Document extraction audit findings

docs/roadmap/audit-findings.md

@@ -106,7 +106,7 @@ These are prioritization signals, not findings:
 | 6: configuration and composition | complete | Discovery/precedence, strict loading, defaults/normalization, templates, cross-field validation, CLI selection, filesystem secrets, conditional adapter composition, and maintained examples reviewed. Exact focused tests and repository vet passed. Confirmed `COR-012` through `COR-015`, `RSK-009`, and `RSK-010`; added `ARC-004`, `DUP-004`, and `TST-006`. |
 | 7: adapters and shared support | complete | All HTTP, subprocess, notification, storage, audio, shared-model, and diagnostic boundaries were compared with their contracts and production callers. Focused normal and race commands passed. Confirmed `COR-016`, `RSK-011` through `RSK-014`, `EFF-002`, and `ARC-004`; added `ARC-005`, `DUP-005`, `COM-003`, and `TST-007`, and refined `TST-001`. |
 | 8: ordinary stages | complete | Prepare, transcribe, merge, polish, normalize, trim, and render were traced from resolved inputs through adapters, validation, run-local/canonical outputs, diagnostics, and manifest recording. The focused normal command passed; the required race command reproduced only `TST-001`. Confirmed `COR-017` through `COR-019`; added `ARC-006`, `DUP-006`, `COM-004`, and `TST-008`, and refined `ARC-001`, `ARC-002`, `ARC-005`, `RSK-013`, and scenario 8. |
-| 9: extraction | not_started | Assigned extraction promotion, provenance, and resume scenario below. |
+| 9: extraction | complete | Configuration, transcript resolution, fingerprinting, Notarius execution, receipt/index/lane validation, immutable promotion, manifest advertisement, catalog hydration, resume, and explicit analyze/publish consumption were traced as one slice. The exact focused command passed. Confirmed `COR-020`; added `DUP-007`, `SIM-002`, and `TST-009`, and refined `ARC-001`, `RSK-013`, and scenario 3. |
 | 10: analyze and dependencies | not_started | Assigned artifact dependency/source and selection scenario below. |
 | 11: maintainability | not_started | Seeded by graph complexity, similarity, and fan-in signals only. |
 | 12: test policy | not_started | Seeded by intended owners and baseline execution observations. |
@@ -124,7 +124,7 @@ has been mapped but not behaviorally audited.
 | Configuration | `internal/config` | 6 | reviewed |
 | Prepare and audio | `internal/stage`, `internal/audio`, `internal/previouscache` | 8 | reviewed |
 | Transcript stages | `internal/stage` plus tool adapters | 8 | reviewed |
-| Extraction | `internal/stage`, Notarius adapter, `internal/fileops` | 9 | assigned |
+| Extraction | `internal/stage`, Notarius adapter, `internal/fileops` | 9 | reviewed |
 | Analyze and artifact dependencies | `internal/stage`, `internal/artifacts`, `internal/artifactpolicy` | 10 | assigned |
 | Publish and cleanup | `internal/stage`, `internal/app` | 4 | reviewed |
 | Manifest state | `internal/manifest`, transition policy in `internal/app` | 2 | reviewed |
@@ -183,7 +183,7 @@ succeeded downstream work, while force pre-stales succeeded downstream work.
 | 4 `polish` | Manifest base transcript or canonical fallback, glossary -> polished transcript, optional report | Audita fields/credential reference; `audita.Runner` | Ordinary succeeded-record skip | Run-local transcript/report validate before canonical materialization; logs/config are diagnostics. Static request/constructor ownership remains `ARC-005`. |
 | 5 `normalize` | Manifest polished transcript or canonical fallback -> final transcript, optional report | Normalize plus Seriatim fields; `seriatim.Runner` | Ordinary succeeded-record skip | Run-local schema/report validation then configured canonical materialization; logs/config are diagnostics. |
 | 6 `trim` | Manifest final transcript or configured canonical fallback -> final-trimmed transcript and, when enabled, bounds | Trim, bounds, Scriptorium, and Seriatim fields; both runners when enabled | Disabled trim copies and validates the normalized transcript, then succeeds; no explicit self-skip or resume validator | Enabled bounds/trim results validate before canonical materialization; render-debug and subprocess logs/config are diagnostics, not outputs. |
-| 7 `extract` | Final-trimmed source -> immutable index and configured lane outputs | Notarius executable/config/pipeline/timeout/output contracts; `notarius.Runner` | Disabled is explicit `notarius_disabled` self-skip; only current `ResumeValidator`; obsolete reruns, unsafe validation errors | Validates run-local receipt/bundle completely, promotes to unique immutable bundle, records checksums/contracts/provenance; identical repeated self-skip is stable. |
+| 7 `extract` | Final-trimmed source -> immutable index and configured lane outputs | Notarius executable/config/pipeline/timeout/output contracts; `notarius.Runner` | Disabled is explicit `notarius_disabled` self-skip; only current `ResumeValidator`; obsolete reruns, unsafe validation errors. The validator does not bind reuse to the current trimmed-transcript bytes (`COR-020`). | Validates the run-local receipt/index/configured lanes, promotes the complete regular-file bundle to a unique no-replace destination, rechecks promoted checksums, and records exact checksums/contracts/provenance. Only configured lanes are selectable; index and unconfigured bundle members remain audit state. |
 | 8 `render` | Manifest final/final-trimmed JSON or canonical fallback -> two Markdown transcripts | Render and Seriatim fields; `seriatim.Runner` | Disabled returns a zero-disposition no-output result, therefore durable success rather than explicit self-skip; later enablement needs force; no validator | Enabled run-local text validates non-empty before either canonical result is recorded; logs/config are diagnostics. Focused wording is imprecise under `COM-004`. |
 | 9 `analyze` | Dynamic built-in, prepared, extraction, configured, and previous sources -> selected configured artifact outputs | Scriptorium artifact graph/selection; `scriptorium.Runner` | Missing config or no executable artifacts returns success with skip metadata; no validator | Topological run-local generation/reuse, validation, canonical outputs, deterministic metadata; static `Declares` omits dynamic outputs and several input families. |
 | 10 `publish` | Session/run state, selected output rules, locks, previous cache -> remote run/output/current objects | Publish/storage/selection fields; `storage.ObjectStore` | Disabled publish or run upload returns ordinary success with skip metadata, not a self-skip; force cannot bypass locks; no validator | Deterministic uploads; `current/manifest.json` before `current/run_id.txt`; post-commit local metadata gates cleanup. Static prerequisites omit extract because disabled extraction is valid and lane resolution enforces required extraction state when selected. |
@@ -326,6 +326,22 @@ terminalization/reconciliation harder to test.
 | 9. Disabled/unselected/reused/generated/extraction/previous source then publish filtering | 10 | Analyze, artifact catalog/resolver/policy, publish tests; config ownership in 6 and publish result in 4 |
 | 10. Concurrent same-session invocation and lock cleanup failures | 3 | Runner lock lifetime in 2; local artifact store, path/file cleanup and lock tests in 3 |
 
+Scenario 3 is resolved. The fingerprint deterministically observes the resolved
+executable and top-level config *paths*, pipeline ID, normalized timeout,
+working directory, and sorted configured lane contracts. Changes to those
+values make the result non-resumable. It intentionally cannot observe the
+contents of the executable, Notarius configuration, profiles, prompts,
+modules, references, environment, or other external/transitive inputs;
+operations and extract documentation require `--force` after those changes.
+That is an explicit operator-owned limitation, although a same-path executable
+replacement deserves the same guidance as the documented configuration cases.
+The current fingerprint also omits the resolved final-trimmed transcript and
+its bytes. That is a direct Narratio-owned input rather than an unknowable
+external dependency and is confirmed as `COR-020`. Force always pre-stales
+succeeded downstream stages; automatically detected invocation-contract or
+bundle-evidence changes rerun extract and invalidate succeeded downstream work
+through the ordinary changed-outcome path.
+
 Scenario 8 is resolved through the ordinary stages. Parent cancellation reaches
 HTTP attempts, retry waits, every AWS call, audio downloads, and each direct
 child process. HTTP/S3/local-file resources are released on error, and a
@@ -393,6 +409,15 @@ Stage 8 test observations for this matrix:
 | Manifest-first transformation and schema/report validation | Merge, polish, normalize, trim, and render suites cover manifest-first and fallback sources, missing/invalid inputs, adapter failures, configured reports/schemas, disabled paths, diagnostics, run-local paths, and canonical materialization. | Alternate valid adapter-returned paths, link/non-regular/oversized results, and multi-output materialization failure boundaries are not coherently tested; `ARC-006`, `RSK-013`, and `TST-008`. |
 | Disabled ordinary-stage lifecycle | Trim tests prove disabled execution copies a valid canonical output; render tests prove disabled execution returns no outputs. Runner tests separately define durable success versus self-skip. | Render's focused document says only “skips,” without the durable-success and later-force consequence; `ARC-002` is resolved for these stages and `COM-004` owns the wording. Analyze remains Stage 10. |
 
+Stage 9 test observations for this matrix:
+
+| Risk | Existing focused protection | Gap or disposition |
+| --- | --- | --- |
+| Receipt, index, and configured-lane acceptance | Notarius adapter tables cover process errors, bounded receipt/index/summary parsing, exact management paths, bundle confinement, symlinks, required receipt fields, descriptor uniqueness, and optional descriptor contracts. Extract tests cover rejection, missing/duplicate/incompatible lanes, invalid/empty JSON, provenance construction, and deterministic output ordering. | Configured lane bodies have no acquisition bound, and extraction/catalog reread them without one; this extends `RSK-013`. Protocol cases otherwise have clear adapter or stage owners. |
+| Promotion and immutable identity | `fileops` tests cover regular nested trees, permissions, source symlink/non-regular/root and entry replacement, destination no-replace races, destination-inside-source, platform support, and cleanup. Stage tests prove promotion errors advertise no outputs. | The assembled extraction slice does not inject a failure after successful install or exercise an ancestor/root replacement during resume; coordinate `TST-009` with the lower-level coverage and `COR-003` rather than duplicating every filesystem case. |
+| Reuse and downstream invalidation | Stage and runner tests cover immediate and cross-invocation reuse, disabled-to-enabled reconsideration, configuration-value changes, missing/tampered payloads, source/contract/provenance mismatches, forced replacement, failed retry, unsafe resume errors, and changed-outcome invalidation. | No test changes the direct trimmed transcript beneath an otherwise succeeded record, so `COR-020` remains green. Same-path external dependency changes are documented force cases; one lifecycle contract test is sufficient if an explicit external revision mechanism is added. |
+| Catalog and explicit consumption | Catalog tables require one complete current bundle and reject unsafe, incomplete, mismatched, incidental, or tampered state. Analyze and publish tests prove only explicitly configured lanes are passed/uploaded and invalid required lanes fail before execution/upload. | Resume and catalog independently encode much of the same bundle proof (`DUP-007`); future shared evidence tests should preserve resume's obsolete-versus-unsafe result and catalog's fail-closed all-or-none behavior. |
+
 ## Path, Artifact, Filesystem, And Lock Conclusions
 
 ### Canonical ownership and normalization
@@ -831,7 +856,7 @@ incorrect under `COR-012`.
 | Stage enablement/order, concurrency, locks, workspace/cache/campaign/spool roots | Canonical stage order is fixed; enabled stages, positive global concurrency, lock settings, and non-empty principal roots are validated. Relative configured roots remain supported. | Planning selects enabled/requested stages; the runner derives layout, local locks, artifact/manifest stores, and worker bounds from the resolved config. No unconsumed execution selector was found. |
 | Campaign/session IDs, stable inputs, audio source, and previous session | Resolution enforces campaign consistency and stable-input precedence; validation requires one audio mode and required campaign/session values, with S3 bucket cross-checks. | Selection, layout, audio materialization, publish keys, and previous-cache planning consume these values. Unsafe ID segment syntax remains `COR-002`; the previous-session CLI expectation is incomplete under `COR-015`. |
 | WhisperX, Seriatim, Audita, and Scriptorium command/protocol settings | Defaults fill endpoints, commands, retry/concurrency/tuning, timeouts, and artifact contracts; enums, safe paths, environment-variable names, dependencies, and cycles are checked. | Adapter constructors and transcript/analyze/trim/render stages consume the settings. Parseable non-positive durations can pass configuration but fail at composition or stage execution under `COR-013`. |
-| Notarius extraction and lane settings | Disabled configurations stay lightweight; enabled configurations require command, config/work paths, declared inputs/outputs, unique lanes, timeout, and positive concurrency. Relative paths are anchored to the pipeline file. | The subprocess runner is constructed only when extraction is selected and Notarius is enabled. Extraction behavior remains assigned to Stage 9; no unconditional external work was found here. |
+| Notarius extraction and lane settings | Disabled configurations stay lightweight; enabled configurations require command, config/work paths, declared inputs/outputs, unique lanes, timeout, and positive concurrency. Relative paths are anchored to the pipeline file. | The subprocess runner is constructed only when extraction is selected and Notarius is enabled. Stage 9 confirmed that resolved settings reach the invocation/fingerprint/output-contract boundary; no unconditional external work was found. |
 | Analyze artifact source/destination, previous requirements, trim/render bounds | Source/destination identities, normalized relative paths, uniqueness, dependency existence, cycles, and bounds syntax are validated. | Artifact resolution and Scriptorium/Seriatim stages consume the values. Deeper dependency semantics remain assigned to Stage 10 rather than being inferred from configuration shape. |
 | Publish outputs/backend, S3 storage, cleanup, and remote locks | Publish sources/destinations and S3/env/path prerequisites are cross-checked; cleanup and lock defaults are explicit. | Publish, storage construction, remote locking, restore, and cleanup consume these fields. The storage backend selector itself is not validated and is not authoritative under `COR-014`. |
 | Filesystem secrets directory and credential variable names | The directory is optional; relative values intentionally use process working directory. Entry names and configured env-var names use the environment-name grammar. Existing process values win. | Secrets are installed into the process environment before adapter/store construction; values are not copied into config, metadata, reports, or logs. Entry-type trust is unsafe under `RSK-010`. |
@@ -1103,6 +1128,96 @@ Stage 10.
   stage/template framework would hide important ordering and failure
   differences and is rejected from this audit pass.
 
+## Extraction Vertical-Slice Conclusions
+
+### Configuration, execution, validation, and promotion
+
+Enabled Notarius configuration is validated before composition and its relative
+paths are anchored to the pipeline document. Application composition constructs
+the runner only when extraction is selected and enabled. Extract resolves the
+final-trimmed artifact through the shared registry, normalizes every invocation
+path, creates run-local receipt/log/output locations, and passes one explicit
+request to the adapter. The adapter separates stdout receipt from stderr,
+requires successful process completion before decoding, bounds the receipt,
+index, rejection, and warning documents, and rejects a non-canonical or
+symlinked bundle tree. The stage then selects exactly one descriptor for every
+sorted configured output, rejects matching rejections or contract differences,
+and verifies regular non-empty JSON lane payloads before promotion.
+
+Promotion copies the complete regular-file source tree through verified source
+handles, syncs files and directories, and installs one unique Narratio-run-ID
+destination through the platform no-replace primitive. It never replaces an
+existing bundle. The stage derives promoted paths from previously confined
+relative names and rechecks index and lane checksums before returning one
+non-selectable index plus the exact configured lane set. Each lane carries its
+checksum, configured contract, producing Narratio run ID, and Notarius system,
+run, pipeline, and lane provenance. Unconfigured bundle members remain in the
+immutable audit bundle but never become manifest outputs.
+
+### Promotion, advertisement, catalog, and resume authority
+
+The four relevant authorities are intentionally distinct:
+
+- `fileops.PromoteDirectory` establishes an all-regular, immutable,
+  no-replacement durable directory; its existence alone is not success.
+- The runner's succeeded session-stage record advertises the current result.
+  A failed replacement clears the old current payload, and an orphan promoted
+  directory is not rediscovered by scanning.
+- Extraction resume accepts a succeeded record only after the current
+  invocation fingerprint, canonical producer/bundle/receipt identity, exact
+  source set, contracts/provenance, confinement, regular type, and checksums
+  agree. Missing or obsolete evidence causes a rerun; unsafe paths, symlinks,
+  and inspection failures stop execution without replacing the prior success.
+- Catalog hydration independently fails closed and marks no extraction lane
+  available unless the whole configured record, index, bundle, provenance,
+  checksums, and JSON payload set validate. Analyze and publish consume only
+  those catalog entries named explicitly by artifact inputs or publish rules.
+
+This prevents a durable bundle, diagnostic file, unconfigured lane, or stale
+invocation manifest from becoming implicitly selectable. It also exposes the
+maintenance tension in `DUP-007`: resume and catalog repeat one evidence policy
+while deliberately mapping failures differently.
+
+### Failure and residue classification
+
+Configuration, input, directory, and adapter-start failures can leave only
+run-local directories or diagnostics and return no result. A subprocess
+failure can leave its receipt/stderr and staging tree for inspection, but none
+is advertised or reusable. Receipt, index, rejection, descriptor, payload, or
+pre-install promotion failures likewise retain diagnostic/staging evidence
+without a current selectable result. If no-replace installation succeeds and
+a later parent-directory sync, promoted-path resolution, or checksum check
+fails, the complete uniquely named durable bundle can remain as orphan audit
+residue; it still has no manifest advertisement and catalog hydration never
+scans for it. A later successful invocation uses a new run identity.
+
+After a successful stage result, runner manifest persistence is the
+advertisement boundary. Its session/run disagreement risks remain the shared
+`RSK-001`, `RSK-002`, and `TST-002` findings rather than extraction-specific
+duplicates. On replacement, the running transition clears the earlier current
+payload; failure retains the previous immutable bundle and prior invocation
+record only for inspection. Downstream succeeded state is invalidated by force
+or a changed executed outcome, while identical repeated disabled self-skip is
+stable.
+
+### Validation shape and bounded acquisition
+
+`ValidateResume` has cyclomatic complexity 40 and cognitive complexity 53
+because it combines fingerprint comparison, canonical bundle identity,
+receipt/source-set proof, contract/provenance checks, and filesystem evidence.
+These checks are consequential and their order is largely justified. `SIM-002`
+therefore proposes only named evidence sub-decisions: cheap record and
+fingerprint checks first, confinement before filesystem access, exact set and
+identity proof before payload acceptance, and an explicit final all-or-none
+decision. It must preserve every obsolete-versus-unsafe classification.
+
+Notarius's bounded management-document reads do not bound configured lane
+payloads. Extract's `checksumRegularFile` reads each lane fully to validate JSON
+and hash it, and catalog hydration streams a checksum and then reads the same
+file fully again for JSON validation. This broadens the already confirmed
+`RSK-013`; safe regular-file shape is stronger here than in ordinary adapters,
+but an external multi-gigabyte JSON lane can still exhaust memory.
+
 ## Confirmed Findings
 
 ### `COR-001`: session identity initialization preserves stale invocation paths and accepts conflicting identity
@@ -1754,6 +1869,50 @@ Stage 10.
 - Dependencies: `COR-002` owns unsafe identity segments and `RSK-008` foreign
   restored paths; neither changes duplicate semantics.
 
+### `COR-020`: extraction reuse is not bound to the current trimmed transcript
+
+- Category: confirmed correctness and data-integrity defect.
+- Locations/invariant: `internal/stage/extract.go` in `extractionFingerprint`
+  and result metadata construction, and
+  `internal/stage/extract_resume.go` in `ValidateResume`. A reusable extraction
+  must represent the current direct transcript input as well as the current
+  invocation contract and durable output bytes.
+- Evidence: execution resolves `narratio.transcript.final_trimmed` and passes
+  its absolute path to Notarius, but the fingerprint contains only executable
+  and config paths, pipeline ID, timeout, working directory, and sorted output
+  contracts. Neither the input path, producer identity, nor an input checksum
+  is recorded. Resume never resolves or hashes the transcript; after comparing
+  the configuration fingerprint it validates only the old promoted bundle and
+  output record. Existing output checksums can therefore all agree while the
+  direct input bytes no longer do. The focused extract documentation lists the
+  fingerprint fields and external transitive limitations but does not assign
+  direct transcript identity to the operator.
+- Realistic scenario: the canonical final-trimmed file is restored, repaired,
+  or modified out of band while the trim and extract stage records remain
+  succeeded. An ordinary run skips extract and continues with lanes derived
+  from the previous transcript. This is especially difficult to observe
+  because the immutable bundle and its checksums are internally valid.
+- Impact/likelihood/confidence: high artifact-integrity impact; low-to-moderate
+  manual restore/repair or state-disagreement likelihood; high confidence from
+  the complete fingerprint document and resume control flow.
+- Estimated remediation scope and owner: small-to-medium extraction identity
+  change. Hash the resolved trimmed transcript before invocation, store its
+  digest plus stable source/producer identity in extraction metadata, and
+  recompute the same evidence during resume before accepting the bundle. Keep
+  external/transitive Notarius dependencies under the documented force rule or
+  add an explicit operator-controlled dependency revision; do not pretend an
+  incomplete recursive file scan can prove them.
+- Test changes: add one lifecycle test that succeeds extraction, changes the
+  resolved transcript bytes without changing the extraction record, and proves
+  the next invocation reruns and invalidates succeeded downstream work. Keep
+  configuration-change and output-tamper tables separate because they protect
+  different evidence.
+- Dependencies: `RSK-008` concerns foreign restored absolute paths generally;
+  this finding owns direct extraction-input identity even when the path is
+  canonical. `DUP-007`/`SIM-002` must carry the new evidence into any shared
+  validation structure. Same-path Notarius files remain the documented
+  scenario-3 force limitation.
+
 ### `RSK-001`: invocation audit records can remain indefinitely `running`
 
 - Category: confirmed correctness/operational risk.
@@ -2182,7 +2341,12 @@ Stage 10.
   `copyTranscript`, `requireNonEmptyFile`, and run-local materialization before
   merge, polish, normalize, trim, and render record canonical outputs. The risk
   therefore crosses the adapter/stage boundary rather than ending at adapter
-  first-pass validation.
+  first-pass validation. Stage 9 found the bounded Notarius management-file
+  boundary stops short of configured lane bodies: extract's
+  `checksumRegularFile` performs one unbounded `os.ReadFile` per lane to parse
+  and hash it, while catalog hydration first streams the checksum and then
+  performs another unbounded `os.ReadFile` for JSON validity. These paths reject
+  links and non-regular files but still admit memory-exhausting external JSON.
 - Realistic scenario: a faulty external CLI writes a multi-gigabyte JSON result
   or leaves the requested output as a symlink to stale data. It exits zero;
   Narratio then exhausts memory or records unrelated bytes as a successful
@@ -2195,8 +2359,9 @@ Stage 10.
   require a regular file, enforce documented per-contract limits, parse from
   the established handle, and leave semantic schema checks in each adapter.
 - Test changes: add one shared table for symlink/non-regular/oversized reads and
-  focused adapter cases proving semantic errors retain their context. Avoid
+  focused adapter cases proving semantic errors retain their context. Include
-  duplicating the same large fixture for every JSON validator.
+  one configured Notarius lane/catalog case at the owner of the chosen bound;
+  avoid duplicating the same large fixture for every JSON validator.
 - Dependencies: coordinate no-follow mechanics with `COR-003` and size policy
   with Stage 8/10 consumers. Do not weaken Notarius's stricter bundle boundary.
 
@@ -2341,8 +2506,11 @@ register above.
   placeholder paths although its result has no persisted output. Stage 8 also
   found unconditional optional report/bounds declarations, configured output
   paths that can differ from the static declaration, and render outputs declared
-  even when disabled render succeeds with none. No production caller of
+  even when disabled render succeeds with none. Stage 9 found extract's row is
-  `Declares` was found.
+  directionally accurate but necessarily uses wildcard/run placeholders, cannot
+  declare the configured lane source IDs or contracts, and says nothing about
+  the nonselectable index, diagnostics, adapter, fingerprint, or self-skip
+  lifecycle. No production caller of `Declares` was found.
 - Contract tension: architecture says every stage declares required inputs,
   produced output state, configuration, adapters, lifecycle, and failure
   behavior; the Go interface declares only partial static artifacts.
@@ -2350,8 +2518,8 @@ register above.
   interface as authoritative and make incorrect dependency or readiness
   decisions. Current likelihood appears low because the method has no
   production caller.
-- Confirmation owners: Stage 8 completed the ordinary-stage rows; Stages 9-10
+- Confirmation owners: Stages 8-9 completed ordinary/extraction rows; Stage 10
-  own extraction/analyze, then Stage 11 owns interface purpose/simplification.
+  owns analyze, then Stage 11 owns interface purpose/simplification.
   Smallest plausible outcome may be clearer
   naming/documentation, a complete contract, or removal; do not choose yet.
 
@@ -2582,6 +2750,32 @@ register above.
   plural raw-directory discovery separate and do not create a generic stage
   framework.
 
+### `DUP-007`: extraction resume and catalog hydration duplicate bundle-evidence policy
+
+- Category: duplication/ownership candidate.
+- Evidence: `extractStage.ValidateResume` and
+  `ArtifactCatalog.HydrateExtractionArtifacts` independently reconstruct the
+  producer bundle, receipt identity, exact configured source/index set,
+  contracts, Notarius provenance, confinement and symlink rules, regular-file
+  shape, and checksums. They have separate segment, metadata, receipt,
+  contract/provenance, component, and payload helpers. Some difference is
+  intentional: resume distinguishes obsolete evidence from unsafe errors and
+  can rely on a prior JSON-valid checksum, while catalog treats the record as
+  untrusted and fails closed without returning errors.
+- Realistic risk: a new identity field such as the direct input digest required
+  by `COR-020`, a contract compatibility change, or a path-safety repair is
+  enforced by resume but not catalog (or vice versa). Extraction can then be
+  skipped as reusable while its consumers refuse it, or a downstream catalog
+  can expose evidence resume would reject.
+- Confirmation owner: Stage 11 should consider one narrow, structured bundle
+  evidence validator owned by `internal/artifacts` or a purpose-specific model
+  package. It must accept explicit current definitions and return typed evidence
+  reasons; resume should map missing/obsolete versus unsafe reasons, while the
+  catalog retains all-or-none fail-closed hydration. Preserve canonical bundle
+  identity, root confinement before reads, exact index/source count,
+  contract/provenance checks, no-follow regular files, checksums, and catalog's
+  JSON validity. Do not move lifecycle decisions into `fileops`.
+
 ### `TST-003`: filesystem safety tests omit destination and lock-recovery boundaries
 
 - Category: test-suite sufficiency candidate.
@@ -2702,6 +2896,31 @@ register above.
   Reuse shared safe-output acquisition tests from `TST-007`; do not duplicate
   every schema error or stage fixture already covered.
 
+### `TST-009`: extraction tests omit direct-input identity and assembled late-failure boundaries
+
+- Category: test-suite sufficiency candidate.
+- Evidence: focused extraction coverage is strong for process/receipt/index
+  validation, required lanes, immediate and cross-invocation reuse,
+  configuration-value change, missing/tampered outputs, source/contract/
+  provenance mismatches, disabled/forced/failed lifecycle outcomes, explicit
+  consumers, and low-level promotion source replacement/no-replace behavior.
+  No case mutates the resolved trimmed transcript beneath a succeeded extract
+  record, so `COR-020` is invisible. Stage tests stop at an injected promotion
+  error and do not exercise a failure after the durable directory has installed;
+  resume has one outside-root error but no assembled ancestor/root replacement
+  case. Configured-lane size is also untested at the acquisition boundary.
+- Realistic risk: the direct-input repair, orphan-bundle policy, unsafe-versus-
+  obsolete mapping, or `RSK-013` lane bound can be incomplete while all current
+  extraction/lifecycle tests pass. Conversely, copying every adversarial
+  `fileops` case upward would add redundant suite friction.
+- Confirmation owner: Stage 12 should add the direct-input lifecycle regression,
+  one deterministic post-install failure/residue assertion if a seam can expose
+  it without private choreography, and one representative assembled unsafe-root
+  case. Put the size case at the shared bounded-reader owner. Reuse the existing
+  downstream invalidation and catalog fixtures rather than creating a broad new
+  end-to-end framework; coordinate manifest-persistence faults with `TST-002`
+  and destination ancestry with `TST-003`/`COR-003`.
+
 ### `SIM-001`: runner terminalization and persistence ordering lack a narrow owner
 
 - Category: simplification candidate.
@@ -2716,6 +2935,28 @@ register above.
 - Confirmation owner: Stage 11 should consider a small terminal failure helper
   or typed transition operation only after Stages 3-10 settle ordering needs.
 
+### `SIM-002`: extraction resume validation conflates distinct evidence decisions
+
+- Category: simplification candidate.
+- Evidence: `extractStage.ValidateResume` spans 154 lines with cyclomatic
+  complexity 40 and cognitive complexity 53. It validates environment and
+  record state, producer identity, parsed/resolved configuration and
+  fingerprint, session layout, canonical bundle and symlink safety, receipt,
+  exact output set, contracts/provenance, and payload evidence in one function.
+  The branches are individually necessary, but the proof phases and the reason
+  each branch is obsolete versus unsafe are difficult to review as a whole.
+- Realistic risk: adding `COR-020`'s input evidence or sharing catalog mechanics
+  can place an I/O check before confinement, accidentally turn an unsafe state
+  into an automatic replacement, or omit one exact-set/identity check.
+- Confirmation owner: Stage 11 should extract only named evidence decisions or
+  a small typed proof result, preferably alongside `DUP-007`. Preserve visible
+  ordering: cheap manifest/producer and fingerprint rejection; canonical root
+  derivation and component confinement before filesystem access; receipt and
+  exact index/source identity; contract/provenance; then regular-file/checksum
+  evidence and one final completeness decision. Preserve every existing
+  non-resumable outcome and every unsafe error, and keep `ValidateResume` as the
+  lifecycle mapper rather than introducing a generic validation framework.
+
 ### `COM-001`: dual-ledger save order and partial-failure policy lack rationale
 
 - Category: comment/clarity candidate.
@@ -2828,6 +3069,11 @@ register above.
 | Adapter result paths have one run-local authority rule | retained as `ARC-006` | Current production adapters return requested paths, but transformation stages inconsistently consume, ignore, or reject returned paths. Stage 11 must make the seam explicit before fakes are aligned. |
 | Transcript discovery helpers are intentionally all distinct | plural raw discovery rejected; singleton repetition retained as `DUP-006` | Raw inputs need directory enumeration and plural ordering. Merged/processed/normalized singleton helpers repeat manifest-first/canonical-fallback mechanics already represented by the artifact resolver. |
 | Similar ordinary-stage `Run` methods need a common framework | rejected at Stage 8 | Adapter sequencing, schemas, optional reports, disabled behavior, diagnostics, and multi-output failure order differ materially. Existing run-local helpers are the correct narrow shared mechanism. |
+| A valid immutable extraction bundle proves it represents the current transcript | confirmed as `COR-020` | Bundle checksums prove only promoted output integrity. The fingerprint and resume validator never resolve or hash the current direct transcript, so an internally valid old bundle can be reused after those input bytes change. |
+| Same-path external Notarius changes are automatically observable | documented force limitation, not a separate Stage 9 defect | Fingerprinting paths cannot prove executable, config, profile, prompt, module, reference, environment, provider, or runtime contents. Configuration/transitive changes are explicitly assigned to `--force`; operations should extend that wording to same-path executable replacement. Direct Narratio transcript identity is separately confirmed in `COR-020`. |
+| Every durable promoted bundle is advertised or reusable | rejected at Stage 9 | Promotion establishes immutable bytes, not success. A later sync/checksum/result-persistence failure may leave a uniquely named orphan bundle, but session-manifest success is advertisement authority and neither resume nor catalog scans incidental directories. |
+| Resume and catalog bundle checks are merely coincidental similarity | retained as `DUP-007` | They repeat one exact-set, identity, contract/provenance, path, type, and checksum policy. Their error mapping differs intentionally, so sharing must return structured evidence rather than collapse lifecycle and fail-closed consumer behavior. |
+| Extraction resume complexity justifies a generic validation framework | rejected; narrow simplification retained as `SIM-002` | The security proof and ordered failure classifications must remain visible. Named evidence decisions can reduce cognitive load without abstracting stage lifecycle or filesystem mechanics behind a generic framework. |
 
 ## Unresolved Questions And Follow-Up
 
@@ -2892,6 +3138,10 @@ register above.
 - Can subprocess environments be reduced to explicit allowlists, or must
   `RSK-012` retain broad inheritance and stream-redact every known sensitive
   value?
+- Should Notarius expose or Narratio require an explicit dependency-generation
+  digest that covers profiles, prompts, modules, references, executable build,
+  and other transitive inputs, or is documented operator-forced invalidation
+  the intended long-term contract?
 - Which native CI runner limitations explain the absence of validation jobs in
   the tag-only release workflow? Stage 12 owns the automation conclusion.
 
@@ -3218,3 +3468,50 @@ No accepted risks or final audit conclusions are recorded yet.
   Stage 11 owns `ARC-001`, `ARC-005`, `ARC-006`, `DUP-006`, `COM-004`, and the
   narrow shared-owner decisions. Stage 12 owns the risk-based additions in
   `TST-001`, `TST-007`, and `TST-008`.
+
+### Stage 9
+
+- Entry revision: `57cac5d` (`Document ordinary stage audit findings`). Commits
+  since the pinned audit revision modify audit documentation only, so
+  implementation/test evidence remains pinned to the identity recorded above.
+- Contracts and code reviewed: development guide, exact Stage 9 sequence, all
+  repository policy, overview, extract/artifacts/manifest/analyze/publish
+  internal documents, Notarius integration, configuration, operations,
+  troubleshooting, CLI run behavior, and the complete extraction production
+  slice through configuration, composition, stage execution/resume, adapter,
+  promotion, manifests, catalog, analyze, and publish.
+- Graph/source evidence: scoped stage architecture, extraction cohesion and
+  hotspot inventory, caller/callee and symbol searches for configuration,
+  fingerprint, execution, promotion, resume, and consumers, followed by exact
+  source inspection of every production branch and focused test case.
+  `ValidateResume` measured cyclomatic complexity 40/cognitive complexity 53;
+  that metric was used only after its proof decisions were manually traced.
+- Validation: the exact required command, `go test -count=1 ./internal/stage
+  ./internal/artifacts ./internal/fileops ./internal/adapters/notarius
+  ./internal/app`, passed all five packages (1.94 s command wall time). No live
+  Notarius process, credential, destructive, remote, or paid operation was
+  exercised.
+- Contract conclusions: run-local receipt/log/staging state is distinct from
+  the complete no-replace durable bundle; promotion is distinct from
+  session-manifest advertisement; resume is distinct from fail-closed catalog
+  hydration. Configured lanes require exact contracts and provenance and are
+  the only selectable outputs. Missing/obsolete evidence reruns extraction,
+  unsafe filesystem evidence stops it, and unadvertised bundles are never
+  discovered incidentally. Scenario 3 is resolved with explicit external/
+  transitive force limits and a missing direct-input identity defect.
+- Findings: confirmed `COR-020`; added `DUP-007`, `SIM-002`, and `TST-009`; and
+  refined `ARC-001` and `RSK-013`. The same-path Notarius dependency limitation
+  is documented and classified rather than duplicated as another defect.
+- Explicit no-finding conclusions: output-map iteration is sorted; required
+  lane descriptors are exact and rejection-aware; index and lane paths are
+  confined; configured lanes are regular, non-empty JSON; checksums are taken
+  before and after promotion; destination installation is atomic no-replace on
+  supported platforms; contract/provenance survives explicit publication;
+  unconfigured lanes and the index are neither selectable nor implicitly
+  uploaded; disabled extraction self-skips coherently; process/receipt/
+  prepromotion failures advertise no result; a generic validation or stage
+  framework is not justified.
+- Later-stage assignments: Stage 10 owns the full analyze source-family and
+  publish-selection matrix. Stage 11 owns `ARC-001`, `DUP-007`, and `SIM-002`.
+  Stage 12 owns the risk-based additions/consolidation in `TST-009` and the
+  extraction reach of `RSK-013` alongside `TST-002`, `TST-003`, and `TST-007`.