: %w", err)
 				}
-				c.PrimaryLLM.APIKey = apiKey
+				patch.apiKey = &apiKey
 			}
+			c.applyPrimaryLLMTargetPatch(patch)
 		}
 		if fileCfg.LLM.Validation != nil {
-			if fileCfg.LLM.Validation.BaseURL != nil {
-				c.ValidationLLM.BaseURL = *fileCfg.LLM.Validation.BaseURL
-			}
-			if fileCfg.LLM.Validation.Model != nil {
-				c.ValidationLLM.Model = *fileCfg.LLM.Validation.Model
+			patch := llmTargetPatch{
+				model:      fileCfg.LLM.Validation.Model,
+				baseURL:    fileCfg.LLM.Validation.BaseURL,
+				maxRetries: fileCfg.LLM.Validation.MaxRetries,
 			}
 			if fileCfg.LLM.Validation.Timeout != nil {
-				v := fileCfg.LLM.Validation.Timeout.Seconds()
-				c.ValidationLLM.TimeoutSeconds = &v
-			}
-			if fileCfg.LLM.Validation.MaxRetries != nil {
-				v := *fileCfg.LLM.Validation.MaxRetries
-				c.ValidationLLM.MaxRetries = &v
+				timeoutSeconds := fileCfg.LLM.Validation.Timeout.Seconds()
+				patch.timeoutSeconds = &timeoutSeconds
 			}
 			if fileCfg.LLM.Validation.APIKeyEnv != nil {
 				apiKey, err := resolveAPIKeyEnv(*fileCfg.LLM.Validation.APIKeyEnv, lookup)
 				if err != nil {
 					return fmt.Errorf("llm.validation.api_key_env: %w", err)
 				}
-				c.ValidationLLM.APIKey = apiKey
+				patch.apiKey = &apiKey
 			}
+			c.applyValidationLLMTargetPatch(patch)
 		}
 	}
 
 	if fileCfg.Concurrency != nil {
-		if fileCfg.Concurrency.TotalLLM != nil {
-			c.TotalLLMConcurrency = *fileCfg.Concurrency.TotalLLM
-		}
-		if fileCfg.Concurrency.ProposalLLM != nil {
-			c.ProposalLLMConcurrency = *fileCfg.Concurrency.ProposalLLM
-		}
-		if fileCfg.Concurrency.ValidationLLM != nil {
-			v := *fileCfg.Concurrency.ValidationLLM
-			c.ValidationLLMConcurrency = &v
-		}
+		c.applyConcurrencyPatch(concurrencyPatch{
+			totalLLM:      fileCfg.Concurrency.TotalLLM,
+			proposalLLM:   fileCfg.Concurrency.ProposalLLM,
+			validationLLM: fileCfg.Concurrency.ValidationLLM,
+		})
 	}
 
 	if fileCfg.Chunking != nil {
-		if fileCfg.Chunking.TargetSections != nil {
-			v := *fileCfg.Chunking.TargetSections
-			c.TargetSections = &v
-		}
-		if fileCfg.Chunking.MaxSectionTokens != nil {
-			c.MaxSectionTokens = *fileCfg.Chunking.MaxSectionTokens
-		}
-		if fileCfg.Chunking.MinSectionTokens != nil {
-			c.MinSectionTokens = *fileCfg.Chunking.MinSectionTokens
-		}
+		c.applyChunkingPatch(chunkingPatch{
+			targetSections:   fileCfg.Chunking.TargetSections,
+			maxSectionTokens: fileCfg.Chunking.MaxSectionTokens,
+			minSectionTokens: fileCfg.Chunking.MinSectionTokens,
+		})
 	}
 
 	if fileCfg.Normalization != nil {
+		patch := normalizationPatch{
+			maxSegmentTokens: fileCfg.Normalization.MaxSegmentTokens,
+		}
 		if fileCfg.Normalization.MaxSegmentGap != nil {
-			c.Normalization.MaxSegmentGap = fileCfg.Normalization.MaxSegmentGap.Seconds()
+			maxSegmentGap := fileCfg.Normalization.MaxSegmentGap.Seconds()
+			patch.maxSegmentGap = &maxSegmentGap
 		}
 		if fileCfg.Normalization.EllipsisGap != nil {
-			c.Normalization.EllipsisGap = fileCfg.Normalization.EllipsisGap.Seconds()
+			ellipsisGap := fileCfg.Normalization.EllipsisGap.Seconds()
+			patch.ellipsisGap = &ellipsisGap
 		}
 		if fileCfg.Normalization.MaxSegmentDuration != nil {
-			c.Normalization.MaxSegmentDuration = fileCfg.Normalization.MaxSegmentDuration.Seconds()
-		}
-		if fileCfg.Normalization.MaxSegmentTokens != nil {
-			c.Normalization.MaxSegmentTokens = *fileCfg.Normalization.MaxSegmentTokens
+			maxSegmentDuration := fileCfg.Normalization.MaxSegmentDuration.Seconds()
+			patch.maxSegmentDuration = &maxSegmentDuration
 		}
+		c.applyNormalizationPatch(patch)
 	}
 
 	if fileCfg.Thresholds != nil {
-		if fileCfg.Thresholds.Glossary != nil {
-			c.Thresholds.Glossary = *fileCfg.Thresholds.Glossary
-		}
-		if fileCfg.Thresholds.Homophones != nil {
-			c.Thresholds.Homophones = *fileCfg.Thresholds.Homophones
-		}
-		if fileCfg.Thresholds.SpokenWord != nil {
-			c.Thresholds.SpokenWord = *fileCfg.Thresholds.SpokenWord
-		}
-		if fileCfg.Thresholds.Grammar != nil {
-			c.Thresholds.Grammar = *fileCfg.Thresholds.Grammar
-		}
+		c.applyThresholdsPatch(thresholdsPatch{
+			glossary:   fileCfg.Thresholds.Glossary,
+			grammar:    fileCfg.Thresholds.Grammar,
+			homophones: fileCfg.Thresholds.Homophones,
+			spokenWord: fileCfg.Thresholds.SpokenWord,
+		})
 	}
 
 	if fileCfg.Context != nil && fileCfg.Context.Description != nil {
-		c.TranscriptDescription = strings.TrimSpace(*fileCfg.Context.Description)
+		c.applyContextPatch(contextPatch{transcriptDescription: fileCfg.Context.Description})
 	}
 
 	if fileCfg.Diagnostics != nil {
-		if fileCfg.Diagnostics.WorkDir != nil {
-			c.WorkDir = *fileCfg.Diagnostics.WorkDir
-		}
-		if fileCfg.Diagnostics.Retention != nil {
-			c.WorkDirRetention = WorkDirRetention(*fileCfg.Diagnostics.Retention)
-		}
+		c.applyDiagnosticsPatch(diagnosticsPatch{
+			workDir:          fileCfg.Diagnostics.WorkDir,
+			workDirRetention: fileCfg.Diagnostics.Retention,
+		})
 	}
 
 	c.syncLegacyConcurrencyAliases()

internal/core/config/flags.go

@@ -51,107 +51,54 @@ func (c *Config) ApplyCLIOverrides(overrides CLIOverrides) error {
 		c.OutputSchema = strings.TrimSpace(*overrides.OutputSchema)
 	}
 
-	if overrides.PrimaryLLMAPIKey != nil {
-		c.PrimaryLLM.APIKey = *overrides.PrimaryLLMAPIKey
-	}
-	if overrides.ValidationLLMAPIKey != nil {
-		c.ValidationLLM.APIKey = *overrides.ValidationLLMAPIKey
-	}
-	if overrides.PrimaryModel != nil {
-		c.PrimaryLLM.Model = *overrides.PrimaryModel
-	}
-	if overrides.ValidationModel != nil {
-		c.ValidationLLM.Model = *overrides.ValidationModel
-	}
-	if overrides.PrimaryBaseURL != nil {
-		c.PrimaryLLM.BaseURL = *overrides.PrimaryBaseURL
-	}
-	if overrides.ValidationBaseURL != nil {
-		c.ValidationLLM.BaseURL = *overrides.ValidationBaseURL
-	}
-	if overrides.PrimaryLLMTimeoutSeconds != nil {
-		c.PrimaryLLM.TimeoutSeconds = *overrides.PrimaryLLMTimeoutSeconds
-	}
-	totalConcurrencySet := false
-	if overrides.TotalLLMConcurrency != nil {
-		c.TotalLLMConcurrency = *overrides.TotalLLMConcurrency
-		totalConcurrencySet = true
-	}
-	// Backward-compatible alias: --llm-concurrency maps to total concurrency
-	// only when --total-llm-concurrency is not set in the same CLI invocation.
-	if overrides.PrimaryLLMConcurrency != nil && !totalConcurrencySet {
-		c.TotalLLMConcurrency = *overrides.PrimaryLLMConcurrency
-		totalConcurrencySet = true
-	}
-	proposalConcurrencySet := false
-	if overrides.ProposalLLMConcurrency != nil {
-		c.ProposalLLMConcurrency = *overrides.ProposalLLMConcurrency
-		proposalConcurrencySet = true
-	}
-	if totalConcurrencySet && !proposalConcurrencySet {
-		c.ProposalLLMConcurrency = c.TotalLLMConcurrency
-	}
-	if overrides.ValidationLLMTimeoutSeconds != nil {
-		value := *overrides.ValidationLLMTimeoutSeconds
-		c.ValidationLLM.TimeoutSeconds = &value
-	}
-	if overrides.MaxRetries != nil {
-		c.PrimaryLLM.MaxRetries = *overrides.MaxRetries
-	}
-	if overrides.ValidationMaxRetries != nil {
-		value := *overrides.ValidationMaxRetries
-		c.ValidationLLM.MaxRetries = &value
-	}
-	if overrides.ValidationLLMConcurrency != nil {
-		value := *overrides.ValidationLLMConcurrency
-		c.ValidationLLMConcurrency = &value
-	}
+	c.applyPrimaryLLMTargetPatch(llmTargetPatch{
+		apiKey:         overrides.PrimaryLLMAPIKey,
+		model:          overrides.PrimaryModel,
+		baseURL:        overrides.PrimaryBaseURL,
+		timeoutSeconds: overrides.PrimaryLLMTimeoutSeconds,
+		maxRetries:     overrides.MaxRetries,
+	})
+	c.applyValidationLLMTargetPatch(llmTargetPatch{
+		apiKey:         overrides.ValidationLLMAPIKey,
+		model:          overrides.ValidationModel,
+		baseURL:        overrides.ValidationBaseURL,
+		timeoutSeconds: overrides.ValidationLLMTimeoutSeconds,
+		maxRetries:     overrides.ValidationMaxRetries,
+	})
+	c.applyConcurrencyPatch(concurrencyPatch{
+		totalLLM:         overrides.TotalLLMConcurrency,
+		legacyTotalLLM:   overrides.PrimaryLLMConcurrency,
+		proposalLLM:      overrides.ProposalLLMConcurrency,
+		validationLLM:    overrides.ValidationLLMConcurrency,
+		inheritProposal:  true,
+		allowLegacyAlias: true,
+	})
+
 	if overrides.ValidationMaxPromptTokens != nil {
 		c.ValidationMaxPromptTokens = *overrides.ValidationMaxPromptTokens
 	}
-	if overrides.MaxSectionTokens != nil {
-		c.MaxSectionTokens = *overrides.MaxSectionTokens
-	}
-	if overrides.MinSectionTokens != nil {
-		c.MinSectionTokens = *overrides.MinSectionTokens
-	}
-	if overrides.TargetSections != nil {
-		value := *overrides.TargetSections
-		c.TargetSections = &value
-	}
-	if overrides.GlossaryConfidenceThreshold != nil {
-		c.Thresholds.Glossary = *overrides.GlossaryConfidenceThreshold
-	}
-	if overrides.GrammarConfidenceThreshold != nil {
-		c.Thresholds.Grammar = *overrides.GrammarConfidenceThreshold
-	}
-	if overrides.HomophonesConfidenceThreshold != nil {
-		c.Thresholds.Homophones = *overrides.HomophonesConfidenceThreshold
-	}
-	if overrides.SpokenWordConfidenceThreshold != nil {
-		c.Thresholds.SpokenWord = *overrides.SpokenWordConfidenceThreshold
-	}
-	if overrides.NormalizeMaxSegmentGap != nil {
-		c.Normalization.MaxSegmentGap = *overrides.NormalizeMaxSegmentGap
-	}
-	if overrides.NormalizeEllipsisGap != nil {
-		c.Normalization.EllipsisGap = *overrides.NormalizeEllipsisGap
-	}
-	if overrides.NormalizeMaxSegmentDuration != nil {
-		c.Normalization.MaxSegmentDuration = *overrides.NormalizeMaxSegmentDuration
-	}
-	if overrides.NormalizeMaxSegmentTokens != nil {
-		c.Normalization.MaxSegmentTokens = *overrides.NormalizeMaxSegmentTokens
-	}
-	if overrides.TranscriptDescription != nil {
-		c.TranscriptDescription = strings.TrimSpace(*overrides.TranscriptDescription)
-	}
-	if overrides.WorkDir != nil {
-		c.WorkDir = *overrides.WorkDir
-	}
-	if overrides.WorkDirRetention != nil {
-		c.WorkDirRetention = WorkDirRetention(*overrides.WorkDirRetention)
-	}
+	c.applyChunkingPatch(chunkingPatch{
+		targetSections:   overrides.TargetSections,
+		maxSectionTokens: overrides.MaxSectionTokens,
+		minSectionTokens: overrides.MinSectionTokens,
+	})
+	c.applyThresholdsPatch(thresholdsPatch{
+		glossary:   overrides.GlossaryConfidenceThreshold,
+		grammar:    overrides.GrammarConfidenceThreshold,
+		homophones: overrides.HomophonesConfidenceThreshold,
+		spokenWord: overrides.SpokenWordConfidenceThreshold,
+	})
+	c.applyNormalizationPatch(normalizationPatch{
+		maxSegmentGap:      overrides.NormalizeMaxSegmentGap,
+		ellipsisGap:        overrides.NormalizeEllipsisGap,
+		maxSegmentDuration: overrides.NormalizeMaxSegmentDuration,
+		maxSegmentTokens:   overrides.NormalizeMaxSegmentTokens,
+	})
+	c.applyContextPatch(contextPatch{transcriptDescription: overrides.TranscriptDescription})
+	c.applyDiagnosticsPatch(diagnosticsPatch{
+		workDir:          overrides.WorkDir,
+		workDirRetention: overrides.WorkDirRetention,
+	})
 
 	c.syncLegacyConcurrencyAliases()
 

internal/core/config/validation.go

@@ -3,6 +3,9 @@ package config
 import (
 	"fmt"
 	"strings"
+
+	"gitea.maximumdirect.net/eric/audita/internal/core/modulecatalog"
+	"gitea.maximumdirect.net/eric/audita/internal/core/outputschema"
 )
 
 func (c Config) Validate() error {
@@ -12,20 +15,20 @@ func (c Config) Validate() error {
 		issues = append(issues, "modules must not be empty")
 	}
 	for _, module := range c.Modules {
-		if strings.TrimSpace(module) == "" {
+		moduleKey := strings.TrimSpace(module)
+		if moduleKey == "" {
 			issues = append(issues, "modules must not contain empty values")
 			break
 		}
+		if !modulecatalog.IsSupported(moduleKey) {
+			issues = append(issues, fmt.Sprintf("unsupported module key %q", moduleKey))
+		}
 	}
 	if strings.TrimSpace(c.OutputSchema) == "" {
 		issues = append(issues, "output schema must not be empty")
-	} else {
-		switch strings.TrimSpace(c.OutputSchema) {
-		case "bare-segments", "audita-v1":
-		default:
+	} else if !outputschema.IsSupported(c.OutputSchema) {
 		issues = append(issues, fmt.Sprintf("unsupported output schema %q", c.OutputSchema))
 	}
-	}
 
 	if c.PrimaryLLM.TimeoutSeconds <= 0 {
 		issues = append(issues, "primary llm timeout seconds must be greater than zero")

internal/core/diagnostics/artifacts.go

@@ -0,0 +1,42 @@
+package diagnostics
+
+import (
+	"path/filepath"
+
+	"gitea.maximumdirect.net/eric/audita/internal/core/reporting"
+)
+
+const (
+	ArtifactSourceTranscript       = "source-transcript.json"
+	ArtifactParsedSourceTranscript = "source-transcript-parsed.json"
+	ArtifactNormalizedTranscript   = "normalized-transcript.json"
+	ArtifactNormalizationSummary   = "normalization-summary.json"
+	ArtifactChunkingSummary        = "chunking-summary.json"
+	ArtifactUtilizationSummary     = "utilization-diagnostics.json"
+	ArtifactCorrectionLedger       = "correction-ledger.json"
+	ArtifactInvocationMetadata     = "invocation.json"
+	ArtifactEffectiveConfig        = "effective-config.json"
+	ArtifactReport                 = "report.json"
+	ArtifactErrorLog               = "error.log"
+)
+
+func BuildDiagnosticsMetadata(runDirectoryPath string, runSucceeded bool) reporting.DiagnosticsMetadata {
+	metadata := reporting.DiagnosticsMetadata{
+		DirectoryPath:               runDirectoryPath,
+		SourceTranscriptPath:        filepath.Join(runDirectoryPath, ArtifactSourceTranscript),
+		ParsedSourceTranscriptPath:  filepath.Join(runDirectoryPath, ArtifactParsedSourceTranscript),
+		NormalizedTranscriptPath:    filepath.Join(runDirectoryPath, ArtifactNormalizedTranscript),
+		NormalizationSummaryPath:    filepath.Join(runDirectoryPath, ArtifactNormalizationSummary),
+		ChunkingSummaryPath:         filepath.Join(runDirectoryPath, ArtifactChunkingSummary),
+		UtilizationSummaryPath:      filepath.Join(runDirectoryPath, ArtifactUtilizationSummary),
+		CorrectionLedgerPath:        filepath.Join(runDirectoryPath, ArtifactCorrectionLedger),
+		InvocationMetadataPath:      filepath.Join(runDirectoryPath, ArtifactInvocationMetadata),
+		RedactedEffectiveConfigPath: filepath.Join(runDirectoryPath, ArtifactEffectiveConfig),
+	}
+
+	if !runSucceeded {
+		metadata.ErrorLogPath = filepath.Join(runDirectoryPath, ArtifactErrorLog)
+	}
+
+	return metadata
+}

internal/core/diagnostics/artifacts_test.go

@@ -0,0 +1,55 @@
+package diagnostics
+
+import (
+	"path/filepath"
+	"testing"
+)
+
+func TestBuildDiagnosticsMetadataSuccessPathsMatchArtifactConstants(t *testing.T) {
+	runPath := filepath.Join("tmp", "run-123")
+	metadata := BuildDiagnosticsMetadata(runPath, true)
+
+	if metadata.DirectoryPath != runPath {
+		t.Fatalf("unexpected diagnostics directory path: got=%q want=%q", metadata.DirectoryPath, runPath)
+	}
+	if metadata.SourceTranscriptPath != filepath.Join(runPath, ArtifactSourceTranscript) {
+		t.Fatalf("unexpected source transcript path: %q", metadata.SourceTranscriptPath)
+	}
+	if metadata.ParsedSourceTranscriptPath != filepath.Join(runPath, ArtifactParsedSourceTranscript) {
+		t.Fatalf("unexpected parsed source transcript path: %q", metadata.ParsedSourceTranscriptPath)
+	}
+	if metadata.NormalizedTranscriptPath != filepath.Join(runPath, ArtifactNormalizedTranscript) {
+		t.Fatalf("unexpected normalized transcript path: %q", metadata.NormalizedTranscriptPath)
+	}
+	if metadata.NormalizationSummaryPath != filepath.Join(runPath, ArtifactNormalizationSummary) {
+		t.Fatalf("unexpected normalization summary path: %q", metadata.NormalizationSummaryPath)
+	}
+	if metadata.ChunkingSummaryPath != filepath.Join(runPath, ArtifactChunkingSummary) {
+		t.Fatalf("unexpected chunking summary path: %q", metadata.ChunkingSummaryPath)
+	}
+	if metadata.UtilizationSummaryPath != filepath.Join(runPath, ArtifactUtilizationSummary) {
+		t.Fatalf("unexpected utilization summary path: %q", metadata.UtilizationSummaryPath)
+	}
+	if metadata.CorrectionLedgerPath != filepath.Join(runPath, ArtifactCorrectionLedger) {
+		t.Fatalf("unexpected correction ledger path: %q", metadata.CorrectionLedgerPath)
+	}
+	if metadata.InvocationMetadataPath != filepath.Join(runPath, ArtifactInvocationMetadata) {
+		t.Fatalf("unexpected invocation metadata path: %q", metadata.InvocationMetadataPath)
+	}
+	if metadata.RedactedEffectiveConfigPath != filepath.Join(runPath, ArtifactEffectiveConfig) {
+		t.Fatalf("unexpected redacted effective config path: %q", metadata.RedactedEffectiveConfigPath)
+	}
+	if metadata.ErrorLogPath != "" {
+		t.Fatalf("did not expect error log path on success: %q", metadata.ErrorLogPath)
+	}
+}
+
+func TestBuildDiagnosticsMetadataFailureIncludesErrorLogPath(t *testing.T) {
+	runPath := filepath.Join("tmp", "run-123")
+	metadata := BuildDiagnosticsMetadata(runPath, false)
+
+	want := filepath.Join(runPath, ArtifactErrorLog)
+	if metadata.ErrorLogPath != want {
+		t.Fatalf("unexpected error log path: got=%q want=%q", metadata.ErrorLogPath, want)
+	}
+}

internal/core/diagnostics/run_dir.go

@@ -106,7 +106,7 @@ func (r *RunDirectory) WriteInvocationMetadata(metadata InvocationMetadata) erro
 		metadata.StartedAt = r.createdAt
 	}
 
-	path := filepath.Join(r.path, "invocation.json")
+	path := filepath.Join(r.path, ArtifactInvocationMetadata)
 	bytes, err := json.MarshalIndent(metadata, "", "  ")
 	if err != nil {
 		return fmt.Errorf("failed to marshal invocation metadata: %w", err)
@@ -120,7 +120,7 @@ func (r *RunDirectory) WriteInvocationMetadata(metadata InvocationMetadata) erro
 
 // WriteEffectiveConfig writes redacted effective config metadata for this run.
 func (r *RunDirectory) WriteEffectiveConfig(cfg config.Config) error {
-	path := filepath.Join(r.path, "effective-config.json")
+	path := filepath.Join(r.path, ArtifactEffectiveConfig)
 	redacted := cfg.Redacted()
 	bytes, err := json.MarshalIndent(redacted, "", "  ")
 	if err != nil {
@@ -136,13 +136,13 @@ func (r *RunDirectory) WriteEffectiveConfig(cfg config.Config) error {
 // WriteSourceTranscript writes the source transcript artifact
 func (r *RunDirectory) WriteSourceTranscript(transcript *schema.SourceTranscript, raw []byte) error {
 	// Write raw source for reference
-	sourcePath := filepath.Join(r.path, "source-transcript.json")
+	sourcePath := filepath.Join(r.path, ArtifactSourceTranscript)
 	if err := os.WriteFile(sourcePath, raw, 0o644); err != nil {
 		return fmt.Errorf("failed to write source transcript: %w", err)
 	}
 
 	// Write parsed source for debugging
-	parsedPath := filepath.Join(r.path, "source-transcript-parsed.json")
+	parsedPath := filepath.Join(r.path, ArtifactParsedSourceTranscript)
 	parsedBytes, err := json.MarshalIndent(transcript, "", "  ")
 	if err != nil {
 		return fmt.Errorf("failed to marshal parsed source transcript: %w", err)
@@ -157,7 +157,7 @@ func (r *RunDirectory) WriteSourceTranscript(transcript *schema.SourceTranscript
 
 // WriteNormalizedTranscript writes the normalized transcript artifact
 func (r *RunDirectory) WriteNormalizedTranscript(transcript *schema.Transcript) error {
-	normalizedPath := filepath.Join(r.path, "normalized-transcript.json")
+	normalizedPath := filepath.Join(r.path, ArtifactNormalizedTranscript)
 	bytes, err := schema.TranscriptToJSON(transcript)
 	if err != nil {
 		return fmt.Errorf("failed to serialize normalized transcript: %w", err)
@@ -170,7 +170,7 @@ func (r *RunDirectory) WriteNormalizedTranscript(transcript *schema.Transcript)
 
 // WriteNormalizationSummary writes the normalization summary artifact
 func (r *RunDirectory) WriteNormalizationSummary(summary *normalization.NormalizationSummary) error {
-	summaryPath := filepath.Join(r.path, "normalization-summary.json")
+	summaryPath := filepath.Join(r.path, ArtifactNormalizationSummary)
 	bytes, err := json.MarshalIndent(summary, "", "  ")
 	if err != nil {
 		return fmt.Errorf("failed to marshal normalization summary: %w", err)
@@ -184,7 +184,7 @@ func (r *RunDirectory) WriteNormalizationSummary(summary *normalization.Normaliz
 
 // WriteReport writes the authoritative report artifact
 func (r *RunDirectory) WriteReport(report reporting.ProcessReport) error {
-	reportPath := filepath.Join(r.path, "report.json")
+	reportPath := filepath.Join(r.path, ArtifactReport)
 	bytes, err := json.MarshalIndent(report, "", "  ")
 	if err != nil {
 		return fmt.Errorf("failed to marshal report: %w", err)
@@ -198,13 +198,13 @@ func (r *RunDirectory) WriteReport(report reporting.ProcessReport) error {
 
 // WriteErrorLog writes an error log on failure
 func (r *RunDirectory) WriteErrorLog(errorMessage string) error {
-	errorPath := filepath.Join(r.path, "error.log")
+	errorPath := filepath.Join(r.path, ArtifactErrorLog)
 	return os.WriteFile(errorPath, []byte(errorMessage+"\n"), 0o644)
 }
 
 // WriteChunkingSummary writes the chunking summary artifact
 func (r *RunDirectory) WriteChunkingSummary(summary *chunking.DetailedSummary) error {
-	summaryPath := filepath.Join(r.path, "chunking-summary.json")
+	summaryPath := filepath.Join(r.path, ArtifactChunkingSummary)
 	bytes, err := json.MarshalIndent(summary, "", "  ")
 	if err != nil {
 		return fmt.Errorf("failed to marshal chunking summary: %w", err)

internal/core/modulecatalog/catalog.go

@@ -0,0 +1,35 @@
+package modulecatalog
+
+import "strings"
+
+const (
+	KeyGlossary   = "glossary"
+	KeyHomophones = "homophones"
+	KeySpokenWord = "spoken_word"
+	KeyGrammar    = "grammar"
+)
+
+var supportedKeys = []string{
+	KeyGlossary,
+	KeyHomophones,
+	KeySpokenWord,
+	KeyGrammar,
+}
+
+var supportedKeySet = map[string]struct{}{
+	KeyGlossary:   {},
+	KeyHomophones: {},
+	KeySpokenWord: {},
+	KeyGrammar:    {},
+}
+
+func SupportedKeys() []string {
+	out := make([]string, len(supportedKeys))
+	copy(out, supportedKeys)
+	return out
+}
+
+func IsSupported(key string) bool {
+	_, ok := supportedKeySet[strings.TrimSpace(key)]
+	return ok
+}

internal/core/modulecatalog/catalog_test.go

@@ -0,0 +1,24 @@
+package modulecatalog
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestSupportedKeys(t *testing.T) {
+	want := []string{KeyGlossary, KeyHomophones, KeySpokenWord, KeyGrammar}
+	if got := SupportedKeys(); !reflect.DeepEqual(got, want) {
+		t.Fatalf("unexpected supported keys: got=%v want=%v", got, want)
+	}
+}
+
+func TestIsSupported(t *testing.T) {
+	for _, key := range SupportedKeys() {
+		if !IsSupported(key) {
+			t.Fatalf("expected key %q to be supported", key)
+		}
+	}
+	if IsSupported("made_up") {
+		t.Fatalf("did not expect made_up to be supported")
+	}
+}

internal/core/outputschema/registry.go

@@ -31,15 +31,31 @@ var definitions = map[string]Definition{
 	},
 }
 
+var supportedKeys = []string{
+	SchemaBareSegments,
+	SchemaAuditaV1,
+}
+
+func SupportedKeys() []string {
+	out := make([]string, len(supportedKeys))
+	copy(out, supportedKeys)
+	return out
+}
+
+func IsSupported(key string) bool {
+	_, ok := definitions[strings.TrimSpace(key)]
+	return ok
+}
+
 func Resolve(key string) (Definition, error) {
 	normalized := strings.TrimSpace(key)
 	if normalized == "" {
 		return Definition{}, fmt.Errorf("output schema must not be empty")
 	}
-	def, ok := definitions[normalized]
-	if !ok {
+	if !IsSupported(normalized) {
 		return Definition{}, fmt.Errorf("unsupported output schema %q", normalized)
 	}
+	def := definitions[normalized]
 	return def, nil
 }
 

internal/core/outputschema/registry_test.go

@@ -2,6 +2,7 @@ package outputschema
 
 import (
 	"encoding/json"
+	"reflect"
 	"strings"
 	"testing"
 
@@ -56,3 +57,19 @@ func TestResolveUnknown(t *testing.T) {
 		t.Fatalf("expected unsupported output schema error, got %v", err)
 	}
 }
+
+func TestSupportedKeysAndIsSupported(t *testing.T) {
+	want := []string{SchemaBareSegments, SchemaAuditaV1}
+	if got := SupportedKeys(); !reflect.DeepEqual(got, want) {
+		t.Fatalf("unexpected supported schema keys: got=%v want=%v", got, want)
+	}
+
+	for _, key := range want {
+		if !IsSupported(key) {
+			t.Fatalf("expected schema key %q to be supported", key)
+		}
+	}
+	if IsSupported("seriatim-intermediate") {
+		t.Fatalf("did not expect unsupported schema to be reported as supported")
+	}
+}

internal/core/reporting/report.go

@@ -7,6 +7,7 @@ import (
 	"time"
 
 	"gitea.maximumdirect.net/eric/audita/internal/framework/proposals"
+	stagewarnings "gitea.maximumdirect.net/eric/audita/internal/framework/warnings"
 )
 
 type ProcessReport struct {
@@ -51,6 +52,7 @@ type ModuleReport struct {
 	ReplacementPolicy  string                       `json:"replacement_policy,omitempty"`
 	Status             string                       `json:"status"`
 	ProposalCount      int                          `json:"proposal_count"`
+	Warnings           []stagewarnings.StageWarning `json:"warnings,omitempty"`
 	ValidatorDecisions []ValidatorDecisionReport    `json:"validator_decisions,omitempty"`
 	ValidatorRejected  []ValidatorRejectedReport    `json:"validator_rejected,omitempty"`
 	AppliedChanges     []proposals.AppliedChange    `json:"applied_changes,omitempty"`

internal/framework/contracts/chunk_proposal_composition_test.go

@@ -47,7 +47,7 @@ func (h testChunkProposalHarness) collectEnrichedProposals(
 			return nil, err
 		}
 
-		for _, proposal := range base {
+		for _, proposal := range base.Proposals {
 			sectionIndex := section.Index
 			out = append(out, proposals.EnrichedCorrectionProposal{
 				CorrectionProposal: proposal,
@@ -85,11 +85,11 @@ func (m deterministicFakeModule) ReplacementPolicy() proposals.ReplacementPolicy
 
 func (m deterministicFakeModule) Validators() []Validator { return nil }
 
-func (m deterministicFakeModule) Propose(ctx context.Context, req ProposalRequest) ([]proposals.CorrectionProposal, error) {
+func (m deterministicFakeModule) Propose(ctx context.Context, req ProposalRequest) (ProposalResult, error) {
 	_ = ctx
 
 	if req.WorkingTranscript == nil || req.Section == nil {
-		return []proposals.CorrectionProposal{}, nil
+		return ProposalResult{}, nil
 	}
 
 	out := make([]proposals.CorrectionProposal, 0)
@@ -110,7 +110,7 @@ func (m deterministicFakeModule) Propose(ctx context.Context, req ProposalReques
 		}
 	}
 
-	return out, nil
+	return ProposalResult{Proposals: out}, nil
 }
 
 func TestChunkProposalMetadataAssociation(t *testing.T) {

internal/framework/contracts/contracts.go

@@ -11,6 +11,7 @@ import (
 	"gitea.maximumdirect.net/eric/audita/internal/framework/proposals"
 	"gitea.maximumdirect.net/eric/audita/internal/framework/responseschema"
 	"gitea.maximumdirect.net/eric/audita/internal/framework/validators"
+	stagewarnings "gitea.maximumdirect.net/eric/audita/internal/framework/warnings"
 )
 
 // StructuredLLMClient provides provider-agnostic structured completion.
@@ -28,7 +29,7 @@ type TranscriptModule interface {
 	Key() string
 	ReplacementPolicy() proposals.ReplacementPolicy
 	Validators() []Validator
-	Propose(ctx context.Context, req ProposalRequest) ([]proposals.CorrectionProposal, error)
+	Propose(ctx context.Context, req ProposalRequest) (ProposalResult, error)
 }
 
 // Validator evaluates candidate proposals and returns one decision per proposal index.
@@ -103,6 +104,11 @@ type ProposalRequest struct {
 	LLMScheduler LLMScheduler        `json:"-"`
 }
 
+type ProposalResult struct {
+	Proposals []proposals.CorrectionProposal `json:"proposals,omitempty"`
+	Warnings  []stagewarnings.StageWarning   `json:"warnings,omitempty"`
+}
+
 // ValidationRequest is the input to validator execution.
 type ValidationRequest = validators.Request
 

internal/framework/contracts/contracts_test.go

@@ -50,11 +50,13 @@ func (f *fakeModule) Validators() []Validator {
 	return []Validator{&fakeValidator{}}
 }
 
-func (f *fakeModule) Propose(ctx context.Context, req ProposalRequest) ([]proposals.CorrectionProposal, error) {
+func (f *fakeModule) Propose(ctx context.Context, req ProposalRequest) (ProposalResult, error) {
 	_ = ctx
 	_ = req
-	return []proposals.CorrectionProposal{
+	return ProposalResult{
+		Proposals: []proposals.CorrectionProposal{
 			{TargetSegmentID: 1, OriginalText: "a", CorrectedText: "b", Confidence: 0.9},
+		},
 	}, nil
 }
 
@@ -68,12 +70,12 @@ func TestInterfaceContractsCompileWithFakes(t *testing.T) {
 		t.Fatalf("unexpected module key: %q", got)
 	}
 
-	proposalsOut, err := module.Propose(context.Background(), ProposalRequest{})
+	proposalResult, err := module.Propose(context.Background(), ProposalRequest{})
 	if err != nil {
 		t.Fatalf("unexpected propose error: %v", err)
 	}
-	if len(proposalsOut) != 1 {
-		t.Fatalf("expected one proposal, got %d", len(proposalsOut))
+	if len(proposalResult.Proposals) != 1 {
+		t.Fatalf("expected one proposal, got %d", len(proposalResult.Proposals))
 	}
 }
 

internal/framework/llm/secrets.go

@@ -0,0 +1,17 @@
+package llm
+
+import "gitea.maximumdirect.net/eric/audita/internal/core/config"
+
+// ConfiguredSecrets returns all configured LLM API-key values that should be
+// redacted from diagnostics and surfaced error payloads.
+func ConfiguredSecrets(cfg *config.Config) []string {
+	if cfg == nil {
+		return nil
+	}
+	effectiveValidation := cfg.EffectiveValidationLLMConfig()
+	return []string{
+		cfg.PrimaryLLM.APIKey,
+		cfg.ValidationLLM.APIKey,
+		effectiveValidation.APIKey,
+	}
+}

internal/framework/llm/secrets_test.go

@@ -0,0 +1,38 @@
+package llm
+
+import (
+	"reflect"
+	"testing"
+
+	"gitea.maximumdirect.net/eric/audita/internal/core/config"
+)
+
+func TestConfiguredSecretsNilConfig(t *testing.T) {
+	if got := ConfiguredSecrets(nil); got != nil {
+		t.Fatalf("expected nil secrets for nil config, got %v", got)
+	}
+}
+
+func TestConfiguredSecretsWithValidationOverride(t *testing.T) {
+	cfg := config.Default()
+	cfg.PrimaryLLM.APIKey = "primary-secret"
+	cfg.ValidationLLM.APIKey = "validation-secret"
+
+	got := ConfiguredSecrets(&cfg)
+	want := []string{"primary-secret", "validation-secret", "validation-secret"}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("unexpected secrets: got=%v want=%v", got, want)
+	}
+}
+
+func TestConfiguredSecretsWithInheritedValidationKey(t *testing.T) {
+	cfg := config.Default()
+	cfg.PrimaryLLM.APIKey = "primary-secret"
+	cfg.ValidationLLM.APIKey = ""
+
+	got := ConfiguredSecrets(&cfg)
+	want := []string{"primary-secret", "", "primary-secret"}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("unexpected inherited secrets: got=%v want=%v", got, want)
+	}
+}

internal/framework/modules/registry.go

@@ -6,6 +6,7 @@ import (
 	"strings"
 
 	"gitea.maximumdirect.net/eric/audita/internal/core/config"
+	"gitea.maximumdirect.net/eric/audita/internal/core/modulecatalog"
 	"gitea.maximumdirect.net/eric/audita/internal/core/schema"
 	"gitea.maximumdirect.net/eric/audita/internal/framework/contracts"
 	glossarymodule "gitea.maximumdirect.net/eric/audita/internal/modules/glossary"
@@ -15,28 +16,20 @@ import (
 )
 
 const (
-	ModuleKeyGlossary   = "glossary"
-	ModuleKeyHomophones = "homophones"
-	ModuleKeySpokenWord = "spoken_word"
-	ModuleKeyGrammar    = "grammar"
+	ModuleKeyGlossary   = modulecatalog.KeyGlossary
+	ModuleKeyHomophones = modulecatalog.KeyHomophones
+	ModuleKeySpokenWord = modulecatalog.KeySpokenWord
+	ModuleKeyGrammar    = modulecatalog.KeyGrammar
 )
 
 const (
 	ReasonUnsupportedModule = "unsupported_module"
 )
 
-var knownModuleKeys = map[string]struct{}{
-	ModuleKeyGlossary:   {},
-	ModuleKeyHomophones: {},
-	ModuleKeySpokenWord: {},
-	ModuleKeyGrammar:    {},
-}
-
 // IsKnownModuleKey reports whether a module key is recognized by the production
 // registry scaffold.
 func IsKnownModuleKey(key string) bool {
-	_, ok := knownModuleKeys[strings.TrimSpace(key)]
-	return ok
+	return modulecatalog.IsSupported(key)
 }
 
 // Dependencies holds explicit constructor dependencies for module creation.
@@ -69,7 +62,7 @@ type Factory struct {
 func NewFactory(deps Dependencies) *Factory {
 	factory := &Factory{
 		deps:         deps,
-		constructors: make(map[string]Constructor, len(knownModuleKeys)),
+		constructors: make(map[string]Constructor, len(modulecatalog.SupportedKeys())),
 	}
 	_ = factory.RegisterConstructor(ModuleKeyGlossary, constructGlossaryModule)
 	_ = factory.RegisterConstructor(ModuleKeyHomophones, constructHomophonesModule)

internal/framework/modules/registry_test.go

@@ -6,6 +6,7 @@ import (
 	"strings"
 	"testing"
 
+	"gitea.maximumdirect.net/eric/audita/internal/core/modulecatalog"
 	"gitea.maximumdirect.net/eric/audita/internal/framework/contracts"
 	"gitea.maximumdirect.net/eric/audita/internal/framework/proposals"
 )
@@ -19,14 +20,14 @@ func (m noopModule) ReplacementPolicy() proposals.ReplacementPolicy {
 	return proposals.ReplacementPolicyRequireUnique
 }
 func (m noopModule) Validators() []contracts.Validator { return nil }
-func (m noopModule) Propose(ctx context.Context, req contracts.ProposalRequest) ([]proposals.CorrectionProposal, error) {
+func (m noopModule) Propose(ctx context.Context, req contracts.ProposalRequest) (contracts.ProposalResult, error) {
 	_ = ctx
 	_ = req
-	return nil, nil
+	return contracts.ProposalResult{}, nil
 }
 
 func TestKnownModuleKeyRecognition(t *testing.T) {
-	for _, key := range []string{ModuleKeyGlossary, ModuleKeyHomophones, ModuleKeySpokenWord, ModuleKeyGrammar} {
+	for _, key := range modulecatalog.SupportedKeys() {
 		if !IsKnownModuleKey(key) {
 			t.Fatalf("expected key %q to be recognized", key)
 		}

internal/framework/processreport/correction_ledger.go

@@ -1,10 +1,11 @@
-package cli
+package processreport
 
 import (
 	"path/filepath"
 	"sort"
 
 	"gitea.maximumdirect.net/eric/audita/internal/framework/runner"
+	validatormetadata "gitea.maximumdirect.net/eric/audita/internal/validators/metadata"
 )
 
 const (
@@ -14,7 +15,12 @@ const (
 	correctionDispositionFailed   = "failed"
 )
 
-type correctionLedgerEntry struct {
+type CorrectionLedgerInput struct {
+	RunDirectoryPath string
+	RunOutput        *runner.RunOutput
+}
+
+type CorrectionLedgerEntry struct {
 	RunID                         string                          `json:"run_id,omitempty"`
 	ModuleKey                     string                          `json:"module_key"`
 	ModuleInstance                string                          `json:"module_instance"`
@@ -27,33 +33,28 @@ type correctionLedgerEntry struct {
 	Disposition                   string                          `json:"disposition"`
 	DispositionReasonCode         string                          `json:"disposition_reason_code,omitempty"`
 	DispositionMessage            string                          `json:"disposition_message,omitempty"`
-	DeterministicValidatorResults []ledgerValidatorDecisionRecord `json:"deterministic_validator_decisions,omitempty"`
-	LLMValidatorResults           []ledgerValidatorDecisionRecord `json:"llm_validator_decisions,omitempty"`
+	DeterministicValidatorResults []LedgerValidatorDecisionRecord `json:"deterministic_validator_decisions,omitempty"`
+	LLMValidatorResults           []LedgerValidatorDecisionRecord `json:"llm_validator_decisions,omitempty"`
 }
 
-type ledgerValidatorDecisionRecord struct {
+type LedgerValidatorDecisionRecord struct {
 	ValidatorKey string `json:"validator_key"`
 	Approved     bool   `json:"approved"`
 	ReasonCode   string `json:"reason_code"`
 	Message      string `json:"message,omitempty"`
 }
 
-func buildCorrectionLedger(runDirPath string, runOutput *runner.RunOutput) []correctionLedgerEntry {
+func BuildCorrectionLedger(input CorrectionLedgerInput) []CorrectionLedgerEntry {
+	runOutput := input.RunOutput
 	if runOutput == nil || len(runOutput.ModuleResults) == 0 {
 		return nil
 	}
 	runID := ""
-	if runDirPath != "" {
-		runID = filepath.Base(runDirPath)
-	}
-
-	entries := make([]correctionLedgerEntry, 0)
-	llmBacked := map[string]bool{
-		"spoken_form_plausibility": true,
-		"meaning_reversal_review":  true,
-		"editorial_review":         true,
+	if input.RunDirectoryPath != "" {
+		runID = filepath.Base(input.RunDirectoryPath)
 	}
 
+	entries := make([]CorrectionLedgerEntry, 0)
 	for _, module := range runOutput.ModuleResults {
 		decisionsByProposal := make(map[int][]runner.ValidatorDecisionRecord)
 		for _, decision := range module.ValidatorDecisions {
@@ -61,7 +62,7 @@ func buildCorrectionLedger(runDirPath string, runOutput *runner.RunOutput) []cor
 		}
 
 		for _, change := range module.AppliedChanges {
-			entries = append(entries, correctionLedgerEntry{
+			entries = append(entries, CorrectionLedgerEntry{
 				RunID:                         runID,
 				ModuleKey:                     module.ModuleKey,
 				ModuleInstance:                module.ModuleInstance,
@@ -72,12 +73,12 @@ func buildCorrectionLedger(runDirPath string, runOutput *runner.RunOutput) []cor
 				AppliedCorrectedText:          change.CorrectedText,
 				ReplacementPolicy:             string(module.ReplacementPolicy),
 				Disposition:                   correctionDispositionApplied,
-				DeterministicValidatorResults: filterLedgerDecisions(decisionsByProposal[change.ProposalIndex], false, llmBacked),
-				LLMValidatorResults:           filterLedgerDecisions(decisionsByProposal[change.ProposalIndex], true, llmBacked),
+				DeterministicValidatorResults: filterLedgerDecisions(decisionsByProposal[change.ProposalIndex], false),
+				LLMValidatorResults:           filterLedgerDecisions(decisionsByProposal[change.ProposalIndex], true),
 			})
 		}
 		for _, change := range module.SkippedChanges {
-			entries = append(entries, correctionLedgerEntry{
+			entries = append(entries, CorrectionLedgerEntry{
 				RunID:                         runID,
 				ModuleKey:                     module.ModuleKey,
 				ModuleInstance:                module.ModuleInstance,
@@ -89,12 +90,12 @@ func buildCorrectionLedger(runDirPath string, runOutput *runner.RunOutput) []cor
 				Disposition:                   correctionDispositionSkipped,
 				DispositionReasonCode:         string(change.SkipReason),
 				DispositionMessage:            change.Message,
-				DeterministicValidatorResults: filterLedgerDecisions(decisionsByProposal[change.ProposalIndex], false, llmBacked),
-				LLMValidatorResults:           filterLedgerDecisions(decisionsByProposal[change.ProposalIndex], true, llmBacked),
+				DeterministicValidatorResults: filterLedgerDecisions(decisionsByProposal[change.ProposalIndex], false),
+				LLMValidatorResults:           filterLedgerDecisions(decisionsByProposal[change.ProposalIndex], true),
 			})
 		}
 		for _, rejection := range module.ValidatorRejected {
-			entries = append(entries, correctionLedgerEntry{
+			entries = append(entries, CorrectionLedgerEntry{
 				RunID:                         runID,
 				ModuleKey:                     module.ModuleKey,
 				ModuleInstance:                module.ModuleInstance,
@@ -106,12 +107,12 @@ func buildCorrectionLedger(runDirPath string, runOutput *runner.RunOutput) []cor
 				Disposition:                   correctionDispositionRejected,
 				DispositionReasonCode:         rejection.ReasonCode,
 				DispositionMessage:            rejection.Message,
-				DeterministicValidatorResults: filterLedgerDecisions(decisionsByProposal[rejection.ProposalIndex], false, llmBacked),
-				LLMValidatorResults:           filterLedgerDecisions(decisionsByProposal[rejection.ProposalIndex], true, llmBacked),
+				DeterministicValidatorResults: filterLedgerDecisions(decisionsByProposal[rejection.ProposalIndex], false),
+				LLMValidatorResults:           filterLedgerDecisions(decisionsByProposal[rejection.ProposalIndex], true),
 			})
 		}
 		if module.Status == runner.ModuleStatusFailed {
-			entries = append(entries, correctionLedgerEntry{
+			entries = append(entries, CorrectionLedgerEntry{
 				RunID:                 runID,
 				ModuleKey:             module.ModuleKey,
 				ModuleInstance:        module.ModuleInstance,
@@ -135,16 +136,29 @@ func buildCorrectionLedger(runDirPath string, runOutput *runner.RunOutput) []cor
 	return entries
 }
 
-func filterLedgerDecisions(in []runner.ValidatorDecisionRecord, wantLLM bool, llmBacked map[string]bool) []ledgerValidatorDecisionRecord {
+func HasSkippedCorrections(runOutput *runner.RunOutput) bool {
+	if runOutput == nil {
+		return false
+	}
+	for _, mr := range runOutput.ModuleResults {
+		if len(mr.SkippedChanges) > 0 || len(mr.ValidatorRejected) > 0 {
+			return true
+		}
+	}
+	return false
+}
+
+func filterLedgerDecisions(in []runner.ValidatorDecisionRecord, wantLLM bool) []LedgerValidatorDecisionRecord {
 	if len(in) == 0 {
 		return nil
 	}
-	out := make([]ledgerValidatorDecisionRecord, 0, len(in))
+	out := make([]LedgerValidatorDecisionRecord, 0, len(in))
 	for _, decision := range in {
-		if llmBacked[decision.ValidatorName] != wantLLM {
+		isLLMBacked := validatormetadata.ClassForKey(decision.ValidatorName) == validatormetadata.ExecutionClassLLMBacked
+		if isLLMBacked != wantLLM {
 			continue
 		}
-		out = append(out, ledgerValidatorDecisionRecord{
+		out = append(out, LedgerValidatorDecisionRecord{
 			ValidatorKey: decision.ValidatorName,
 			Approved:     decision.Approved,
 			ReasonCode:   decision.ReasonCode,

internal/framework/processreport/correction_ledger_test.go

@@ -0,0 +1,128 @@
+package processreport
+
+import (
+	"testing"
+
+	"gitea.maximumdirect.net/eric/audita/internal/framework/proposals"
+	"gitea.maximumdirect.net/eric/audita/internal/framework/runner"
+)
+
+func TestBuildCorrectionLedgerClassifiesValidatorDecisionsFromCanonicalMetadata(t *testing.T) {
+	output := &runner.RunOutput{
+		ModuleResults: []runner.ModuleResult{
+			{
+				ModuleKey:         "glossary",
+				ModuleInstance:    "glossary",
+				ReplacementPolicy: proposals.ReplacementPolicyReplaceAll,
+				ValidatorDecisions: []runner.ValidatorDecisionRecord{
+					{ValidatorName: "proposal_shape", ProposalIndex: 3, Approved: true, ReasonCode: "approved"},
+					{ValidatorName: "spoken_form_plausibility", ProposalIndex: 3, Approved: true, ReasonCode: "approved"},
+				},
+				AppliedChanges: []proposals.AppliedChange{
+					{
+						ProposalIndex:   3,
+						ModuleKey:       "glossary",
+						ModuleInstance:  "glossary",
+						TargetSegmentID: 1,
+						OriginalText:    "gestures",
+						CorrectedText:   "Jesters",
+					},
+				},
+			},
+		},
+	}
+
+	ledger := BuildCorrectionLedger(CorrectionLedgerInput{
+		RunDirectoryPath: "/tmp/audita-run-id",
+		RunOutput:        output,
+	})
+	if len(ledger) != 1 {
+		t.Fatalf("expected one ledger entry, got %d", len(ledger))
+	}
+	entry := ledger[0]
+	if entry.RunID != "audita-run-id" || entry.Disposition != "applied" || entry.AppliedCorrectedText != "Jesters" {
+		t.Fatalf("unexpected applied ledger entry: %+v", entry)
+	}
+	if len(entry.DeterministicValidatorResults) != 1 || entry.DeterministicValidatorResults[0].ValidatorKey != "proposal_shape" {
+		t.Fatalf("unexpected deterministic decision split: %+v", entry.DeterministicValidatorResults)
+	}
+	if len(entry.LLMValidatorResults) != 1 || entry.LLMValidatorResults[0].ValidatorKey != "spoken_form_plausibility" {
+		t.Fatalf("unexpected llm-backed decision split: %+v", entry.LLMValidatorResults)
+	}
+}
+
+func TestBuildCorrectionLedgerPreservesDispositionPolicy(t *testing.T) {
+	output := &runner.RunOutput{
+		ModuleResults: []runner.ModuleResult{
+			{
+				ModuleKey:         "grammar",
+				ModuleInstance:    "grammar",
+				ReplacementPolicy: proposals.ReplacementPolicyRequireUnique,
+				Status:            runner.ModuleStatusSuccess,
+				SkippedChanges: []proposals.SkippedChange{
+					{
+						ProposalIndex:   2,
+						TargetSegmentID: 7,
+						OriginalText:    "old",
+						CorrectedText:   "new",
+						SkipReason:      proposals.SkipReasonAmbiguousOriginal,
+						Message:         "ambiguous",
+					},
+				},
+				ValidatorRejected: []runner.ValidatorRejectedChange{
+					{
+						ProposalIndex:   3,
+						TargetSegmentID: 8,
+						OriginalText:    "before",
+						CorrectedText:   "after",
+						ReasonCode:      "protected_term",
+						Message:         "blocked",
+					},
+				},
+			},
+			{
+				ModuleKey:      "capitalization",
+				ModuleInstance: "capitalization",
+				Status:         runner.ModuleStatusFailed,
+				ErrorMessage:   "failed",
+			},
+		},
+	}
+
+	ledger := BuildCorrectionLedger(CorrectionLedgerInput{RunOutput: output})
+	if len(ledger) != 3 {
+		t.Fatalf("expected skipped, rejected, and failed entries, got %+v", ledger)
+	}
+
+	byDisposition := make(map[string]CorrectionLedgerEntry)
+	for _, entry := range ledger {
+		byDisposition[entry.Disposition] = entry
+	}
+	if byDisposition["skipped"].DispositionReasonCode != string(proposals.SkipReasonAmbiguousOriginal) ||
+		byDisposition["skipped"].DispositionMessage != "ambiguous" {
+		t.Fatalf("unexpected skipped ledger entry: %+v", byDisposition["skipped"])
+	}
+	if byDisposition["rejected"].DispositionReasonCode != "protected_term" ||
+		byDisposition["rejected"].ProposedCorrectedText != "after" {
+		t.Fatalf("unexpected rejected ledger entry: %+v", byDisposition["rejected"])
+	}
+	if byDisposition["failed"].DispositionReasonCode != "module_failed" ||
+		byDisposition["failed"].DispositionMessage != "failed" {
+		t.Fatalf("unexpected failed ledger entry: %+v", byDisposition["failed"])
+	}
+}
+
+func TestHasSkippedCorrectionsIncludesApplicationSkipsAndValidatorRejections(t *testing.T) {
+	if HasSkippedCorrections(nil) {
+		t.Fatal("nil output should not have skipped corrections")
+	}
+	if HasSkippedCorrections(&runner.RunOutput{ModuleResults: []runner.ModuleResult{{AppliedChanges: []proposals.AppliedChange{{ProposalIndex: 1}}}}}) {
+		t.Fatal("applied-only output should not have skipped corrections")
+	}
+	if !HasSkippedCorrections(&runner.RunOutput{ModuleResults: []runner.ModuleResult{{SkippedChanges: []proposals.SkippedChange{{ProposalIndex: 1}}}}}) {
+		t.Fatal("application skips should count as skipped corrections")
+	}
+	if !HasSkippedCorrections(&runner.RunOutput{ModuleResults: []runner.ModuleResult{{ValidatorRejected: []runner.ValidatorRejectedChange{{ProposalIndex: 1}}}}}) {
+		t.Fatal("validator rejections should count as skipped corrections")
+	}
+}

internal/framework/processreport/report.go

@@ -0,0 +1,158 @@
+package processreport
+
+import (
+	"time"
+
+	"gitea.maximumdirect.net/eric/audita/internal/core/chunking"
+	"gitea.maximumdirect.net/eric/audita/internal/core/diagnostics"
+	"gitea.maximumdirect.net/eric/audita/internal/core/normalization"
+	"gitea.maximumdirect.net/eric/audita/internal/core/reporting"
+	"gitea.maximumdirect.net/eric/audita/internal/framework/runner"
+	stagewarnings "gitea.maximumdirect.net/eric/audita/internal/framework/warnings"
+)
+
+// BuildInput contains already-computed process execution facts for report assembly.
+type BuildInput struct {
+	Status               string
+	TranscriptPath       string
+	GlossaryPath         string
+	OutputPath           string
+	Modules              []string
+	OutputSchema         string
+	ConfigVersion        *int
+	StartedAt            time.Time
+	CompletedAt          time.Time
+	ErrorMessage         string
+	ErrorPhase           string
+	RunDirectoryPath     string
+	NormalizationSummary *normalization.NormalizationSummary
+	ChunkingSummary      *chunking.Summary
+	RunOutput            *runner.RunOutput
+}
+
+// Build creates the public process report without owning command parsing or config loading.
+func Build(input BuildInput) reporting.ProcessReport {
+	report := reporting.ProcessReport{
+		ReportMetadata: reporting.ReportMetadata{
+			ReportSchemaName:    reporting.DefaultProcessReportSchemaName,
+			ReportSchemaVersion: reporting.DefaultProcessReportSchemaVersion,
+			OutputSchema:        input.OutputSchema,
+			ConfigVersion:       input.ConfigVersion,
+		},
+		Phase:          "default_pipeline",
+		Status:         input.Status,
+		Operation:      "process",
+		TranscriptPath: input.TranscriptPath,
+		GlossaryPath:   input.GlossaryPath,
+		OutputPath:     input.OutputPath,
+		Modules:        append([]string(nil), input.Modules...),
+		StartedAt:      input.StartedAt,
+		CompletedAt:    &input.CompletedAt,
+		ErrorPhase:     input.ErrorPhase,
+	}
+	if input.RunDirectoryPath != "" {
+		runSucceeded := input.Status == "success"
+		metadata := diagnostics.BuildDiagnosticsMetadata(input.RunDirectoryPath, runSucceeded)
+		report.Diagnostics = &metadata
+	}
+	if input.ErrorMessage != "" {
+		report.ErrorMessage = input.ErrorMessage
+	}
+	if input.NormalizationSummary != nil {
+		report.InputSegmentCount = &input.NormalizationSummary.InputSegmentCount
+		report.NormalizedSegmentCount = &input.NormalizationSummary.OutputSegmentCount
+		report.NormalizationMerges = &input.NormalizationSummary.MergesPerformed
+		report.NormalizationIDReassignments = &input.NormalizationSummary.IDsReassigned
+		report.NormalizationSkipped.DifferentSpeakers = &input.NormalizationSummary.SkippedMerges.DifferentSpeakers
+		report.NormalizationSkipped.GapTooLarge = &input.NormalizationSummary.SkippedMerges.GapTooLarge
+		report.NormalizationSkipped.DurationExceeded = &input.NormalizationSummary.SkippedMerges.DurationExceeded
+		report.NormalizationSkipped.TokenLimitExceeded = &input.NormalizationSummary.SkippedMerges.TokenLimitExceeded
+	}
+	if input.ChunkingSummary != nil {
+		report.Chunking = &reporting.ChunkingSummary{
+			ChunkCount:           input.ChunkingSummary.ChunkCount,
+			MinEstimatedTokens:   input.ChunkingSummary.MinEstimatedTokens,
+			MaxEstimatedTokens:   input.ChunkingSummary.MaxEstimatedTokens,
+			TotalEstimatedTokens: input.ChunkingSummary.TotalEstimatedTokens,
+			TargetSections:       input.ChunkingSummary.TargetSections,
+			MaxSectionTokens:     input.ChunkingSummary.MaxSectionTokens,
+			MinSectionTokens:     input.ChunkingSummary.MinSectionTokens,
+		}
+	}
+	report.ModulesSummary, report.ModuleResults = buildModuleReporting(input.RunOutput)
+	return report
+}
+
+func buildModuleReporting(runOutput *runner.RunOutput) (*reporting.ModulesSummary, []reporting.ModuleReport) {
+	if runOutput == nil || len(runOutput.ModuleResults) == 0 {
+		return nil, nil
+	}
+
+	moduleReports := make([]reporting.ModuleReport, 0, len(runOutput.ModuleResults))
+	summary := &reporting.ModulesSummary{ModuleCount: len(runOutput.ModuleResults)}
+	for _, r := range runOutput.ModuleResults {
+		startedAt := r.StartedAt
+		completedAt := r.CompletedAt
+		moduleReports = append(moduleReports, reporting.ModuleReport{
+			ModuleKey:          r.ModuleKey,
+			ModuleInstance:     r.ModuleInstance,
+			ReplacementPolicy:  string(r.ReplacementPolicy),
+			Status:             r.Status,
+			ProposalCount:      r.ProposalCount,
+			Warnings:           append([]stagewarnings.StageWarning(nil), r.Warnings...),
+			ValidatorDecisions: mapValidatorDecisions(r.ValidatorDecisions),
+			ValidatorRejected:  mapValidatorRejected(r.ValidatorRejected),
+			AppliedChanges:     r.AppliedChanges,
+			SkippedChanges:     r.SkippedChanges,
+			ErrorMessage:       r.ErrorMessage,
+			StartedAt:          &startedAt,
+			CompletedAt:        &completedAt,
+		})
+		summary.TotalAppliedChanges += len(r.AppliedChanges)
+		summary.TotalSkippedChanges += len(r.SkippedChanges) + len(r.ValidatorRejected)
+		if r.Status == runner.ModuleStatusFailed && summary.FailedModuleInstance == "" {
+			summary.FailedModuleInstance = r.ModuleInstance
+		}
+	}
+
+	return summary, moduleReports
+}
+
+func mapValidatorDecisions(in []runner.ValidatorDecisionRecord) []reporting.ValidatorDecisionReport {
+	if len(in) == 0 {
+		return nil
+	}
+	out := make([]reporting.ValidatorDecisionReport, len(in))
+	for i, d := range in {
+		out[i] = reporting.ValidatorDecisionReport{
+			ValidatorName:          d.ValidatorName,
+			ProposalIndex:          d.ProposalIndex,
+			Approved:               d.Approved,
+			ReasonCode:             d.ReasonCode,
+			Message:                d.Message,
+			DiagnosticArtifactPath: d.DiagnosticArtifactPath,
+		}
+	}
+	return out
+}
+
+func mapValidatorRejected(in []runner.ValidatorRejectedChange) []reporting.ValidatorRejectedReport {
+	if len(in) == 0 {
+		return nil
+	}
+	out := make([]reporting.ValidatorRejectedReport, len(in))
+	for i, d := range in {
+		out[i] = reporting.ValidatorRejectedReport{
+			ValidatorName:   d.ValidatorName,
+			ProposalIndex:   d.ProposalIndex,
+			ModuleKey:       d.ModuleKey,
+			ModuleInstance:  d.ModuleInstance,
+			TargetSegmentID: d.TargetSegmentID,
+			OriginalText:    d.OriginalText,
+			CorrectedText:   d.CorrectedText,
+			ReasonCode:      d.ReasonCode,
+			Message:         d.Message,
+		}
+	}
+	return out
+}

internal/framework/processreport/report_test.go

@@ -0,0 +1,180 @@
+package processreport
+
+import (
+	"path/filepath"
+	"testing"
+	"time"
+
+	"gitea.maximumdirect.net/eric/audita/internal/core/chunking"
+	"gitea.maximumdirect.net/eric/audita/internal/core/diagnostics"
+	"gitea.maximumdirect.net/eric/audita/internal/core/normalization"
+	"gitea.maximumdirect.net/eric/audita/internal/core/reporting"
+	"gitea.maximumdirect.net/eric/audita/internal/framework/proposals"
+	"gitea.maximumdirect.net/eric/audita/internal/framework/runner"
+)
+
+func TestBuildSuccessReportMapsExecutionFacts(t *testing.T) {
+	startedAt := time.Date(2026, 5, 23, 10, 0, 0, 0, time.UTC)
+	completedAt := startedAt.Add(time.Second)
+	configVersion := 4
+	targetSections := 2
+	inputSegments := 5
+	outputSegments := 4
+	merges := 1
+	reassigned := 2
+	differentSpeakers := 3
+
+	report := Build(BuildInput{
+		Status:         "success",
+		TranscriptPath: "transcript.json",
+		GlossaryPath:   "glossary.yaml",
+		OutputPath:     "out.json",
+		Modules:        []string{"grammar"},
+		OutputSchema:   "default",
+		ConfigVersion:  &configVersion,
+		StartedAt:      startedAt,
+		CompletedAt:    completedAt,
+		RunDirectoryPath: filepath.Join(
+			"tmp",
+			"audita-run",
+		),
+		NormalizationSummary: &normalization.NormalizationSummary{
+			InputSegmentCount:  inputSegments,
+			OutputSegmentCount: outputSegments,
+			MergesPerformed:    merges,
+			IDsReassigned:      reassigned,
+			SkippedMerges: struct {
+				DifferentSpeakers  int `json:"different_speakers"`
+				GapTooLarge        int `json:"gap_too_large"`
+				DurationExceeded   int `json:"duration_exceeded"`
+				TokenLimitExceeded int `json:"token_limit_exceeded"`
+			}{
+				DifferentSpeakers: differentSpeakers,
+			},
+		},
+		ChunkingSummary: &chunking.Summary{
+			ChunkCount:           3,
+			MinEstimatedTokens:   10,
+			MaxEstimatedTokens:   20,
+			TotalEstimatedTokens: 45,
+			TargetSections:       &targetSections,
+			MaxSectionTokens:     200,
+			MinSectionTokens:     50,
+		},
+		RunOutput: &runner.RunOutput{
+			ModuleResults: []runner.ModuleResult{
+				{
+					ModuleKey:         "grammar",
+					ModuleInstance:    "grammar",
+					ReplacementPolicy: proposals.ReplacementPolicyRequireUnique,
+					Status:            runner.ModuleStatusSuccess,
+					ProposalCount:     2,
+					ValidatorDecisions: []runner.ValidatorDecisionRecord{
+						{
+							ValidatorName:          "proposal_shape",
+							ProposalIndex:          1,
+							Approved:               true,
+							ReasonCode:             "approved",
+							Message:                "ok",
+							DiagnosticArtifactPath: "diagnostics/validator.json",
+						},
+					},
+					ValidatorRejected: []runner.ValidatorRejectedChange{
+						{
+							ValidatorName:   "protected_term",
+							ProposalIndex:   2,
+							ModuleKey:       "grammar",
+							ModuleInstance:  "grammar",
+							TargetSegmentID: 7,
+							OriginalText:    "old",
+							CorrectedText:   "new",
+							ReasonCode:      "protected_term",
+							Message:         "blocked",
+						},
+					},
+					AppliedChanges: []proposals.AppliedChange{
+						{ProposalIndex: 1, TargetSegmentID: 7, OriginalText: "old", CorrectedText: "new"},
+					},
+					SkippedChanges: []proposals.SkippedChange{
+						{ProposalIndex: 3, TargetSegmentID: 8, SkipReason: proposals.SkipReasonMissingSegment},
+					},
+					StartedAt:   startedAt,
+					CompletedAt: completedAt,
+				},
+			},
+		},
+	})
+
+	if report.ReportMetadata.ReportSchemaName != reporting.DefaultProcessReportSchemaName ||
+		report.ReportMetadata.ReportSchemaVersion != reporting.DefaultProcessReportSchemaVersion ||
+		report.ReportMetadata.OutputSchema != "default" ||
+		report.ReportMetadata.ConfigVersion == nil ||
+		*report.ReportMetadata.ConfigVersion != configVersion {
+		t.Fatalf("unexpected report metadata: %+v", report.ReportMetadata)
+	}
+	if report.Phase != "default_pipeline" || report.Operation != "process" || report.Status != "success" {
+		t.Fatalf("unexpected process identity fields: phase=%q operation=%q status=%q", report.Phase, report.Operation, report.Status)
+	}
+	if report.Diagnostics == nil || report.Diagnostics.CorrectionLedgerPath != filepath.Join("tmp", "audita-run", diagnostics.ArtifactCorrectionLedger) {
+		t.Fatalf("unexpected diagnostics metadata: %+v", report.Diagnostics)
+	}
+	if report.InputSegmentCount == nil || *report.InputSegmentCount != inputSegments ||
+		report.NormalizationSkipped.DifferentSpeakers == nil ||
+		*report.NormalizationSkipped.DifferentSpeakers != differentSpeakers {
+		t.Fatalf("unexpected normalization summary: %+v", report)
+	}
+	if report.Chunking == nil || report.Chunking.ChunkCount != 3 || report.Chunking.TargetSections == nil || *report.Chunking.TargetSections != targetSections {
+		t.Fatalf("unexpected chunking summary: %+v", report.Chunking)
+	}
+	if report.ModulesSummary == nil ||
+		report.ModulesSummary.ModuleCount != 1 ||
+		report.ModulesSummary.TotalAppliedChanges != 1 ||
+		report.ModulesSummary.TotalSkippedChanges != 2 {
+		t.Fatalf("unexpected modules summary: %+v", report.ModulesSummary)
+	}
+	if len(report.ModuleResults) != 1 ||
+		len(report.ModuleResults[0].ValidatorDecisions) != 1 ||
+		len(report.ModuleResults[0].ValidatorRejected) != 1 {
+		t.Fatalf("unexpected module reports: %+v", report.ModuleResults)
+	}
+}
+
+func TestBuildFailedReportPreservesErrorAndFailureSummary(t *testing.T) {
+	startedAt := time.Date(2026, 5, 23, 10, 0, 0, 0, time.UTC)
+	completedAt := startedAt.Add(time.Second)
+
+	report := Build(BuildInput{
+		Status:           "failed",
+		TranscriptPath:   "transcript.json",
+		GlossaryPath:     "glossary.yaml",
+		Modules:          []string{"grammar"},
+		OutputSchema:     "default",
+		StartedAt:        startedAt,
+		CompletedAt:      completedAt,
+		ErrorPhase:       "module",
+		ErrorMessage:     "module failed",
+		RunDirectoryPath: "run-dir",
+		RunOutput: &runner.RunOutput{
+			ModuleResults: []runner.ModuleResult{
+				{
+					ModuleKey:      "grammar",
+					ModuleInstance: "grammar",
+					Status:         runner.ModuleStatusFailed,
+					ErrorMessage:   "module failed",
+					StartedAt:      startedAt,
+					CompletedAt:    completedAt,
+				},
+			},
+		},
+	})
+
+	if report.Status != "failed" || report.ErrorPhase != "module" || report.ErrorMessage != "module failed" {
+		t.Fatalf("unexpected failure fields: %+v", report)
+	}
+	if report.Diagnostics == nil || report.Diagnostics.ErrorLogPath == "" {
+		t.Fatalf("expected failure diagnostics metadata, got %+v", report.Diagnostics)
+	}
+	if report.ModulesSummary == nil || report.ModulesSummary.FailedModuleInstance != "grammar" {
+		t.Fatalf("unexpected failed module summary: %+v", report.ModulesSummary)
+	}
+}

internal/framework/promptcontext/transcript_section.go

@@ -0,0 +1,45 @@
+package promptcontext
+
+import (
+	"encoding/json"
+
+	"gitea.maximumdirect.net/eric/audita/internal/core/schema"
+)
+
+type transcriptSectionSegment struct {
+	ID         int      `json:"id"`
+	Speaker    string   `json:"speaker"`
+	Start      float64  `json:"start"`
+	End        float64  `json:"end"`
+	Text       string   `json:"text"`
+	Categories []string `json:"categories,omitempty"`
+}
+
+type transcriptSectionPayload struct {
+	SectionIndex int                        `json:"section_index"`
+	Segments     []transcriptSectionSegment `json:"segments"`
+}
+
+// MarshalTranscriptSectionJSON builds the standardized transcript-section JSON
+// payload consumed by proposal prompt templates.
+func MarshalTranscriptSectionJSON(transcript *schema.Transcript, sectionIndex int) ([]byte, error) {
+	payload := transcriptSectionPayload{
+		SectionIndex: sectionIndex,
+		Segments:     make([]transcriptSectionSegment, 0),
+	}
+
+	if transcript != nil {
+		for _, s := range transcript.Segments {
+			payload.Segments = append(payload.Segments, transcriptSectionSegment{
+				ID:         s.ID,
+				Speaker:    s.Speaker,
+				Start:      s.Start,
+				End:        s.End,
+				Text:       s.Text,
+				Categories: append([]string(nil), s.Categories...),
+			})
+		}
+	}
+
+	return json.MarshalIndent(payload, "", "  ")
+}

internal/framework/promptcontext/transcript_section_test.go

@@ -0,0 +1,95 @@
+package promptcontext
+
+import (
+	"encoding/json"
+	"reflect"
+	"testing"
+
+	"gitea.maximumdirect.net/eric/audita/internal/core/schema"
+)
+
+func TestMarshalTranscriptSectionJSONShape(t *testing.T) {
+	transcript := &schema.Transcript{Segments: []schema.Segment{
+		{ID: 1, Speaker: "A", Start: 0.1, End: 1.2, Text: "alpha", Categories: []string{"session", "intro"}},
+	}}
+
+	raw, err := MarshalTranscriptSectionJSON(transcript, 3)
+	if err != nil {
+		t.Fatalf("MarshalTranscriptSectionJSON error: %v", err)
+	}
+
+	var decoded map[string]any
+	if err := json.Unmarshal(raw, &decoded); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+
+	if got := decoded["section_index"]; got != float64(3) {
+		t.Fatalf("section_index: got=%v want=%v", got, 3)
+	}
+	segments, ok := decoded["segments"].([]any)
+	if !ok || len(segments) != 1 {
+		t.Fatalf("segments shape mismatch: %T %+v", decoded["segments"], decoded["segments"])
+	}
+	first, ok := segments[0].(map[string]any)
+	if !ok {
+		t.Fatalf("segment shape mismatch: %T", segments[0])
+	}
+	if first["id"] != float64(1) || first["speaker"] != "A" || first["start"] != 0.1 || first["end"] != 1.2 || first["text"] != "alpha" {
+		t.Fatalf("unexpected segment fields: %+v", first)
+	}
+	cats, ok := first["categories"].([]any)
+	if !ok || len(cats) != 2 || cats[0] != "session" || cats[1] != "intro" {
+		t.Fatalf("unexpected categories: %+v", first["categories"])
+	}
+}
+
+func TestMarshalTranscriptSectionJSONEmptyTranscript(t *testing.T) {
+	raw, err := MarshalTranscriptSectionJSON(nil, 0)
+	if err != nil {
+		t.Fatalf("MarshalTranscriptSectionJSON error: %v", err)
+	}
+
+	var decoded map[string]any
+	if err := json.Unmarshal(raw, &decoded); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+
+	if got := decoded["section_index"]; got != float64(0) {
+		t.Fatalf("section_index: got=%v want=%v", got, 0)
+	}
+	segments, ok := decoded["segments"].([]any)
+	if !ok {
+		t.Fatalf("segments shape mismatch: %T", decoded["segments"])
+	}
+	if len(segments) != 0 {
+		t.Fatalf("expected empty segments, got %d", len(segments))
+	}
+}
+
+func TestMarshalTranscriptSectionJSONCopiesCategories(t *testing.T) {
+	transcript := &schema.Transcript{Segments: []schema.Segment{
+		{ID: 1, Speaker: "A", Start: 0, End: 1, Text: "alpha", Categories: []string{"kept"}},
+	}}
+
+	raw, err := MarshalTranscriptSectionJSON(transcript, 1)
+	if err != nil {
+		t.Fatalf("MarshalTranscriptSectionJSON error: %v", err)
+	}
+
+	transcript.Segments[0].Categories[0] = "changed"
+
+	var decoded struct {
+		Segments []struct {
+			Categories []string `json:"categories"`
+		} `json:"segments"`
+	}
+	if err := json.Unmarshal(raw, &decoded); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if len(decoded.Segments) != 1 {
+		t.Fatalf("expected one segment, got %d", len(decoded.Segments))
+	}
+	if !reflect.DeepEqual(decoded.Segments[0].Categories, []string{"kept"}) {
+		t.Fatalf("expected copied categories, got %v", decoded.Segments[0].Categories)
+	}
+}

internal/framework/proposal_generation/generate.go

@@ -15,6 +15,9 @@ import (
 	"gitea.maximumdirect.net/eric/audita/internal/framework/llm"
 	"gitea.maximumdirect.net/eric/audita/internal/framework/proposals"
 	"gitea.maximumdirect.net/eric/audita/internal/framework/responseschema"
+	"gitea.maximumdirect.net/eric/audita/internal/framework/stagename"
+	"gitea.maximumdirect.net/eric/audita/internal/framework/structuredoutput"
+	stagewarnings "gitea.maximumdirect.net/eric/audita/internal/framework/warnings"
 )
 
 // InteractionDiagnosticsWriter writes machine-readable prompt/response artifacts.
@@ -68,6 +71,7 @@ type Request struct {
 type Result struct {
 	Corrections []proposals.CorrectionProposal         `json:"corrections"`
 	Enriched    []proposals.EnrichedCorrectionProposal `json:"enriched"`
+	Warnings    []stagewarnings.StageWarning           `json:"warnings,omitempty"`
 	Artifacts   InteractionArtifacts                   `json:"artifacts,omitempty"`
 }
 
@@ -92,7 +96,7 @@ func GenerateCandidates(ctx context.Context, req Request) (Result, error) {
 
 	stage := strings.TrimSpace(req.StageName)
 	if stage == "" {
-		stage = buildStageName(req.ModuleInstance, req.Section)
+		stage = stagename.ProposalGeneration(req.ModuleInstance, sectionIndexPtr(req.Section))
 	}
 	model := resolveModel(req.Config, req.Model)
 	messages := append([]contracts.LLMMessage(nil), req.Messages...)
@@ -104,7 +108,7 @@ func GenerateCandidates(ctx context.Context, req Request) (Result, error) {
 		writer = diagnosticsWriterAdapter{
 			writer: llm.NewDiagnosticsWriter(
 				filepath.Join(req.DiagnosticsDir, req.ModuleInstance),
-				proposalGenerationSecrets(req.Config),
+				llm.ConfiguredSecrets(req.Config),
 			),
 		}
 	}
@@ -141,7 +145,7 @@ func GenerateCandidates(ctx context.Context, req Request) (Result, error) {
 	if len(req.PromptMetadata) > 0 {
 		requestMetadata["prompt_metadata"] = req.PromptMetadata
 	}
-	requestMetadata["response_schema"] = schemaMetadata(responseSchema)
+	requestMetadata["response_schema"] = responseSchema.DiagnosticsMap()
 
 	if writer != nil {
 		artifacts, _ = writer.WriteInteraction(
@@ -156,6 +160,12 @@ func GenerateCandidates(ctx context.Context, req Request) (Result, error) {
 	}
 
 	if callErr != nil {
+		if structuredoutput.IsMalformedError(callErr) {
+			return Result{
+				Warnings:  []stagewarnings.StageWarning{newMalformedProposalWarning(req.Section, artifacts, callErr)},
+				Artifacts: artifacts,
+			}, nil
+		}
 		return Result{}, fmt.Errorf("proposal generation completion failed: %w", callErr)
 	}
 
@@ -168,9 +178,6 @@ func GenerateCandidates(ctx context.Context, req Request) (Result, error) {
 			CorrectedText:   raw.CorrectedText,
 			Confidence:      raw.Confidence,
 		}
-		if err := candidate.Validate(); err != nil {
-			return Result{}, fmt.Errorf("invalid structured correction at index %d: %w", i, err)
-		}
 
 		corrections = append(corrections, candidate)
 		enrichedCandidate := proposals.EnrichedCorrectionProposal{
@@ -191,27 +198,11 @@ func GenerateCandidates(ctx context.Context, req Request) (Result, error) {
 	return Result{
 		Corrections: corrections,
 		Enriched:    enriched,
+		Warnings:    nil,
 		Artifacts:   artifacts,
 	}, nil
 }
 
-func schemaMetadata(schema responseschema.Schema) map[string]any {
-	return map[string]any{
-		"id":      schema.ID,
-		"version": schema.Version,
-		"name":    schema.Name,
-		"sha256":  schema.SHA256,
-	}
-}
-
-func buildStageName(moduleInstance string, section *contracts.SectionMetadata) string {
-	base := fmt.Sprintf("%s:proposal-generation", moduleInstance)
-	if section == nil {
-		return base
-	}
-	return fmt.Sprintf("%s:section-%04d", base, section.Index)
-}
-
 func resolveModel(cfg *config.Config, override string) string {
 	if strings.TrimSpace(override) != "" {
 		return strings.TrimSpace(override)
@@ -222,17 +213,6 @@ func resolveModel(cfg *config.Config, override string) string {
 	return llm.ResolvePrimaryConfig(*cfg).Model
 }
 
-func proposalGenerationSecrets(cfg *config.Config) []string {
-	if cfg == nil {
-		return nil
-	}
-	return []string{
-		cfg.PrimaryLLM.APIKey,
-		cfg.ValidationLLM.APIKey,
-		cfg.EffectiveValidationLLMConfig().APIKey,
-	}
-}
-
 func errPayload(err error) any {
 	if err == nil {
 		return nil
@@ -240,6 +220,35 @@ func errPayload(err error) any {
 	return map[string]any{"error": err.Error()}
 }
 
+func newMalformedProposalWarning(section *contracts.SectionMetadata, artifacts InteractionArtifacts, err error) stagewarnings.StageWarning {
+	warning := stagewarnings.StageWarning{
+		Scope:                  stagewarnings.ScopeProposalGeneration,
+		ReasonCode:             "proposal_response_malformed",
+		Message:                strings.TrimSpace(err.Error()),
+		DiagnosticArtifactPath: diagnosticArtifactPath(artifacts),
+	}
+	if section != nil {
+		sectionIndex := section.Index
+		warning.SectionIndex = &sectionIndex
+	}
+	return warning
+}
+
+func diagnosticArtifactPath(artifacts InteractionArtifacts) string {
+	if artifacts.ErrorPayloadPath != "" {
+		return artifacts.ErrorPayloadPath
+	}
+	return artifacts.ResponsePayloadPath
+}
+
+func sectionIndexPtr(section *contracts.SectionMetadata) *int {
+	if section == nil {
+		return nil
+	}
+	index := section.Index
+	return &index
+}
+
 type diagnosticsWriterAdapter struct {
 	writer *llm.DiagnosticsWriter
 }

internal/framework/proposal_generation/generate_test.go

@@ -224,12 +224,12 @@ func TestGenerateCandidatesDiagnosticsIncludeSchemaMetadata(t *testing.T) {
 	}
 }
 
-func TestGenerateCandidatesMalformedStructuredResponse(t *testing.T) {
+func TestGenerateCandidatesInvalidCorrectionIsPreservedForLaterValidation(t *testing.T) {
 	client := &fakeStructuredClient{
 		responses: []StructuredCorrectionSet{
 			{
 				Corrections: []StructuredCorrectionProposal{
-					{TargetSegmentID: 1, OriginalText: "x", CorrectedText: "", Confidence: 0.9},
+					{TargetSegmentID: 0, OriginalText: "x", CorrectedText: "", Confidence: 1.2},
 				},
 			},
 		},
@@ -237,9 +237,55 @@ func TestGenerateCandidatesMalformedStructuredResponse(t *testing.T) {
 	req := defaultRequest(t)
 	req.LLMClient = client
 
-	_, err := GenerateCandidates(context.Background(), req)
-	if err == nil || !strings.Contains(err.Error(), "invalid structured correction") {
-		t.Fatalf("expected structured response validation failure, got %v", err)
+	result, err := GenerateCandidates(context.Background(), req)
+	if err != nil {
+		t.Fatalf("expected invalid correction to survive generation, got %v", err)
+	}
+	if len(result.Corrections) != 1 {
+		t.Fatalf("expected one correction, got %+v", result)
+	}
+	if result.Corrections[0].TargetSegmentID != 0 || result.Corrections[0].Confidence != 1.2 {
+		t.Fatalf("unexpected preserved correction: %+v", result.Corrections[0])
+	}
+	if len(result.Warnings) != 0 {
+		t.Fatalf("did not expect warnings for individually invalid corrections, got %+v", result.Warnings)
+	}
+}
+
+func TestGenerateCandidatesMalformedStructuredOutputReturnsWarning(t *testing.T) {
+	client := &fakeStructuredClient{err: errors.New("malformed structured output")}
+	req := defaultRequest(t)
+	req.LLMClient = client
+
+	result, err := GenerateCandidates(context.Background(), req)
+	if err != nil {
+		t.Fatalf("expected malformed structured output to downgrade to warning, got %v", err)
+	}
+	if len(result.Corrections) != 0 || len(result.Enriched) != 0 {
+		t.Fatalf("expected no proposals on malformed response, got %+v", result)
+	}
+	if len(result.Warnings) != 1 {
+		t.Fatalf("expected one warning, got %+v", result.Warnings)
+	}
+	if result.Warnings[0].ReasonCode != "proposal_response_malformed" {
+		t.Fatalf("unexpected warning: %+v", result.Warnings[0])
+	}
+}
+
+func TestGenerateCandidatesProviderMalformedEnvelopeReturnsWarning(t *testing.T) {
+	client := &fakeStructuredClient{err: errors.New("provider response missing choices")}
+	req := defaultRequest(t)
+	req.LLMClient = client
+
+	result, err := GenerateCandidates(context.Background(), req)
+	if err != nil {
+		t.Fatalf("expected malformed provider envelope to downgrade to warning, got %v", err)
+	}
+	if len(result.Corrections) != 0 || len(result.Enriched) != 0 {
+		t.Fatalf("expected no proposals on malformed response, got %+v", result)
+	}
+	if len(result.Warnings) != 1 || result.Warnings[0].ReasonCode != "proposal_response_malformed" {
+		t.Fatalf("unexpected warnings: %+v", result.Warnings)
 	}
 }
 
@@ -315,20 +361,22 @@ func TestGenerateCandidatesMultipleSectionsStableMetadata(t *testing.T) {
 }
 
 func TestGenerateCandidatesDiagnosticsWrittenAndRedacted(t *testing.T) {
-	secret := "proposal-secret"
+	primarySecret := "proposal-primary-secret"
+	validationSecret := "proposal-validation-secret"
 	client := &fakeStructuredClient{
 		responses: []StructuredCorrectionSet{
-			{Corrections: []StructuredCorrectionProposal{{TargetSegmentID: 1, OriginalText: secret, CorrectedText: "safe", Confidence: 0.9}}},
+			{Corrections: []StructuredCorrectionProposal{{TargetSegmentID: 1, OriginalText: validationSecret, CorrectedText: "safe", Confidence: 0.9}}},
 		},
 	}
 	cfg := config.Default()
-	cfg.PrimaryLLM.APIKey = secret
+	cfg.PrimaryLLM.APIKey = primarySecret
+	cfg.ValidationLLM.APIKey = validationSecret
 	req := defaultRequest(t)
 	req.Config = &cfg
 	req.LLMClient = client
 	req.DiagnosticsDir = t.TempDir()
 	req.Messages = []contracts.LLMMessage{
-		{Role: "system", Content: "include secret " + secret},
+		{Role: "system", Content: "include secret " + primarySecret},
 		{Role: "user", Content: "fix it"},
 	}
 
@@ -345,8 +393,8 @@ func TestGenerateCandidatesDiagnosticsWrittenAndRedacted(t *testing.T) {
 		if readErr != nil {
 			t.Fatalf("read artifact %q: %v", path, readErr)
 		}
-		if strings.Contains(string(raw), secret) {
-			t.Fatalf("artifact leaked secret %q: %s", path, string(raw))
+		if strings.Contains(string(raw), primarySecret) || strings.Contains(string(raw), validationSecret) {
+			t.Fatalf("artifact leaked configured secret in %q: %s", path, string(raw))
 		}
 		if !strings.Contains(string(raw), "[REDACTED]") {
 			t.Fatalf("expected redaction marker in artifact %q: %s", path, string(raw))

internal/framework/proposal_generation/module_proposal.go

@@ -0,0 +1,81 @@
+package proposal_generation
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"gitea.maximumdirect.net/eric/audita/internal/core/schema"
+	"gitea.maximumdirect.net/eric/audita/internal/framework/contracts"
+	"gitea.maximumdirect.net/eric/audita/internal/framework/stagename"
+	"gitea.maximumdirect.net/eric/audita/internal/prompts"
+)
+
+type ProposalMessageBuilder func(transcript *schema.Transcript, glossary *schema.Glossary, sectionIndex int, transcriptDescription string) ([]contracts.LLMMessage, error)
+
+type ModuleProposalRequest struct {
+	ProposalRequest contracts.ProposalRequest
+	PromptID        string
+	BuildMessages   ProposalMessageBuilder
+}
+
+// ExecuteModuleProposal runs shared proposal generation plumbing for one
+// module, leaving only module-specific prompt message building at call sites.
+func ExecuteModuleProposal(ctx context.Context, req ModuleProposalRequest) (contracts.ProposalResult, error) {
+	if req.BuildMessages == nil {
+		return contracts.ProposalResult{}, fmt.Errorf("proposal message builder is required")
+	}
+	if strings.TrimSpace(req.PromptID) == "" {
+		return contracts.ProposalResult{}, fmt.Errorf("prompt ID must not be empty")
+	}
+
+	sectionIndex := 0
+	if req.ProposalRequest.Section != nil {
+		sectionIndex = req.ProposalRequest.Section.Index
+	}
+
+	transcriptDescription := ""
+	if req.ProposalRequest.Config != nil {
+		transcriptDescription = req.ProposalRequest.Config.TranscriptDescription
+	}
+
+	messages, err := req.BuildMessages(
+		req.ProposalRequest.WorkingTranscript,
+		req.ProposalRequest.Glossary,
+		sectionIndex,
+		transcriptDescription,
+	)
+	if err != nil {
+		return contracts.ProposalResult{}, err
+	}
+
+	promptMetadata, ok := prompts.LookupMetadata(req.PromptID)
+	if !ok {
+		return contracts.ProposalResult{}, fmt.Errorf("unknown prompt ID %q", req.PromptID)
+	}
+
+	generated, err := GenerateCandidates(ctx, Request{
+		ModuleKey:         req.ProposalRequest.RunSpec.ModuleKey,
+		ModuleInstance:    req.ProposalRequest.RunSpec.InstanceName,
+		ReplacementPolicy: req.ProposalRequest.RunSpec.ReplacementPolicy,
+		WorkingTranscript: req.ProposalRequest.WorkingTranscript,
+		Section:           req.ProposalRequest.Section,
+		Glossary:          req.ProposalRequest.Glossary,
+		Config:            req.ProposalRequest.Config,
+		Messages:          messages,
+		PromptMetadata:    promptMetadata.DiagnosticsMap(),
+		StageName:         stagename.ModuleProposal(req.ProposalRequest.RunSpec.InstanceName, sectionIndexPtr(req.ProposalRequest.Section)),
+		StartIndex:        0,
+		LLMClient:         req.ProposalRequest.LLMClient,
+		Scheduler:         req.ProposalRequest.LLMScheduler,
+		DiagnosticsDir:    req.ProposalRequest.DiagnosticsDir,
+	})
+	if err != nil {
+		return contracts.ProposalResult{}, err
+	}
+
+	return contracts.ProposalResult{
+		Proposals: generated.Corrections,
+		Warnings:  generated.Warnings,
+	}, nil
+}

internal/framework/proposal_generation/module_proposal_test.go

@@ -0,0 +1,115 @@
+package proposal_generation
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"gitea.maximumdirect.net/eric/audita/internal/core/config"
+	"gitea.maximumdirect.net/eric/audita/internal/core/schema"
+	"gitea.maximumdirect.net/eric/audita/internal/framework/contracts"
+	"gitea.maximumdirect.net/eric/audita/internal/framework/proposals"
+	"gitea.maximumdirect.net/eric/audita/internal/prompts"
+)
+
+func TestExecuteModuleProposalBuildsMessagesFromSectionAndDescription(t *testing.T) {
+	client := &fakeStructuredClient{
+		responses: []StructuredCorrectionSet{
+			{Corrections: []StructuredCorrectionProposal{{TargetSegmentID: 1, OriginalText: "teh", CorrectedText: "the", Confidence: 0.9}}},
+		},
+	}
+	section := contracts.SectionMetadata{Index: 7}
+	cfg := config.Default()
+	cfg.TranscriptDescription = "Hearing transcript with role titles."
+	transcript := &schema.Transcript{Segments: []schema.Segment{{ID: 1, Speaker: "A", Start: 0, End: 1, Text: "teh"}}}
+	glossary := &schema.Glossary{Entries: []schema.GlossaryEntry{{Name: "X"}}}
+
+	var gotSectionIndex int
+	var gotDescription string
+	var gotTranscript *schema.Transcript
+	var gotGlossary *schema.Glossary
+
+	out, err := ExecuteModuleProposal(context.Background(), ModuleProposalRequest{
+		ProposalRequest: contracts.ProposalRequest{
+			ExecutionContext: contracts.ExecutionContext{
+				Config:            &cfg,
+				WorkingTranscript: transcript,
+				Glossary:          glossary,
+				Section:           &section,
+			},
+			RunSpec: contracts.ModuleRunSpec{
+				ModuleKey:         "grammar",
+				InstanceName:      "grammar",
+				ReplacementPolicy: proposals.ReplacementPolicyRequireUnique,
+			},
+			LLMClient: client,
+		},
+		PromptID: prompts.PromptIDModuleGrammarProposal,
+		BuildMessages: func(inTranscript *schema.Transcript, inGlossary *schema.Glossary, sectionIndex int, transcriptDescription string) ([]contracts.LLMMessage, error) {
+			gotSectionIndex = sectionIndex
+			gotDescription = transcriptDescription
+			gotTranscript = inTranscript
+			gotGlossary = inGlossary
+			return []contracts.LLMMessage{{Role: "system", Content: "sys"}, {Role: "user", Content: "usr"}}, nil
+		},
+	})
+	if err != nil {
+		t.Fatalf("ExecuteModuleProposal error: %v", err)
+	}
+	if gotSectionIndex != 7 {
+		t.Fatalf("section index: got=%d want=%d", gotSectionIndex, 7)
+	}
+	if gotDescription != cfg.TranscriptDescription {
+		t.Fatalf("transcript description: got=%q want=%q", gotDescription, cfg.TranscriptDescription)
+	}
+	if gotTranscript != transcript {
+		t.Fatalf("expected shared transcript pointer")
+	}
+	if gotGlossary != glossary {
+		t.Fatalf("expected shared glossary pointer")
+	}
+	if len(client.calls) != 1 || client.calls[0].StageName != "grammar:proposal:section-0007" {
+		t.Fatalf("unexpected stage name calls: %+v", client.calls)
+	}
+	if len(out.Proposals) != 1 || out.Proposals[0].CorrectedText != "the" {
+		t.Fatalf("unexpected proposals: %+v", out)
+	}
+}
+
+func TestExecuteModuleProposalValidatesInputs(t *testing.T) {
+	if _, err := ExecuteModuleProposal(context.Background(), ModuleProposalRequest{}); err == nil {
+		t.Fatalf("expected missing message builder error")
+	}
+
+	_, err := ExecuteModuleProposal(context.Background(), ModuleProposalRequest{
+		BuildMessages: func(transcript *schema.Transcript, glossary *schema.Glossary, sectionIndex int, transcriptDescription string) ([]contracts.LLMMessage, error) {
+			return nil, nil
+		},
+	})
+	if err == nil {
+		t.Fatalf("expected empty prompt ID error")
+	}
+
+	_, err = ExecuteModuleProposal(context.Background(), ModuleProposalRequest{
+		PromptID: "missing.prompt.id",
+		BuildMessages: func(transcript *schema.Transcript, glossary *schema.Glossary, sectionIndex int, transcriptDescription string) ([]contracts.LLMMessage, error) {
+			return []contracts.LLMMessage{{Role: "system", Content: "sys"}, {Role: "user", Content: "usr"}}, nil
+		},
+	})
+	if err == nil {
+		t.Fatalf("expected unknown prompt ID error")
+	}
+}
+
+func TestExecuteModuleProposalPropagatesBuilderError(t *testing.T) {
+	wantErr := errors.New("builder failed")
+	_, err := ExecuteModuleProposal(context.Background(), ModuleProposalRequest{
+		PromptID: prompts.PromptIDModuleGlossaryProposal,
+		BuildMessages: func(transcript *schema.Transcript, glossary *schema.Glossary, sectionIndex int, transcriptDescription string) ([]contracts.LLMMessage, error) {
+			return nil, wantErr
+		},
+	})
+	if !errors.Is(err, wantErr) {
+		t.Fatalf("expected builder error, got %v", err)
+	}
+}

internal/framework/proposals/apply.go

@@ -147,6 +147,8 @@ func skipReasonMessage(reason ProposalSkipReason) string {
 		return "original_text matched multiple spans under require_unique policy"
 	case SkipReasonNoEffect:
 		return "original_text and corrected_text are identical"
+	case SkipReasonEmptyResultingText:
+		return "proposal would leave the segment empty"
 	case SkipReasonInvalidProposal:
 		return "proposal failed structural or policy validation"
 	default:

internal/framework/proposals/preview.go

@@ -15,6 +15,7 @@ const (
 	SkipReasonMissingOriginalText ProposalSkipReason = "missing_original_text"
 	SkipReasonAmbiguousOriginal   ProposalSkipReason = "ambiguous_original_text"
 	SkipReasonNoEffect            ProposalSkipReason = "no_effect"
+	SkipReasonEmptyResultingText  ProposalSkipReason = "empty_resulting_segment"
 	SkipReasonInvalidProposal     ProposalSkipReason = "invalid_proposal"
 )
 
@@ -62,6 +63,9 @@ func PreviewProposalForSegment(segment *schema.Segment, proposal CorrectionPropo
 		}
 
 		corrected := strings.Replace(segment.Text, proposal.OriginalText, proposal.CorrectedText, 1)
+		if strings.TrimSpace(corrected) == "" {
+			return SegmentPreviewResult{SkipReason: SkipReasonEmptyResultingText}
+		}
 		return SegmentPreviewResult{
 			Applicable:           true,
 			CorrectedSegmentText: corrected,
@@ -70,6 +74,9 @@ func PreviewProposalForSegment(segment *schema.Segment, proposal CorrectionPropo
 
 	case ReplacementPolicyReplaceAll:
 		corrected := strings.ReplaceAll(segment.Text, proposal.OriginalText, proposal.CorrectedText)
+		if strings.TrimSpace(corrected) == "" {
+			return SegmentPreviewResult{SkipReason: SkipReasonEmptyResultingText}
+		}
 		return SegmentPreviewResult{
 			Applicable:           true,
 			CorrectedSegmentText: corrected,

internal/framework/proposals/preview_test.go

@@ -121,6 +121,42 @@ func TestPreviewProposalForSegmentNoEffectReplacement(t *testing.T) {
 	}
 }
 
+func TestPreviewProposalForSegmentAllowsEmptyCorrectedTextWhenSegmentRemainsNonEmpty(t *testing.T) {
+	segment := &schema.Segment{ID: 8, Text: "uh hello"}
+	proposal := CorrectionProposal{
+		TargetSegmentID: 8,
+		OriginalText:    "uh ",
+		CorrectedText:   "",
+		Confidence:      0.9,
+	}
+
+	result := PreviewProposalForSegment(segment, proposal, ReplacementPolicyRequireUnique)
+	if !result.Applicable {
+		t.Fatalf("expected applicable preview, got skip reason %q", result.SkipReason)
+	}
+	if result.CorrectedSegmentText != "hello" {
+		t.Fatalf("unexpected corrected text: %q", result.CorrectedSegmentText)
+	}
+}
+
+func TestPreviewProposalForSegmentRejectsEmptyResultingSegment(t *testing.T) {
+	segment := &schema.Segment{ID: 8, Text: "uh"}
+	proposal := CorrectionProposal{
+		TargetSegmentID: 8,
+		OriginalText:    "uh",
+		CorrectedText:   "",
+		Confidence:      0.9,
+	}
+
+	result := PreviewProposalForSegment(segment, proposal, ReplacementPolicyRequireUnique)
+	if result.Applicable {
+		t.Fatal("expected non-applicable preview")
+	}
+	if result.SkipReason != SkipReasonEmptyResultingText {
+		t.Fatalf("expected skip reason %q, got %q", SkipReasonEmptyResultingText, result.SkipReason)
+	}
+}
+
 func TestPreviewProposalForSegmentPreservesInputSegment(t *testing.T) {
 	segment := &schema.Segment{ID: 9, Speaker: "A", Start: 1.0, End: 2.0, Text: "rank rank"}
 	original := *segment

internal/framework/proposals/proposal.go

@@ -38,9 +38,6 @@ func (p CorrectionProposal) Validate() error {
 	if strings.TrimSpace(p.OriginalText) == "" {
 		return fmt.Errorf("proposal original_text must not be empty")
 	}
-	if strings.TrimSpace(p.CorrectedText) == "" {
-		return fmt.Errorf("proposal corrected_text must not be empty")
-	}
 	if p.Confidence < 0.0 || p.Confidence > 1.0 {
 		return fmt.Errorf("proposal confidence must be between 0.0 and 1.0")
 	}

internal/framework/proposals/proposal_test.go

@@ -35,7 +35,7 @@ func TestCorrectionProposalValidate_InvalidEmptyOriginalText(t *testing.T) {
 	}
 }
 
-func TestCorrectionProposalValidate_InvalidEmptyCorrectedText(t *testing.T) {
+func TestCorrectionProposalValidate_AllowsEmptyCorrectedText(t *testing.T) {
 	proposal := CorrectionProposal{
 		TargetSegmentID: 42,
 		OriginalText:    "gestures",
@@ -43,12 +43,8 @@ func TestCorrectionProposalValidate_InvalidEmptyCorrectedText(t *testing.T) {
 		Confidence:      0.95,
 	}
 
-	err := proposal.Validate()
-	if err == nil {
-		t.Fatal("expected validation error, got nil")
-	}
-	if err.Error() != "proposal corrected_text must not be empty" {
-		t.Fatalf("unexpected error: %v", err)
+	if err := proposal.Validate(); err != nil {
+		t.Fatalf("expected empty corrected_text to be allowed, got %v", err)
 	}
 }
 

internal/framework/responseschema/registry.go

@@ -5,6 +5,7 @@ import (
 	"encoding/hex"
 	"encoding/json"
 	"fmt"
+	"sort"
 	"strings"
 )
 
@@ -28,6 +29,15 @@ type Schema struct {
 	SHA256     string          `json:"sha256"`
 }
 
+func (s Schema) DiagnosticsMap() map[string]any {
+	return map[string]any{
+		"id":      s.ID,
+		"version": s.Version,
+		"name":    s.Name,
+		"sha256":  s.SHA256,
+	}
+}
+
 var registry = map[Key]Schema{
 	CorrectionSetKey: mustBuildSchema(
 		correctionSetSchemaID,
@@ -43,6 +53,20 @@ var registry = map[Key]Schema{
 	),
 }
 
+func Registered() []Schema {
+	keys := make([]string, 0, len(registry))
+	for key := range registry {
+		keys = append(keys, string(key))
+	}
+	sort.Strings(keys)
+
+	out := make([]Schema, 0, len(keys))
+	for _, key := range keys {
+		out = append(out, cloneSchema(registry[Key(key)]))
+	}
+	return out
+}
+
 // Lookup returns a copy of the registered schema for the provided key.
 func Lookup(key Key) (Schema, bool) {
 	schema, ok := registry[key]

internal/framework/responseschema/registry_test.go

@@ -89,3 +89,20 @@ func TestLookupReturnsSchemaCopy(t *testing.T) {
 		t.Fatalf("expected lookup to return independent schema copy")
 	}
 }
+
+func TestDiagnosticsMapIncludesStableSchemaMetadataShapeForAllSchemas(t *testing.T) {
+	registered := Registered()
+	if len(registered) == 0 {
+		t.Fatalf("expected registered response schemas")
+	}
+
+	for _, schema := range registered {
+		metadataMap := schema.DiagnosticsMap()
+		if metadataMap["id"] != schema.ID ||
+			metadataMap["version"] != schema.Version ||
+			metadataMap["name"] != schema.Name ||
+			metadataMap["sha256"] != schema.SHA256 {
+			t.Fatalf("unexpected diagnostics metadata map for %q: %+v", schema.ID, metadataMap)
+		}
+	}
+}

internal/framework/runner/runner.go

@@ -15,6 +15,7 @@ import (
 	"gitea.maximumdirect.net/eric/audita/internal/framework/llm"
 	"gitea.maximumdirect.net/eric/audita/internal/framework/proposals"
 	"gitea.maximumdirect.net/eric/audita/internal/framework/validators"
+	stagewarnings "gitea.maximumdirect.net/eric/audita/internal/framework/warnings"
 	validatormetadata "gitea.maximumdirect.net/eric/audita/internal/validators/metadata"
 )
 
@@ -42,6 +43,7 @@ type ModuleResult struct {
 	ReplacementPolicy  proposals.ReplacementPolicy  `json:"replacement_policy"`
 	Status             string                       `json:"status"`
 	ProposalCount      int                          `json:"proposal_count"`
+	Warnings           []stagewarnings.StageWarning `json:"warnings,omitempty"`
 	ValidatorDecisions []ValidatorDecisionRecord    `json:"validator_decisions,omitempty"`
 	ValidatorRejected  []ValidatorRejectedChange    `json:"validator_rejected,omitempty"`
 	AppliedChanges     []proposals.AppliedChange    `json:"applied_changes,omitempty"`
@@ -176,6 +178,7 @@ func (r *Runner) Run(ctx context.Context, input RunInput) (RunOutput, error) {
 				ReplacementPolicy:  policy,
 				Status:             ModuleStatusFailed,
 				ProposalCount:      pipelineResult.ProposalCount,
+				Warnings:           pipelineResult.Warnings,
 				ValidatorDecisions: pipelineResult.ValidatorDecisions,
 				ValidatorRejected:  pipelineResult.ValidatorRejected,
 				ErrorMessage:       pipelineErr.Error(),
@@ -199,6 +202,7 @@ func (r *Runner) Run(ctx context.Context, input RunInput) (RunOutput, error) {
 			ReplacementPolicy:  policy,
 			Status:             ModuleStatusSuccess,
 			ProposalCount:      pipelineResult.ProposalCount,
+			Warnings:           pipelineResult.Warnings,
 			ValidatorDecisions: pipelineResult.ValidatorDecisions,
 			ValidatorRejected:  pipelineResult.ValidatorRejected,
 			AppliedChanges:     applyResult.Applied,
@@ -232,12 +236,14 @@ type collectSectionProposalsInput struct {
 type sectionProposals struct {
 	meta      contracts.SectionMetadata
 	corrected []proposals.CorrectionProposal
+	warnings  []stagewarnings.StageWarning
 }
 
 type sectionProposalResult struct {
 	sectionPos int
 	section    chunking.Section
 	corrected  []proposals.CorrectionProposal
+	warnings   []stagewarnings.StageWarning
 	err        error
 }
 
@@ -247,12 +253,14 @@ type sectionValidationResult struct {
 	approved   []proposals.EnrichedCorrectionProposal
 	decisions  []ValidatorDecisionRecord
 	rejected   []ValidatorRejectedChange
+	warnings   []stagewarnings.StageWarning
 	err        error
 }
 
 type modulePipelineResult struct {
 	ProposalCount      int
 	Approved           []proposals.EnrichedCorrectionProposal
+	Warnings           []stagewarnings.StageWarning
 	ValidatorDecisions []ValidatorDecisionRecord
 	ValidatorRejected  []ValidatorRejectedChange
 }
@@ -271,7 +279,7 @@ func collectSectionProposals(ctx context.Context, input collectSectionProposalsI
 			go func() {
 				defer wg.Done()
 				meta := contracts.SectionMetadataFromSection(section)
-				corrected, err := input.Module.Propose(withModuleInstanceContext(runCtx, input.Spec.InstanceName), contracts.ProposalRequest{
+				proposalResult, err := input.Module.Propose(withModuleInstanceContext(runCtx, input.Spec.InstanceName), contracts.ProposalRequest{
 					ExecutionContext: contracts.ExecutionContext{
 						Config:            input.Config,
 						WorkingTranscript: transcriptFromSection(section),
@@ -291,7 +299,8 @@ func collectSectionProposals(ctx context.Context, input collectSectionProposalsI
 				case results <- sectionProposalResult{
 					sectionPos: sectionPos,
 					section:    section,
-					corrected:  corrected,
+					corrected:  proposalResult.Proposals,
+					warnings:   proposalResult.Warnings,
 					err:        err,
 				}:
 				case <-runCtx.Done():
@@ -308,6 +317,7 @@ func collectSectionProposals(ctx context.Context, input collectSectionProposalsI
 func runModulePipeline(ctx context.Context, input collectSectionProposalsInput) (modulePipelineResult, error) {
 	out := modulePipelineResult{
 		Approved:           make([]proposals.EnrichedCorrectionProposal, 0),
+		Warnings:           make([]stagewarnings.StageWarning, 0),
 		ValidatorDecisions: make([]ValidatorDecisionRecord, 0),
 		ValidatorRejected:  make([]ValidatorRejectedChange, 0),
 	}
@@ -352,6 +362,7 @@ func runModulePipeline(ctx context.Context, input collectSectionProposalsInput)
 		if firstErr != nil {
 			continue
 		}
+		out.Warnings = append(out.Warnings, result.warnings...)
 		pending[result.sectionPos] = result
 
 		for {
@@ -401,6 +412,7 @@ func runModulePipeline(ctx context.Context, input collectSectionProposalsInput)
 					approved:   validated.approved,
 					decisions:  validated.decisions,
 					rejected:   validated.rejected,
+					warnings:   validated.warnings,
 					err:        err,
 				}
 			}(nextSectionToProcess, sectionEnriched, sectionMeta)
@@ -424,6 +436,7 @@ func runModulePipeline(ctx context.Context, input collectSectionProposalsInput)
 			break
 		}
 		out.Approved = append(out.Approved, res.approved...)
+		out.Warnings = append(out.Warnings, res.warnings...)
 		out.ValidatorDecisions = append(out.ValidatorDecisions, res.decisions...)
 		out.ValidatorRejected = append(out.ValidatorRejected, res.rejected...)
 	}
@@ -440,6 +453,38 @@ func runModulePipeline(ctx context.Context, input collectSectionProposalsInput)
 		}
 		return validatorOrder[out.ValidatorRejected[i].ValidatorName] < validatorOrder[out.ValidatorRejected[j].ValidatorName]
 	})
+	sort.SliceStable(out.Warnings, func(i, j int) bool {
+		leftSection, rightSection := -1, -1
+		if out.Warnings[i].SectionIndex != nil {
+			leftSection = *out.Warnings[i].SectionIndex
+		}
+		if out.Warnings[j].SectionIndex != nil {
+			rightSection = *out.Warnings[j].SectionIndex
+		}
+		if leftSection != rightSection {
+			return leftSection < rightSection
+		}
+		leftBatch, rightBatch := -1, -1
+		if out.Warnings[i].BatchIndex != nil {
+			leftBatch = *out.Warnings[i].BatchIndex
+		}
+		if out.Warnings[j].BatchIndex != nil {
+			rightBatch = *out.Warnings[j].BatchIndex
+		}
+		if leftBatch != rightBatch {
+			return leftBatch < rightBatch
+		}
+		if out.Warnings[i].ValidatorName != out.Warnings[j].ValidatorName {
+			return validatorOrder[out.Warnings[i].ValidatorName] < validatorOrder[out.Warnings[j].ValidatorName]
+		}
+		if out.Warnings[i].Scope != out.Warnings[j].Scope {
+			return out.Warnings[i].Scope < out.Warnings[j].Scope
+		}
+		if out.Warnings[i].ReasonCode != out.Warnings[j].ReasonCode {
+			return out.Warnings[i].ReasonCode < out.Warnings[j].ReasonCode
+		}
+		return out.Warnings[i].Message < out.Warnings[j].Message
+	})
 
 	if firstErr != nil {
 		return out, firstErr
@@ -467,11 +512,13 @@ type validateSectionCandidatesResult struct {
 	approved  []proposals.EnrichedCorrectionProposal
 	decisions []ValidatorDecisionRecord
 	rejected  []ValidatorRejectedChange
+	warnings  []stagewarnings.StageWarning
 }
 
 func validateSectionCandidates(ctx context.Context, input validateSectionCandidatesInput) (validateSectionCandidatesResult, error) {
 	decisions := make([]ValidatorDecisionRecord, 0)
 	rejected := make([]ValidatorRejectedChange, 0)
+	warnings := make([]stagewarnings.StageWarning, 0)
 	eligible := append([]proposals.EnrichedCorrectionProposal(nil), input.SectionEnriched...)
 
 	for _, validator := range input.Validators {
@@ -480,7 +527,7 @@ func validateSectionCandidates(ctx context.Context, input validateSectionCandida
 			diagnosticsWriter = &llmDiagnosticsWriterAdapter{
 				writer: llm.NewDiagnosticsWriter(
 					filepath.Join(input.DiagnosticsDir, input.Spec.InstanceName),
-					validatorSecrets(input.Config),
+					llm.ConfiguredSecrets(input.Config),
 				),
 			}
 		}
@@ -512,6 +559,7 @@ func validateSectionCandidates(ctx context.Context, input validateSectionCandida
 				approved:  eligible,
 				decisions: decisions,
 				rejected:  rejected,
+				warnings:  warnings,
 			}, fmt.Errorf("validator %q failed: %w", validator.Name(), err)
 		}
 		if err := validators.EnforceDecisionCardinality(eligible, vResult.Decisions); err != nil {
@@ -519,8 +567,10 @@ func validateSectionCandidates(ctx context.Context, input validateSectionCandida
 				approved:  eligible,
 				decisions: decisions,
 				rejected:  rejected,
+				warnings:  warnings,
 			}, fmt.Errorf("validator %q cardinality failed: %w", validator.Name(), err)
 		}
+		warnings = append(warnings, vResult.Warnings...)
 
 		nextEligible := make([]proposals.EnrichedCorrectionProposal, 0, len(eligible))
 		byIndex := make(map[int]proposals.EnrichedCorrectionProposal, len(eligible))
@@ -562,6 +612,7 @@ func validateSectionCandidates(ctx context.Context, input validateSectionCandida
 		approved:  eligible,
 		decisions: decisions,
 		rejected:  rejected,
+		warnings:  warnings,
 	}, nil
 }
 
@@ -693,15 +744,3 @@ func (a *llmDiagnosticsWriterAdapter) WriteInteraction(stage string, requestMeta
 		ErrorPayloadPath:    art.ErrorPayloadPath,
 	}, nil
 }
-
-func validatorSecrets(cfg *config.Config) []string {
-	if cfg == nil {
-		return nil
-	}
-	effective := cfg.EffectiveValidationLLMConfig()
-	return []string{
-		cfg.PrimaryLLM.APIKey,
-		effective.APIKey,
-		cfg.ValidationLLM.APIKey,
-	}
-}

internal/framework/runner/runner_test.go

@@ -47,11 +47,12 @@ type fakeModule struct {
 func (m fakeModule) Key() string                                    { return m.key }
 func (m fakeModule) ReplacementPolicy() proposals.ReplacementPolicy { return m.policy }
 func (m fakeModule) Validators() []contracts.Validator              { return m.validators }
-func (m fakeModule) Propose(ctx context.Context, req contracts.ProposalRequest) ([]proposals.CorrectionProposal, error) {
+func (m fakeModule) Propose(ctx context.Context, req contracts.ProposalRequest) (contracts.ProposalResult, error) {
 	if m.proposeF == nil {
-		return nil, nil
+		return contracts.ProposalResult{}, nil
 	}
-	return m.proposeF(req)
+	proposalsOut, err := m.proposeF(req)
+	return contracts.ProposalResult{Proposals: proposalsOut}, err
 }
 
 type fakeValidator struct {
@@ -1191,7 +1192,7 @@ func TestRunnerLLMValidatorRejectionPreventsApplication(t *testing.T) {
 	}
 }
 
-func TestRunnerLLMValidatorMalformedResponseFailsWithPartialProgress(t *testing.T) {
+func TestRunnerLLMValidatorMalformedResponseRejectsBatchAndKeepsPartialProgress(t *testing.T) {
 	client := &fakeStructuredClient{responses: []validators.LLMValidationResponse{{Validations: []validators.LLMValidationDecision{{CorrectionIndex: 99, Approved: true, Confidence: 0.9, Reason: "bad index"}}}}}
 	llmValidator, _ := validators.NewLLMBackedValidator("spoken_form_plausibility_review", validators.LLMValidatorTypeSpokenFormPlausibility, "")
 	r := New(fakeFactory{modules: map[string]contracts.TranscriptModule{
@@ -1209,15 +1210,21 @@ func TestRunnerLLMValidatorMalformedResponseFailsWithPartialProgress(t *testing.
 		ModuleSpecs:         []contracts.ModuleRunSpec{{ModuleKey: "m1", InstanceName: "m1"}, {ModuleKey: "m2", InstanceName: "m2"}},
 		ValidationLLMClient: client,
 	})
-	if err == nil {
-		t.Fatal("expected llm validator failure")
+	if err != nil {
+		t.Fatalf("expected malformed validator response to downgrade, got %v", err)
 	}
 	if out.FinalTranscript.Segments[0].Text != "the cat" {
 		t.Fatalf("expected partial progress retained")
 	}
+	if len(out.ModuleResults) != 2 || len(out.ModuleResults[1].ValidatorRejected) != 1 {
+		t.Fatalf("expected second module rejection, got %+v", out.ModuleResults)
+	}
+	if len(out.ModuleResults[1].Warnings) != 1 || out.ModuleResults[1].Warnings[0].ReasonCode != validators.ReasonValidatorMalformed {
+		t.Fatalf("expected malformed warning, got %+v", out.ModuleResults[1].Warnings)
+	}
 }
 
-func TestRunnerLLMValidatorMissingDecisionFails(t *testing.T) {
+func TestRunnerLLMValidatorMissingDecisionRejectsBatch(t *testing.T) {
 	client := &fakeStructuredClient{responses: []validators.LLMValidationResponse{{Validations: []validators.LLMValidationDecision{}}}}
 	llmValidator, _ := validators.NewLLMBackedValidator("spoken_form_plausibility_review", validators.LLMValidatorTypeSpokenFormPlausibility, "")
 	r := New(fakeFactory{modules: map[string]contracts.TranscriptModule{
@@ -1232,12 +1239,12 @@ func TestRunnerLLMValidatorMissingDecisionFails(t *testing.T) {
 		ModuleSpecs:         []contracts.ModuleRunSpec{{ModuleKey: "m", InstanceName: "m"}},
 		ValidationLLMClient: client,
 	})
-	if err == nil {
-		t.Fatal("expected missing decision failure")
+	if err != nil {
+		t.Fatalf("expected missing decision downgrade, got %v", err)
 	}
 }
 
-func TestRunnerLLMValidatorDuplicateDecisionFails(t *testing.T) {
+func TestRunnerLLMValidatorDuplicateDecisionRejectsBatch(t *testing.T) {
 	client := &fakeStructuredClient{responses: []validators.LLMValidationResponse{{Validations: []validators.LLMValidationDecision{
 		{CorrectionIndex: 0, Approved: true, Confidence: 0.9, Reason: "ok"},
 		{CorrectionIndex: 0, Approved: false, Confidence: 0.9, Reason: "dup"},
@@ -1255,8 +1262,8 @@ func TestRunnerLLMValidatorDuplicateDecisionFails(t *testing.T) {
 		ModuleSpecs:         []contracts.ModuleRunSpec{{ModuleKey: "m", InstanceName: "m"}},
 		ValidationLLMClient: client,
 	})
-	if err == nil {
-		t.Fatal("expected duplicate decision failure")
+	if err != nil {
+		t.Fatalf("expected duplicate decision downgrade, got %v", err)
 	}
 }
 
@@ -1300,12 +1307,13 @@ func TestRunnerLLMValidatorBatchingAndSchedulerUsage(t *testing.T) {
 }
 
 func TestRunnerLLMValidatorDiagnosticsWrittenAndRedacted(t *testing.T) {
-	secret := "super-secret-key"
-	client := &fakeStructuredClient{responses: []validators.LLMValidationResponse{{Validations: []validators.LLMValidationDecision{{CorrectionIndex: 0, Approved: true, Confidence: 0.9, Reason: secret}}}}}
+	primarySecret := "runner-primary-secret"
+	validationSecret := "runner-validation-secret"
+	client := &fakeStructuredClient{responses: []validators.LLMValidationResponse{{Validations: []validators.LLMValidationDecision{{CorrectionIndex: 0, Approved: true, Confidence: 0.9, Reason: validationSecret}}}}}
 	llmValidator, _ := validators.NewLLMBackedValidator("spoken_form_plausibility_review", validators.LLMValidatorTypeSpokenFormPlausibility, "")
 	cfg := config.Default()
-	cfg.PrimaryLLM.APIKey = secret
-	cfg.ValidationLLM.APIKey = secret
+	cfg.PrimaryLLM.APIKey = primarySecret
+	cfg.ValidationLLM.APIKey = validationSecret
 	diagDir := t.TempDir()
 	r := New(fakeFactory{modules: map[string]contracts.TranscriptModule{
 		"m": fakeModule{key: "m", policy: proposals.ReplacementPolicyRequireUnique, validators: []contracts.Validator{llmValidator}, proposeF: func(req contracts.ProposalRequest) ([]proposals.CorrectionProposal, error) {
@@ -1314,7 +1322,7 @@ func TestRunnerLLMValidatorDiagnosticsWrittenAndRedacted(t *testing.T) {
 	}})
 	out, err := r.Run(context.Background(), RunInput{
 		Config:                   &cfg,
-		Transcript:               &schema.Transcript{Segments: []schema.Segment{{ID: 1, Text: "There were gestures at the temple."}}},
+		Transcript:               &schema.Transcript{Segments: []schema.Segment{{ID: 1, Text: "There were gestures at the temple. " + primarySecret}}},
 		ModuleSpecs:              []contracts.ModuleRunSpec{{ModuleKey: "m", InstanceName: "m"}},
 		ValidationLLMClient:      client,
 		ValidationDiagnosticsDir: diagDir,
@@ -1325,12 +1333,26 @@ func TestRunnerLLMValidatorDiagnosticsWrittenAndRedacted(t *testing.T) {
 	if len(out.ModuleResults[0].ValidatorDecisions) == 0 || out.ModuleResults[0].ValidatorDecisions[0].DiagnosticArtifactPath == "" {
 		t.Fatalf("expected diagnostic artifact path on decision")
 	}
+	matches, globErr := filepath.Glob(filepath.Join(diagDir, "m", "*.json"))
+	if globErr != nil {
+		t.Fatalf("glob diagnostics: %v", globErr)
+	}
+	if len(matches) == 0 {
+		t.Fatalf("expected diagnostics JSON artifacts under %s", filepath.Join(diagDir, "m"))
+	}
+	for _, path := range matches {
+		raw, readErr := os.ReadFile(path)
+		if readErr != nil {
+			t.Fatalf("read diagnostic %q: %v", path, readErr)
+		}
+		if strings.Contains(string(raw), primarySecret) || strings.Contains(string(raw), validationSecret) {
+			t.Fatalf("configured secret leaked in diagnostics %q: %s", path, string(raw))
+		}
+	}
+
 	raw, readErr := os.ReadFile(out.ModuleResults[0].ValidatorDecisions[0].DiagnosticArtifactPath)
 	if readErr != nil {
-		t.Fatalf("read diagnostic: %v", readErr)
-	}
-	if strings.Contains(string(raw), secret) {
-		t.Fatalf("secret leaked in diagnostics: %s", string(raw))
+		t.Fatalf("read decision diagnostic: %v", readErr)
 	}
 	if !strings.Contains(string(raw), "[REDACTED]") {
 		t.Fatalf("expected redaction marker in diagnostics")
@@ -1355,7 +1377,7 @@ type proposalGenerationModule struct {
 func (m proposalGenerationModule) Key() string                                    { return m.key }
 func (m proposalGenerationModule) ReplacementPolicy() proposals.ReplacementPolicy { return m.policy }
 func (m proposalGenerationModule) Validators() []contracts.Validator              { return nil }
-func (m proposalGenerationModule) Propose(ctx context.Context, req contracts.ProposalRequest) ([]proposals.CorrectionProposal, error) {
+func (m proposalGenerationModule) Propose(ctx context.Context, req contracts.ProposalRequest) (contracts.ProposalResult, error) {
 	result, err := proposal_generation.GenerateCandidates(ctx, proposal_generation.Request{
 		ModuleKey:         req.RunSpec.ModuleKey,
 		ModuleInstance:    req.RunSpec.InstanceName,
@@ -1372,9 +1394,9 @@ func (m proposalGenerationModule) Propose(ctx context.Context, req contracts.Pro
 		DiagnosticsDir: req.DiagnosticsDir,
 	})
 	if err != nil {
-		return nil, err
+		return contracts.ProposalResult{}, err
 	}
-	return result.Corrections, nil
+	return contracts.ProposalResult{Proposals: result.Corrections, Warnings: result.Warnings}, nil
 }
 
 type fakeProposalStructuredClient struct {

internal/framework/stagename/stagename.go

@@ -0,0 +1,24 @@
+package stagename
+
+import (
+	"fmt"
+)
+
+func ModuleProposal(moduleInstance string, sectionIndex *int) string {
+	if sectionIndex == nil || *sectionIndex == 0 {
+		return fmt.Sprintf("%s:proposal", moduleInstance)
+	}
+	return fmt.Sprintf("%s:proposal:section-%04d", moduleInstance, *sectionIndex)
+}
+
+func ProposalGeneration(moduleInstance string, sectionIndex *int) string {
+	base := fmt.Sprintf("%s:proposal-generation", moduleInstance)
+	if sectionIndex == nil {
+		return base
+	}
+	return fmt.Sprintf("%s:section-%04d", base, *sectionIndex)
+}
+
+func ValidatorBatch(moduleInstance string, validatorName string, batchIndex int) string {
+	return fmt.Sprintf("%s:%s:batch-%04d", moduleInstance, validatorName, batchIndex)
+}

internal/framework/stagename/stagename_test.go

@@ -0,0 +1,33 @@
+package stagename
+
+import (
+	"testing"
+)
+
+func TestModuleProposalStageName(t *testing.T) {
+	if got := ModuleProposal("grammar", nil); got != "grammar:proposal" {
+		t.Fatalf("unexpected stage name without section: %q", got)
+	}
+
+	sectionIndex := 7
+	if got := ModuleProposal("grammar", &sectionIndex); got != "grammar:proposal:section-0007" {
+		t.Fatalf("unexpected stage name with section: %q", got)
+	}
+}
+
+func TestProposalGenerationStageName(t *testing.T) {
+	if got := ProposalGeneration("grammar", nil); got != "grammar:proposal-generation" {
+		t.Fatalf("unexpected proposal generation stage name without section: %q", got)
+	}
+
+	sectionIndex := 3
+	if got := ProposalGeneration("grammar", &sectionIndex); got != "grammar:proposal-generation:section-0003" {
+		t.Fatalf("unexpected proposal generation stage name with section: %q", got)
+	}
+}
+
+func TestValidatorBatchStageName(t *testing.T) {
+	if got := ValidatorBatch("homophones_1", "spoken_form_plausibility_review", 12); got != "homophones_1:spoken_form_plausibility_review:batch-0012" {
+		t.Fatalf("unexpected validator batch stage name: %q", got)
+	}
+}

internal/framework/structuredoutput/malformed.go

@@ -0,0 +1,28 @@
+package structuredoutput
+
+import "strings"
+
+var malformedMarkers = []string{
+	"malformed structured output",
+	"decode structured output:",
+	"decode provider response envelope:",
+	"provider response missing choices",
+	"provider response missing assistant message content",
+	"provider response assistant message content is empty",
+	"provider response assistant message content is not valid JSON",
+}
+
+// IsMalformedError reports whether err matches provider malformed
+// structured-output failure markers that should be downgraded.
+func IsMalformedError(err error) bool {
+	if err == nil {
+		return false
+	}
+	msg := err.Error()
+	for _, marker := range malformedMarkers {
+		if strings.Contains(msg, marker) {
+			return true
+		}
+	}
+	return false
+}

internal/framework/structuredoutput/malformed_test.go

@@ -0,0 +1,32 @@
+package structuredoutput
+
+import (
+	"errors"
+	"testing"
+)
+
+func TestIsMalformedError(t *testing.T) {
+	cases := []struct {
+		name string
+		err  error
+		want bool
+	}{
+		{name: "nil", err: nil, want: false},
+		{name: "generic", err: errors.New("network timeout"), want: false},
+		{name: "malformed", err: errors.New("malformed structured output"), want: true},
+		{name: "decode structured", err: errors.New("decode structured output: unexpected end of JSON input"), want: true},
+		{name: "missing choices", err: errors.New("provider response missing choices"), want: true},
+		{name: "missing content", err: errors.New("provider response missing assistant message content"), want: true},
+		{name: "empty content", err: errors.New("provider response assistant message content is empty"), want: true},
+		{name: "invalid content json", err: errors.New("provider response assistant message content is not valid JSON"), want: true},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := IsMalformedError(tc.err)
+			if got != tc.want {
+				t.Fatalf("IsMalformedError(%v): got=%v want=%v", tc.err, got, tc.want)
+			}
+		})
+	}
+}

internal/framework/validators/deterministic.go

@@ -4,8 +4,35 @@ import (
 	"context"
 	"fmt"
 	"strings"
+
+	"gitea.maximumdirect.net/eric/audita/internal/core/schema"
+	"gitea.maximumdirect.net/eric/audita/internal/framework/proposals"
 )
 
+type ProposalShapeValidator struct{}
+
+func (v ProposalShapeValidator) Name() string { return "proposal_shape" }
+
+func (v ProposalShapeValidator) Validate(_ context.Context, req Request) (Result, error) {
+	decisions := make([]Decision, 0, len(req.CandidateProposal))
+	for _, c := range req.CandidateProposal {
+		switch {
+		case c.TargetSegmentID <= 0:
+			decisions = append(decisions, rejection(c.ProposalIndex, ReasonInvalidTargetSegment, "proposal target segment id must be positive"))
+		case strings.TrimSpace(c.OriginalText) == "":
+			decisions = append(decisions, rejection(c.ProposalIndex, ReasonEmptyOriginalText, "proposal original_text must not be empty"))
+		case c.Confidence < 0.0 || c.Confidence > 1.0:
+			decisions = append(decisions, rejection(c.ProposalIndex, ReasonInvalidConfidence, "proposal confidence must be between 0.0 and 1.0"))
+		default:
+			decisions = append(decisions, approval(c.ProposalIndex))
+		}
+	}
+	if err := EnforceDecisionCardinality(req.CandidateProposal, decisions); err != nil {
+		return Result{}, err
+	}
+	return Result{ValidatorName: v.Name(), Decisions: decisions}, nil
+}
+
 type ConfidenceThresholdValidator struct{}
 
 func (v ConfidenceThresholdValidator) Name() string { return "confidence_threshold" }
@@ -62,10 +89,23 @@ type NonEmptyCorrectionValidator struct{}
 func (v NonEmptyCorrectionValidator) Name() string { return "non_empty_corrected_text" }
 
 func (v NonEmptyCorrectionValidator) Validate(_ context.Context, req Request) (Result, error) {
+	segmentsByID := make(map[int]schema.Segment)
+	if req.WorkingTranscript != nil {
+		for _, seg := range req.WorkingTranscript.Segments {
+			segmentsByID[seg.ID] = seg
+		}
+	}
+
 	decisions := make([]Decision, 0, len(req.CandidateProposal))
 	for _, c := range req.CandidateProposal {
-		if strings.TrimSpace(c.CorrectedText) == "" {
-			decisions = append(decisions, rejection(c.ProposalIndex, ReasonEmptyCorrectedText, "corrected_text must not be empty"))
+		segment, ok := segmentsByID[c.TargetSegmentID]
+		if !ok {
+			decisions = append(decisions, approval(c.ProposalIndex))
+			continue
+		}
+		preview := proposals.PreviewProposalForSegment(&segment, c.CorrectionProposal, req.ReplacementPolicy)
+		if preview.SkipReason == proposals.SkipReasonEmptyResultingText {
+			decisions = append(decisions, rejection(c.ProposalIndex, ReasonEmptyResultingText, "proposal would leave the segment empty"))
 			continue
 		}
 		decisions = append(decisions, approval(c.ProposalIndex))

internal/framework/validators/llm_validators.go

@@ -11,6 +11,9 @@ import (
 	"gitea.maximumdirect.net/eric/audita/internal/core/schema"
 	"gitea.maximumdirect.net/eric/audita/internal/framework/proposals"
 	"gitea.maximumdirect.net/eric/audita/internal/framework/responseschema"
+	"gitea.maximumdirect.net/eric/audita/internal/framework/stagename"
+	"gitea.maximumdirect.net/eric/audita/internal/framework/structuredoutput"
+	stagewarnings "gitea.maximumdirect.net/eric/audita/internal/framework/warnings"
 	"gitea.maximumdirect.net/eric/audita/internal/prompts"
 )
 
@@ -78,7 +81,20 @@ func (v *LLMBackedValidator) Validate(ctx context.Context, req Request) (Result,
 		maxTokens = req.Config.ValidationMaxPromptTokens
 	}
 
-	batches, err := ChunkLLMValidationItems(validationReq.Items, maxTokens, v.estimator)
+	warnings := append([]stagewarnings.StageWarning(nil), oversizedValidationWarnings(v.name, maxTokens, validationReq.Items, v.estimator)...)
+	oversized := oversizedValidationDecisions(validationReq.Items, maxTokens, v.estimator)
+	itemsForBatching := filterItemsByDecision(validationReq.Items, oversized)
+	if len(itemsForBatching) == 0 {
+		all := append([]Decision(nil), immediate...)
+		all = append(all, oversized...)
+		if err := EnforceDecisionCardinality(req.CandidateProposal, all); err != nil {
+			return Result{}, err
+		}
+		sort.SliceStable(all, func(i, j int) bool { return all[i].ProposalIndex < all[j].ProposalIndex })
+		return Result{ValidatorName: v.name, Decisions: all, Warnings: warnings}, nil
+	}
+
+	batches, err := ChunkLLMValidationItems(itemsForBatching, maxTokens, v.estimator)
 	if err != nil {
 		return Result{}, err
 	}
@@ -96,9 +112,10 @@ func (v *LLMBackedValidator) Validate(ctx context.Context, req Request) (Result,
 
 		var response LLMValidationResponse
 		responseSchema := responseschema.MustLookup(responseschema.ValidatorDecisionSetKey)
+		stage := stagename.ValidatorBatch(req.ModuleInstance, v.name, batch.BatchIndex)
 		call := func(callCtx context.Context) error {
 			_, err = req.LLMClient.CompleteStructured(callCtx, StructuredCompletionRequest{
-				StageName:      fmt.Sprintf("%s:%s:batch-%04d", req.ModuleInstance, v.name, batch.BatchIndex),
+				StageName:      stage,
 				Messages:       messages,
 				Model:          resolvedValidationModel(req.Config, v.model),
 				ResponseSchema: &responseSchema,
@@ -112,7 +129,6 @@ func (v *LLMBackedValidator) Validate(ctx context.Context, req Request) (Result,
 		}
 		artifacts := InteractionArtifacts{}
 		if req.DiagnosticsWriter != nil {
-			stage := fmt.Sprintf("%s:%s:batch-%04d", req.ModuleInstance, v.name, batch.BatchIndex)
 			promptMetadata := validatorPromptMetadata(v.validatorType)
 			artifacts, _ = req.DiagnosticsWriter.WriteInteraction(
 				stage,
@@ -120,19 +136,8 @@ func (v *LLMBackedValidator) Validate(ctx context.Context, req Request) (Result,
 					"validator_name":  v.name,
 					"validator_type":  v.validatorType,
 					"batch_index":     batch.BatchIndex,
-					"prompt_metadata": map[string]any{
-						"prompt_id":      promptMetadata.PromptID,
-						"prompt_version": promptMetadata.PromptVersion,
-						"prompt_source":  promptMetadata.PromptSource,
-						"embedded_path":  promptMetadata.EmbeddedPath,
-						"sha256":         promptMetadata.SHA256,
-					},
-					"response_schema": map[string]any{
-						"id":      responseSchema.ID,
-						"version": responseSchema.Version,
-						"name":    responseSchema.Name,
-						"sha256":  responseSchema.SHA256,
-					},
+					"prompt_metadata": promptMetadata.DiagnosticsMap(),
+					"response_schema": responseSchema.DiagnosticsMap(),
 				},
 				map[string]any{"messages": messages, "items": batch.Items},
 				response,
@@ -140,12 +145,19 @@ func (v *LLMBackedValidator) Validate(ctx context.Context, req Request) (Result,
 			)
 		}
 		if err != nil {
+			if structuredoutput.IsMalformedError(err) {
+				llmDecisions = append(llmDecisions, rejectBatch(batch.Items, ReasonValidatorMalformed, fmt.Sprintf("validator response malformed: %s", strings.TrimSpace(err.Error())))...)
+				warnings = append(warnings, newValidatorWarning(v.name, batch.BatchIndex, ReasonValidatorMalformed, err.Error(), artifacts))
+				continue
+			}
 			return Result{}, fmt.Errorf("LLM validator %q completion failed: %w", v.name, err)
 		}
 
 		batchDecisions, err := mapLLMResponseToDecisions(batch.Items, response)
 		if err != nil {
-			return Result{}, fmt.Errorf("LLM validator %q response invalid: %w", v.name, err)
+			llmDecisions = append(llmDecisions, rejectBatch(batch.Items, ReasonValidatorMalformed, fmt.Sprintf("validator response malformed: %s", strings.TrimSpace(err.Error())))...)
+			warnings = append(warnings, newValidatorWarning(v.name, batch.BatchIndex, ReasonValidatorMalformed, err.Error(), artifacts))
+			continue
 		}
 		for i := range batchDecisions {
 			batchDecisions[i].DiagnosticArtifactPath = artifacts.ResponsePayloadPath
@@ -154,12 +166,13 @@ func (v *LLMBackedValidator) Validate(ctx context.Context, req Request) (Result,
 	}
 
 	all := append([]Decision(nil), immediate...)
+	all = append(all, oversized...)
 	all = append(all, llmDecisions...)
 	if err := EnforceDecisionCardinality(req.CandidateProposal, all); err != nil {
 		return Result{}, err
 	}
 	sort.SliceStable(all, func(i, j int) bool { return all[i].ProposalIndex < all[j].ProposalIndex })
-	return Result{ValidatorName: v.name, Decisions: all}, nil
+	return Result{ValidatorName: v.name, Decisions: all, Warnings: warnings}, nil
 }
 
 func validatorPromptMetadata(validatorType LLMValidatorType) prompts.Metadata {
@@ -301,3 +314,77 @@ func mapLLMResponseToDecisions(items []LLMValidationItem, response LLMValidation
 	}
 	return decisions, nil
 }
+
+func oversizedValidationDecisions(items []LLMValidationItem, maxPromptTokens int, estimator chunking.TokenEstimator) []Decision {
+	out := make([]Decision, 0)
+	for _, item := range items {
+		singleTokens, err := estimateBatchTokens(estimator, []LLMValidationItem{item})
+		if err != nil || singleTokens <= maxPromptTokens {
+			continue
+		}
+		out = append(out, rejection(item.CorrectionIndex, ReasonValidatorInputTooLarge, "validation input exceeds max prompt tokens"))
+	}
+	return out
+}
+
+func oversizedValidationWarnings(validatorName string, maxPromptTokens int, items []LLMValidationItem, estimator chunking.TokenEstimator) []stagewarnings.StageWarning {
+	out := make([]stagewarnings.StageWarning, 0)
+	for _, item := range items {
+		singleTokens, err := estimateBatchTokens(estimator, []LLMValidationItem{item})
+		if err != nil || singleTokens <= maxPromptTokens {
+			continue
+		}
+		out = append(out, stagewarnings.StageWarning{
+			Scope:         stagewarnings.ScopeValidator,
+			ValidatorName: validatorName,
+			ReasonCode:    ReasonValidatorInputTooLarge,
+			Message:       fmt.Sprintf("validation input exceeds max prompt tokens for proposal %d", item.CorrectionIndex),
+		})
+	}
+	return out
+}
+
+func filterItemsByDecision(items []LLMValidationItem, decisions []Decision) []LLMValidationItem {
+	if len(decisions) == 0 {
+		return append([]LLMValidationItem(nil), items...)
+	}
+	rejected := make(map[int]struct{}, len(decisions))
+	for _, decision := range decisions {
+		rejected[decision.ProposalIndex] = struct{}{}
+	}
+	out := make([]LLMValidationItem, 0, len(items))
+	for _, item := range items {
+		if _, ok := rejected[item.CorrectionIndex]; ok {
+			continue
+		}
+		out = append(out, item)
+	}
+	return out
+}
+
+func rejectBatch(items []LLMValidationItem, reasonCode string, message string) []Decision {
+	out := make([]Decision, 0, len(items))
+	for _, item := range items {
+		out = append(out, rejection(item.CorrectionIndex, reasonCode, message))
+	}
+	return out
+}
+
+func newValidatorWarning(validatorName string, batchIndex int, reasonCode string, message string, artifacts InteractionArtifacts) stagewarnings.StageWarning {
+	idx := batchIndex
+	return stagewarnings.StageWarning{
+		Scope:                  stagewarnings.ScopeValidator,
+		ValidatorName:          validatorName,
+		BatchIndex:             &idx,
+		ReasonCode:             reasonCode,
+		Message:                strings.TrimSpace(message),
+		DiagnosticArtifactPath: diagnosticArtifactPath(artifacts),
+	}
+}
+
+func diagnosticArtifactPath(artifacts InteractionArtifacts) string {
+	if artifacts.ErrorPayloadPath != "" {
+		return artifacts.ErrorPayloadPath
+	}
+	return artifacts.ResponsePayloadPath
+}

internal/framework/validators/llm_validators_test.go

@@ -248,29 +248,55 @@ func TestLLMBackedValidatorApprovalAndRejection(t *testing.T) {
 	}
 }
 
-func TestLLMBackedValidatorMalformedOutputFails(t *testing.T) {
+func TestLLMBackedValidatorMalformedOutputRejectsBatch(t *testing.T) {
 	client := &fakeStructuredLLMClient{err: errors.New("malformed structured output")}
 	v, _ := NewLLMBackedValidator("spoken_form_plausibility_review", LLMValidatorTypeSpokenFormPlausibility, "test-model")
 	req := makeReq([]proposals.EnrichedCorrectionProposal{mk(0, "gestures", "Jesters")})
 	req.LLMClient = client
-	_, err := v.Validate(context.Background(), req)
-	if err == nil || !strings.Contains(err.Error(), "completion failed") {
-		t.Fatalf("expected malformed output error, got %v", err)
+	res, err := v.Validate(context.Background(), req)
+	if err != nil {
+		t.Fatalf("expected malformed output downgrade, got %v", err)
+	}
+	if len(res.Decisions) != 1 || res.Decisions[0].Approved || res.Decisions[0].ReasonCode != ReasonValidatorMalformed {
+		t.Fatalf("unexpected decisions: %+v", res.Decisions)
+	}
+	if len(res.Warnings) != 1 || res.Warnings[0].ReasonCode != ReasonValidatorMalformed {
+		t.Fatalf("expected malformed warning, got %+v", res.Warnings)
 	}
 }
 
-func TestLLMBackedValidatorMissingDecisionFails(t *testing.T) {
+func TestLLMBackedValidatorProviderMalformedEnvelopeRejectsBatch(t *testing.T) {
+	client := &fakeStructuredLLMClient{err: errors.New("provider response assistant message content is empty")}
+	v, _ := NewLLMBackedValidator("spoken_form_plausibility_review", LLMValidatorTypeSpokenFormPlausibility, "test-model")
+	req := makeReq([]proposals.EnrichedCorrectionProposal{mk(0, "gestures", "Jesters")})
+	req.LLMClient = client
+	res, err := v.Validate(context.Background(), req)
+	if err != nil {
+		t.Fatalf("expected malformed provider envelope downgrade, got %v", err)
+	}
+	if len(res.Decisions) != 1 || res.Decisions[0].Approved || res.Decisions[0].ReasonCode != ReasonValidatorMalformed {
+		t.Fatalf("unexpected decisions: %+v", res.Decisions)
+	}
+	if len(res.Warnings) != 1 || res.Warnings[0].ReasonCode != ReasonValidatorMalformed {
+		t.Fatalf("expected malformed warning, got %+v", res.Warnings)
+	}
+}
+
+func TestLLMBackedValidatorMissingDecisionRejectsBatch(t *testing.T) {
 	client := &fakeStructuredLLMClient{responses: []LLMValidationResponse{{Validations: []LLMValidationDecision{}}}}
 	v, _ := NewLLMBackedValidator("spoken_form_plausibility_review", LLMValidatorTypeSpokenFormPlausibility, "test-model")
 	req := makeReq([]proposals.EnrichedCorrectionProposal{mk(0, "gestures", "Jesters")})
 	req.LLMClient = client
-	_, err := v.Validate(context.Background(), req)
-	if err == nil || !strings.Contains(err.Error(), "response invalid") {
-		t.Fatalf("expected missing decision error, got %v", err)
+	res, err := v.Validate(context.Background(), req)
+	if err != nil {
+		t.Fatalf("expected missing decision downgrade, got %v", err)
+	}
+	if len(res.Decisions) != 1 || res.Decisions[0].ReasonCode != ReasonValidatorMalformed {
+		t.Fatalf("unexpected decisions: %+v", res.Decisions)
 	}
 }
 
-func TestLLMBackedValidatorDuplicateDecisionFails(t *testing.T) {
+func TestLLMBackedValidatorDuplicateDecisionRejectsBatch(t *testing.T) {
 	client := &fakeStructuredLLMClient{responses: []LLMValidationResponse{{Validations: []LLMValidationDecision{
 		{CorrectionIndex: 0, Approved: true, Confidence: 0.9, Reason: "ok"},
 		{CorrectionIndex: 0, Approved: false, Confidence: 0.9, Reason: "dup"},
@@ -278,20 +304,74 @@ func TestLLMBackedValidatorDuplicateDecisionFails(t *testing.T) {
 	v, _ := NewLLMBackedValidator("spoken_form_plausibility_review", LLMValidatorTypeSpokenFormPlausibility, "test-model")
 	req := makeReq([]proposals.EnrichedCorrectionProposal{mk(0, "gestures", "Jesters")})
 	req.LLMClient = client
-	_, err := v.Validate(context.Background(), req)
-	if err == nil || !strings.Contains(err.Error(), "duplicate") {
-		t.Fatalf("expected duplicate decision error, got %v", err)
+	res, err := v.Validate(context.Background(), req)
+	if err != nil {
+		t.Fatalf("expected duplicate decision downgrade, got %v", err)
+	}
+	if len(res.Decisions) != 1 || res.Decisions[0].ReasonCode != ReasonValidatorMalformed {
+		t.Fatalf("unexpected decisions: %+v", res.Decisions)
 	}
 }
 
-func TestLLMBackedValidatorUnknownProposalIndexFails(t *testing.T) {
+func TestLLMBackedValidatorUnknownProposalIndexRejectsBatch(t *testing.T) {
 	client := &fakeStructuredLLMClient{responses: []LLMValidationResponse{{Validations: []LLMValidationDecision{{CorrectionIndex: 99, Approved: true, Confidence: 0.9, Reason: "unknown"}}}}}
 	v, _ := NewLLMBackedValidator("spoken_form_plausibility_review", LLMValidatorTypeSpokenFormPlausibility, "test-model")
 	req := makeReq([]proposals.EnrichedCorrectionProposal{mk(0, "gestures", "Jesters")})
 	req.LLMClient = client
-	_, err := v.Validate(context.Background(), req)
-	if err == nil || !strings.Contains(err.Error(), "unknown") {
-		t.Fatalf("expected unknown index error, got %v", err)
+	res, err := v.Validate(context.Background(), req)
+	if err != nil {
+		t.Fatalf("expected unknown index downgrade, got %v", err)
+	}
+	if len(res.Decisions) != 1 || res.Decisions[0].ReasonCode != ReasonValidatorMalformed {
+		t.Fatalf("unexpected decisions: %+v", res.Decisions)
+	}
+}
+
+func TestLLMBackedValidatorOversizedSingleProposalRejectsOnlyThatProposal(t *testing.T) {
+	client := &fakeStructuredLLMClient{responses: []LLMValidationResponse{{Validations: []LLMValidationDecision{
+		{CorrectionIndex: 1, Approved: true, Confidence: 0.9, Reason: "ok"},
+	}}}}
+	v, _ := NewLLMBackedValidator("spoken_form_plausibility_review", LLMValidatorTypeSpokenFormPlausibility, "test-model")
+	huge := strings.Repeat("gestures ", 200)
+	req := Request{
+		WorkingTranscript: &schema.Transcript{Segments: []schema.Segment{
+			{ID: 1, Text: huge},
+			{ID: 2, Text: "There were gestures at the temple.", Categories: []string{"narration"}},
+		}},
+		CandidateProposal: []proposals.EnrichedCorrectionProposal{
+			{
+				CorrectionProposal: proposals.CorrectionProposal{TargetSegmentID: 1, OriginalText: huge, CorrectedText: "Jesters", Confidence: 0.9},
+				ProposalMetadata:   proposals.ProposalMetadata{ProposalIndex: 0, ModuleKey: "homophones", ModuleInstance: "homophones"},
+			},
+			{
+				CorrectionProposal: proposals.CorrectionProposal{TargetSegmentID: 2, OriginalText: "gestures", CorrectedText: "Jesters", Confidence: 0.9},
+				ProposalMetadata:   proposals.ProposalMetadata{ProposalIndex: 1, ModuleKey: "homophones", ModuleInstance: "homophones"},
+			},
+		},
+		ModuleKey:         "homophones",
+		ModuleInstance:    "homophones",
+		ReplacementPolicy: proposals.ReplacementPolicyRequireUnique,
+	}
+	req.LLMClient = client
+	cfg := config.Default()
+	cfg.ValidationMaxPromptTokens = 200
+	req.Config = &cfg
+
+	res, err := v.Validate(context.Background(), req)
+	if err != nil {
+		t.Fatalf("expected oversize downgrade, got %v", err)
+	}
+	if len(res.Decisions) != 2 {
+		t.Fatalf("expected two decisions, got %+v", res.Decisions)
+	}
+	if res.Decisions[0].ReasonCode != ReasonValidatorInputTooLarge || res.Decisions[0].Approved {
+		t.Fatalf("expected first decision oversize rejection, got %+v", res.Decisions[0])
+	}
+	if !res.Decisions[1].Approved {
+		t.Fatalf("expected second decision approved, got %+v", res.Decisions[1])
+	}
+	if len(res.Warnings) != 1 || res.Warnings[0].ReasonCode != ReasonValidatorInputTooLarge {
+		t.Fatalf("expected one oversize warning, got %+v", res.Warnings)
 	}
 }
 

internal/framework/validators/models.go

@@ -6,8 +6,10 @@ import (
 	"strings"
 
 	"gitea.maximumdirect.net/eric/audita/internal/core/config"
+	"gitea.maximumdirect.net/eric/audita/internal/core/modulecatalog"
 	"gitea.maximumdirect.net/eric/audita/internal/core/schema"
 	"gitea.maximumdirect.net/eric/audita/internal/framework/proposals"
+	stagewarnings "gitea.maximumdirect.net/eric/audita/internal/framework/warnings"
 )
 
 const (
@@ -15,9 +17,14 @@ const (
 	ReasonLowConfidence          = "low_confidence"
 	ReasonMissingOriginalText    = "missing_original_text"
 	ReasonMissingTargetSegment   = "missing_target_segment"
-	ReasonEmptyCorrectedText    = "empty_corrected_text"
+	ReasonEmptyResultingText     = "empty_resulting_segment"
 	ReasonNoEffect               = "no_effect"
 	ReasonProtectedGlossaryTerm  = "protected_glossary_term"
+	ReasonInvalidTargetSegment   = "invalid_target_segment_id"
+	ReasonEmptyOriginalText      = "empty_original_text"
+	ReasonInvalidConfidence      = "invalid_confidence"
+	ReasonValidatorMalformed     = "validator_response_malformed"
+	ReasonValidatorInputTooLarge = "validator_input_too_large"
 )
 
 // Request is the runtime input shared by deterministic validators.
@@ -47,6 +54,7 @@ type Decision struct {
 type Result struct {
 	ValidatorName string                       `json:"validator_name"`
 	Decisions     []Decision                   `json:"decisions"`
+	Warnings      []stagewarnings.StageWarning `json:"warnings,omitempty"`
 }
 
 // ValidationScheduler provides bounded execution for validator LLM calls.
@@ -111,13 +119,13 @@ func confidenceThresholdForModule(moduleKey string, cfg *config.Config) float64
 		return 0.0
 	}
 	switch moduleKey {
-	case "glossary":
+	case modulecatalog.KeyGlossary:
 		return cfg.Thresholds.Glossary
-	case "grammar":
+	case modulecatalog.KeyGrammar:
 		return cfg.Thresholds.Grammar
-	case "homophones":
+	case modulecatalog.KeyHomophones:
 		return cfg.Thresholds.Homophones
-	case "spoken_word":
+	case modulecatalog.KeySpokenWord:
 		return cfg.Thresholds.SpokenWord
 	default:
 		return 0.0

internal/framework/validators/validators_test.go

@@ -68,6 +68,31 @@ func TestConfidenceThresholdValidator(t *testing.T) {
 	}
 }
 
+func TestProposalShapeValidator(t *testing.T) {
+	req := Request{CandidateProposal: []proposals.EnrichedCorrectionProposal{
+		mkCandidate(0, 1, "teh", "the", 0.9),
+		mkCandidate(1, 0, "teh", "the", 0.9),
+		mkCandidate(2, 1, "   ", "the", 0.9),
+		mkCandidate(3, 1, "teh", "the", 1.5),
+	}}
+	res, err := (ProposalShapeValidator{}).Validate(context.Background(), req)
+	if err != nil {
+		t.Fatalf("Validate error: %v", err)
+	}
+	if !res.Decisions[0].Approved {
+		t.Fatalf("expected proposal 0 approved")
+	}
+	if res.Decisions[1].ReasonCode != ReasonInvalidTargetSegment {
+		t.Fatalf("expected invalid target segment rejection, got %+v", res.Decisions[1])
+	}
+	if res.Decisions[2].ReasonCode != ReasonEmptyOriginalText {
+		t.Fatalf("expected empty original rejection, got %+v", res.Decisions[2])
+	}
+	if res.Decisions[3].ReasonCode != ReasonInvalidConfidence {
+		t.Fatalf("expected invalid confidence rejection, got %+v", res.Decisions[3])
+	}
+}
+
 func TestOriginalTextPresenceValidator(t *testing.T) {
 	req := Request{WorkingTranscript: &schema.Transcript{Segments: []schema.Segment{{ID: 1, Text: "hello world"}}}, CandidateProposal: []proposals.EnrichedCorrectionProposal{
 		mkCandidate(0, 1, "hello", "hi", 0.9),
@@ -90,9 +115,12 @@ func TestOriginalTextPresenceValidator(t *testing.T) {
 }
 
 func TestNonEmptyCorrectionValidator(t *testing.T) {
-	req := Request{CandidateProposal: []proposals.EnrichedCorrectionProposal{
+	req := Request{
+		WorkingTranscript: &schema.Transcript{Segments: []schema.Segment{{ID: 1, Text: "hello world"}}},
+		ReplacementPolicy: proposals.ReplacementPolicyRequireUnique,
+		CandidateProposal: []proposals.EnrichedCorrectionProposal{
 			mkCandidate(0, 1, "hello", "hi", 0.9),
-		mkCandidate(1, 1, "hello", "   ", 0.9),
+			mkCandidate(1, 1, "hello world", "   ", 0.9),
 		}}
 	res, err := (NonEmptyCorrectionValidator{}).Validate(context.Background(), req)
 	if err != nil {
@@ -101,8 +129,8 @@ func TestNonEmptyCorrectionValidator(t *testing.T) {
 	if !res.Decisions[0].Approved {
 		t.Fatalf("expected proposal 0 approved")
 	}
-	if res.Decisions[1].ReasonCode != ReasonEmptyCorrectedText {
-		t.Fatalf("expected empty_corrected_text, got %+v", res.Decisions[1])
+	if res.Decisions[1].ReasonCode != ReasonEmptyResultingText {
+		t.Fatalf("expected empty_resulting_segment, got %+v", res.Decisions[1])
 	}
 }
 
@@ -151,9 +179,14 @@ func TestStableReasonCodes(t *testing.T) {
 		ReasonLowConfidence,
 		ReasonMissingOriginalText,
 		ReasonMissingTargetSegment,
-		ReasonEmptyCorrectedText,
+		ReasonEmptyResultingText,
 		ReasonNoEffect,
 		ReasonProtectedGlossaryTerm,
+		ReasonInvalidTargetSegment,
+		ReasonEmptyOriginalText,
+		ReasonInvalidConfidence,
+		ReasonValidatorMalformed,
+		ReasonValidatorInputTooLarge,
 	}
 	for _, code := range codes {
 		if strings.TrimSpace(code) == "" {

internal/framework/warnings/warnings.go

@@ -0,0 +1,18 @@
+package warnings
+
+type Scope string
+
+const (
+	ScopeProposalGeneration Scope = "proposal_generation"
+	ScopeValidator          Scope = "validator"
+)
+
+type StageWarning struct {
+	Scope                  Scope  `json:"scope"`
+	ReasonCode             string `json:"reason_code"`
+	Message                string `json:"message"`
+	SectionIndex           *int   `json:"section_index,omitempty"`
+	ValidatorName          string `json:"validator_name,omitempty"`
+	BatchIndex             *int   `json:"batch_index,omitempty"`
+	DiagnosticArtifactPath string `json:"diagnostic_artifact_path,omitempty"`
+}

internal/modules/glossary/module.go

@@ -2,12 +2,11 @@ package glossary
 
 import (
 	"context"
-	"fmt"
 
-	"gitea.maximumdirect.net/eric/audita/internal/core/schema"
 	"gitea.maximumdirect.net/eric/audita/internal/framework/contracts"
 	"gitea.maximumdirect.net/eric/audita/internal/framework/proposal_generation"
 	"gitea.maximumdirect.net/eric/audita/internal/framework/proposals"
+	"gitea.maximumdirect.net/eric/audita/internal/prompts"
 	builtinvalidators "gitea.maximumdirect.net/eric/audita/internal/validators"
 )
 
@@ -36,65 +35,10 @@ func (m *Module) Validators() []contracts.Validator {
 	return append([]contracts.Validator(nil), m.validators...)
 }
 
-func (m *Module) Propose(ctx context.Context, req contracts.ProposalRequest) ([]proposals.CorrectionProposal, error) {
-	sectionTranscript := transcriptForSection(req.WorkingTranscript, req.Section)
-	sectionIndex := 0
-	if req.Section != nil {
-		sectionIndex = req.Section.Index
-	}
-	transcriptDescription := ""
-	if req.Config != nil {
-		transcriptDescription = req.Config.TranscriptDescription
-	}
-	messages, err := BuildProposalMessages(sectionTranscript, req.Glossary, sectionIndex, transcriptDescription)
-	if err != nil {
-		return nil, err
-	}
-
-	generated, err := proposal_generation.GenerateCandidates(ctx, proposal_generation.Request{
-		ModuleKey:         req.RunSpec.ModuleKey,
-		ModuleInstance:    req.RunSpec.InstanceName,
-		ReplacementPolicy: req.RunSpec.ReplacementPolicy,
-		WorkingTranscript: req.WorkingTranscript,
-		Section:           req.Section,
-		Glossary:          req.Glossary,
-		Config:            req.Config,
-		Messages:          messages,
-		PromptMetadata: map[string]any{
-			"prompt_id":      proposalPromptMetadata().PromptID,
-			"prompt_version": proposalPromptMetadata().PromptVersion,
-			"prompt_source":  proposalPromptMetadata().PromptSource,
-			"embedded_path":  proposalPromptMetadata().EmbeddedPath,
-			"sha256":         proposalPromptMetadata().SHA256,
-		},
-		StageName:      proposalStageName(req),
-		StartIndex:     0,
-		LLMClient:      req.LLMClient,
-		Scheduler:      req.LLMScheduler,
-		DiagnosticsDir: req.DiagnosticsDir,
+func (m *Module) Propose(ctx context.Context, req contracts.ProposalRequest) (contracts.ProposalResult, error) {
+	return proposal_generation.ExecuteModuleProposal(ctx, proposal_generation.ModuleProposalRequest{
+		ProposalRequest: req,
+		PromptID:        prompts.PromptIDModuleGlossaryProposal,
+		BuildMessages:   BuildProposalMessages,
 	})
-	if err != nil {
-		return nil, err
-	}
-	return generated.Corrections, nil
-}
-
-func transcriptForSection(transcript *schema.Transcript, section *contracts.SectionMetadata) *schema.Transcript {
-	if section == nil || transcript == nil {
-		return transcript
-	}
-	segments := make([]schema.Segment, 0, len(transcript.Segments))
-	for _, seg := range transcript.Segments {
-		if seg.ID >= section.StartSegmentID && seg.ID <= section.EndSegmentID {
-			segments = append(segments, seg)
-		}
-	}
-	return &schema.Transcript{Segments: segments}
-}
-
-func proposalStageName(req contracts.ProposalRequest) string {
-	if req.Section == nil || req.Section.Index == 0 {
-		return fmt.Sprintf("%s:proposal", req.RunSpec.InstanceName)
-	}
-	return fmt.Sprintf("%s:proposal:section-%04d", req.RunSpec.InstanceName, req.Section.Index)
 }

internal/modules/glossary/module_test.go

@@ -129,6 +129,7 @@ func TestGlossaryModuleValidatorChain(t *testing.T) {
 		got = append(got, v.Name())
 	}
 	want := []string{
+		"proposal_shape",
 		"no_effect",
 		"original_text_presence",
 		"confidence_threshold",
@@ -185,7 +186,7 @@ func TestGlossaryModuleProposeMapsCorrectionsAndWritesDiagnostics(t *testing.T)
 	if len(client.calls) != 1 || client.calls[0].StageName != "glossary:proposal" {
 		t.Fatalf("expected one glossary:proposal call, got %+v", client.calls)
 	}
-	if len(out) != 1 || out[0].CorrectedText != "Jesters" {
+	if len(out.Proposals) != 1 || out.Proposals[0].CorrectedText != "Jesters" {
 		t.Fatalf("unexpected proposals: %+v", out)
 	}
 	diagFiles, globErr := filepath.Glob(filepath.Join(diagDir, "glossary", "*proposal*response-payload.json"))

internal/modules/glossary/prompt.go

@@ -10,43 +10,13 @@ import (
 	"gitea.maximumdirect.net/eric/audita/internal/prompts"
 )
 
-type promptSegment struct {
-	ID         int      `json:"id"`
-	Speaker    string   `json:"speaker"`
-	Start      float64  `json:"start"`
-	End        float64  `json:"end"`
-	Text       string   `json:"text"`
-	Categories []string `json:"categories,omitempty"`
-}
-
-type promptTranscriptSection struct {
-	SectionIndex int             `json:"section_index"`
-	Segments     []promptSegment `json:"segments"`
-}
-
 func BuildProposalMessages(transcript *schema.Transcript, glossary *schema.Glossary, sectionIndex int, transcriptDescription string) ([]contracts.LLMMessage, error) {
 	glossaryJSON, err := json.MarshalIndent(glossary, "", "  ")
 	if err != nil {
 		return nil, fmt.Errorf("marshal glossary prompt context: %w", err)
 	}
 
-	sectionPayload := promptTranscriptSection{
-		SectionIndex: sectionIndex,
-		Segments:     make([]promptSegment, 0),
-	}
-	if transcript != nil {
-		for _, s := range transcript.Segments {
-			sectionPayload.Segments = append(sectionPayload.Segments, promptSegment{
-				ID:         s.ID,
-				Speaker:    s.Speaker,
-				Start:      s.Start,
-				End:        s.End,
-				Text:       s.Text,
-				Categories: append([]string(nil), s.Categories...),
-			})
-		}
-	}
-	sectionJSON, err := json.MarshalIndent(sectionPayload, "", "  ")
+	sectionJSON, err := promptcontext.MarshalTranscriptSectionJSON(transcript, sectionIndex)
 	if err != nil {
 		return nil, fmt.Errorf("marshal transcript prompt context: %w", err)
 	}
@@ -65,7 +35,3 @@ func BuildProposalMessages(transcript *schema.Transcript, glossary *schema.Gloss
 		{Role: "user", Content: user},
 	}, nil
 }
-
-func proposalPromptMetadata() prompts.Metadata {
-	return prompts.MustLookupMetadata(prompts.PromptIDModuleGlossaryProposal)
-}

internal/modules/grammar/module.go

@@ -2,12 +2,11 @@ package grammar
 
 import (
 	"context"
-	"fmt"
 
-	"gitea.maximumdirect.net/eric/audita/internal/core/schema"
 	"gitea.maximumdirect.net/eric/audita/internal/framework/contracts"
 	"gitea.maximumdirect.net/eric/audita/internal/framework/proposal_generation"
 	"gitea.maximumdirect.net/eric/audita/internal/framework/proposals"
+	"gitea.maximumdirect.net/eric/audita/internal/prompts"
 	builtinvalidators "gitea.maximumdirect.net/eric/audita/internal/validators"
 )
 
@@ -36,65 +35,10 @@ func (m *Module) Validators() []contracts.Validator {
 	return append([]contracts.Validator(nil), m.validators...)
 }
 
-func (m *Module) Propose(ctx context.Context, req contracts.ProposalRequest) ([]proposals.CorrectionProposal, error) {
-	sectionTranscript := transcriptForSection(req.WorkingTranscript, req.Section)
-	sectionIndex := 0
-	if req.Section != nil {
-		sectionIndex = req.Section.Index
-	}
-	transcriptDescription := ""
-	if req.Config != nil {
-		transcriptDescription = req.Config.TranscriptDescription
-	}
-	messages, err := BuildProposalMessages(sectionTranscript, req.Glossary, sectionIndex, transcriptDescription)
-	if err != nil {
-		return nil, err
-	}
-
-	generated, err := proposal_generation.GenerateCandidates(ctx, proposal_generation.Request{
-		ModuleKey:         req.RunSpec.ModuleKey,
-		ModuleInstance:    req.RunSpec.InstanceName,
-		ReplacementPolicy: req.RunSpec.ReplacementPolicy,
-		WorkingTranscript: req.WorkingTranscript,
-		Section:           req.Section,
-		Glossary:          req.Glossary,
-		Config:            req.Config,
-		Messages:          messages,
-		PromptMetadata: map[string]any{
-			"prompt_id":      proposalPromptMetadata().PromptID,
-			"prompt_version": proposalPromptMetadata().PromptVersion,
-			"prompt_source":  proposalPromptMetadata().PromptSource,
-			"embedded_path":  proposalPromptMetadata().EmbeddedPath,
-			"sha256":         proposalPromptMetadata().SHA256,
-		},
-		StageName:      proposalStageName(req),
-		StartIndex:     0,
-		LLMClient:      req.LLMClient,
-		Scheduler:      req.LLMScheduler,
-		DiagnosticsDir: req.DiagnosticsDir,
+func (m *Module) Propose(ctx context.Context, req contracts.ProposalRequest) (contracts.ProposalResult, error) {
+	return proposal_generation.ExecuteModuleProposal(ctx, proposal_generation.ModuleProposalRequest{
+		ProposalRequest: req,
+		PromptID:        prompts.PromptIDModuleGrammarProposal,
+		BuildMessages:   BuildProposalMessages,
 	})
-	if err != nil {
-		return nil, err
-	}
-	return generated.Corrections, nil
-}
-
-func transcriptForSection(transcript *schema.Transcript, section *contracts.SectionMetadata) *schema.Transcript {
-	if section == nil || transcript == nil {
-		return transcript
-	}
-	segments := make([]schema.Segment, 0, len(transcript.Segments))
-	for _, seg := range transcript.Segments {
-		if seg.ID >= section.StartSegmentID && seg.ID <= section.EndSegmentID {
-			segments = append(segments, seg)
-		}
-	}
-	return &schema.Transcript{Segments: segments}
-}
-
-func proposalStageName(req contracts.ProposalRequest) string {
-	if req.Section == nil || req.Section.Index == 0 {
-		return fmt.Sprintf("%s:proposal", req.RunSpec.InstanceName)
-	}
-	return fmt.Sprintf("%s:proposal:section-%04d", req.RunSpec.InstanceName, req.Section.Index)
 }

internal/modules/grammar/module_test.go

@@ -131,6 +131,7 @@ func TestGrammarModuleValidatorChain(t *testing.T) {
 		got = append(got, v.Name())
 	}
 	want := []string{
+		"proposal_shape",
 		"no_effect",
 		"original_text_presence",
 		"confidence_threshold",
@@ -187,7 +188,7 @@ func TestGrammarModuleProposeMapsCorrectionsAndWritesDiagnostics(t *testing.T) {
 	if len(client.calls) != 1 || client.calls[0].StageName != "grammar:proposal" {
 		t.Fatalf("expected one grammar:proposal call, got %+v", client.calls)
 	}
-	if len(out) != 1 || out[0].CorrectedText != "Hello, world" {
+	if len(out.Proposals) != 1 || out.Proposals[0].CorrectedText != "Hello, world" {
 		t.Fatalf("unexpected proposals: %+v", out)
 	}
 	diagFiles, globErr := filepath.Glob(filepath.Join(diagDir, "grammar", "*proposal*response-payload.json"))

internal/modules/grammar/prompt.go

@@ -10,20 +10,6 @@ import (
 	"gitea.maximumdirect.net/eric/audita/internal/prompts"
 )
 
-type promptSegment struct {
-	ID         int      `json:"id"`
-	Speaker    string   `json:"speaker"`
-	Start      float64  `json:"start"`
-	End        float64  `json:"end"`
-	Text       string   `json:"text"`
-	Categories []string `json:"categories,omitempty"`
-}
-
-type promptTranscriptSection struct {
-	SectionIndex int             `json:"section_index"`
-	Segments     []promptSegment `json:"segments"`
-}
-
 // BuildProposalMessages constrains corrections to punctuation/capitalization/
 // spacing cleanup with strict meaning guards.
 func BuildProposalMessages(transcript *schema.Transcript, glossary *schema.Glossary, sectionIndex int, transcriptDescription string) ([]contracts.LLMMessage, error) {
@@ -32,24 +18,7 @@ func BuildProposalMessages(transcript *schema.Transcript, glossary *schema.Gloss
 		return nil, fmt.Errorf("marshal glossary prompt context: %w", err)
 	}
 
-	sectionPayload := promptTranscriptSection{
-		SectionIndex: sectionIndex,
-		Segments:     make([]promptSegment, 0),
-	}
-	if transcript != nil {
-		for _, s := range transcript.Segments {
-			sectionPayload.Segments = append(sectionPayload.Segments, promptSegment{
-				ID:         s.ID,
-				Speaker:    s.Speaker,
-				Start:      s.Start,
-				End:        s.End,
-				Text:       s.Text,
-				Categories: append([]string(nil), s.Categories...),
-			})
-		}
-	}
-
-	sectionJSON, err := json.MarshalIndent(sectionPayload, "", "  ")
+	sectionJSON, err := promptcontext.MarshalTranscriptSectionJSON(transcript, sectionIndex)
 	if err != nil {
 		return nil, fmt.Errorf("marshal transcript prompt context: %w", err)
 	}
@@ -68,7 +37,3 @@ func BuildProposalMessages(transcript *schema.Transcript, glossary *schema.Gloss
 		{Role: "user", Content: user},
 	}, nil
 }
-
-func proposalPromptMetadata() prompts.Metadata {
-	return prompts.MustLookupMetadata(prompts.PromptIDModuleGrammarProposal)
-}

internal/modules/homophones/module.go

@@ -2,12 +2,11 @@ package homophones
 
 import (
 	"context"
-	"fmt"
 
-	"gitea.maximumdirect.net/eric/audita/internal/core/schema"
 	"gitea.maximumdirect.net/eric/audita/internal/framework/contracts"
 	"gitea.maximumdirect.net/eric/audita/internal/framework/proposal_generation"
 	"gitea.maximumdirect.net/eric/audita/internal/framework/proposals"
+	"gitea.maximumdirect.net/eric/audita/internal/prompts"
 	builtinvalidators "gitea.maximumdirect.net/eric/audita/internal/validators"
 )
 
@@ -36,65 +35,10 @@ func (m *Module) Validators() []contracts.Validator {
 	return append([]contracts.Validator(nil), m.validators...)
 }
 
-func (m *Module) Propose(ctx context.Context, req contracts.ProposalRequest) ([]proposals.CorrectionProposal, error) {
-	sectionTranscript := transcriptForSection(req.WorkingTranscript, req.Section)
-	sectionIndex := 0
-	if req.Section != nil {
-		sectionIndex = req.Section.Index
-	}
-	transcriptDescription := ""
-	if req.Config != nil {
-		transcriptDescription = req.Config.TranscriptDescription
-	}
-	messages, err := BuildProposalMessages(sectionTranscript, req.Glossary, sectionIndex, transcriptDescription)
-	if err != nil {
-		return nil, err
-	}
-
-	generated, err := proposal_generation.GenerateCandidates(ctx, proposal_generation.Request{
-		ModuleKey:         req.RunSpec.ModuleKey,
-		ModuleInstance:    req.RunSpec.InstanceName,
-		ReplacementPolicy: req.RunSpec.ReplacementPolicy,
-		WorkingTranscript: req.WorkingTranscript,
-		Section:           req.Section,
-		Glossary:          req.Glossary,
-		Config:            req.Config,
-		Messages:          messages,
-		PromptMetadata: map[string]any{
-			"prompt_id":      proposalPromptMetadata().PromptID,
-			"prompt_version": proposalPromptMetadata().PromptVersion,
-			"prompt_source":  proposalPromptMetadata().PromptSource,
-			"embedded_path":  proposalPromptMetadata().EmbeddedPath,
-			"sha256":         proposalPromptMetadata().SHA256,
-		},
-		StageName:      proposalStageName(req),
-		StartIndex:     0,
-		LLMClient:      req.LLMClient,
-		Scheduler:      req.LLMScheduler,
-		DiagnosticsDir: req.DiagnosticsDir,
+func (m *Module) Propose(ctx context.Context, req contracts.ProposalRequest) (contracts.ProposalResult, error) {
+	return proposal_generation.ExecuteModuleProposal(ctx, proposal_generation.ModuleProposalRequest{
+		ProposalRequest: req,
+		PromptID:        prompts.PromptIDModuleHomophonesProposal,
+		BuildMessages:   BuildProposalMessages,
 	})
-	if err != nil {
-		return nil, err
-	}
-	return generated.Corrections, nil
-}
-
-func transcriptForSection(transcript *schema.Transcript, section *contracts.SectionMetadata) *schema.Transcript {
-	if section == nil || transcript == nil {
-		return transcript
-	}
-	segments := make([]schema.Segment, 0, len(transcript.Segments))
-	for _, seg := range transcript.Segments {
-		if seg.ID >= section.StartSegmentID && seg.ID <= section.EndSegmentID {
-			segments = append(segments, seg)
-		}
-	}
-	return &schema.Transcript{Segments: segments}
-}
-
-func proposalStageName(req contracts.ProposalRequest) string {
-	if req.Section == nil || req.Section.Index == 0 {
-		return fmt.Sprintf("%s:proposal", req.RunSpec.InstanceName)
-	}
-	return fmt.Sprintf("%s:proposal:section-%04d", req.RunSpec.InstanceName, req.Section.Index)
 }

internal/modules/homophones/module_test.go

@@ -145,6 +145,7 @@ func TestHomophonesModuleValidatorChain(t *testing.T) {
 		got = append(got, v.Name())
 	}
 	want := []string{
+		"proposal_shape",
 		"no_effect",
 		"original_text_presence",
 		"confidence_threshold",
@@ -201,7 +202,7 @@ func TestHomophonesModuleProposeMapsCorrectionsAndWritesDiagnostics(t *testing.T
 	if len(client.calls) != 1 || client.calls[0].StageName != "homophones:proposal" {
 		t.Fatalf("expected one homophones:proposal call, got %+v", client.calls)
 	}
-	if len(out) != 1 || out[0].CorrectedText != "Jesters" {
+	if len(out.Proposals) != 1 || out.Proposals[0].CorrectedText != "Jesters" {
 		t.Fatalf("unexpected proposals: %+v", out)
 	}
 	diagFiles, globErr := filepath.Glob(filepath.Join(diagDir, "homophones", "*proposal*response-payload.json"))

internal/modules/homophones/prompt.go

@@ -10,20 +10,6 @@ import (
 	"gitea.maximumdirect.net/eric/audita/internal/prompts"
 )
 
-type promptSegment struct {
-	ID         int      `json:"id"`
-	Speaker    string   `json:"speaker"`
-	Start      float64  `json:"start"`
-	End        float64  `json:"end"`
-	Text       string   `json:"text"`
-	Categories []string `json:"categories,omitempty"`
-}
-
-type promptTranscriptSection struct {
-	SectionIndex int             `json:"section_index"`
-	Segments     []promptSegment `json:"segments"`
-}
-
 // BuildProposalMessages constrains corrections to conservative homophone and
 // mistranscription updates.
 func BuildProposalMessages(transcript *schema.Transcript, glossary *schema.Glossary, sectionIndex int, transcriptDescription string) ([]contracts.LLMMessage, error) {
@@ -32,23 +18,7 @@ func BuildProposalMessages(transcript *schema.Transcript, glossary *schema.Gloss
 		return nil, fmt.Errorf("marshal glossary prompt context: %w", err)
 	}
 
-	sectionPayload := promptTranscriptSection{
-		SectionIndex: sectionIndex,
-		Segments:     make([]promptSegment, 0),
-	}
-	if transcript != nil {
-		for _, s := range transcript.Segments {
-			sectionPayload.Segments = append(sectionPayload.Segments, promptSegment{
-				ID:         s.ID,
-				Speaker:    s.Speaker,
-				Start:      s.Start,
-				End:        s.End,
-				Text:       s.Text,
-				Categories: append([]string(nil), s.Categories...),
-			})
-		}
-	}
-	sectionJSON, err := json.MarshalIndent(sectionPayload, "", "  ")
+	sectionJSON, err := promptcontext.MarshalTranscriptSectionJSON(transcript, sectionIndex)
 	if err != nil {
 		return nil, fmt.Errorf("marshal transcript prompt context: %w", err)
 	}
@@ -67,7 +37,3 @@ func BuildProposalMessages(transcript *schema.Transcript, glossary *schema.Gloss
 		{Role: "user", Content: user},
 	}, nil
 }
-
-func proposalPromptMetadata() prompts.Metadata {
-	return prompts.MustLookupMetadata(prompts.PromptIDModuleHomophonesProposal)
-}

internal/modules/spoken_word/module.go

@@ -2,12 +2,11 @@ package spoken_word
 
 import (
 	"context"
-	"fmt"
 
-	"gitea.maximumdirect.net/eric/audita/internal/core/schema"
 	"gitea.maximumdirect.net/eric/audita/internal/framework/contracts"
 	"gitea.maximumdirect.net/eric/audita/internal/framework/proposal_generation"
 	"gitea.maximumdirect.net/eric/audita/internal/framework/proposals"
+	"gitea.maximumdirect.net/eric/audita/internal/prompts"
 	builtinvalidators "gitea.maximumdirect.net/eric/audita/internal/validators"
 )
 
@@ -36,65 +35,10 @@ func (m *Module) Validators() []contracts.Validator {
 	return append([]contracts.Validator(nil), m.validators...)
 }
 
-func (m *Module) Propose(ctx context.Context, req contracts.ProposalRequest) ([]proposals.CorrectionProposal, error) {
-	sectionTranscript := transcriptForSection(req.WorkingTranscript, req.Section)
-	sectionIndex := 0
-	if req.Section != nil {
-		sectionIndex = req.Section.Index
-	}
-	transcriptDescription := ""
-	if req.Config != nil {
-		transcriptDescription = req.Config.TranscriptDescription
-	}
-	messages, err := BuildProposalMessages(sectionTranscript, req.Glossary, sectionIndex, transcriptDescription)
-	if err != nil {
-		return nil, err
-	}
-
-	generated, err := proposal_generation.GenerateCandidates(ctx, proposal_generation.Request{
-		ModuleKey:         req.RunSpec.ModuleKey,
-		ModuleInstance:    req.RunSpec.InstanceName,
-		ReplacementPolicy: req.RunSpec.ReplacementPolicy,
-		WorkingTranscript: req.WorkingTranscript,
-		Section:           req.Section,
-		Glossary:          req.Glossary,
-		Config:            req.Config,
-		Messages:          messages,
-		PromptMetadata: map[string]any{
-			"prompt_id":      proposalPromptMetadata().PromptID,
-			"prompt_version": proposalPromptMetadata().PromptVersion,
-			"prompt_source":  proposalPromptMetadata().PromptSource,
-			"embedded_path":  proposalPromptMetadata().EmbeddedPath,
-			"sha256":         proposalPromptMetadata().SHA256,
-		},
-		StageName:      proposalStageName(req),
-		StartIndex:     0,
-		LLMClient:      req.LLMClient,
-		Scheduler:      req.LLMScheduler,
-		DiagnosticsDir: req.DiagnosticsDir,
+func (m *Module) Propose(ctx context.Context, req contracts.ProposalRequest) (contracts.ProposalResult, error) {
+	return proposal_generation.ExecuteModuleProposal(ctx, proposal_generation.ModuleProposalRequest{
+		ProposalRequest: req,
+		PromptID:        prompts.PromptIDModuleSpokenWordProposal,
+		BuildMessages:   BuildProposalMessages,
 	})
-	if err != nil {
-		return nil, err
-	}
-	return generated.Corrections, nil
-}
-
-func transcriptForSection(transcript *schema.Transcript, section *contracts.SectionMetadata) *schema.Transcript {
-	if section == nil || transcript == nil {
-		return transcript
-	}
-	segments := make([]schema.Segment, 0, len(transcript.Segments))
-	for _, seg := range transcript.Segments {
-		if seg.ID >= section.StartSegmentID && seg.ID <= section.EndSegmentID {
-			segments = append(segments, seg)
-		}
-	}
-	return &schema.Transcript{Segments: segments}
-}
-
-func proposalStageName(req contracts.ProposalRequest) string {
-	if req.Section == nil || req.Section.Index == 0 {
-		return fmt.Sprintf("%s:proposal", req.RunSpec.InstanceName)
-	}
-	return fmt.Sprintf("%s:proposal:section-%04d", req.RunSpec.InstanceName, req.Section.Index)
 }

internal/modules/spoken_word/module_test.go

@@ -132,6 +132,7 @@ func TestSpokenWordModuleValidatorChain(t *testing.T) {
 		got = append(got, v.Name())
 	}
 	want := []string{
+		"proposal_shape",
 		"no_effect",
 		"original_text_presence",
 		"confidence_threshold",
@@ -188,7 +189,7 @@ func TestSpokenWordModuleProposeMapsCorrectionsAndWritesDiagnostics(t *testing.T
 	if len(client.calls) != 1 || client.calls[0].StageName != "spoken_word:proposal" {
 		t.Fatalf("expected one spoken_word:proposal call, got %+v", client.calls)
 	}
-	if len(out) != 1 || out[0].CorrectedText != "I think" {
+	if len(out.Proposals) != 1 || out.Proposals[0].CorrectedText != "I think" {
 		t.Fatalf("unexpected proposals: %+v", out)
 	}
 	diagFiles, globErr := filepath.Glob(filepath.Join(diagDir, "spoken_word", "*proposal*response-payload.json"))

internal/modules/spoken_word/prompt.go

@@ -10,20 +10,6 @@ import (
 	"gitea.maximumdirect.net/eric/audita/internal/prompts"
 )
 
-type promptSegment struct {
-	ID         int      `json:"id"`
-	Speaker    string   `json:"speaker"`
-	Start      float64  `json:"start"`
-	End        float64  `json:"end"`
-	Text       string   `json:"text"`
-	Categories []string `json:"categories,omitempty"`
-}
-
-type promptTranscriptSection struct {
-	SectionIndex int             `json:"section_index"`
-	Segments     []promptSegment `json:"segments"`
-}
-
 // BuildProposalMessages constrains corrections to conservative dysfluency
 // cleanup with strict semantic preservation.
 func BuildProposalMessages(transcript *schema.Transcript, glossary *schema.Glossary, sectionIndex int, transcriptDescription string) ([]contracts.LLMMessage, error) {
@@ -32,23 +18,7 @@ func BuildProposalMessages(transcript *schema.Transcript, glossary *schema.Gloss
 		return nil, fmt.Errorf("marshal glossary prompt context: %w", err)
 	}
 
-	sectionPayload := promptTranscriptSection{
-		SectionIndex: sectionIndex,
-		Segments:     make([]promptSegment, 0),
-	}
-	if transcript != nil {
-		for _, s := range transcript.Segments {
-			sectionPayload.Segments = append(sectionPayload.Segments, promptSegment{
-				ID:         s.ID,
-				Speaker:    s.Speaker,
-				Start:      s.Start,
-				End:        s.End,
-				Text:       s.Text,
-				Categories: append([]string(nil), s.Categories...),
-			})
-		}
-	}
-	sectionJSON, err := json.MarshalIndent(sectionPayload, "", "  ")
+	sectionJSON, err := promptcontext.MarshalTranscriptSectionJSON(transcript, sectionIndex)
 	if err != nil {
 		return nil, fmt.Errorf("marshal transcript prompt context: %w", err)
 	}
@@ -67,7 +37,3 @@ func BuildProposalMessages(transcript *schema.Transcript, glossary *schema.Gloss
 		{Role: "user", Content: user},
 	}, nil
 }
-
-func proposalPromptMetadata() prompts.Metadata {
-	return prompts.MustLookupMetadata(prompts.PromptIDModuleSpokenWordProposal)
-}

internal/prompts/registry.go

@@ -40,6 +40,16 @@ type Metadata struct {
 	SHA256        string `json:"sha256"`
 }
 
+func (m Metadata) DiagnosticsMap() map[string]any {
+	return map[string]any{
+		"prompt_id":      m.PromptID,
+		"prompt_version": m.PromptVersion,
+		"prompt_source":  m.PromptSource,
+		"embedded_path":  m.EmbeddedPath,
+		"sha256":         m.SHA256,
+	}
+}
+
 type definition struct {
 	id          string
 	version     string

internal/prompts/registry_test.go

@@ -107,3 +107,16 @@ func TestRenderedPromptsContainHardening(t *testing.T) {
 		}
 	}
 }
+
+func TestDiagnosticsMapIncludesStablePromptMetadataShapeForAllPrompts(t *testing.T) {
+	for _, m := range RegisteredMetadata() {
+		metadataMap := m.DiagnosticsMap()
+		if metadataMap["prompt_id"] != m.PromptID ||
+			metadataMap["prompt_version"] != m.PromptVersion ||
+			metadataMap["prompt_source"] != m.PromptSource ||
+			metadataMap["embedded_path"] != m.EmbeddedPath ||
+			metadataMap["sha256"] != m.SHA256 {
+			t.Fatalf("unexpected diagnostics metadata map for %q: %+v", m.PromptID, metadataMap)
+		}
+	}
+}

internal/testsupport/files.go

@@ -0,0 +1,57 @@
+package testsupport
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func ReadFile(t *testing.T, path string) []byte {
+	t.Helper()
+	data, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("failed to read file %q: %v", path, err)
+	}
+	return data
+}
+
+func OnlyRunDir(t *testing.T, workDir string) string {
+	t.Helper()
+	entries, err := os.ReadDir(workDir)
+	if err != nil {
+		t.Fatalf("failed to read work dir %q: %v", workDir, err)
+	}
+	dirs := make([]string, 0, len(entries))
+	for _, e := range entries {
+		if e.IsDir() {
+			dirs = append(dirs, filepath.Join(workDir, e.Name()))
+		}
+	}
+	if len(dirs) != 1 {
+		t.Fatalf("expected exactly one run dir in %q, found %d", workDir, len(dirs))
+	}
+	return dirs[0]
+}
+
+func AssertNoSecretInFile(t *testing.T, path, secret string) {
+	t.Helper()
+	raw := string(ReadFile(t, path))
+	if strings.Contains(raw, secret) {
+		t.Fatalf("secret leaked in %s", path)
+	}
+}
+
+func AssertNoSecretInTree(t *testing.T, root, secret string) {
+	t.Helper()
+	_ = filepath.WalkDir(root, func(path string, d os.DirEntry, err error) error {
+		if err != nil || d == nil || d.IsDir() {
+			return nil
+		}
+		raw, readErr := os.ReadFile(path)
+		if readErr == nil && strings.Contains(string(raw), secret) {
+			t.Fatalf("secret leaked in %s", path)
+		}
+		return nil
+	})
+}

internal/validators/chains.go

@@ -2,13 +2,16 @@ package validators
 
 import (
 	"fmt"
+	"strings"
 
+	"gitea.maximumdirect.net/eric/audita/internal/core/modulecatalog"
 	"gitea.maximumdirect.net/eric/audita/internal/framework/contracts"
 	"gitea.maximumdirect.net/eric/audita/internal/validators/protected_terms"
 )
 
 var builtInChains = map[string][]string{
-	"glossary": {
+	modulecatalog.KeyGlossary: {
+		KeyProposalShape,
 		KeyNoEffect,
 		KeyOriginalTextPresence,
 		KeyConfidenceThreshold,
@@ -17,7 +20,8 @@ var builtInChains = map[string][]string{
 		KeySpokenFormPlausibility,
 		KeyMeaningReversalReview,
 	},
-	"homophones": {
+	modulecatalog.KeyHomophones: {
+		KeyProposalShape,
 		KeyNoEffect,
 		KeyOriginalTextPresence,
 		KeyConfidenceThreshold,
@@ -26,7 +30,8 @@ var builtInChains = map[string][]string{
 		KeySpokenFormPlausibility,
 		KeyMeaningReversalReview,
 	},
-	"spoken_word": {
+	modulecatalog.KeySpokenWord: {
+		KeyProposalShape,
 		KeyNoEffect,
 		KeyOriginalTextPresence,
 		KeyConfidenceThreshold,
@@ -35,7 +40,8 @@ var builtInChains = map[string][]string{
 		KeyEditorialReview,
 		KeyMeaningReversalReview,
 	},
-	"grammar": {
+	modulecatalog.KeyGrammar: {
+		KeyProposalShape,
 		KeyNoEffect,
 		KeyOriginalTextPresence,
 		KeyConfidenceThreshold,
@@ -47,9 +53,10 @@ var builtInChains = map[string][]string{
 }
 
 func BuiltInChainKeys(moduleKey string) ([]string, error) {
-	keys, ok := builtInChains[moduleKey]
+	key := strings.TrimSpace(moduleKey)
+	keys, ok := builtInChains[key]
 	if !ok {
-		return nil, fmt.Errorf("no built-in validator chain for module %q", moduleKey)
+		return nil, fmt.Errorf("no built-in validator chain for module %q", key)
 	}
 	out := make([]string, len(keys))
 	copy(out, keys)
@@ -57,6 +64,7 @@ func BuiltInChainKeys(moduleKey string) ([]string, error) {
 }
 
 func ResolveBuiltInChain(moduleKey string, registry *Registry) ([]contracts.Validator, error) {
+	moduleKey = strings.TrimSpace(moduleKey)
 	keys, err := BuiltInChainKeys(moduleKey)
 	if err != nil {
 		return nil, err
@@ -67,7 +75,7 @@ func ResolveBuiltInChain(moduleKey string, registry *Registry) ([]contracts.Vali
 
 	out := make([]contracts.Validator, 0, len(keys))
 	for _, key := range keys {
-		if moduleKey == "glossary" && key == KeyProtectedTerms {
+		if moduleKey == modulecatalog.KeyGlossary && key == KeyProtectedTerms {
 			// Glossary stages preserve current stricter protection semantics while
 			// reporting the stable protected_terms key.
 			v, buildErr := protected_terms.NewGlossaryStage()

internal/validators/metadata/metadata.go

@@ -1,6 +1,10 @@
 package metadata
 
-import "gitea.maximumdirect.net/eric/audita/internal/framework/contracts"
+import (
+	"strings"
+
+	"gitea.maximumdirect.net/eric/audita/internal/framework/contracts"
+)
 
 type ExecutionClass string
 
@@ -9,6 +13,31 @@ const (
 	ExecutionClassLLMBacked     ExecutionClass = "llm_backed"
 )
 
+const (
+	KeyProposalShape         = "proposal_shape"
+	KeyConfidenceThreshold   = "confidence_threshold"
+	KeyOriginalTextPresence  = "original_text_presence"
+	KeyNonEmptyCorrectedText = "non_empty_corrected_text"
+	KeyNoEffect              = "no_effect"
+	KeyProtectedTerms        = "protected_terms"
+
+	KeySpokenFormPlausibility = "spoken_form_plausibility"
+	KeyMeaningReversalReview  = "meaning_reversal_review"
+	KeyEditorialReview        = "editorial_review"
+)
+
+var executionClassByKey = map[string]ExecutionClass{
+	KeyProposalShape:          ExecutionClassDeterministic,
+	KeyConfidenceThreshold:    ExecutionClassDeterministic,
+	KeyOriginalTextPresence:   ExecutionClassDeterministic,
+	KeyNonEmptyCorrectedText:  ExecutionClassDeterministic,
+	KeyNoEffect:               ExecutionClassDeterministic,
+	KeyProtectedTerms:         ExecutionClassDeterministic,
+	KeySpokenFormPlausibility: ExecutionClassLLMBacked,
+	KeyMeaningReversalReview:  ExecutionClassLLMBacked,
+	KeyEditorialReview:        ExecutionClassLLMBacked,
+}
+
 type ClassifiedValidator interface {
 	contracts.Validator
 	ExecutionClass() ExecutionClass
@@ -18,9 +47,11 @@ func ClassOf(v contracts.Validator) ExecutionClass {
 	if v == nil {
 		return ExecutionClassDeterministic
 	}
+
+	classFromKey := ClassForKey(v.Name())
 	classified, ok := v.(ClassifiedValidator)
 	if !ok {
-		return ExecutionClassDeterministic
+		return classFromKey
 	}
 	switch classified.ExecutionClass() {
 	case ExecutionClassLLMBacked:
@@ -28,8 +59,16 @@ func ClassOf(v contracts.Validator) ExecutionClass {
 	case ExecutionClassDeterministic:
 		return ExecutionClassDeterministic
 	default:
+		return classFromKey
+	}
+}
+
+func ClassForKey(key string) ExecutionClass {
+	class, ok := executionClassByKey[strings.TrimSpace(key)]
+	if !ok {
 		return ExecutionClassDeterministic
 	}
+	return class
 }
 
 func Wrap(v contracts.Validator, class ExecutionClass) contracts.Validator {

internal/validators/metadata/metadata_test.go

@@ -16,6 +16,16 @@ func (u unclassifiedValidator) Validate(_ context.Context, _ contracts.Validatio
 	return frameworkvalidators.Result{ValidatorName: u.Name(), Decisions: nil}, nil
 }
 
+type namedUnclassifiedValidator struct {
+	name string
+}
+
+func (n namedUnclassifiedValidator) Name() string { return n.name }
+
+func (n namedUnclassifiedValidator) Validate(_ context.Context, _ contracts.ValidationRequest) (frameworkvalidators.Result, error) {
+	return frameworkvalidators.Result{ValidatorName: n.Name(), Decisions: nil}, nil
+}
+
 func TestClassOfDefaultsToDeterministic(t *testing.T) {
 	if got := ClassOf(unclassifiedValidator{}); got != ExecutionClassDeterministic {
 		t.Fatalf("expected deterministic default class, got %q", got)
@@ -28,3 +38,22 @@ func TestWrapExposesExecutionClass(t *testing.T) {
 		t.Fatalf("expected llm_backed class, got %q", got)
 	}
 }
+
+func TestClassForKey(t *testing.T) {
+	if got := ClassForKey(KeyProposalShape); got != ExecutionClassDeterministic {
+		t.Fatalf("expected deterministic class for %q, got %q", KeyProposalShape, got)
+	}
+	if got := ClassForKey(KeySpokenFormPlausibility); got != ExecutionClassLLMBacked {
+		t.Fatalf("expected llm_backed class for %q, got %q", KeySpokenFormPlausibility, got)
+	}
+	if got := ClassForKey("unknown"); got != ExecutionClassDeterministic {
+		t.Fatalf("expected deterministic fallback for unknown key, got %q", got)
+	}
+}
+
+func TestClassOfFallsBackToStableValidatorKey(t *testing.T) {
+	v := namedUnclassifiedValidator{name: KeyEditorialReview}
+	if got := ClassOf(v); got != ExecutionClassLLMBacked {
+		t.Fatalf("expected llm_backed fallback by key, got %q", got)
+	}
+}

internal/validators/proposal_shape/validator.go

@@ -0,0 +1,13 @@
+package proposal_shape
+
+import (
+	"gitea.maximumdirect.net/eric/audita/internal/framework/contracts"
+	frameworkvalidators "gitea.maximumdirect.net/eric/audita/internal/framework/validators"
+	validatormetadata "gitea.maximumdirect.net/eric/audita/internal/validators/metadata"
+)
+
+const Key = "proposal_shape"
+
+func New() (contracts.Validator, error) {
+	return validatormetadata.Wrap(frameworkvalidators.ProposalShapeValidator{}, validatormetadata.ExecutionClassDeterministic), nil
+}

internal/validators/registry.go

@@ -8,29 +8,31 @@ import (
 	"gitea.maximumdirect.net/eric/audita/internal/validators/confidence_threshold"
 	"gitea.maximumdirect.net/eric/audita/internal/validators/editorial_review"
 	"gitea.maximumdirect.net/eric/audita/internal/validators/meaning_reversal_review"
+	validatormetadata "gitea.maximumdirect.net/eric/audita/internal/validators/metadata"
 	"gitea.maximumdirect.net/eric/audita/internal/validators/no_effect"
 	"gitea.maximumdirect.net/eric/audita/internal/validators/non_empty_corrected_text"
 	"gitea.maximumdirect.net/eric/audita/internal/validators/original_text_presence"
+	"gitea.maximumdirect.net/eric/audita/internal/validators/proposal_shape"
 	"gitea.maximumdirect.net/eric/audita/internal/validators/protected_terms"
 	"gitea.maximumdirect.net/eric/audita/internal/validators/spoken_form_plausibility"
 )
 
 const (
-	KeyConfidenceThreshold   = "confidence_threshold"
-	KeyOriginalTextPresence  = "original_text_presence"
-	KeyNonEmptyCorrectedText = "non_empty_corrected_text"
-	KeyNoEffect              = "no_effect"
-	KeyProtectedTerms        = "protected_terms"
+	KeyProposalShape         = validatormetadata.KeyProposalShape
+	KeyConfidenceThreshold   = validatormetadata.KeyConfidenceThreshold
+	KeyOriginalTextPresence  = validatormetadata.KeyOriginalTextPresence
+	KeyNonEmptyCorrectedText = validatormetadata.KeyNonEmptyCorrectedText
+	KeyNoEffect              = validatormetadata.KeyNoEffect
+	KeyProtectedTerms        = validatormetadata.KeyProtectedTerms
 
-	KeySpokenFormPlausibility = "spoken_form_plausibility"
-	KeyMeaningReversalReview  = "meaning_reversal_review"
-	KeyEditorialReview        = "editorial_review"
+	KeySpokenFormPlausibility = validatormetadata.KeySpokenFormPlausibility
+	KeyMeaningReversalReview  = validatormetadata.KeyMeaningReversalReview
+	KeyEditorialReview        = validatormetadata.KeyEditorialReview
 )
 
 type BuiltInValidatorDefinition struct {
 	Key   string
 	Build func() (contracts.Validator, error)
-	LLMBacked bool
 }
 
 type Registry struct {
@@ -39,14 +41,15 @@ type Registry struct {
 
 func NewBuiltInRegistry() *Registry {
 	defs := []BuiltInValidatorDefinition{
+		{Key: KeyProposalShape, Build: proposal_shape.New},
 		{Key: KeyConfidenceThreshold, Build: confidence_threshold.New},
 		{Key: KeyOriginalTextPresence, Build: original_text_presence.New},
 		{Key: KeyNonEmptyCorrectedText, Build: non_empty_corrected_text.New},
 		{Key: KeyNoEffect, Build: no_effect.New},
 		{Key: KeyProtectedTerms, Build: protected_terms.New},
-		{Key: KeySpokenFormPlausibility, LLMBacked: true, Build: spoken_form_plausibility.New},
-		{Key: KeyMeaningReversalReview, LLMBacked: true, Build: meaning_reversal_review.New},
-		{Key: KeyEditorialReview, LLMBacked: true, Build: editorial_review.New},
+		{Key: KeySpokenFormPlausibility, Build: spoken_form_plausibility.New},
+		{Key: KeyMeaningReversalReview, Build: meaning_reversal_review.New},
+		{Key: KeyEditorialReview, Build: editorial_review.New},
 	}
 
 	m := make(map[string]BuiltInValidatorDefinition, len(defs))

internal/validators/registry_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"testing"
 
+	"gitea.maximumdirect.net/eric/audita/internal/core/modulecatalog"
 	"gitea.maximumdirect.net/eric/audita/internal/core/schema"
 	"gitea.maximumdirect.net/eric/audita/internal/framework/contracts"
 	"gitea.maximumdirect.net/eric/audita/internal/framework/proposals"
@@ -14,6 +15,7 @@ import (
 	"gitea.maximumdirect.net/eric/audita/internal/validators/no_effect"
 	"gitea.maximumdirect.net/eric/audita/internal/validators/non_empty_corrected_text"
 	"gitea.maximumdirect.net/eric/audita/internal/validators/original_text_presence"
+	"gitea.maximumdirect.net/eric/audita/internal/validators/proposal_shape"
 	"gitea.maximumdirect.net/eric/audita/internal/validators/protected_terms"
 	"gitea.maximumdirect.net/eric/audita/internal/validators/spoken_form_plausibility"
 )
@@ -21,6 +23,7 @@ import (
 func TestBuiltInRegistryRegistersAllKeys(t *testing.T) {
 	r := NewBuiltInRegistry()
 	for _, key := range []string{
+		KeyProposalShape,
 		KeyConfidenceThreshold,
 		KeyOriginalTextPresence,
 		KeyNonEmptyCorrectedText,
@@ -52,6 +55,7 @@ func TestBuiltInValidatorPackagesConstruct(t *testing.T) {
 		wantClass validatormetadata.ExecutionClass
 	}
 	cases := []validatorCtor{
+		{name: "proposal_shape", key: KeyProposalShape, build: proposal_shape.New, wantClass: validatormetadata.ExecutionClassDeterministic},
 		{name: "confidence_threshold", key: KeyConfidenceThreshold, build: confidence_threshold.New, wantClass: validatormetadata.ExecutionClassDeterministic},
 		{name: "original_text_presence", key: KeyOriginalTextPresence, build: original_text_presence.New, wantClass: validatormetadata.ExecutionClassDeterministic},
 		{name: "non_empty_corrected_text", key: KeyNonEmptyCorrectedText, build: non_empty_corrected_text.New, wantClass: validatormetadata.ExecutionClassDeterministic},
@@ -78,11 +82,6 @@ func TestBuiltInValidatorPackagesConstruct(t *testing.T) {
 
 func TestRegistryBuildsClassifiedValidators(t *testing.T) {
 	r := NewBuiltInRegistry()
-	llmKeys := map[string]bool{
-		KeySpokenFormPlausibility: true,
-		KeyMeaningReversalReview:  true,
-		KeyEditorialReview:        true,
-	}
 	for _, key := range r.RegisteredKeys() {
 		v, err := r.MustBuild(key)
 		if err != nil {
@@ -91,16 +90,28 @@ func TestRegistryBuildsClassifiedValidators(t *testing.T) {
 		if _, ok := v.(validatormetadata.ClassifiedValidator); !ok {
 			t.Fatalf("expected built validator %q to expose execution classification metadata", key)
 		}
-		want := validatormetadata.ExecutionClassDeterministic
-		if llmKeys[key] {
-			want = validatormetadata.ExecutionClassLLMBacked
-		}
+		want := validatormetadata.ClassForKey(key)
 		if got := validatormetadata.ClassOf(v); got != want {
 			t.Fatalf("expected class %q for %q, got %q", want, key, got)
 		}
 	}
 }
 
+func TestExecutionClassResolvableByStableKeyAndByValidatorInstance(t *testing.T) {
+	r := NewBuiltInRegistry()
+	for _, key := range r.RegisteredKeys() {
+		v, err := r.MustBuild(key)
+		if err != nil {
+			t.Fatalf("must build %q: %v", key, err)
+		}
+		fromKey := validatormetadata.ClassForKey(key)
+		fromInstance := validatormetadata.ClassOf(v)
+		if fromInstance != fromKey {
+			t.Fatalf("class mismatch for %q: key=%q instance=%q", key, fromKey, fromInstance)
+		}
+	}
+}
+
 func TestRegistryProtectedTermsUsesNonGlossaryStageBehavior(t *testing.T) {
 	r := NewBuiltInRegistry()
 	v, err := r.MustBuild(KeyProtectedTerms)
@@ -197,7 +208,7 @@ func TestBuiltInRegistryUnknownKeyFails(t *testing.T) {
 }
 
 func TestBuiltInChainKeysResolveForProductionModules(t *testing.T) {
-	for _, moduleKey := range []string{"glossary", "homophones", "spoken_word", "grammar"} {
+	for _, moduleKey := range modulecatalog.SupportedKeys() {
 		keys, err := BuiltInChainKeys(moduleKey)
 		if err != nil {
 			t.Fatalf("resolve keys for %q: %v", moduleKey, err)
@@ -210,7 +221,7 @@ func TestBuiltInChainKeysResolveForProductionModules(t *testing.T) {
 
 func TestResolveBuiltInChainUsesRegisteredKeys(t *testing.T) {
 	r := NewBuiltInRegistry()
-	for _, moduleKey := range []string{"glossary", "homophones", "spoken_word", "grammar"} {
+	for _, moduleKey := range modulecatalog.SupportedKeys() {
 		chain, err := ResolveBuiltInChain(moduleKey, r)
 		if err != nil {
 			t.Fatalf("resolve chain for %q: %v", moduleKey, err)