Fix derived publish destinations with explicit requiredness

internal/config/pipeline_configkit.go

@@ -209,11 +209,17 @@ func resolvePipelineConfig(cfg *PipelineConfig, resolution *configkit.Resolution
 		resolution.Record(configkit.Keys("notarius"), configkit.ChangeNormalization, "canonical Notarius configuration")
 	}
 	if cfg.Publish != nil {
-		for _, derived := range deriveMissingPublishDestinations(cfg.Publish, cfg.Scriptorium, cfg.Notarius) {
+		destinations := deriveMissingPublishDestinations(cfg.Publish, cfg.Scriptorium, cfg.Notarius)
+		for _, derived := range destinations {
 			output := cfg.Publish.Outputs[derived.index]
 			configkit.Normalize(resolution, configkit.Keys("publish", "outputs").Index(derived.index).Key("dest"), &output.Dest, derived.dest, "derived from publish source")
 			cfg.Publish.Outputs[derived.index] = output
 		}
+		if len(destinations) > 0 {
+			// ConfigKit compares sequences atomically; child records alone do not
+			// cover the list mutation when requiredness was already explicit.
+			resolution.Record(configkit.Keys("publish", "outputs"), configkit.ChangeNormalization, "derived publish destinations")
+		}
 	}
 	return nil
 }

internal/config/storage_publish_test.go

@@ -3,6 +3,8 @@ package config
 import (
 	"strings"
 	"testing"
+
+	"gopkg.in/yaml.v3"
 )
 
 func TestStorageS3DefaultsAndValidation(t *testing.T) {
@@ -549,6 +551,52 @@ publish:
 	}
 }
 
+func TestPublishDerivedDestinationsPreserveExplicitRequiredness(t *testing.T) {
+	pipelinePath, sessionPath := writeConfigFiles(t, testPipelineBaseYAML+`
+scriptorium:
+  artifacts:
+    session_recap:
+      enabled: true
+      prompt_id: dnd.session_recap
+      output_path: artifacts/session_recap.md
+publish:
+  outputs:
+    - {source: narratio.transcript.final, required: true}
+    - {source: narratio.transcript.final_markdown, required: false}
+    - {source: narratio.artifact.session_recap, required: false}
+    - {source: narratio.transcript.final_trimmed, dest: custom/trimmed.json, required: true}
+`, testSessionBaseYAML)
+	cfg, err := Load(pipelinePath, sessionPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := Validate(cfg); err != nil {
+		t.Fatal(err)
+	}
+	effective, err := MarshalEffectivePipeline(cfg.Pipeline)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var projected struct {
+		Publish PublishConfig `yaml:"publish"`
+	}
+	if err := yaml.Unmarshal(effective, &projected); err != nil {
+		t.Fatal(err)
+	}
+	wantDest := []string{"transcripts/final.json", "transcripts/final.md", "artifacts/session_recap.md", "custom/trimmed.json"}
+	wantRequired := []bool{true, false, false, true}
+	for label, publish := range map[string]*PublishConfig{"loaded": cfg.Pipeline.Publish, "effective": &projected.Publish} {
+		if len(publish.Outputs) != len(wantDest) {
+			t.Fatalf("%s output count = %d, want %d", label, len(publish.Outputs), len(wantDest))
+		}
+		for i, output := range publish.Outputs {
+			if output.Dest != wantDest[i] || output.Required == nil || *output.Required != wantRequired[i] {
+				t.Errorf("%s output %d = %#v, want destination %q and required %t", label, i, output, wantDest[i], wantRequired[i])
+			}
+		}
+	}
+}
+
 func TestScriptoriumOutputPathsIgnoreInvalidKeys(t *testing.T) {
 	scriptorium := &ScriptoriumConfig{Artifacts: map[string]ScriptoriumArtifactConfig{
 		" artifact": {OutputPath: "artifacts/invalid.md"},