Migrate remaining configuration documents to ConfigKit

docs/config.md

@@ -106,9 +106,13 @@ remote state with an unsafe legacy identity must be migrated before use.
 - An omitted profile, an empty profile option, and the exact name `default`
   select the base configuration. Any other name selects
   `profiles/<name>.yml` relative to the pipeline root.
+- Campaign, session, and canonical-party documents are strict single-source
+  ConfigKit schemas. They do not enable imports, profiles, or `configkit`
+  directives.
 - Configured timeout and retry-delay durations must be positive. An omitted
   artifact timeout continues to inherit its configured Scriptorium timeout.
 - Session files must be concrete; unresolved `{{ ... }}` placeholders fail load.
+- Session and party inputs inspected before typed loading are limited to 8 MiB.
 - Pipeline defaults are applied before validation.
 - Campaign and session identities must agree.
 - Required stable files (`speakers_file`, `autocorrect_file`, `glossary_file`,

docs/internal/configuration.md

@@ -44,6 +44,14 @@ download retain that exact pipeline object and its private provenance. Removing
 a temporary downloaded session file therefore cannot invalidate the resolved
 pipeline or campaign context.
 
+Campaign and session files use independent ConfigKit definitions with imports
+and profiles disabled. Campaign files normally load directly from their source;
+session files are first read through the 8 MiB bounded-read boundary because the
+application must reject unresolved template placeholders before passing an exact
+byte snapshot to ConfigKit. Local and remotely downloaded session bytes then use
+the same typed loader and retain the existing post-load identity expectations,
+stable-input precedence, and source-relative path semantics.
+
 The application also has a separate read-only inspection resolver for `config
 validate`, `config show`, and `config sources`. It uses the same production root/profile and
 campaign selection functions, but never routes through session discovery,
@@ -88,13 +96,16 @@ configured roster authority; player and session-party fields are unsupported.
 
 ## Canonical Party Domain
 
-`ParseParty` is the package-owned boundary for parsing a party source. It
-requires a top-level `schema_version` and strictly validates the
-`narratio.party.v1` contract into ordered character domain values. The
-canonical value retains a separate exact byte copy of its source so consumers
-can materialize the authored party document without reserializing it. Its
-`PlayersYAML` method deterministically derives the versioned players-only
-projection.
+`ParseParty` is the package-owned boundary for parsing a party source. Its
+single-source ConfigKit definition disables imports and profiles, requires
+`schema_version` through `VersionRule`, and strictly decodes the
+character-keyed typed schema before applying Narratio's party-domain checks.
+Successful metadata coordinates recover authored character-map order without a
+second YAML parse; class and alias slice order comes directly from typed decode.
+The canonical value retains a separate exact byte copy of its source so
+consumers can materialize the authored party document without reserializing it.
+Its `PlayersYAML` method deterministically derives the ID-sorted, versioned
+players-only projection.
 
 An unversioned source is rejected before resolution, family expansion, or
 prepare-stage materialization.
@@ -159,8 +170,9 @@ metadata, and root-relative path behavior. Application configuration-loader test
 single-read boundary by changing the pipeline file after its initial load and
 confirming local session resolution retains the original pipeline. Other
 configuration tests continue to protect defaults and validation after assembly.
-`party_test.go` protects the versioned party schema, domain invariants, and
-deterministic players projection without involving campaign or runtime wiring.
+`party_test.go` protects the versioned typed party schema, domain invariants,
+authored character order, retained bytes, and deterministic players projection
+without involving campaign or runtime wiring.
 `party_resolution_test.go` protects campaign-owned party loading, canonical
 input restrictions, source provenance, and virtual players input selection.
 

docs/roadmap/implementation.md

@@ -240,7 +240,10 @@ still fail. Commands use the new pipeline loader with no format fallback. Update
 
 ## Stage 5 — Migrate campaign, session, and canonical party loading
 
-Status: Pending
+Status: Complete — Migrated campaign, session, and canonical-party documents to
+independent ConfigKit definitions, preserved bounded session inspection, exact
+party bytes and metadata-derived authored order, and retained identity, source,
+family-expansion, and validation behavior; verified all tests and focused races.
 
 Read: `internal/config/load.go`, `party.go`, `party_resolution.go`,
 `artifact_families.go`, session-template tests, `internal/app/config_loader.go`,