Refresh CLI and internal restore documentation for current behavior

Split operator helper implementations by command responsibility
Centralize remote current-state loading and preserve caller policy
2026-05-23 14:07:11 +00:00 · 2026-05-23 14:03:31 +00:00 · 2026-05-23 13:56:53 +00:00 · 2026-05-23 13:47:39 +00:00 · 2026-05-23 13:39:15 +00:00 · 2026-05-23 13:28:25 +00:00
157 changed files with 9581 additions and 6498 deletions
--- a/README.md
+++ b/README.md
@@ -1,22 +1,22 @@
 # narratio
-Narratio is a Go orchestration application that turns D&D session audio into polished transcripts and generated session artifacts.
+Narratio is a stage-driven Go orchestrator for turning D&D session audio into polished transcripts and generated artifacts.
-It coordinates transcription, merge/polish/normalize/trim processing, artifact generation, archive publishing, and resumable run state in one operator workflow.
+It runs a deterministic workflow across `prepare`, `transcribe`, `merge`, `polish`, `normalize`, `trim`, `analyze`, and `publish`, with manifest-driven resume and restore support.
 ```bash
-narratio run --session-id 2026-04-04
+narratio run 2026-04-04
 ```
-This command requires discoverable `pipeline.yml` and `session.yml` files (or explicit `--config` and `--session` flags).
+This requires resolvable `pipeline.yml`, `campaign.yml`, and concrete `session.yml` (or explicit config flags).
 ## Documentation
 - [Configuration](docs/config.md)
 - [CLI Reference](docs/cli.md)
- [Operations and Recovery](docs/operations.md)
+- [Configuration](docs/config.md)
 - [Operations](docs/operations.md)
 - [Troubleshooting](docs/troubleshooting.md)
 - [Development Guide](docs/development.md)
 - [Architecture Principles](docs/architecture.md)
 - [Internal Component Contracts](docs/internal/README.md)
- [Config Examples](examples/)
+- [Development Guide](docs/policy/development.md)
 - [Architecture Principles](docs/policy/architecture.md)
 - [Maintained Examples](examples/)
--- a/docs/cli.md
+++ b/docs/cli.md
@@ -1,88 +1,100 @@
-# CLI
+# CLI Reference
 ## Shortest Useful Command
 ```bash
-narratio run --session-id 2026-04-04
+narratio run 2026-04-04
 ```
-This command uses default system discovery for `pipeline.yml`, `campaign.yml`, and local `session.yml`. If local session discovery misses and S3 storage is configured, `--session-id` can load remote `session.yml` from the canonical session prefix.
+This runs the canonical full pipeline for session `2026-04-04`.
 Default discovery checks system config locations only. Pass `--config`, `--campaign`, and `--session` to use files from the current working directory.
 ## Command Overview
-Implemented commands:
+Top-level commands:
- `run`: execute pipeline stages and persist manifest state.
+- `run <session_id>`: run full stage order.
- `plan`: validate config, prepare workspace layout, and print stage run/skip decisions.
+- `resume <session_id>`: continue from first non-succeeded stage.
- `resume`: continue from first non-succeeded stage unless forced.
+- `run-stage <stage> <session_id>`: run one stage.
- `status`: read an existing manifest or inspect local/remote state for a session.
+- `analyze <session_id>`: force-run analyze.
- `run-stage`: execute exactly one stage.
+- `publish <session_id>`: force-run publish.
- `analyze`: force-rerun the analyze stage.
+- `clean <session_id>` or `clean --all`: remove local work/spool state.
- `restore`: restore durable local session state from the committed remote archive state.
+- `session <subcommand>`: session helper commands.
 - `session validate`: run read-only preflight checks for a session.
 - `session init`: create local or remote `session.yml`.
 - `artifacts list`: list effective artifact source IDs.
 - `locks`: list, add, and remove archive promotion locks.
 - `clean`: remove local workspace/spool state for one session or all local sessions.
-Unknown commands print usage and exit non-zero.
+Session subcommands:
-For config semantics, see [docs/config.md](./config.md). For operator lifecycle and recovery, see [docs/operations.md](./operations.md).
+- `session init <session_id>`
 - `session plan <session_id>`
 - `session validate <session_id>`
 - `session status <session_id>`
 - `session restore <session_id>`
 - `session artifacts <session_id>`
 - `session locks <session_id>`
 - `session locks add <session_id> <source>`
 - `session locks remove <session_id> <source>`
-## Complete Flag Reference
+## Common Config Flags
 Most session-aware commands accept:
 - `--config <pipeline.yml>`
 - `--campaign <id>`
 - `--campaign-file <campaign.yml>`
 - `--session <session.yml>`
 - `--session-id <session_id>`
 - `--previous-session-id <session_id>`
 Rules:
 - `--campaign` and `--campaign-file` are mutually exclusive.
 - `--session` is not used by `session init`.
 - if both positional `<session_id>` and `--session-id` are provided, values must match.
 - `clean --all` cannot be combined with campaign/session selectors.
 ## Session ID Input Rules
 Session-aware commands accept one of these forms:
 - positional session ID: `... <session_id>`
 - compatibility flag: `... --session-id <session_id>`
 When both are present, command parsing requires an exact match.
 Commands with additional positionals keep their command-specific order:
 - `run-stage <stage> <session_id>` or `run-stage <stage> --session-id <session_id>`
 - `session locks add <session_id> <source>` or `session locks add --session-id <session_id> <source>`
 - `session locks remove <session_id> <source>` or `session locks remove --session-id <session_id> <source>`
 ## Command Reference
 ### `run`
- `--config <path>`: optional explicit `pipeline.yml` path.
+```bash
- `--campaign <path>`: optional explicit `campaign.yml` path.
+narratio run <session_id> [--force] [--artifacts <name[,name...]>] [...common config flags]
- `--session <path>`: optional explicit `session.yml` path.
+```
 - `--session-id <value>`: session template variable value.
 - `--previous-session-id <value>`: previous-session template variable value.
 - `--force`: force stage execution.
 - `--artifacts <names>`: analyze artifact keys to execute (repeatable or comma-separated).
-### `plan`
+Behavior:
- `--config <path>`
+- evaluates full stage order;
- `--campaign <path>`
+- skips already-succeeded stages unless `--force` is set;
- `--session <path>`
+- writes session and run manifests.
 - `--session-id <value>`
 - `--previous-session-id <value>`
 - `--force`
 ### `resume`
- `--config <path>`
+```bash
- `--campaign <path>`
+narratio resume <session_id> [--force] [--artifacts <name[,name...]>] [...common config flags]
- `--session <path>`
+```
- `--session-id <value>`
+
- `--previous-session-id <value>`
+Behavior:
- `--force`
+
- `--artifacts <names>`: analyze artifact keys to execute (repeatable or comma-separated).
+- when not forced, starts at first non-succeeded stage in manifest order;
 - with `--force`, reevaluates the selected stage list as runnable.
 ### `run-stage`
- `--config <path>`
+```bash
- `--campaign <path>`
+narratio run-stage <stage> <session_id> [--force] [--artifacts <name[,name...]>] [...common config flags]
- `--session <path>`
+```
 - `--session-id <value>`
 - `--previous-session-id <value>`
 - `--force`
 - `--artifacts <names>`: analyze artifact keys to execute (repeatable or comma-separated).
 - positional `<stage>`: required stage name.
 ### `analyze`
 - `--config <path>`
 - `--campaign <path>`
 - `--session <path>`
 - `--session-id <value>`
 - `--previous-session-id <value>`
 - `--artifacts <names>`: analyze artifact keys to execute (repeatable or comma-separated).
 `analyze` is force-by-design and does not accept `--force`.
 Valid stage names:
@@ -93,439 +105,187 @@ Valid stage names:
 - `normalize`
 - `trim`
 - `analyze`
- `archive`
+- `publish`
 - `notify`
-### `restore`
+Rules:
- `--config <path>`
+- `--artifacts` is accepted only for `analyze` and `publish` stage targets.
 - `--campaign <path>`
 - `--session <path>`
 - `--session-id <value>`
 - `--previous-session-id <value>`
 - `--dry-run`: plan restore actions without writing local files.
 - `--force`: overwrite local conflicting files with remote archive files.
 - `--include-audio`: include durable archived `audio/**` files in restore scope.
 ### `clean`
 - `--session-id <value>`: required for session cleanup unless `--all` is set.
 - `--config <path>`
 - `--campaign <path>`
 - `--session <path>`
 - `--previous-session-id <value>`
 - `--all`: clean all local session work/spool state using pipeline config only.
 - `--dry-run`: print cleanup targets without deleting.
 - `--clear-cache`: also remove matching S3 audio cache entries.
 ### `status`
 - `--manifest <path>`: inspect one manifest file.
 - `--config <path>`
 - `--campaign <path>`
 - `--session <path>`
 - `--session-id <value>`
 - `--previous-session-id <value>`
 ### `session validate`
 - `--config <path>`
 - `--campaign <path>`
 - `--session <path>`
 - `--session-id <value>`
 - `--previous-session-id <value>`
 ### `session init`
 - `--config <path>`: required.
 - `--campaign <path>`: required.
 - `--session-id <value>`: required.
 - `--output <path>`: local `session.yml` target; mutually exclusive with `--remote`.
 - `--remote`: write remote `session.yml` to the canonical session prefix; mutually exclusive with `--output`.
 - `--previous-session-id <value>`
 - `--date <value>`
 - `--title <value>`
 - `--audio-s3-prefix <prefix>`: defaults to `audio/` when neither audio flag is provided.
 - `--audio-dir <path>`: local audio directory; mutually exclusive with `--audio-s3-prefix`.
 - `--force`: overwrite existing local or remote target.
 ### `artifacts list`
 - `--config <path>`
 - `--campaign <path>`
 - `--session <path>`
 - `--session-id <value>`
 - `--previous-session-id <value>`
 - `--remote`: check remote availability for configured archive promotion destinations.
 ### `locks`
 - `--session-id <value>`: required for list, add, and remove.
 - `--config <path>`: optional explicit `pipeline.yml` path.
 - `--campaign <path>`: optional explicit `campaign.yml` path.
 - `--session <path>`: optional explicit `session.yml` path.
 - `--previous-session-id <value>`: optional session template value.
 - `add <source>`: add a remote lock for one artifact or transcript source.
 - `add --reason <text>`: record an optional remote lock reason.
 - `add --force`: update the reason for an existing remote lock.
 - `remove <source>`: remove one remote lock.
 ## Command Reference
 ### `run`
 Purpose:
 - Execute configured stages in canonical order.
 Syntax:
 ```bash
 narratio run [--config <pipeline.yml>] [--campaign <campaign.yml>] [--session <session.yml>] [--session-id <id>] [--previous-session-id <id>] [--force] [--artifacts <name[,name...]>]
 ```
 Success output:
 - `narratio run: session <session_id>; executed=<n> skipped=<n>; manifest=<path>`
 Common failure cases:
 - missing system default config/campaign/session paths when flags omitted.
 - missing local session plus missing/unavailable remote `session.yml`.
 - invalid template/rendered session mismatch.
 - unknown/invalid `--artifacts` value.
 - `--artifacts` with unknown configured artifact key.
 ### `plan`
 Purpose:
 - Validate config, load secrets (if configured), prepare workdir, and print stage run/skip decisions.
 Syntax:
 ```bash
 narratio plan [--config <pipeline.yml>] [--campaign <campaign.yml>] [--session <session.yml>] [--session-id <id>] [--previous-session-id <id>] [--force]
 ```
 Success output includes:
 - `narratio plan: workdir prepared at <path>`
 - one line per stage (`<stage>: run|skip`)
 - `totals: run=<n> skip=<n>`
 Common failure cases:
 - same config/campaign/session discovery and validation failures as `run`.
 - remote session fallback failures when local session discovery misses.
 - secrets directory read failures when `pipeline.secrets.env_dir` is configured.
 ### `resume`
 Purpose:
 - Continue from session-manifest stage status.
 Syntax:
 ```bash
 narratio resume [--config <pipeline.yml>] [--campaign <campaign.yml>] [--session <session.yml>] [--session-id <id>] [--previous-session-id <id>] [--force] [--artifacts <name[,name...]>]
 ```
 Success output:
 - `narratio resume: session <session_id> has no remaining stages`
 - or `narratio resume: session <session_id>; executed=<n> skipped=<n>; manifest=<path>`
 Common failure cases:
 - same discovery/template/validation failures as `run`.
 - manifest load errors when existing manifest is unreadable.
 - invalid or unknown artifact selections.
 ### `status`
 Purpose:
 - Inspect one manifest file, or inspect configured local/remote state for a session.
 Syntax:
 ```bash
 narratio status --manifest <manifest.json>
 narratio status [--config <pipeline.yml>] [--campaign <campaign.yml>] [--session <session.yml>] [--session-id <id>] [--previous-session-id <id>]
 ```
 Manifest output includes:
 - `session_id: <id>`
 - `updated_at: <timestamp>`
 - `stages:` entries (`- <stage>: <status>`)
 Session output includes:
 - session ID, campaign, workspace, session config source.
 - local manifest state when present.
 - remote current archive state when storage is configured.
 - catalog-based remote output availability for expected transcript and artifact sources.
 - effective archive locks and conservative next actions.
 Common failure cases:
 - missing `--manifest` when no config/session flags are provided.
 - unreadable or invalid manifest path.
 - invalid config or remote session fallback failure in session mode.
 ### `session validate`
 Purpose:
 - Run read-only preflight checks for a session.
 Syntax:
 ```bash
 narratio session validate [--config <pipeline.yml>] [--campaign <campaign.yml>] [--session <session.yml>] [--session-id <id>] [--previous-session-id <id>]
 ```
 Checks include:
 - effective config and session source.
 - stable input files.
 - local or remote audio availability.
 - previous-session requirements.
 - archive promotions and effective locks.
 Warnings do not fail the command. Any `ERROR` finding exits non-zero.
 ### `session init`
 Purpose:
 - Create a strict-decoded session skeleton locally or in object storage.
 Syntax:
 ```bash
 narratio session init --config <pipeline.yml> --campaign <campaign.yml> --session-id <id> --output ./session.yml
 narratio session init --config <pipeline.yml> --campaign <campaign.yml> --session-id <id> --remote
 ```
 Behavior:
 - exactly one of `--output` or `--remote` is required.
 - remote writes target `{root_prefix}/campaigns/{campaign}/sessions/{session_id}/session.yml`.
 - existing local or remote targets fail unless `--force` is passed.
 - remote writes use existence checks, not compare-and-swap.
 ### `artifacts list`
 Purpose:
 - List built-in, configured, previous-session, promoted, and locked artifact sources.
 Syntax:
 ```bash
 narratio artifacts list [--config <pipeline.yml>] [--campaign <campaign.yml>] [--session <session.yml>] [--session-id <id>] [--previous-session-id <id>] [--remote]
 ```
 `--remote` checks promoted top-level object availability through the storage adapter. Remote markers appear only in the `Promoted` section, which reports each configured archive promotion destination and includes `dest=<path>` when that destination differs from the source's canonical path.
 ### `locks`
 Purpose:
 - Inspect and mutate source-based archive promotion locks for one session.
 Syntax:
 ```bash
 narratio locks --session-id <id>
 narratio locks add --session-id <id> [--reason <text>] [--force] <source>
 narratio locks remove --session-id <id> <source>
 ```
 Behavior:
 - `--session-id` is required for list, add, and remove.
 - optional `--config`, `--campaign`, and `--session` override default config discovery.
 - list mode prints effective locks from static `pipeline.archive.locks` and remote `{session_prefix}/locks.yml`.
 - `locks add` writes only the remote lock store and fails if the source is already locked by pipeline config.
 - `locks remove` removes only remote locks and cannot remove static pipeline locks.
 - `locks add --force` is required to update an existing remote lock reason.
 Examples:
 ```bash
 narratio locks --session-id 2026-04-04
 narratio locks add --session-id 2026-04-04 --reason "manual transcript review" narratio.transcript.trimmed
 narratio locks remove --session-id 2026-04-04 narratio.transcript.trimmed
 ```
 ### `run-stage`
 Purpose:
 - Execute exactly one stage.
 Syntax:
 ```bash
 narratio run-stage [--config <pipeline.yml>] [--campaign <campaign.yml>] [--session <session.yml>] [--session-id <id>] [--previous-session-id <id>] [--force] [--artifacts <name[,name...]>] <stage>
 ```
 Success output:
 - `narratio run-stage: stage=<name> executed=<n> skipped=<n> force=<true|false>; manifest=<path>`
 `--artifacts` behavior:
 - accepted only when `<stage>` is `analyze`.
 - names are normalized (trimmed, deduplicated, sorted).
 - unknown configured artifact keys fail.
 Common failure cases:
 - missing stage positional arg.
 - unknown stage name.
 - using `--artifacts` with any non-`analyze` stage.
 ### `analyze`
 Purpose:
 - Force-rerun the analyze stage.
 - Provide a shorter equivalent for `narratio run-stage --force analyze`.
 Syntax:
 ```bash
-narratio analyze [--config <pipeline.yml>] [--campaign <campaign.yml>] [--session <session.yml>] [--session-id <id>] [--previous-session-id <id>] [--artifacts <name[,name...]>]
+narratio analyze <session_id> [--artifacts <name[,name...]>] [...common config flags]
 ```
-Success output:
+Equivalent to:
 - `narratio analyze: executed=<n> skipped=<n> force=true; manifest=<path>`
 Common failure cases:
 - positional arguments.
 - `--force`, because force is implicit.
 - unknown configured artifact keys.
 ### `restore`
 Purpose:
 - Restore durable session state (`manifest.json`, `transcripts/**`, `artifacts/**`, `previous/**`, and optional `audio/**`) from the committed remote archive current state.
 Syntax:
 ```bash
-narratio restore [--config <pipeline.yml>] [--campaign <campaign.yml>] [--session <session.yml>] [--session-id <id>] [--previous-session-id <id>] [--dry-run] [--force] [--include-audio]
+narratio run-stage analyze <session_id> --force [...common config flags]
 ```
-Success output (dry-run):
+### `publish`
 - `Restore plan for <campaign>/<session_id>`
 - `Remote run: <run_id>`
 - `Would download: <n>`
 - `Would skip unchanged: <n>`
 - `Conflicts: <n>`
-Success output (non-dry-run):
+```bash
- `Restored session archive for <campaign>/<session_id>`
+narratio publish <session_id> [--artifacts <name[,name...]>] [...common config flags]
- `Remote run: <run_id>`
+```
 - `Downloaded: <n>`
 - `Skipped unchanged: <n>`
 - `Conflicts: <n>`
-Common failure cases:
+Equivalent to:
 - storage backend is not configured.
 - remote `current/run_id.txt` missing/empty.
 - remote `current/manifest.json` missing or invalid.
 - remote manifest session/campaign mismatch.
 - local conflicts without `--force`.
 - session lock conflict.
-When `--include-audio` is set, S3 audio files are restored through the shared audio cache. Cache hits avoid re-downloading large audio objects.
+```bash
 narratio run-stage publish <session_id> --force [...common config flags]
 ```
 ### `clean`
 Purpose:
 - Remove local Narratio work/spool state for testing, reruns, or recovery from corrupted local files.
 - Preserve durable S3 audio cache state unless `--clear-cache` is passed.
 Syntax:
 ```bash
-narratio clean --session-id <id> [--config <pipeline.yml>] [--campaign <campaign.yml>] [--session <session.yml>] [--previous-session-id <id>] [--dry-run] [--clear-cache]
+narratio clean <session_id> [--dry-run] [--clear-cache] [...common config flags]
-narratio clean --all [--config <pipeline.yml>] [--dry-run] [--clear-cache]
+narratio clean --all [--dry-run] [--clear-cache] [--config <pipeline.yml>]
 ```
-Session cleanup deletes:
+Behavior:
 - `{workspace.root}/work/{campaign}/{session_id}`
 - `{spool.root}/{campaign}/{session_id}`
-All-session cleanup deletes:
+- session mode removes:
- `{workspace.root}/work`
+  - `{workspace.root}/work/{campaign}/{session_id}`
- the contents of `{spool.root}`, while preserving the spool root directory itself.
+  - `{spool.root}/{campaign}/{session_id}`
 - `--all` removes:
  - `{workspace.root}/work/*`
  - direct children under `{spool.root}`
 - cache remains unless `--clear-cache` is provided.
-Cache behavior:
+### `session plan`
 - cache is preserved by default.
 - `--clear-cache` in session mode removes cached S3 audio files for the resolved session.
 - `--all --clear-cache` removes the configured Narratio S3 audio cache namespace for the configured bucket/root prefix.
 - `--clear-cache` does not delete arbitrary files under `pipeline.cache.root`.
-Common failure cases:
+```bash
- missing `--session-id` when `--all` is not set.
+narratio session plan <session_id> [--force] [...common config flags]
- combining `--all` with `--campaign`, `--session`, `--session-id`, or `--previous-session-id`.
+```
- unsafe cleanup target, such as a symlink, a non-directory session target, a configured root directory, or a path outside the configured root.
+
 Validates config, prepares local workdir layout, and prints run/skip decisions for each stage.
 ### `session validate`
 ```bash
 narratio session validate <session_id> [...common config flags]
 ```
 Read-only preflight checks for config validity, required inputs, audio mode, previous-session requirements, publish outputs, and effective locks.
 ### `session status`
 ```bash
 narratio session status <session_id> [...common config flags]
 ```
 Prints local manifest state and, when storage is available, remote current-state and published-output status.
 ### `session init`
 ```bash
 narratio session init <session_id> --output ./session.yml [options]
 narratio session init <session_id> --remote [options]
 ```
 Required target selection:
 - exactly one of:
  - `--output <path>`
  - `--remote`
 Options:
 - `--config <pipeline.yml>`
 - `--campaign <id>` or `--campaign-file <campaign.yml>`
 - `--previous-session-id <id>`
 - `--date <YYYY-MM-DD>`
 - `--title <text>`
 - `--audio-dir <path>`
 - `--audio-s3-prefix <prefix>`
 - `--force`
 Rules:
 - `--audio-dir` and `--audio-s3-prefix` are mutually exclusive.
 - if campaign `session_template_file` is configured, `session init` renders it.
 - generated session YAML must be concrete (no unresolved `{{ ... }}` placeholders).
 ### `session restore`
 ```bash
 narratio session restore <session_id> [--dry-run] [--force] [--include-audio] [...common config flags]
 ```
 Behavior:
 - discovers committed remote current state;
 - plans local restores;
 - writes `reports/restore-latest.json` on execution;
 - blocks conflicting overwrites unless `--force` is set.
 Default restore scope:
 - `manifest.json`
 - `transcripts/**`
 - `artifacts/**`
 - `previous/**` when required by configured previous-session inputs
 `audio/**` is included only with `--include-audio`.
 ### `session artifacts`
 ```bash
 narratio session artifacts <session_id> [--remote] [...common config flags]
 ```
 Lists effective built-in and configured artifact sources, publish rules, lock state, and optional remote published-state availability.
 ### `session locks`
 ```bash
 narratio session locks <session_id> [...common config flags]
 narratio session locks add <session_id> <source> [--reason <text>] [--force] [...common config flags]
 narratio session locks remove <session_id> <source> [...common config flags]
 ```
 Behavior:
 - list mode merges static `pipeline.publish.locks` with remote `{session_prefix}/locks.yml`;
 - add/remove mutate only remote locks;
 - static locks from pipeline config cannot be removed by CLI commands.
 ## `--artifacts` Selection Rules
 - accepted on `run`, `resume`, `run-stage`, `analyze`, and `publish`;
 - names must exist in `pipeline.scriptorium.artifacts`;
 - empty entries are invalid;
 - repeated names are deduplicated.
 Effects:
 - filters analyze execution to selected configured artifacts;
 - filters publish rules that source `narratio.artifact.<name>`;
 - does not filter built-in transcript/bounds publish sources.
 ## Common Workflows
-Default-discovery run:
+Run full pipeline:
 ```bash
-narratio run --session-id 2026-04-04
+narratio run 2026-04-04
 ```
-Run only selected analyze artifacts:
+Dry-run restore plan:
 ```bash
-narratio run --session-id 2026-04-04 --artifacts session_recap,player_handout
+narratio session restore 2026-04-04 --dry-run
 ```
-Resume with selected analyze artifacts:
+Generate a concrete session file from template/default structure:
 ```bash
-narratio resume --session-id 2026-04-04 --artifacts player_handout
+narratio session init 2026-04-04 --output ./session.yml --date 2026-04-04 --title "Session 12"
 ```
-Force-rerun analyze with selected artifacts:
+Force publish only:
 ```bash
-narratio analyze --session-id 2026-04-04 --artifacts player_handout
+narratio publish 2026-04-04
 ```
 Preview restore actions without writes:
 ```bash
 narratio restore --session-id 2026-04-04 --dry-run
 ```
 Restore and then force analyze:
 ```bash
 narratio restore --session-id 2026-04-04
 narratio analyze --session-id 2026-04-04
 ```
 Rehydrate canonical previous-session inputs after artifact-input changes:
 ```bash
 narratio run-stage --session-id 2026-04-04 --force prepare
 ```
 Reset local state before testing restore:
 ```bash
 narratio clean --session-id 2026-04-04 --dry-run
 narratio clean --session-id 2026-04-04
 narratio restore --session-id 2026-04-04 --include-audio
 ```
 Clean all local sessions while keeping cached S3 audio:
 ```bash
 narratio clean --all
 ```
 ## Diagnostic / Recovery Commands
 Inspect stage status:
 ```bash
 narratio status --manifest <manifest.json>
 ```
 Get manifest path from previous output:
 - `run`, `resume`, `run-stage`, and `analyze` print `manifest=<path>` on success.
 ## `--artifacts` and `--force`
 - `--artifacts` filters which configured artifacts are executable when analyze runs.
 - `--artifacts` does not imply `--force`.
 - if analyze is already `succeeded` and `--force` is not set, runner-level skip still applies.
--- a/docs/config.md
+++ b/docs/config.md
@@ -1,263 +1,131 @@
-# Configuration
+# Configuration Reference
-## 1. Overview
+## Purpose
-Narratio loads three YAML files:
+Narratio resolves three YAML documents:
- `pipeline.yml`: pipeline-level runtime configuration.
+- `pipeline.yml`: pipeline/runtime settings
- `campaign.yml`: stable campaign identity and campaign-level input defaults.
+- `campaign.yml`: campaign identity and stable input defaults
- `session.yml`: per-session metadata and input selection, loaded locally or from the configured S3 backend.
+- `session.yml`: session identity, metadata, and audio source selection
-These commands load and validate all three files before running:
+## Discovery and Selection
 - `narratio run`
 - `narratio plan`
 - `narratio resume`
 - `narratio run-stage`
 - `narratio restore`
 Behavior:
 - strict YAML decode is enabled (`KnownFields(true)`): unknown fields fail.
 - session templates render before session YAML decode.
 - remote `session.yml` uses the same strict decode and template behavior as local `session.yml`.
 - defaults are applied for optional pipeline fields.
 - campaign-level stable input paths fill missing session input paths.
 - session-level stable input paths override campaign-level input paths.
 - validation enforces required fields, value formats, and cross-field constraints.
 ## 2. Config file discovery
 These commands use the same config discovery behavior:
 - `narratio run`
 - `narratio plan`
 - `narratio resume`
 - `narratio run-stage`
 - `narratio restore`
 Pipeline config lookup:
 - if `--config <path>` is provided, that path is used.
 - if omitted, Narratio searches in order:
  1. `/usr/local/etc/narratio/pipeline.yml`
  2. `/etc/narratio/pipeline.yml`
 - first existing file wins.
 Campaign config lookup:
 - if `--campaign <path>` is provided, that path is used.
 - if omitted, Narratio searches in order:
  1. `/usr/local/etc/narratio/campaign.yml`
  2. `/etc/narratio/campaign.yml`
 - first existing file wins.
 Session config lookup:
 - if `--session <path>` is provided, that path is used.
 - if `--session` is omitted, Narratio searches locally in order:
  1. `/usr/local/etc/narratio/session.yml`
  2. `/etc/narratio/session.yml`
 - first existing local file wins.
 - if no local session file is found, `--session-id <value>` is present, storage is configured, and campaign identity is resolved, Narratio loads remote `session.yml` from:
  - `{root_prefix}/campaigns/{campaign}/sessions/{session_id}/session.yml`
 - local discovery always runs before remote fallback.
 - local files in the current working directory are used only when passed explicitly, for example `--config ./pipeline.yml --campaign ./campaign.yml --session ./session.yml`.
 ## 3. Session templating
 Template behavior for local and remote `session.yml`:
 - supported placeholders:
  - `{{session_id}}`
  - `{{ session_id }}`
  - `{{previous_session_id}}`
  - `{{ previous_session_id }}`
 - `--session-id <value>` supplies the placeholder value.
 - `--previous-session-id <value>` supplies the previous-session placeholder value.
 - unresolved placeholders fail load.
 - if rendered `session_id` mismatches `--session-id`, load fails.
 - if rendered `previous_session_id` mismatches `--previous-session-id`, load fails.
 ## 4. Minimal config set
 ### `pipeline.yml`
-```yaml
+When `--config` is omitted, search order is:
 whisperx:
  transcribe_url: "https://transcription.example.com/transcribe"
 ```
-Why this is sufficient:
+1. `/usr/local/etc/narratio/pipeline.yml`
-
+2. `/etc/narratio/pipeline.yml`
 - `whisperx.transcribe_url` is required.
 - `workspace.root` defaults to `/var/lib/narratio`.
 - optional sections (`seriatim`, `audita`, `archive`, `scriptorium`, `trim`, `normalize`, etc.) receive defaults or stay inactive.
 ### `campaign.yml`
 Selection rules:
 - if `--campaign-file` is set, use that path;
 - else if `--campaign <id>` is set, use `{pipeline.campaigns.root}/{id}/campaign.yml`;
 - else use `{pipeline.campaigns.root}/{pipeline.campaigns.default_campaign_id}/campaign.yml`.
 ### `session.yml`
 When `--session` is omitted, local search order is:
 1. `/usr/local/etc/narratio/session.yml`
 2. `/etc/narratio/session.yml`
 If local session discovery fails and a `session_id` is known, Narratio attempts remote session loading from:
 - `{root_prefix}/campaigns/{campaign}/sessions/{session_id}/session.yml`
 using configured object storage.
 ## Validation and Merge Rules
 - YAML decode is strict (`KnownFields(true)`): unknown fields fail load.
 - Session files must be concrete; unresolved `{{ ... }}` placeholders fail load.
 - Pipeline defaults are applied before validation.
 - Campaign and session identities must agree.
 - Stable files (`speakers_file`, `autocorrect_file`, `glossary_file`) resolve from session overrides when provided, otherwise from campaign defaults.
 - Exactly one audio mode must be configured in session input:
  - local (`audio_dir` or `audio_files`), or
  - S3 (`audio_s3.prefix`).
 ## Minimal Working Configuration
 `pipeline.yml`
 ```yaml
-campaign: sample-campaign
+campaigns:
  root: /usr/local/share/narratio/campaigns
  default_campaign_id: sample-campaign
 whisperx:
  transcribe_url: https://transcription.example.com/transcribe
 ```
 `campaign.yml`
 ```yaml
 campaign_id: sample-campaign
 inputs:
  speakers_file: ./speakers.yml
  autocorrect_file: ./autocorrect.yml
  glossary_file: ./glossary.yml
 ```
-Why this is sufficient:
+`session.yml` (local audio)
 - `campaign` supplies the stable campaign identity.
 - stable input files are required and resolve relative to `campaign.yml` when copied during `prepare`.
 ### `session.yml`
 ```yaml
-session_id: "{{ session_id }}"
+session_id: 2026-05-03
 inputs:
  audio_dir: ./audio
 ```
-Why this is sufficient:
+## Secrets Handling
- `session_id` is required and can be rendered from `--session-id`.
+- Do not place raw secrets in YAML.
- `campaign` can be omitted because it is supplied by `campaign.yml`.
+- Use env var names in config (for example `pipeline.audita.llm_api_key_env`).
- stable input paths can be omitted because `campaign.yml` supplies defaults.
+- Optionally load env files from `pipeline.secrets.env_dir`.
- local `audio_dir` resolves relative to `session.yml`.
+- Commands that need storage/auth load filesystem secrets before constructing adapters.
-Minimal local-file usage:
+## Publish Configuration Summary
-```bash
+Publish rules live under `pipeline.publish`.
 narratio run --config /path/to/pipeline.yml --campaign ./campaign.yml --session ./session.yml --session-id 2026-05-03
 ```
 Previous-session-enabled variant:
 ```yaml
-session_id: "{{ session_id }}"
+publish:
 previous_session_id: "{{ previous_session_id }}"
 inputs:
  audio_dir: ./audio
 ```
 ```bash
 narratio run --config /path/to/pipeline.yml --campaign ./campaign.yml --session ./session.yml --session-id 2026-05-03 --previous-session-id 2026-04-26
 ```
 ## 5. Production-oriented config set
 ### `pipeline.yml`
 ```yaml
 workspace:
  root: /var/lib/narratio/workspace
  cleanup_after_archive: true
 storage:
  backend: s3
  s3:
    bucket: my-dnd-archive
    root_prefix: dnd
    region: us-east-1
    access_key_id_env: OBJECT_STORAGE_KEY_ID
    secret_access_key_env: OBJECT_STORAGE_KEY
 spool:
  root: /var/spool/narratio
  delete_audio_after_archive: true
 cache:
  root: /var/cache/narratio
  s3_audio: true
 archive:
  enabled: true
  upload_run: true
-  promote_artifacts:
+  outputs:
-    - source: narratio.transcript.trimmed
+    - source: narratio.transcript.final_trimmed
-      dest: transcripts/trimmed.json
+      dest: transcripts/final.trimmed.json
      required: true
    - source: narratio.artifact.session_recap
      dest: artifacts/session_recap.md
      required: true
  locks:
    - source: narratio.artifact.session_recap
-      reason: Final recap was manually edited.
+      reason: manual post-publish edits
 whisperx:
  transcribe_url: "https://transcription.example.com/transcribe"
 scriptorium:
  artifacts:
    session_recap:
      enabled: true
      prompt_id: dnd.session_recap
      output_path: artifacts/session_recap.md
      inputs:
        transcript:
          source: narratio.transcript.trimmed
          required: true
        previous_recap:
          source: narratio.previous_session.artifact.session_recap
          required: false
 ```
-### `campaign.yml`
+Rules:
-```yaml
+- `outputs[].source` is required.
-campaign: forsaken
+- `outputs[].dest` may be omitted when derivable from source.
-inputs:
+- `outputs[].required` defaults to `true`.
-  speakers_file: /srv/narratio/campaigns/forsaken/speakers.yml
+- static locks (`pipeline.publish.locks`) merge with remote locks (`{session_prefix}/locks.yml`), with static locks taking precedence on duplicates.
  autocorrect_file: /srv/narratio/campaigns/forsaken/autocorrect.yml
  glossary_file: /srv/narratio/campaigns/forsaken/glossary.yml
 ```
-### Local `session.yml`
+## Full Schema
-```yaml
+### Pipeline
 session_id: "{{ session_id }}"
 previous_session_id: "{{ previous_session_id }}"
 date: 2026-05-03
 title: The Black Cabin
 inputs:
  audio_s3:
    prefix: audio/
 ```
-### S3-first session config
+| Field | Type | Required | Default / Rule |
 For S3-first operation, upload the same `session.yml` content to:
 ```text
 {root_prefix}/campaigns/{campaign}/sessions/{session_id}/session.yml
 ```
 Then run with explicit or discovered pipeline/campaign config and no `--session`:
 ```bash
 narratio run --config /usr/local/etc/narratio/pipeline.yml --campaign /usr/local/etc/narratio/campaign.yml --session-id 2026-05-03 --previous-session-id 2026-04-26
 ```
 Operational notes:
 - archive promotion is explicit and source-based via `archive.promote_artifacts`.
 - `source` is required; `dest` is optional and derived when omitted.
 - `archive.locks` skips top-level promotion overwrites for static locked sources while preserving run-local uploads.
 - operator-created mutable locks are stored at `{root_prefix}/campaigns/{campaign}/sessions/{session_id}/locks.yml` and are merged with static locks.
 - Narratio does not auto-promote all generated analyze artifacts.
 - `restore` reads the same config/campaign/session inputs and restore scope is bounded by committed archive current state.
 - `clean` removes workspace/spool state by default and preserves `pipeline.cache.root` unless `--clear-cache` is passed.
 ## 6. Full pipeline reference
 | Path | Type | Required | Default |
 | --- | --- | --- | --- |
 | `pipeline.workspace.root` | string | No | `/var/lib/narratio` |
-| `pipeline.workspace.cleanup_after_archive` | bool | No | `false` |
+| `pipeline.workspace.cleanup_after_publish` | bool | No | `false` |
-| `pipeline.secrets.env_dir` | string | Conditional | none |
+| `pipeline.campaigns.root` | string | No | `/usr/local/share/narratio/campaigns` |
 | `pipeline.campaigns.default_campaign_id` | string | No | empty |
 | `pipeline.secrets.env_dir` | string | No | empty |
 | `pipeline.storage.backend` | string | No | empty |
-| `pipeline.storage.bucket` | string | No | empty |
+| `pipeline.storage.s3.bucket` | string | Conditional | required for S3 session-audio and for publish upload when backend is `s3` |
 | `pipeline.storage.prefix` | string | No | empty |
 | `pipeline.storage.s3.bucket` | string | Conditional | empty |
 | `pipeline.storage.s3.root_prefix` | string | No | `dnd` |
 | `pipeline.storage.s3.region` | string | No | empty |
 | `pipeline.storage.s3.endpoint` | string | No | empty |
@@ -265,26 +133,26 @@ Operational notes:
 | `pipeline.storage.s3.access_key_id_env` | string | No | `OBJECT_STORAGE_KEY_ID` |
 | `pipeline.storage.s3.secret_access_key_env` | string | No | `OBJECT_STORAGE_KEY` |
 | `pipeline.spool.root` | string | No | `/var/spool/narratio` |
-| `pipeline.spool.delete_audio_after_archive` | bool | No | `false` |
+| `pipeline.spool.delete_audio_after_publish` | bool | No | `false` |
 | `pipeline.cache.root` | string | No | `/var/cache/narratio` |
 | `pipeline.cache.s3_audio` | bool | No | `true` |
-| `pipeline.archive.enabled` | bool | No | `true` |
+| `pipeline.publish.enabled` | bool | No | `true` |
-| `pipeline.archive.upload_run` | bool | No | `true` |
+| `pipeline.publish.upload_run` | bool | No | `true` |
-| `pipeline.archive.promote_artifacts[]` | list | No | trimmed transcript rule |
+| `pipeline.publish.outputs[]` | list | No | defaults to final trimmed transcript output |
-| `pipeline.archive.promote_artifacts[].source` | string | Yes (per rule) | none |
+| `pipeline.publish.outputs[].source` | string | Yes (per rule) | must reference built-in or configured artifact source |
-| `pipeline.archive.promote_artifacts[].dest` | string | No | derived from source |
+| `pipeline.publish.outputs[].dest` | string | Conditional | derived if omitted and source supports derivation |
-| `pipeline.archive.promote_artifacts[].required` | bool | No | `true` |
+| `pipeline.publish.outputs[].required` | bool | No | `true` |
-| `pipeline.archive.locks[]` | list | No | empty |
+| `pipeline.publish.locks[]` | list | No | empty |
-| `pipeline.archive.locks[].source` | string | Yes (per lock) | none |
+| `pipeline.publish.locks[].source` | string | Yes (per lock) | must reference supported publish source |
-| `pipeline.archive.locks[].reason` | string | No | empty |
+| `pipeline.publish.locks[].reason` | string | No | empty |
-| `pipeline.whisperx.transcribe_url` | string | Yes | none |
+| `pipeline.whisperx.transcribe_url` | string | Yes | valid URL |
 | `pipeline.whisperx.language` | string | No | `en` |
-| `pipeline.whisperx.timeout` | duration string | No | `30m` |
+| `pipeline.whisperx.timeout` | duration | No | `30m` |
 | `pipeline.whisperx.retries` | int | No | `3` |
-| `pipeline.whisperx.retry_delay` | duration string | No | `2s` |
+| `pipeline.whisperx.retry_delay` | duration | No | `2s` |
 | `pipeline.whisperx.concurrency` | int | No | `2` |
 | `pipeline.seriatim.binary` | string | No | `seriatim` |
-| `pipeline.seriatim.timeout` | duration string | No | `10m` |
+| `pipeline.seriatim.timeout` | duration | No | `10m` |
 | `pipeline.seriatim.output_schema` | string | No | `seriatim-intermediate` |
 | `pipeline.seriatim.coalesce_gap` | float | No | `3.0` |
 | `pipeline.seriatim.report` | bool | No | `true` |
@@ -293,7 +161,7 @@ Operational notes:
 | `pipeline.seriatim.env.backchannel_max_duration` | float | No | unset |
 | `pipeline.seriatim.env.filler_max_duration` | float | No | unset |
 | `pipeline.audita.binary` | string | No | `audita` |
-| `pipeline.audita.timeout` | duration string | No | `3h` |
+| `pipeline.audita.timeout` | duration | No | `3h` |
 | `pipeline.audita.llm_api_key_env` | string | No | empty |
 | `pipeline.audita.modules[]` | list[string] | No | empty |
 | `pipeline.audita.base_url` | string | No | empty |
@@ -307,181 +175,89 @@ Operational notes:
 | `pipeline.audita.output_schema` | string | No | empty |
 | `pipeline.audita.work_dir_retention` | string | No | empty |
 | `pipeline.audita.report` | bool | No | `true` |
-| `pipeline.normalize.output_path` | string | No | `transcripts/normalized.json` |
+| `pipeline.normalize.output_path` | string | No | `transcripts/final.json` |
 | `pipeline.normalize.output_schema` | string | No | `seriatim-intermediate` |
 | `pipeline.normalize.report` | bool | No | `true` |
 | `pipeline.trim.enabled` | bool | No | `false` |
-| `pipeline.trim.output_path` | string | Conditional | none |
+| `pipeline.trim.output_path` | string | Conditional | required when trim enabled |
-| `pipeline.trim.bounds.prompt_id` | string | Conditional | none |
+| `pipeline.trim.bounds.prompt_id` | string | Conditional | required when trim enabled |
 | `pipeline.trim.bounds.profile_id` | string | No | empty |
-| `pipeline.trim.bounds.transcript_input_name` | string | Conditional | none |
+| `pipeline.trim.bounds.transcript_input_name` | string | Conditional | required when trim enabled |
-| `pipeline.trim.bounds.output_path` | string | Conditional | none |
+| `pipeline.trim.bounds.output_path` | string | Conditional | required when trim enabled |
-| `pipeline.trim.bounds.timeout` | duration string | No | `10m` |
+| `pipeline.trim.bounds.timeout` | duration | No | `10m` |
 | `pipeline.trim.bounds.render_debug` | bool | No | `false` |
-| `pipeline.trim.bounds.render_output_path` | string | Conditional | none |
+| `pipeline.trim.bounds.render_output_path` | string | Conditional | required when `render_debug` is true |
 | `pipeline.trim.seriatim.report` | bool | No | `false` |
 | `pipeline.scriptorium.binary` | string | No | `scriptorium` |
 | `pipeline.scriptorium.config_path` | string | No | empty |
-| `pipeline.scriptorium.timeout` | duration string | No | `10m` |
+| `pipeline.scriptorium.timeout` | duration | No | `10m` |
 | `pipeline.scriptorium.render_debug` | bool | No | `false` |
 | `pipeline.scriptorium.artifacts` | map | No | empty |
 | `pipeline.scriptorium.artifacts.<name>.enabled` | bool | No | `false` |
 | `pipeline.scriptorium.artifacts.<name>.depends_on[]` | list[string] | No | empty |
 | `pipeline.scriptorium.artifacts.<name>.render_debug` | bool | No | unset |
 | `pipeline.scriptorium.artifacts.<name>.prompt_id` | string | Conditional | none |
 | `pipeline.scriptorium.artifacts.<name>.profile_id` | string | No | empty |
 | `pipeline.scriptorium.artifacts.<name>.output_path` | string | Conditional | none |
 | `pipeline.scriptorium.artifacts.<name>.timeout` | duration string | No | empty |
 | `pipeline.scriptorium.artifacts.<name>.inputs.<key>.source` | string | Conditional | none |
 | `pipeline.scriptorium.artifacts.<name>.inputs.<key>.artifact` | string | No | empty |
 | `pipeline.scriptorium.artifacts.<name>.inputs.<key>.path` | string | No | empty |
 | `pipeline.scriptorium.artifacts.<name>.inputs.<key>.required` | bool | No | `false` |
 | `pipeline.scriptorium.artifacts.<name>.vars.<key>` | map value | No | empty |
 | `pipeline.analyzer.binary_path` | string | No | empty |
 | `pipeline.analyzer.timeout` | duration string | No | empty |
 | `pipeline.analyzer.artifacts.output_dir` | string | No | empty |
 | `pipeline.analyzer.artifacts.types[]` | list[string] | No | empty |
 | `pipeline.notification.backend` | string | No | empty |
 | `pipeline.notification.recipient` | string | No | empty |
-| `pipeline.notification.timeout` | duration string | No | empty |
+| `pipeline.notification.timeout` | duration | No | `30s` |
-Scriptorium artifact-key and dependency rules:
+### Scriptorium Artifact Entries
- artifact keys must match `^[a-z][a-z0-9_]*$`.
+For each `pipeline.scriptorium.artifacts.<name>`:
 - enabled artifacts require `prompt_id` and `output_path`.
 - `output_path` must be relative, traversal-safe, and under `artifacts/`.
 - configured artifact input sources use `narratio.artifact.<name>`.
 - if input source references `narratio.artifact.<name>`, artifact `<name>` must exist and must be listed in `depends_on`.
 - every `depends_on` entry must be a configured artifact key.
 - self-dependency is rejected.
 - enabled dependency cycles are rejected.
 - any artifact referenced by `depends_on` or `narratio.artifact.<name>` source must define `output_path` (even if not enabled).
-Allowed `pipeline.scriptorium.artifacts.<name>.inputs.<key>.source` values:
+| Field | Type | Required | Rule |
 - `narratio.previous_session.artifact.<configured_artifact_key>`
 - `narratio.transcript.merged`
 - `narratio.transcript.polished`
 - `narratio.transcript.full`
 - `narratio.transcript.trimmed`
 - `narratio.bounds.session`
 - `narratio.artifact.<configured_artifact_key>`
 - `previous_session_artifact` (legacy path-based source; uses `inputs.<key>.path`)
 `pipeline.archive.promote_artifacts[].source` values:
 - `narratio.transcript.merged`
 - `narratio.transcript.polished`
 - `narratio.transcript.full`
 - `narratio.transcript.trimmed`
 - `narratio.bounds.session`
 - `narratio.artifact.<configured_artifact_key>`
 `pipeline.archive.locks[].source` accepts the same source values as `pipeline.archive.promote_artifacts[].source`.
 Archive promotion destination rules:
 - `dest` must be a clean relative path (not absolute, no traversal).
 - duplicate `dest` values are rejected.
 - if `dest` is omitted:
  - built-in sources derive their canonical destination path;
  - configured sources derive from `pipeline.scriptorium.artifacts.<name>.output_path`;
  - derivation failure is a config validation error.
 Archive lock rules:
 - locks are source-based and do not accept `dest`.
 - duplicate lock sources are rejected.
 - static `pipeline.archive.locks` win over remote mutable locks for the same source.
 - locked promotions are recorded as intentional skips in archive metadata.
 - locked required promotions do not fail archive by default.
 - ordinary `--force` reruns do not override locks.
 Remote mutable lock store:
 - path: `{root_prefix}/campaigns/{campaign}/sessions/{session_id}/locks.yml`.
 - strict YAML shape: top-level `locks`, each with `source` and optional `reason`.
 - `narratio locks add` and `narratio locks remove` mutate only the remote lock store.
 - writes use existence checks plus `--force` for updates; they are not compare-and-swap atomic.
 Restore-related implications:
 - restore remote identity requires archive S3 identity to resolve (`pipeline.storage.s3.bucket` and session prefix derivation inputs).
 - restore scope considers committed current state and durable paths (`manifest.json`, `transcripts/**`, `artifacts/**`, `previous/**`, optional `audio/**`).
 - S3 audio downloads use `pipeline.spool.root` for active downloads and `pipeline.cache.root` for reusable cached audio when `pipeline.cache.s3_audio` is true.
 - `pipeline.cache.root` is durable local cache state. It is not workspace state and is preserved by default by `narratio clean`.
 ## 7. Full campaign reference
 | Path | Type | Required | Default |
 | --- | --- | --- | --- |
-| `campaign.campaign` | string | Yes | none |
+| `enabled` | bool | No | `false` if omitted |
-| `campaign.inputs.speakers_file` | string | Yes | none |
+| `depends_on[]` | list[string] | No | must reference configured artifact keys; no self-reference; enabled graph must be acyclic |
-| `campaign.inputs.autocorrect_file` | string | Yes | none |
+| `render_debug` | bool | No | per-artifact override |
-| `campaign.inputs.glossary_file` | string | Yes | none |
+| `prompt_id` | string | Conditional | required when artifact is enabled |
 | `profile_id` | string | No | empty |
 | `output_path` | string | Conditional | required when enabled; also required when referenced by publish/output/input rules |
 | `timeout` | duration | No | artifact override |
 | `inputs` | map | No | input key names must be non-empty |
 | `vars` | map | No | values must be string or bool |
-Campaign input paths may be absolute or relative. Relative paths resolve from the directory containing `campaign.yml`.
+For each artifact input `pipeline.scriptorium.artifacts.<name>.inputs.<input_name>`:
-## 8. Full session reference
+| Field | Type | Required | Rule |
 | Path | Type | Required | Default |
 | --- | --- | --- | --- |
-| `session.session_id` | string | Yes | none |
+| `source` | string | Yes | built-in runtime source, `narratio.artifact.<name>`, or `narratio.previous_session.artifact.<name>` |
-| `session.previous_session_id` | string | No | empty |
+| `artifact` | string | No | optional passthrough adapter field |
-| `session.campaign` | string | No | `campaign.campaign` |
+| `path` | string | No | optional passthrough adapter field |
-| `session.date` | string | No | empty |
+| `required` | bool | No | optional input requirement |
 | `session.title` | string | No | empty |
 | `session.inputs.audio_dir` | string | Conditional | empty |
 | `session.inputs.audio_files[]` | list[string] | Conditional | empty |
 | `session.inputs.audio_s3.prefix` | string | Conditional | none |
 | `session.inputs.speakers_file` | string | No | `campaign.inputs.speakers_file` |
 | `session.inputs.autocorrect_file` | string | No | `campaign.inputs.autocorrect_file` |
 | `session.inputs.glossary_file` | string | No | `campaign.inputs.glossary_file` |
-Session input paths may be absolute or relative. Relative audio paths and session-level stable input overrides resolve from the directory containing `session.yml`. If both `campaign.yml` and `session.yml` specify campaign identity, the values must match.
+### Campaign
-Audio-source rule:
+| Field | Type | Required | Notes |
 | --- | --- | --- | --- |
 | `campaign_id` | string | Yes | canonical campaign identity |
 | `session_template_file` | string | No | used by `session init` when set |
 | `inputs.speakers_file` | string | Yes | stable input default |
 | `inputs.autocorrect_file` | string | Yes | stable input default |
 | `inputs.glossary_file` | string | Yes | stable input default |
- configure exactly one mode:
+### Session
  - `audio_dir`, or
  - `audio_files` (at least one), or
  - `audio_s3.prefix`
 - `audio_s3` cannot be combined with local audio fields.
-Previous-session rule:
+| Field | Type | Required in session file | Notes |
 | --- | --- | --- | --- |
 | `session_id` | string | Yes | must match CLI session target when provided |
 | `previous_session_id` | string | No | must not equal `session_id` |
 | `campaign` | string | No | filled from `campaign_id` during resolve if omitted |
 | `date` | string | No | metadata |
 | `title` | string | No | metadata |
 | `inputs.speakers_file` | string | No | overrides campaign stable input |
 | `inputs.autocorrect_file` | string | No | overrides campaign stable input |
 | `inputs.glossary_file` | string | No | overrides campaign stable input |
 | `inputs.audio_dir` | string | Conditional | local audio mode |
 | `inputs.audio_files[]` | list[string] | Conditional | local audio mode |
 | `inputs.audio_s3.prefix` | string | Conditional | S3 audio mode |
- if `session.previous_session_id` is set, it must not equal `session.session_id`.
+Audio rules:
 - canonical previous-session sources (`narratio.previous_session.artifact.<name>`) are hydrated during `prepare` from archive current state when required by enabled configured artifacts.
-## 9. Secrets
+- configure local mode (`audio_dir` or `audio_files`) or S3 mode (`audio_s3.prefix`), not both.
-Narratio supports filesystem-based secret injection via `pipeline.secrets.env_dir`.
+## Maintained Examples
 Behavior:
 - `env_dir` may be absolute or relative.
 - relative `env_dir` resolves from current working directory.
 - files with valid env-var names (`[A-Za-z_][A-Za-z0-9_]*`) are loaded.
 - values are loaded from file contents with trailing newline trimming.
 - existing process env vars are preserved.
 - invalid names and subdirectories are skipped.
 - missing/unreadable `env_dir` fails command execution.
 Guidance:
 - do not put secret values directly in YAML.
 - configure env var names in config and provide values via env/secrets files.
 ## 10. Examples
 Maintained examples:
 - `examples/pipeline.minimal.yml`
 - `examples/pipeline.production.yml`
 - `examples/pipeline.full.annotated.yml`
- `examples/campaign.yml`
+- `examples/campaigns/sample-campaign/campaign.yml`
 - `examples/session.template.yml`
 - `examples/session.local-audio.yml`
 - `examples/session.s3-audio.yml`
-
+- `examples/session.template.yml`
 These examples are validated by `internal/config` tests.
--- a/docs/integrations/README.md
+++ b/docs/integrations/README.md
@@ -1,15 +1,19 @@
-# Integration Documentation Index
+# Integrations Index
 ## Audience
-Developers and LLM coding agents changing Narratio's external integration contracts.
+Developers and coding agents changing Narratio's external integration boundaries.
 ## Scope
-Implemented-only reference notes for the external systems Narratio currently integrates with.
+`docs/integrations/` is the implementation-level reference for downstream tool adapter contracts.
-## Integration Docs
+These docs cover what Narratio expects from external tools and what each adapter guarantees back to stage code.
 - `audita.md`: Audita adapter invocation and validation contract.
 - `seriatim.md`: Seriatim normalize/merge/trim adapter contract.
 - `scriptorium.md`: Scriptorium run/render adapter contract.
-## Canonical Owner
+## Integration Contracts
-`docs/integrations/` is the canonical home for external integration reference notes per `docs/documentation/policy.md`.
+- `audita.md`: transcript polishing adapter (`audita process`).
 - `seriatim.md`: merge/normalize/trim adapter (`seriatim`).
 - `scriptorium.md`: artifact run/render adapter (`scriptorium run|render`).
 ## Related Canonical Docs
 - `docs/config.md`: operator-facing configuration reference.
 - `docs/internal/adapters.md`: shared adapter boundary and runner wiring.
 - `docs/internal/stage-*.md`: stage-specific integration usage.
--- a/docs/integrations/audita.md
+++ b/docs/integrations/audita.md
@@ -1,66 +1,60 @@
-# Integration: audita
+# Integration: Audita
 ## Purpose
-Define Narratio's adapter contract for transcript polishing via Audita CLI subprocess execution.
+Define the Audita adapter contract used by the `polish` stage.
-## Inputs and Outputs
+## Adapter Boundary
-Inputs (`audita.PolishRequest`):
+Interface:
- merged transcript path
+- `audita.Runner`
- glossary path
+- method: `Run(ctx, PolishRequest) (PolishResult, error)`
 - output processed transcript path
 - optional report path (required when report enabled)
 - work dir
 - generated config path
 - stdout/stderr log paths
 - optional module/model/base URL and concurrency knobs
-Outputs (`audita.PolishResult`):
+Primary implementation:
- processed transcript path
+- `internal/adapters/audita/SubprocessRunner`
 - optional report path
 - generated config path
 - stdout/stderr log paths
 - exit code, duration, invoked binary
 - adapter metadata
-## Boundaries
+Execution mode:
-Owns:
+- subprocess invocation of `audita process`
 - Deterministic CLI argument construction for `audita process`
 - Environment bridging for API credentials
 - Invocation config emission
 - Output validation for processed transcript and report
-Does not own:
+## Request Contract
- Upstream/downstream stage orchestration
+`PolishRequest` carries:
- Credential sourcing policy beyond required env-var presence check
+- required transcript/glossary/output/work-dir paths;
 - optional report path (required when report mode is enabled);
 - generated config and stdout/stderr log paths;
 - optional module/model/base-url/config/output-schema/concurrency settings.
-## Config Fields Used
+## Result Contract
-Via `pipeline.audita.*` mapped in app/stage wiring:
+`PolishResult` returns:
- `binary`, `timeout`, `llm_api_key_env`, `modules`, `base_url`, `model`
+- processed transcript path;
- `transcript_description`, `config_path`, `output_schema`, `work_dir_retention`
+- optional report path;
- `total_llm_concurrency`, `proposal_llm_concurrency`, `validation_model`, `validation_llm_concurrency`, `report`
+- work dir and generated-config/log paths;
 - exit code, duration, binary provenance;
 - adapter metadata map.
-## External Adapters Used
+## Validation and Failure Semantics
- Shared subprocess helper (`internal/adapters/subprocess`) to run CLI and capture logs.
+Construction fails for invalid static config values, including:
 - empty binary;
 - non-positive timeout;
 - invalid base URL;
 - invalid output schema;
 - invalid work-dir retention value;
 - invalid concurrency values.
-## State and Manifest Behavior
+Run fails for:
- No direct manifest writes.
+- missing required request paths;
- Stage-level metadata records adapter provenance and credential-present signal.
+- missing required credential env var when configured (`llm_api_key_env`);
- Generated invocation YAML is written when `GeneratedConfigPath` is provided.
+- subprocess execution failure;
 - invalid processed transcript JSON (`segments` array required);
 - invalid report JSON when reporting is enabled.
-## Skip and Resume Behavior
+Failure results still include output/log/config/exit metadata for diagnostics.
 - Adapter has no skip/resume logic. Stage/runner controls this.
-## Failure Behavior
+## Deterministic Behavior
- Constructor validation fails on invalid binary/timeout/schema/concurrency/URL values.
+- CLI args are built from runner config + request in a fixed order.
- Run fails on missing required paths, missing required credential env var, subprocess errors, invalid processed JSON shape, or invalid report JSON.
+- Generated invocation YAML (`audita.generated.v1`) is emitted when requested.
- Failures preserve stdout/stderr paths in returned result metadata.
+- Manifest writes are stage-owned; adapter itself is stateless.
-## Tests to Inspect Before Changing
+## Config Mapping
- `internal/adapters/audita/subprocess_test.go`
+Config fields consumed through runner/stage wiring are under `pipeline.audita.*`.
 - `internal/adapters/audita/fake_test.go`
 - `internal/stage/polish_test.go`
-## Architectural Invariants
+Maintained example with Audita config:
- Processed output must be valid JSON with top-level `segments` array.
+- `examples/pipeline.full.annotated.yml`
- When report is enabled, report output must be valid JSON.
+- `examples/pipeline.production.yml`
 - If `llm_api_key_env` is configured, credential must be present in environment.
--- a/docs/integrations/scriptorium.md
+++ b/docs/integrations/scriptorium.md
@@ -1,64 +1,66 @@
-# Integration: scriptorium
+# Integration: Scriptorium
 ## Purpose
-Define Narratio's adapter contract for Scriptorium artifact generation and render-debug subprocess invocations.
+Define the Scriptorium adapter contract used by `analyze` and trim-bounds generation in `trim`.
-## Inputs and Outputs
+## Adapter Boundary
-Inputs:
+Interface:
- `RunArtifactRequest`: binary, config path, prompt/profile IDs, input map, vars map, timeout, output path, logs/config paths, optional API env and working dir
+- `scriptorium.Runner`
- `RenderArtifactRequest`: same core fields for render mode
+- methods:
  - `RunArtifact(ctx, RunArtifactRequest)`
  - `RenderArtifact(ctx, RenderArtifactRequest)`
-Outputs (`ArtifactResult`):
+Primary implementation:
- output path
+- `internal/adapters/scriptorium/SubprocessRunner`
 - stdout/stderr log paths
 - generated config path
 - exit code and duration
 - command mode (`run` or `render`)
 - prompt/profile provenance
 - validation failure signal
 - adapter metadata
-## Boundaries
+Execution modes:
-Owns:
+- `scriptorium run`
- Deterministic CLI arg construction for `scriptorium run` and `scriptorium render`
+- `scriptorium render`
 - Common request validation
 - Invocation config emission
 - Output existence/non-empty checks
 - Validation-failure mapping for run exit code 2
-Does not own:
+## Request Contract
- Artifact selection policy (`analyze` stage)
+Both request types carry:
- Bounds semantic validation (`trim` stage)
+- binary/config/prompt/profile IDs;
 - input map and vars map;
 - output path;
 - timeout;
 - generated config + stdout/stderr log paths;
 - optional API-key env var name;
 - optional working directory.
-## Config Fields Used
+## Result Contract
-Via `pipeline.scriptorium.*` and stage-level artifact config:
+`ArtifactResult` returns:
- `binary`, `config_path`, `timeout`, `render_debug`
+- output/log/generated-config paths;
- artifact-level `prompt_id`, `profile_id`, `timeout`, `inputs`, `vars`, `output_path`
+- exit code and duration;
 - command mode (`run` or `render`);
 - prompt/profile provenance;
 - `ValidationFailed` marker;
 - metadata map.
-## External Adapters Used
+## Validation and Failure Semantics
- Shared subprocess helper (`internal/adapters/subprocess`).
+Request validation fails for:
 - missing binary, prompt id, or output path;
 - non-positive timeout;
 - empty input/var names;
 - empty input path values;
 - missing required credential env var when `APIKeyEnv` is set.
-## State and Manifest Behavior
+Run behavior:
- No direct manifest writes.
+- subprocess errors propagate with context;
- Stage metadata records adapter outputs and command mode.
+- `run` exit code `2` is mapped to `ValidationFailed=true`;
- Generated invocation YAML is written when requested.
+- successful subprocess still fails if output file is missing or empty.
-## Skip and Resume Behavior
+Render behavior:
- Adapter has no skip/resume logic. Stage/runner controls execution.
+- subprocess errors propagate;
 - output file must exist and be non-empty.
-## Failure Behavior
+## Deterministic Behavior
- Request validation fails for missing binary/prompt/output, invalid timeout, invalid input/var names, or missing required API env var.
+- input and var maps are sorted into deterministic `--input` and `--var` CLI args.
- Subprocess errors bubble with command context.
+- generated invocation YAML (`scriptorium.generated.v1`) is emitted when requested.
- `run` exit code 2 is treated as `ValidationFailed=true` and surfaced as error by calling stage.
+- adapter is stateless and does not own artifact-selection policy.
 - Successful subprocess still fails if output file is missing/empty.
-## Tests to Inspect Before Changing
+## Config Mapping
- `internal/adapters/scriptorium/subprocess_test.go`
+Config fields consumed through runner/stage wiring are under `pipeline.scriptorium.*` plus per-artifact settings under `pipeline.scriptorium.artifacts.*`.
 - `internal/adapters/scriptorium/fake_test.go`
 - `internal/stage/analyze_test.go`
 - `internal/stage/trim_test.go`
-## Architectural Invariants
+Maintained examples with Scriptorium config:
- Both modes require explicit timeout > 0.
+- `examples/pipeline.full.annotated.yml`
- Input/var maps are sorted into deterministic CLI argument order.
+- `examples/pipeline.production.yml`
 - Run-mode validation failures are represented explicitly, not silently skipped.
--- a/docs/integrations/seriatim.md
+++ b/docs/integrations/seriatim.md
@@ -1,60 +1,56 @@
-# Integration: seriatim
+# Integration: Seriatim
 ## Purpose
-Define Narratio's adapter contract for merge, normalize, and trim subprocess invocations of Seriatim.
+Define the Seriatim adapter contract used by `merge`, `normalize`, and `trim`.
-## Inputs and Outputs
+## Adapter Boundary
-Inputs:
+Interface:
- `MergeRequest`: raw/normalized transcript inputs, output path, optional report, speaker/autocorrect paths, logs/config
+- `seriatim.Runner`
- `NormalizeRequest`: input transcript, output path, schema, optional report, timeout/log/config
+- methods:
- `TrimRequest`: input transcript, output path, keep selector, timeout/log/config
+  - `Run(ctx, MergeRequest)`
  - `Normalize(ctx, NormalizeRequest)`
  - `Trim(ctx, TrimRequest)`
-Outputs:
+Primary implementation:
- `MergeResult`, `NormalizeResult`, `TrimResult` with output paths, logs/config paths, exit code, duration, binary provenance, and metadata.
+- `internal/adapters/seriatim/SubprocessRunner`
-## Boundaries
+Execution modes:
-Owns:
+- `seriatim merge`
- Validated deterministic CLI invocation construction
+- `seriatim normalize`
- Optional env tuning propagation for merge
+- `seriatim trim`
 - Invocation config file emission
 - JSON output validation
-Does not own:
+## Request/Result Contracts
- Transcript input selection/promotion logic (stage-owned)
+- `MergeRequest`/`MergeResult`: multi-input merge to base transcript, optional report.
- Bounds computation (scriptorium/trim-stage-owned)
+- `NormalizeRequest`/`NormalizeResult`: transcript normalization with explicit schema.
 - `TrimRequest`/`TrimResult`: transcript trimming with required keep selector.
-## Config Fields Used
+Results include output/log/config paths, timing, exit code, and metadata.
 Via `pipeline.seriatim.*` mapped in app/stage wiring:
 - `binary`, `timeout`, `output_schema`, `coalesce_gap`, `report`
 - `env.overlap_word_run_gap`
 - `env.overlap_word_run_reorder_window`
 - `env.backchannel_max_duration`
 - `env.filler_max_duration`
-## External Adapters Used
+## Validation and Failure Semantics
- Shared subprocess helper (`internal/adapters/subprocess`).
+Runner construction validates:
 - binary presence;
 - timeout > 0;
 - supported output schema (`seriatim-minimal|seriatim-intermediate|seriatim-full`);
 - non-negative coalesce gap.
-## State and Manifest Behavior
+Invocation fails on:
- No direct manifest writes.
+- missing required request paths/inputs;
- Stage metadata consumes adapter result fields and preserves generated config/log references.
+- invalid normalize schema override;
 - subprocess failure;
 - invalid JSON outputs;
 - missing `segments` array for normalize/trim transcript outputs.
-## Skip and Resume Behavior
+When report paths are provided/enabled, report files must parse as JSON.
 - Adapter has no skip/resume logic. Runner controls stage execution.
-## Failure Behavior
+## Deterministic Behavior
- Constructor fails for invalid binary/timeout/output-schema/coalesce-gap.
+- argument ordering is deterministic per command construction.
- Merge fails on missing output path/inputs/report path (if enabled), subprocess errors, invalid merged output JSON, invalid report JSON.
+- merge env overrides are explicit (`SERIATIM_*`) and only emitted when configured.
- Normalize fails on missing input/output, invalid schema, subprocess errors, invalid normalized output JSON shape, invalid report JSON.
+- generated invocation YAML (`seriatim.generated.v1`) is emitted when requested.
- Trim fails on missing input/output/keep selector, subprocess errors, invalid trimmed output JSON shape.
+- adapter does not write manifests or choose stage inputs.
-## Tests to Inspect Before Changing
+## Config Mapping
- `internal/adapters/seriatim/subprocess_test.go`
+Config fields consumed through runner/stage wiring are under `pipeline.seriatim.*`.
 - `internal/adapters/seriatim/fake_test.go`
 - `internal/stage/merge_test.go`
 - `internal/stage/normalize_test.go`
 - `internal/stage/trim_test.go`
-## Architectural Invariants
+Maintained examples with Seriatim config:
- Supported output schemas are limited to `seriatim-minimal`, `seriatim-intermediate`, `seriatim-full`.
+- `examples/pipeline.full.annotated.yml`
- Normalize/trim outputs must include `segments` arrays.
+- `examples/pipeline.production.yml`
 - Merge/normalize/trim all route through deterministic subprocess invocation.
--- a/docs/internal/README.md
+++ b/docs/internal/README.md
@@ -1,29 +1,43 @@
 # Internal Documentation Index
 ## Audience
-Developers and LLM coding agents changing Narratio internals.
+Developers and coding agents changing Narratio internals.
 ## Scope
-Implementation-accurate contracts for workspace/state, manifests, stages, artifact resolution, adapter boundaries, and restore command behavior.
+`docs/internal/` documents implemented internal contracts: stage boundaries, manifest/state behavior, artifact resolution, restore behavior, storage boundaries, and workspace invariants.
-## Component Docs
+User and operator behavior belongs in:
- `adapters.md`: external adapter map, runtime wiring, and boundary ownership.
+- `docs/cli.md`
- `storage.md`: remote storage backend contracts and object-store invariants.
+- `docs/config.md`
- `manifest.md`: session/run manifest schemas, lifecycle transitions, and persistence semantics.
+- `docs/operations.md`
- `artifacts.md`: built-in artifact registry, runtime artifact catalog, and source-resolution behavior.
+- `docs/troubleshooting.md`
 - `workspace.md`: local state model, manifests, run-local layout, promotion, and cleanup invariants.
 - `command-restore.md`: restore command discovery/planning/execution/reporting contract.
 - `stage-prepare.md`: input materialization and provenance capture.
 - `stage-transcribe.md`: WhisperX transcript generation.
 - `stage-merge.md`: Seriatim normalization + merge.
 - `stage-polish.md`: Audita transcript polishing.
 - `stage-normalize.md`: post-polish normalization.
 - `stage-trim.md`: bounds-driven transcript trimming.
 - `stage-analyze.md`: dependency-ordered Scriptorium artifact generation for selected configured artifacts.
 - `stage-archive.md`: archive upload and current-pointer publish contract.
-## External Integration Notes
+## Pipeline Stage Set
- `../integrations/README.md`: canonical location for external integration contracts (`audita.md`, `seriatim.md`, `scriptorium.md`).
+Canonical stage order from `internal/stage.All()`:
 1. `prepare`
 2. `transcribe`
 3. `merge`
 4. `polish`
 5. `normalize`
 6. `trim`
 7. `analyze`
 8. `publish`
 9. `notify` (placeholder)
-## Canonical Owner
+`notify` is currently a placeholder stage with optional notifier call behavior; it has no persisted pipeline outputs.
-`docs/internal/` is the canonical home for implemented internals per `docs/documentation/policy.md`.
+
 ## Internal Component Docs
 - `adapters.md`: external adapter boundaries and default runtime wiring.
 - `artifacts.md`: canonical source IDs, runtime catalog behavior, and resolution rules.
 - `manifest.md`: session and run manifest contracts.
 - `storage.md`: object-store interface and S3 implementation behavior.
 - `workspace.md`: local session layout, run-local layout, and cleanup guardrails.
 - `command-restore.md`: restore discovery, planning, execution, and reporting.
 - `stage-prepare.md`
 - `stage-transcribe.md`
 - `stage-merge.md`
 - `stage-polish.md`
 - `stage-normalize.md`
 - `stage-trim.md`
 - `stage-analyze.md`
 - `stage-publish.md`
--- a/docs/internal/adapters.md
+++ b/docs/internal/adapters.md
@@ -1,80 +1,52 @@
 # Internal: Adapters
 ## Purpose
-Describe the external adapter boundaries used by Narratio stages and app orchestration, including default runtime wiring.
+Define external integration boundaries and default adapter wiring used by app/stage orchestration.
-## Inputs and outputs
+## Adapter Boundaries
-Inputs:
+Narratio stage logic depends on adapter interfaces, not transport-specific details.
 - Stage requests passed through adapter interfaces (for example transcription, merge/normalize/trim, polish, artifact generation, object-store operations, notifications).
 - Resolved config values used to construct default adapters.
-Outputs:
+Primary adapters:
 - Adapter-specific result structs (paths, metadata, status/attempt info, duration/exit details).
 - Adapter errors returned to stage/app orchestration.
 ## Boundaries
 Owns:
 - Transport/process/SDK details at system boundaries (`HTTP`, subprocess CLI invocation, AWS SDK calls).
 - Request/response contracts in `internal/adapters/*` packages.
 Does not own:
 - Stage sequencing, skip/force/resume decisions.
 - Manifest transition logic.
 - Canonical workspace path policy.
 ## Config fields used
 Default wiring and adapter calls consume:
 - `pipeline.whisperx.*`
 - `pipeline.seriatim.*`
 - `pipeline.audita.*`
 - `pipeline.scriptorium.*`
 - `pipeline.storage.*` and `pipeline.archive.*` (object-store construction/gating)
 - `pipeline.notification.*` (sender boundary exists; placeholder behavior today)
 ## External adapters used
 Runtime env boundary fields (`internal/stage.Env`):
 - `whisperx.Client`
 - `seriatim.Runner`
 - `audita.Runner`
 - `scriptorium.Runner`
 - `storage.ObjectStore`
 - `notify.Sender`
 - `analyzer.Runner`
-Current execution usage:
+Legacy compatibility boundary:
- Actively used by implemented stages: `WhisperX`, `Seriatim`, `Audita`, `Scriptorium`, `ObjectStore`, `Notifier`.
+- `storage.Backend` remains in the storage adapter package and defaults to `NoopBackend`; current pipeline stages use `storage.ObjectStore`.
 - Present but not used by implemented stage set: `Analyzer`, legacy `storage.Backend`.
-Default construction in app runner:
+## Ownership
- Auto-constructed when not injected: WhisperX HTTP client, Seriatim subprocess runner, Audita subprocess runner, Scriptorium subprocess runner, object store (only when needed), and `notify.NoopSender`.
+Adapters own:
- Object-store construction goes through app command orchestration so configured filesystem secrets are loaded before the storage adapter is initialized.
+- HTTP/subprocess/SDK argument and transport details.
- Callers can inject test/fake implementations through `app.RunOptions.Env`.
+- Backend-specific request/response mapping.
-## State and manifest behavior
+Adapters do not own:
- Adapters do not directly mutate session/run manifests.
+- stage ordering/skip/force logic;
- Stages and runner own manifest writes and stage status transitions.
+- manifest transitions;
- Adapter outputs are persisted indirectly through stage result mapping (outputs/logs/generated configs/metadata).
+- canonical path policy.
-## Skip and resume behavior
+## Default Wiring
- No adapter-level skip/resume semantics.
+`internal/app/runner.go` initializes default adapters when not injected:
- Skip/resume/force behavior is decided by app runner using manifest stage state.
+- WhisperX HTTP client from pipeline config.
 - Seriatim subprocess runner.
 - Audita subprocess runner.
 - Scriptorium subprocess runner.
 - Noop notifier (`notify.NoopSender`).
 - Object store only when required by selected stages/config.
-## Failure behavior
+Object-store construction goes through `newCommandObjectStore`, which loads configured filesystem secrets before adapter initialization.
 - Adapter constructors validate config-derived values and fail early on invalid required inputs.
 - Adapter run-time failures are returned to stage code with boundary context and are recorded as stage failures by runner logic.
 - Subprocess adapters preserve stdout/stderr and generated-config paths to aid diagnosis.
-## Tests to inspect before changing
+## Failure Semantics
 - Constructor errors fail stage execution setup early.
 - Runtime adapter errors propagate to stage code and then manifest failure handling.
 - Subprocess adapters persist stage logs/generated configs through stage-managed paths.
 ## Test Surfaces
 - `internal/adapters/whisperx/http_test.go`
 - `internal/adapters/seriatim/subprocess_test.go`
 - `internal/adapters/audita/subprocess_test.go`
 - `internal/adapters/scriptorium/subprocess_test.go`
 - `internal/adapters/storage/*_test.go`
 - `internal/adapters/notify/fake_test.go`
 - `internal/adapters/analyzer/fake_test.go`
 - `internal/app/runner_test.go`
 ## Architectural invariants
 - Stage code depends on adapter interfaces, not transport-specific implementation types.
 - External SDK-specific types remain inside adapter implementations.
 - Default app wiring must remain deterministic and overrideable via injected env dependencies.
--- a/docs/internal/artifacts.md
+++ b/docs/internal/artifacts.md
@@ -1,106 +1,112 @@
 # Internal: Artifacts
 ## Purpose
-Define Narratio artifact identity, catalog, and source-resolution behavior for:
+Define canonical artifact IDs, runtime catalog behavior, source resolution rules, and shared current-state mechanics used by app and previous-cache code.
 - built-in session artifacts;
 - configured analyze artifacts;
 - canonical previous-session artifact sources.
-## Inputs and outputs
+## Built-in Source IDs
 Inputs:
 - configured input sources (`pipeline.scriptorium.artifacts.*.inputs.*.source`);
 - session paths and manifest inputs/outputs;
 - runtime catalog state.
-Outputs:
+- `narratio.transcript.base` -> `transcripts/base.json` (`merge`)
- resolved artifact path + provenance (`ResolvedSessionArtifact`);
+- `narratio.transcript.polished` -> `transcripts/polished.json` (`polish`)
- runtime catalog entries for built-ins and configured artifacts;
+- `narratio.transcript.final` -> `transcripts/final.json` (`normalize`)
- requirement sets for canonical previous-session inputs.
+- `narratio.transcript.final_trimmed` -> `transcripts/final.trimmed.json` (`trim`)
- canonical S3 session, run, current, session config, session locks, audio, and promoted artifact keys.
+- `narratio.bounds.session` -> `artifacts/session_bounds.json` (`trim`)
-## Boundaries
+## Configured and Previous-Session Sources
 Owns:
 - built-in source registry and validation;
 - configured artifact catalog identity (`narratio.artifact.<name>`);
 - canonical previous-session source parsing and resolution;
 - previous-session requirement collection (`CollectPreviousArtifactRequirements`).
-Does not own:
+- configured source ID format: `narratio.artifact.<artifact_key>`
- prepare-stage remote hydration;
+- previous-session source ID format: `narratio.previous_session.artifact.<artifact_key>`
 - stage success/skip transitions;
 - archive upload orchestration.
-## Built-in IDs
+Both formats are validated by strict source-policy rules.
 | Artifact ID | Canonical file | Producer stage | Output kind |
 | --- | --- | --- | --- |
 | `narratio.transcript.merged` | `transcripts/merged.json` | `merge` | `transcript_merged` |
 | `narratio.transcript.polished` | `transcripts/processed.json` | `polish` | `transcript_processed` |
 | `narratio.transcript.full` | `transcripts/normalized.json` | `normalize` | `transcript_normalized` |
 | `narratio.transcript.trimmed` | `transcripts/trimmed.json` | `trim` | `transcript_trimmed` |
 | `narratio.bounds.session` | `artifacts/session_bounds.json` | `trim` | `session_bounds` |
-## Source families
+## Runtime Catalog
 - built-in: `narratio.transcript.*`, `narratio.bounds.session`
 - configured artifact: `narratio.artifact.<artifact_key>`
 - canonical previous-session artifact: `narratio.previous_session.artifact.<artifact_key>`
-## S3 key helpers
+`ArtifactCatalog` tracks:
 - session prefix: `{root_prefix}/campaigns/{campaign}/sessions/{session_id}/`
 - session config: `{session_prefix}/session.yml`
 - session lock store: `{session_prefix}/locks.yml`
 - run prefix: `{session_prefix}/runs/{run_id}/`
 - audio prefix: `{session_prefix}/{session.inputs.audio_s3.prefix}`
 - current manifest: `{session_prefix}/current/manifest.json`
 - current run pointer: `{session_prefix}/current/run_id.txt`
-## Runtime catalog model
+- `planned`: source registered for run context;
-Catalog entries track:
+- `executable`: selected and enabled for analyze execution;
- `planned`: source is registered for this run;
+- `available`: local file exists and validates;
- `executable`: configured artifact is selected for analyze execution;
+- `provenance`: availability source.
- `available`: usable local file exists (generated this run or reused from disk).
+
 Current provenance values:
 Configured artifact provenance values include:
 - `generated.current_analyze_run`
 - `filesystem.disabled_artifact_output`
 Previous-session canonical provenance values include:
 - `manifest.inputs.previous_cache`
 - `current_session.previous_cache`
-## Resolution behavior
+## Resolution Rules
 - Built-ins resolve via manifest producer outputs first, then canonical fallback paths.
 - Configured `narratio.artifact.<name>` sources resolve through catalog availability.
 - Canonical previous-session sources resolve to current-session `previous/` cache candidates derived from configured artifact canonical output paths.
 - Archive-relative configured artifact paths under `artifacts/` are cached without a redundant nested `artifacts/` segment.
 - Previous-session canonical resolution prefers manifest-recorded input paths when present, then filesystem fallback under `previous/artifacts/**`.
-## Previous-session requirement scanning
+Built-ins:
-`CollectPreviousArtifactRequirements`:
+
- scans enabled configured artifacts only;
+1. manifest producer outputs (when present)
- includes canonical previous-session sources only;
+2. canonical session-path fallback
- deduplicates by artifact key;
+
- merges required/optional references (`required` wins);
+Configured sources (`narratio.artifact.*`):
- records deterministic sorted source locations for diagnostics.
+
 - resolve only through runtime catalog availability.
 Previous-session sources (`narratio.previous_session.artifact.*`):
 - resolve only from local `previous/` cache state;
 - prefer manifest-backed previous-input paths;
 - fallback to existing previous-cache filesystem paths.
 Validation by content type:
 ## Validation behavior
 - transcript built-ins: JSON with top-level `segments` array;
 - bounds built-in: valid JSON;
- configured and previous-session artifact files: non-empty text content.
+- configured/previous-session artifact files: non-empty text file.
-## Failure behavior
+## Previous Requirement Collection
 - unsupported source or malformed canonical previous source: validation/resolution error;
 - known source unavailable: `ErrSessionArtifactNotFound`;
 - configured/previous canonical source without catalog: error;
 - resolved invalid file content: validation error.
-## Tests to inspect before changing
+`CollectPreviousArtifactRequirements`:
 - `internal/artifacts/artifact_resolver_test.go`
 - `internal/artifacts/catalog_test.go`
 - `internal/artifacts/previous_requirements_test.go`
 - `internal/stage/prepare_previous_test.go`
 - `internal/stage/analyze_test.go`
-## Architectural invariants
+- scans enabled configured artifacts only;
- Built-in source IDs are static.
+- extracts only canonical previous-session sources;
- Configured and previous-session source IDs are artifact-key based and validation-gated.
+- deduplicates by artifact key;
- Resolution behavior remains deterministic and manifest-aware.
+- merges required and optional references (required wins);
 - returns deterministic ordering and source locations.
 ## Current-State Helpers
 Artifacts package owns shared remote current-state loading mechanics used by restore, status/validate checks, and previous-cache planning.
 Core helpers:
 - `LoadCurrentRunPointer`
 - `LoadCurrentManifest`
 - `LoadCurrentState`
 - `ValidateCurrentStateIdentity`
 Typed missing-state errors:
 - `CurrentRunPointerMissingError` (`ErrCurrentRunPointerMissing`)
 - `CurrentManifestMissingError` (`ErrCurrentManifestMissing`)
 Identity validation supports caller-provided expectations:
 - expected campaign;
 - expected session ID;
 - expected run ID, or pointer/manifest run-ID consistency check.
 Caller policy is intentionally outside artifacts helpers:
 - some callers fail on missing current state;
 - some callers downgrade missing state to status/findings;
 - some callers skip optional behavior when state is missing.
 ## Key Path Helpers
 `internal/artifacts/paths.go` and S3-key helpers define canonical helpers for:
 - session/work/run paths;
 - previous-cache paths;
 - spool/cache paths;
 - S3 session/run/current-state key layout.
 ## Invariants
 - source ID formats are stable contracts;
 - artifact resolution is deterministic and manifest-aware;
 - previous-session source resolution in `analyze` is local-only;
 - remote current-state key construction remains centralized in artifacts helpers.
--- a/docs/internal/command-restore.md
+++ b/docs/internal/command-restore.md
@@ -1,105 +1,84 @@
 # Internal: Command Restore
 ## Purpose
-Define the implemented `narratio restore` contract: committed remote-state discovery, deterministic plan classification, safe file install semantics, and restore reporting.
+Define the implemented `narratio session restore` command contract:
-## Inputs and outputs
+- committed remote current-state discovery;
-Inputs:
+- deterministic restore planning;
- CLI flags: `--config`, `--session`, `--session-id`, `--previous-session-id`, `--dry-run`, `--force`, `--include-audio`.
+- safe local install semantics;
- Resolved/validated `pipeline.yml` and `session.yml`.
+- durable restore reporting.
 - Configured remote object store.
 - Remote committed current-state markers (`current/run_id.txt`, `current/manifest.json`).
-Outputs:
+## Discovery Contract
 - Dry-run summary to stdout (plan + counts).
 - Non-dry-run completion summary to stdout.
 - Local durable session files restored under canonical session root.
 - Non-dry-run restore report at `reports/restore-latest.json`.
-## Boundaries
+Restore resolves remote committed state from the session publish current pointers:
 Owns:
 - Restore command flag parsing and command wiring.
 - Remote current-state discovery and identity validation.
 - Restore plan construction and conflict classification.
 - Restore execution for planned downloads.
 - Restore report model and persistence.
-Does not own:
+- `current/run_id.txt` (required, non-empty);
- Stage execution orchestration (`run`, `resume`, `run-stage`).
+- `current/manifest.json` (required, decodable).
 - Archive publish behavior (owned by archive stage).
 - Storage transport implementation details (owned by storage adapters).
-## Config fields used
+Current-state discovery uses shared artifacts-level mechanics and validates identity against the resolved request config:
 - Config/session discovery and templating fields consumed by all commands.
 - `pipeline.workspace.root` (local restore target root).
 - `pipeline.storage.*` (remote backend + archive identity derivation).
 - `pipeline.storage.s3.*` identity components used by archive prefix helpers.
 - `pipeline.spool.root` for active audio downloads.
 - `pipeline.cache.root` and `pipeline.cache.s3_audio` for reusable S3 audio cache.
 - `session.session_id`
 - `session.campaign`
-## External adapters used
+- campaign must match;
- `storage.ObjectStore` for `Exists`, `List`, `Download`.
+- session ID must match.
 - `artifacts.Store` (`LocalStore`) for layout and session lock management.
 - `manifest.LocalStore` for manifest decode/validation and identity checks.
-## State and manifest behavior
+Restore treats any missing or invalid remote current state as a command error.
 - Restore is not a pipeline run and does not create a run manifest.
 - Restore uses committed remote current state only:
  - `current/run_id.txt` must exist and be non-empty.
  - `current/manifest.json` must decode and match requested session/campaign.
 - Non-dry-run writes restore files to canonical session paths.
 - With `--include-audio`, restore uses the shared S3 audio cache for `audio/**` objects. Cache hits avoid object downloads; cache misses download through spool, install the work file, and populate cache.
 - Manifest install behavior:
  - validated before replacement.
  - installed last among download actions.
  - existing local manifest is preserved if restored manifest validation/install fails.
 - Non-dry-run report persists summary/action status metadata in `reports/restore-latest.json`.
-Restore path scope:
+## Planning Contract
 - includes:
  - `manifest.json`
  - `transcripts/**`
  - `artifacts/**`
  - `previous/**`
  - `audio/**` only when `--include-audio` is set
 - excludes:
  - `runs/**`
  - `logs/**`
  - `reports/**`
  - `config/**`
  - `inputs/**`
  - remote `current/**` pointer files as local restore targets
-## Skip and resume behavior
+Restore planner action kinds:
 - Restore does not participate in stage skip/resume decisions.
 - Restore provides durable local state so subsequent stage commands can resume or rerun based on restored manifest state.
 - Audio cache is outside the workspace and is reused across restore and prepare invocations.
 - Dry-run is read-only and returns plan output only.
-## Failure behavior
+- `download`;
- Fails when storage backend is unavailable or archive identity cannot be resolved.
+- `skip_same`;
- Fails when remote current pointer/manifest is missing or invalid.
+- `conflict`.
 - Fails when remote manifest identity mismatches requested campaign/session.
 - Fails on local conflicts unless `--force` is set.
 - Fails fast on session lock acquisition conflict for non-dry-run execution.
 - On execution failure, previously installed files remain; no rollback is performed.
-## Tests to inspect before changing
+Planner behavior:
 - `internal/app/restore_test.go`
 - `internal/app/restore_discovery_test.go`
 - `internal/app/restore_plan_test.go`
 - `internal/app/restore_execution_test.go`
 - `internal/app/restore_workflow_test.go`
 - `internal/artifacts/archive_identity_test.go`
-## Architectural invariants
+- remote list scope is the resolved session prefix;
- Restore relies on centralized archive identity/key helpers (`internal/artifacts`) rather than ad hoc key building.
+- remote-to-local mapping is traversal-safe;
- `current/run_id.txt` is the remote commit marker; restore must not infer committed state from incidental files.
+- actions are sorted deterministically by local relative path.
- Local path mapping is traversal-safe and constrained to session root.
+
- Restore scope is deterministic and path-classified:
+Restore scope from current remote state:
-  - include `manifest.json`, `transcripts/**`, `artifacts/**`, `previous/**`
+
-  - include `audio/**` only with `--include-audio`
+- include `manifest.json`;
-  - exclude `runs/**`, `logs/**`, `reports/**`, `config/**`, `inputs/**`
+- include `transcripts/**`;
- Command remains standalone; no implicit `run --restore` behavior.
+- include `artifacts/**`;
 - include `audio/**` only with `--include-audio`.
 Explicit exclusions from current remote state mapping:
 - `current/**`;
 - `runs/**`;
 - `logs/**`;
 - `reports/**`;
 - `config/**`;
 - `inputs/**`;
 - `previous/**`.
 Previous-cache files are planned separately through `previouscache.BuildPlan` when configured previous-session requirements exist.
 ## Execution Contract
 Execution order and safety:
 - non-manifest downloads happen before manifest install;
 - `manifest.json` installs last;
 - downloads use sibling temp files plus atomic rename;
 - manifest replacement is validated before rename;
 - failed installs do not roll back files already written in the same execution.
 Audio restore path:
 - uses `audio.MaterializeS3Audio`;
 - integrates spool and S3 audio cache paths;
 - supports cache-hit reuse without object redownload.
 ## Reporting Contract
 - `--dry-run`: prints summary only; no local writes.
 - non-dry-run: writes `reports/restore-latest.json`.
 - report includes plan counts, per-action status, and execution failures.
 ## Invariants
 - restore uses committed remote current state as authority;
 - `current/run_id.txt` is the remote publish commit marker;
 - restore does not execute pipeline stages.
--- a/docs/internal/manifest.md
+++ b/docs/internal/manifest.md
@@ -1,81 +1,57 @@
 # Internal: Manifest
 ## Purpose
-Describe Narratio's durable execution state model for session-level and run-level manifests, including lifecycle transitions and persistence behavior.
+Define durable session state (`manifest.json`) and invocation state (`runs/{run_id}/manifest.json`) contracts.
-## Inputs and outputs
+## Session Manifest
-Inputs:
+Path:
- Session identity and run identity from app orchestration.
+- `{workspace.root}/work/{campaign}/{session_id}/manifest.json`
 - Stage transition events and stage result payloads.
-Outputs:
+Primary model (`manifest.Manifest`):
- Session manifest at `{workspace.root}/work/{campaign}/{session_id}/manifest.json`.
+- identity (`session_id`, `campaign`, `run_id`)
- Run manifest at `{workspace.root}/work/{campaign}/{session_id}/runs/{run_id}/manifest.json`.
+- local path metadata (`local_workdir`, `local_spool_dir`)
 - remote identity metadata (`s3_bucket`, `s3_session_prefix`, `s3_run_prefix`)
 - `inputs` records
 - durable `artifacts` records
 - per-stage `stages` map
-## Boundaries
+Stage status enum:
-Owns:
+- `pending`
- Manifest schemas (`Manifest`, `RunManifest`, stage records, error records, input/artifact records).
+- `running`
- Stage status/action transition methods.
+- `succeeded`
- Persistent store contract (`manifest.Store`) and local JSON store implementation.
+- `failed`
 - `skipped`
 - `stale`
 - `interrupted`
-Does not own:
+## Run Manifest
- Stage implementation details.
+Path:
- Path construction policy outside manifest file persistence calls.
+- `{workspace.root}/work/{campaign}/{session_id}/runs/{run_id}/manifest.json`
 - CLI command behavior.
-## Config fields used
+Run model (`manifest.RunManifest`):
-Manifest package itself does not read config directly.
+- invocation identity and `force` flag
 - requested stages
 - per-stage action (`run` or `skip`)
 - per-stage status
 - overall run status (`running`, `succeeded`, `failed`)
-Manifest identity fields are populated by app/stage orchestration from:
+## Persistence Semantics
- `session.session_id`
+`manifest.LocalStore`:
- `session.campaign`
+- validates loaded documents;
- `pipeline.workspace.root`
+- normalizes missing maps/stage records;
- `pipeline.storage.s3.*` (when archive/S3 identity is set)
+- writes atomically via temp file + rename;
 - updates `updated_at` on save.
-## External adapters used
+## Execution Semantics
- No external service adapters.
+Runner updates both manifests per stage transition:
- Uses local filesystem for persistence via `manifest.LocalStore`.
+- mark running
 - mark succeeded/failed/skipped
 - persist logs/generated config refs and metadata
-## State and manifest behavior
+Session manifest is the authoritative stage-progress ledger across invocations.
-Session manifest model:
+Run manifest is invocation-scoped audit state.
 - Tracks durable per-session stage state and provenance (`pending`, `running`, `succeeded`, `failed`, `skipped`, `stale`, `interrupted`).
 - Stores resolved inputs, durable artifacts, stage logs/config refs, and stage metadata.
-Run manifest model:
+## Invariants
- Tracks one invocation (`run_id`) with requested stages and force mode.
+- stage resume/skip decisions are session-manifest driven.
- Tracks per-stage action (`run` or `skip`) and per-stage status.
+- force reruns stale downstream succeeded stages.
- Tracks overall run status (`running`, `succeeded`, `failed`).
+- run manifest does not replace session manifest as progress authority.
 Persistence behavior:
 - Load validates required identity/timestamp fields and normalizes maps/records.
 - Save updates `updated_at` and writes JSON atomically (temp file + rename).
 - Session and run manifests are saved incrementally before/after stage transitions.
 Relationship during execution:
 - Runner updates both manifests for every stage transition.
 - Session manifest is the durable pipeline-progress ledger.
 - Run manifest is invocation history and audit record.
 - Analyze stage outputs are persisted as `kind=scriptorium_artifact` with `source_id=narratio.artifact.<name>` for configured artifact identity.
 ## Skip and resume behavior
 - Resume and skip decisions are based on session-manifest stage statuses.
 - `--force` reruns selected stages and marks downstream succeeded stages as `stale` in session manifest.
 - Run manifest records whether each stage was executed or skipped in that invocation.
 ## Failure behavior
 - Stage failure marks both manifests failed for that stage and records error messages/timestamps.
 - Save failures are returned immediately and fail the command.
 - Invalid/malformed manifest files fail load with explicit validation/decode errors.
 ## Tests to inspect before changing
 - `internal/manifest/manifest_test.go`
 - `internal/manifest/run_manifest_test.go`
 - `internal/manifest/store_test.go`
 - `internal/app/runner_test.go`
 - `internal/app/run_control_test.go`
 - `internal/app/resume_run_stage_test.go`
 ## Architectural invariants
 - Session manifest is authoritative for stage progression across invocations.
 - Run manifest is invocation-scoped and never replaces session manifest as progress authority.
 - Manifest writes are atomic and deterministic (JSON + newline, temp rename pattern).
--- a/docs/internal/stage-analyze.md
+++ b/docs/internal/stage-analyze.md
@@ -1,81 +1,38 @@
 # Stage: analyze
 ## Purpose
-Execute selected configured Scriptorium artifacts in deterministic dependency order and promote successful outputs to canonical session artifact paths.
+Execute selected configured Scriptorium artifacts in dependency order and materialize outputs.
-## Inputs and outputs
+## Inputs
-Inputs:
+- configured artifacts from `pipeline.scriptorium.artifacts`
- configured artifact definitions from `pipeline.scriptorium.artifacts`;
+- optional selected artifact filter (`--artifacts`)
- selected artifact filter (`--artifacts`) when provided;
+- built-in/configured/previous-session source references in artifact inputs
 - resolved artifact sources from resolver/catalog.
-Source types used by analyze:
+Supported source families:
- built-ins: `narratio.transcript.*`, `narratio.bounds.session`;
+- built-ins: `narratio.transcript.*`, `narratio.bounds.session`
- configured artifacts: `narratio.artifact.<artifact_key>`;
+- configured artifacts: `narratio.artifact.<key>`
- canonical previous-session artifacts: `narratio.previous_session.artifact.<artifact_key>`;
+- previous-session cache: `narratio.previous_session.artifact.<key>`
 - legacy path-based previous-session source: `previous_session_artifact` (uses `inputs.*.path`).
-Outputs:
+## Outputs
- promoted configured artifact files at each configured `output_path`;
+- one materialized output per executed configured artifact (`output_path`)
- stage metadata (`generated_artifacts`, `reused_artifacts`, selected/order info).
+- stage metadata describing selected/generated/reused artifacts
-## Boundaries
+## Key Behavior
-Owns:
+- skips with metadata when Scriptorium config is missing or no executable artifacts remain.
- runtime artifact catalog construction;
+- builds runtime artifact catalog (built-ins + configured artifacts).
- selected-artifact planning and dependency ordering;
+- marks non-executable configured artifacts as reusable when output files already exist.
- per-input resolution and required/optional handling;
+- validates selected artifact dependency order (cycle-safe topo ordering).
- Scriptorium render/run invocation;
+- resolves required/optional inputs per artifact source definition.
- run-local output generation and canonical promotion.
+- resolves previous-session sources from local `previous/` cache only.
 - runs optional render-debug, then artifact execution.
 - validates non-empty output files and materializes canonical outputs.
-Does not own:
+## Failure Semantics
- prepare-time previous-session hydration;
+- required missing configured/previous-session inputs fail.
- object-store access for previous-session sources;
+- missing required previous-session source includes prepare rerun guidance.
- archive promotion policy.
+- dependency cycles or unavailable required dependencies fail.
 - adapter validation failures fail stage.
-## Config fields used
+## Invariants
- `session.session_id`
+- `analyze` performs no remote storage calls for previous-session source resolution.
- `session.campaign`
+- output provenance and metadata are deterministic per execution.
 - `pipeline.workspace.root`
 - `pipeline.scriptorium.binary`
 - `pipeline.scriptorium.config_path`
 - `pipeline.scriptorium.timeout`
 - `pipeline.scriptorium.render_debug`
 - `pipeline.scriptorium.artifacts.<name>.*`
 ## External adapters used
 - Scriptorium adapter:
  - optional `RenderArtifact` when render-debug is enabled;
  - `RunArtifact` for artifact generation.
 ## State and manifest behavior
 - If Scriptorium config is absent, or no artifacts are executable after filtering, analyze returns success metadata with `skipped=true`.
 - Builds runtime catalog with built-ins and configured `narratio.artifact.<name>` entries.
 - Non-executable configured artifacts may still be marked available from existing canonical output files.
 - Resolves canonical previous-session sources from local prepared `previous/` cache:
  - prefers manifest-backed previous input paths when present;
  - may fall back to current-session `previous/` filesystem paths.
 - Analyze does not call object storage for canonical previous-session source resolution.
 - Required canonical previous-session input missing:
  - fails with guidance to run `narratio run-stage --force prepare`.
 - Optional missing sources are omitted from adapter input paths.
 ## Skip and resume behavior
 - Runner-level skip applies when analyze is already `succeeded` and `--force` is not set.
 - Analyze is stage-scoped for resume; no per-artifact manifest resume state.
 - `--artifacts` filters executable artifacts but does not imply force rerun.
 ## Failure behavior
 - Fails on dependency-order violations, missing required inputs, resolver validation failures, adapter errors, and missing/empty generated outputs.
 - Required unavailable configured artifact source (`narratio.artifact.<name>`) fails before invocation.
 - Required canonical previous-session source fails with prepare-rerun guidance.
 ## Tests to inspect before changing
 - `internal/stage/analyze_test.go`
 - `internal/artifacts/catalog_test.go`
 - `internal/artifacts/artifact_resolver_test.go`
 - `internal/app/restore_workflow_test.go`
 ## Architectural invariants
 - Canonical previous-session behavior is local-cache only during analyze.
 - Generated outputs are validated and promoted before stage success is recorded.
 - Resolver/catalog decisions stay deterministic and validation-gated.
--- a/docs/internal/stage-archive.md
+++ b/docs/internal/stage-archive.md
@@ -1,84 +0,0 @@
 # Stage: archive
 ## Purpose
 Publish durable run/session state to object storage, then atomically advance remote current state.
 ## Inputs and Outputs
 Inputs:
 - session manifest and prerequisite stage records
 - run root contents under `runs/{run_id}/`
 - promotion rules with artifact `source` IDs and archive `dest` paths (`archive.promote_artifacts`)
 - effective source-based promotion locks from static config and remote session lock store
 - session-level `previous/**` cache files when present
 Outputs:
 - uploaded run files under `{session_prefix}/runs/{run_id}/...`
 - uploaded promoted artifacts under `{session_prefix}/...`
 - uploaded session previous-cache files under `{session_prefix}/previous/...` when present
 - `{session_prefix}/current/manifest.json`
 - `{session_prefix}/current/run_id.txt` written last
 ## Boundaries
 Owns:
 - Archive enable/disable gate behavior
 - Prerequisite stage success enforcement
 - Run file collection and upload (excluding `audio/`)
 - Promotion rule resolution and upload
 - Promotion lock enforcement
 - Session previous-cache file collection/upload
 - Commit pointer publish order
 Does not own:
 - Stage execution before archive
 - Post-archive local cleanup policy execution (handled by app cleanup logic)
 ## Config Fields Used
 - `pipeline.archive.enabled`
 - `pipeline.archive.upload_run`
 - `pipeline.archive.promote_artifacts`
 - `pipeline.archive.locks`
 - `{session_prefix}/locks.yml` loaded by app orchestration before archive execution
 - `pipeline.storage.s3.bucket`
 - `pipeline.storage.s3.root_prefix`
 - `pipeline.workspace.root`
 - `session.campaign`
 - `session.session_id`
 ## External Adapters Used
 - Object storage backend (`env.ObjectStore`) for upload/list primitives.
 ## State and Manifest Behavior
 - Requires `prepare`, `transcribe`, `merge`, `polish`, `normalize`, `trim`, and `analyze` status `succeeded`.
 - Resolves bucket/prefix from manifest identity first, then config fallback.
 - Uploads session `previous/**` files as durable session state when the local `previous/` directory exists.
 - Skips top-level promotion uploads for effective locked sources; run-local uploads still publish.
 - Effective locks are the union of `pipeline.archive.locks` and remote `{session_prefix}/locks.yml`; static pipeline locks win on duplicate sources.
 - Writes metadata including:
  - upload counts/paths
  - `previous_files_uploaded` and `previous_uploaded_paths`
  - `locked_promotion_count` and `locked_promotions`
  - `current_manifest_key`
  - `current_run_id_key`
  - `current_pointer_written`
 - On skipped archive path, returns metadata with `skipped=true` and pointer not written.
 ## Skip and Resume Behavior
 - Stage may self-skip (metadata skip) when archive disabled or run upload disabled.
 - Runner-level skip also applies for previously succeeded stage unless forced.
 ## Failure Behavior
 - Fails on missing prerequisite success, missing object store when required, missing run root, missing unlocked required promotion source, upload failures, or pointer write failures.
 - Locked required promotions are intentional skips and do not fail archive.
 - Pointer semantics are fail-safe: `current/run_id.txt` is not written if prior required uploads fail.
 ## Tests to Inspect Before Changing
 - `internal/stage/archive_test.go`
 - `internal/app/post_archive_cleanup_test.go`
 ## Architectural Invariants
 - Run upload excludes `audio/` subtree.
 - Session `previous/**` is archiveable durable input/provenance state, not run-local output.
 - Ordinary `--force` does not override archive locks.
 - Malformed or unreadable remote lock store fails archive-capable execution before promotion.
 - `current/manifest.json` uploads before `current/run_id.txt`.
 - `current/run_id.txt` is the remote publish commit marker.
--- a/docs/internal/stage-merge.md
+++ b/docs/internal/stage-merge.md
@@ -1,63 +1,25 @@
 # Stage: merge
 ## Purpose
-Normalize per-speaker raw transcripts and merge them into one merged transcript via Seriatim.
+Normalize raw transcript inputs and merge into base transcript via Seriatim.
-## Inputs and Outputs
+## Inputs
 Inputs:
 - `transcripts/raw/*.json`
 - `inputs/speakers.yml`
 - `inputs/autocorrect.yml`
-Outputs:
+## Outputs
- `transcripts/merged.json`
+- `transcripts/base.json`
- optional `artifacts/seriatim.report.json` (when report enabled)
+- optional `artifacts/seriatim.report.json`
-## Boundaries
+## Key Behavior
-Owns:
+- discovers and validates raw transcript inputs.
- Raw transcript discovery/validation
+- normalizes each raw transcript (`seriatim.Normalize`) into run-local scratch output.
- Per-input normalize calls to Seriatim
+- merges normalized inputs (`seriatim.Run`) into base transcript.
- Final merge call to Seriatim
+- validates merged transcript and optional report JSON.
- Run-local log/config/report path wiring
+- materializes canonical outputs and records stage logs/generated configs.
 - Promotion of merged/report outputs to canonical paths
-Does not own:
+## Invariants
- Transcript polishing or downstream artifact generation
+- merge always consumes normalized forms of raw inputs.
-
+- base transcript must validate before stage success.
-## Config Fields Used
+- report output is config-gated.
 - `session.session_id`
 - `session.campaign`
 - `pipeline.workspace.root`
 - `pipeline.seriatim.binary`
 - `pipeline.seriatim.timeout`
 - `pipeline.seriatim.output_schema`
 - `pipeline.seriatim.coalesce_gap`
 - `pipeline.seriatim.report`
 - `pipeline.seriatim.env.*`
 ## External Adapters Used
 - Seriatim adapter:
  - `Normalize` for each raw input
  - `Run` for final merge
 ## State and Manifest Behavior
 - Reads transcript inputs from transcribe stage outputs in manifest when present; falls back to canonical raw directory.
 - Writes run-local outputs/logs/config under `runs/{run_id}/merge/...` when enabled.
 - Promotes canonical merged transcript and optional report.
 - Records normalized-input provenance and adapter metadata in stage metadata.
 ## Skip and Resume Behavior
 - Runner-level skip applies when already succeeded and not forced.
 - Forced rerun of this or upstream stages can stale downstream succeeded stages via runner invalidation.
 ## Failure Behavior
 - Fails on missing/invalid raw transcripts, missing speakers/autocorrect files, normalize failure, merge failure, invalid merged output JSON, or invalid report JSON when enabled.
 ## Tests to Inspect Before Changing
 - `internal/stage/merge_test.go`
 - `internal/adapters/seriatim/subprocess_test.go`
 ## Architectural Invariants
 - Merge consumes normalized forms of each raw transcript.
 - Merged transcript must validate before promotion.
 - Report output is optional and gated by config.
--- a/docs/internal/stage-normalize.md
+++ b/docs/internal/stage-normalize.md
@@ -1,56 +1,22 @@
 # Stage: normalize
 ## Purpose
-Normalize the processed transcript into a deterministic intermediate schema for trim and optionally emit a normalize report.
+Normalize polished transcript into final transcript using Seriatim.
-## Inputs and Outputs
+## Inputs
-Inputs:
+- `transcripts/polished.json`
 - `transcripts/processed.json`
-Outputs:
+## Outputs
- `transcripts/normalized.json` (or configured normalize output path)
+- `transcripts/final.json` (or configured normalize output path)
 - optional `artifacts/seriatim.normalize.report.json`
-## Boundaries
+## Key Behavior
-Owns:
+- resolves polished transcript from manifest outputs/canonical fallback.
- Processed transcript discovery/validation
+- applies `pipeline.normalize` config or default normalize config.
- Normalize request construction and invocation
+- runs Seriatim normalize with configured timeout/binary.
- Optional normalize report wiring
+- validates normalized transcript and optional report.
- Promotion of normalized transcript and optional report
+- materializes canonical outputs and records logs/generated configs.
-Does not own:
+## Invariants
- Bounds detection or segment trimming
+- final transcript must validate as processed transcript JSON (`segments` array).
-
+- normalize defaults are applied when `pipeline.normalize` is unset.
 ## Config Fields Used
 - `session.session_id`
 - `session.campaign`
 - `pipeline.workspace.root`
 - `pipeline.normalize.output_path`
 - `pipeline.normalize.output_schema`
 - `pipeline.normalize.report`
 - `pipeline.seriatim.binary`
 - `pipeline.seriatim.timeout`
 ## External Adapters Used
 - Seriatim adapter (`Normalize`).
 ## State and Manifest Behavior
 - Reads processed transcript from polish outputs in manifest when present; falls back to canonical path.
 - Uses run-local output/report/log/config paths when run layout is enabled.
 - Promotes canonical normalized transcript and optional normalize report.
 - Records adapter/result metadata including source path selection.
 ## Skip and Resume Behavior
 - Runner-level skip applies when already succeeded and not forced.
 - Forced reruns can stale downstream succeeded stages.
 ## Failure Behavior
 - Fails on missing/invalid processed transcript, adapter error, invalid normalized output, or invalid report output when report enabled.
 ## Tests to Inspect Before Changing
 - `internal/stage/normalize_test.go`
 - `internal/adapters/seriatim/subprocess_test.go`
 ## Architectural Invariants
 - Normalized output must validate as processed-transcript-compatible JSON (`segments` array required).
 - Default normalize config is applied when `pipeline.normalize` is unset.
--- a/docs/internal/stage-polish.md
+++ b/docs/internal/stage-polish.md
@@ -1,69 +1,23 @@
 # Stage: polish
 ## Purpose
-Polish merged transcript with Audita and produce a processed transcript for downstream normalization/analyze.
+Run Audita polishing on base transcript and produce polished transcript.
-## Inputs and Outputs
+## Inputs
-Inputs:
+- `transcripts/base.json`
 - `transcripts/merged.json`
 - `inputs/glossary.yml`
-Outputs:
+## Outputs
- `transcripts/processed.json`
+- `transcripts/polished.json`
- optional `artifacts/audita.report.json` (when report enabled)
+- optional `artifacts/audita.report.json`
-## Boundaries
+## Key Behavior
-Owns:
+- resolves base transcript from merge outputs/canonical fallback.
- Merged transcript discovery/validation
+- invokes Audita with configured model/module/runtime options.
- Audita invocation request construction
+- validates processed transcript structure (`segments` array required).
- Run-local logs/config/work-dir/report wiring
+- validates optional report JSON.
- Promotion of processed transcript and optional report
+- materializes canonical outputs; records logs/generated config and adapter metadata.
-Does not own:
+## Invariants
- Upstream merge normalization
+- polished transcript schema validation is mandatory.
- Downstream normalize/trim/analyze logic
+- report output is config-gated.
 ## Config Fields Used
 - `session.session_id`
 - `session.campaign`
 - `pipeline.workspace.root`
 - `pipeline.audita.binary`
 - `pipeline.audita.timeout`
 - `pipeline.audita.llm_api_key_env`
 - `pipeline.audita.modules`
 - `pipeline.audita.base_url`
 - `pipeline.audita.model`
 - `pipeline.audita.transcript_description`
 - `pipeline.audita.config_path`
 - `pipeline.audita.output_schema`
 - `pipeline.audita.work_dir_retention`
 - `pipeline.audita.total_llm_concurrency`
 - `pipeline.audita.proposal_llm_concurrency`
 - `pipeline.audita.validation_model`
 - `pipeline.audita.validation_llm_concurrency`
 - `pipeline.audita.report`
 ## External Adapters Used
 - Audita adapter (`env.Audita.Run`).
 ## State and Manifest Behavior
 - Reads merged transcript from merge manifest outputs when available; falls back to canonical merged path.
 - Uses run-local output/report/log/config/scratch paths when run layout is enabled.
 - Promotes canonical `transcripts/processed.json` and optional report.
 - Records adapter invocation metadata, credential presence signal, and output provenance in stage metadata.
 ## Skip and Resume Behavior
 - Runner-level skip applies when already succeeded and not forced.
 - Forced rerun can stale downstream succeeded stages via runner invalidation.
 ## Failure Behavior
 - Fails on missing/invalid merged transcript, missing glossary, adapter error, invalid processed output shape (`segments` array required), or invalid report JSON when enabled.
 ## Tests to Inspect Before Changing
 - `internal/stage/polish_test.go`
 - `internal/adapters/audita/subprocess_test.go`
 ## Architectural Invariants
 - Processed transcript must contain a top-level `segments` array.
 - Report behavior is strictly config-gated.
 - Stage output canonicalization always ends at `transcripts/processed.json`.
--- a/docs/internal/stage-prepare.md
+++ b/docs/internal/stage-prepare.md
@@ -1,124 +1,42 @@
 # Stage: prepare
 ## Purpose
-Materialize canonical current-session input state and provenance before downstream stages run.
+Materialize canonical current-session inputs before processing stages.
-Prepare owns:
+## Inputs
- local input file materialization (`inputs/**`);
+- resolved `campaign.yml`, `session.yml`, and pipeline config
- audio input materialization (`audio/**`);
+- stable input files (`speakers`, `autocorrect`, `glossary`)
 - previous-session cache hydration (`previous/**`) for canonical previous-session artifact sources.
 ## Inputs and outputs
 Inputs:
 - resolved config/campaign/session (`pipeline.yml`, `campaign.yml`, `session.yml`);
 - remote session provenance when `session.yml` was loaded from S3;
 - campaign or session input files (`speakers`, `autocorrect`, `glossary`);
 - audio source:
-  - local: `session.inputs.audio_dir` or `session.inputs.audio_files`;
+  - local `audio_dir`/`audio_files`, or
-  - S3: `session.inputs.audio_s3.prefix`;
+  - S3 `audio_s3.prefix`
- configured enabled Scriptorium artifact inputs (for previous-session requirement scanning);
+- enabled configured artifact input requirements for previous-session sources
 - remote previous-session current archive state when previous hydration is required.
-Outputs:
+## Outputs
- `inputs/campaign.yml`;
+- `inputs/campaign.yml`
- `inputs/session.yml`;
+- `inputs/session.yml`
- `inputs/pipeline.resolved.yml`;
+- `inputs/pipeline.resolved.yml`
- `inputs/speakers.yml`;
+- `inputs/speakers.yml`
- `inputs/autocorrect.yml`;
+- `inputs/autocorrect.yml`
- `inputs/glossary.yml`;
+- `inputs/glossary.yml`
- `audio/*.flac` in canonical session `audio/`;
+- `audio/*.flac`
- optional `previous/manifest.json`;
+- optional `previous/manifest.json`
- optional `previous/artifacts/**`;
+- optional `previous/artifacts/**`
- deterministic `manifest.Inputs` records with checksums and provenance metadata.
+- deterministic `manifest.inputs` entries (checksums + provenance)
-## Boundaries
+## Key Behavior
-Owns:
+- validates required config/store state.
- input path resolution and materialization;
+- enforces local audio vs S3 audio mutual exclusivity.
- S3 audio list/download/copy flow;
+- materializes S3 audio through spool/cache-aware logic.
- previous-session artifact requirement collection from enabled configured artifacts;
+- scans enabled configured artifact inputs for `narratio.previous_session.artifact.*` requirements.
- previous cache lifecycle when requirements exist (clear and rehydrate managed `previous/` state).
+- when previous requirements exist:
 Does not own:
 - transcript or artifact generation;
 - analyze-stage source resolution;
 - archive commit behavior.
 ## Config fields used
 - `session.session_id`
 - `session.previous_session_id`
 - `session.campaign`
 - `session.inputs.speakers_file`
 - `session.inputs.autocorrect_file`
 - `session.inputs.glossary_file`
 - `session.inputs.audio_dir`
 - `session.inputs.audio_files`
 - `session.inputs.audio_s3.prefix`
 - `pipeline.workspace.root`
 - `pipeline.spool.root`
 - `pipeline.cache.root`
 - `pipeline.cache.s3_audio`
 - `pipeline.storage.s3.bucket`
 - `pipeline.storage.s3.root_prefix`
 - `pipeline.scriptorium.artifacts.<name>.enabled`
 - `pipeline.scriptorium.artifacts.<name>.inputs.<key>.source`
 - `pipeline.scriptorium.artifacts.<name>.inputs.<key>.required`
 - `campaign.campaign`
 - `campaign.inputs.speakers_file`
 - `campaign.inputs.autocorrect_file`
 - `campaign.inputs.glossary_file`
 ## External adapters used
 - `storage.ObjectStore` for:
  - S3 audio listing/downloads;
  - previous-session current pointer/manifest/artifact object checks and downloads.
 ## State and manifest behavior
 - Ensures workspace layout exists.
 - Materializes canonical input files and audio files.
 - For S3 audio, uses run-scoped spool for active downloads and durable cache for reusable audio files; cache hits copy directly to work audio without downloading the object again.
 - Records `inputs/session.yml` provenance as local `session_config` or remote `session_config.s3`.
 - Resolves campaign-provided stable input paths relative to `campaign.yml`.
 - Resolves session-provided stable input overrides relative to `session.yml`.
 - Scans enabled configured artifact inputs for canonical sources:
  - `narratio.previous_session.artifact.<artifact_key>`
 - If one or more canonical previous-session requirements exist:
  - clears managed `previous/` state;
-  - hydrates required/optional previous artifacts from the configured previous session’s committed archive current state;
+  - builds previous-cache remote plan;
-  - writes `previous/manifest.json` and hydrated `previous/artifacts/**`;
+  - downloads previous manifest/artifacts;
-  - stores archive-relative artifact paths such as `artifacts/session_recap.md` as `previous/artifacts/session_recap.md`, not `previous/artifacts/artifacts/session_recap.md`;
+  - records previous inputs in `manifest.inputs`.
  - records hydrated previous inputs in `manifest.Inputs` with source `previous_session_archive.current`.
 - If no canonical previous-session requirements exist, prepare does not manage `previous/`.
 - `manifest.Inputs` is sorted deterministically by `(kind, path)`.
 - S3 audio `manifest.Inputs` retain S3 provenance and include `cache_path`; `spool_path` is present only when the current prepare invocation downloaded the file.
-## Required and optional previous-session behavior
+Required previous-session inputs fail when unavailable; optional missing inputs are skipped.
 - `previous_session_id` unset:
  - if any referenced previous artifact is required: fail;
  - if all referenced previous artifacts are optional: continue and omit them.
 - Previous session archive current pointer or manifest missing:
  - if any referenced previous artifact is required: fail;
  - if all referenced previous artifacts are optional: continue and omit missing ones.
 - Missing required previous artifact object: fail.
 - Missing optional previous artifact object: omit.
 - Downloaded previous artifacts must validate as non-empty files.
-## Skip and resume behavior
+## Invariants
- Runner-level skip remains authoritative:
+- only `prepare` hydrates canonical `previous/` cache state.
-  - if `prepare` already succeeded and run is not forced, `prepare` does not run and no hydration/download occurs.
+- managed previous artifacts are stored under `previous/artifacts/**` without duplicate `artifacts/artifacts/` nesting.
- If `prepare` runs (including with `--force`), it owns managed `previous/` state for canonical previous-session inputs.
+- `manifest.inputs` ordering is deterministic (`kind`, `path`).
 ## Failure behavior
 - Fails on missing required input files, invalid audio-source combinations, empty/duplicate audio inputs, missing object store for S3 modes, and remote access/download/validation errors.
 - For required canonical previous-session inputs, analyze-time missing-input guidance is to rerun:
  - `narratio run-stage --force prepare`
 ## Tests to inspect before changing
 - `internal/stage/prepare_test.go`
 - `internal/stage/prepare_previous_test.go`
 - `internal/artifacts/previous_requirements_test.go`
 - `internal/app/runner_test.go`
 ## Architectural invariants
 - `audio_dir`/`audio_files` and `audio_s3` are mutually exclusive.
 - Storage keys are computed by callers using archive/path helpers; storage adapter receives explicit keys.
 - `prepare` is the only stage that hydrates canonical previous-session cache state.
--- a/docs/internal/stage-publish.md
+++ b/docs/internal/stage-publish.md
@@ -0,0 +1,44 @@
 # Stage: publish
 ## Purpose
 Upload run/session outputs to object storage and atomically advance remote current state.
 ## Inputs
 - successful prerequisite stages: `prepare`, `transcribe`, `merge`, `polish`, `normalize`, `trim`, `analyze`
 - run root `runs/{run_id}/**`
 - publish output rules (`pipeline.publish.outputs`)
 - effective publish locks (static + remote merged lock set)
 - local `previous/**` files when present
 ## Outputs
 - uploaded run files under remote `runs/{run_id}/...` (excluding `audio/**`)
 - uploaded selected publish outputs under session prefix
 - uploaded `previous/**` files under session prefix when present
 - uploaded `current/manifest.json`
 - uploaded `current/run_id.txt` written last
 ## Key Behavior
 - stage can self-skip when publish disabled or run upload disabled.
 - validates prerequisite stage success and object-store availability.
 - collects deterministic run file list plus run `manifest.json`.
 - resolves publish output sources through runtime artifact catalog and manifest-aware resolution.
 - selected artifact filter applies to configured artifact sources only.
 - locked outputs are skipped intentionally (including required ones).
 - optional missing outputs are skipped; required missing unlocked outputs fail.
 - writes remote current manifest before current run pointer.
 ## Metadata Signals
 Includes counts/lists for:
 - run uploads
 - published output uploads
 - previous uploads
 - skipped optional outputs
 - skipped unselected outputs
 - locked outputs
 - current-state key paths
 - `current_pointer_written`
 ## Invariants
 - `current/run_id.txt` is the remote commit marker and is written last.
 - run upload excludes `audio/**`.
 - publish locks are not overridden by `--force`.
--- a/docs/internal/stage-transcribe.md
+++ b/docs/internal/stage-transcribe.md
@@ -1,58 +1,22 @@
 # Stage: transcribe
 ## Purpose
-Generate per-speaker raw transcripts from prepared audio using WhisperX.
+Generate raw per-speaker transcripts from prepared audio using WhisperX.
-## Inputs and Outputs
+## Inputs
-Inputs:
+- `audio/*.flac` from `prepare`
 - `audio/*.flac` prepared by `prepare`
-Outputs:
+## Outputs
- `transcripts/raw/<speaker>.json` for each input audio file
+- `transcripts/raw/<speaker>.json`
-## Boundaries
+## Key Behavior
-Owns:
+- discovers prepared audio from manifest inputs or canonical audio directory.
- Discovering prepared audio inputs
+- derives speaker ID from `.flac` basename.
- Deriving speaker ids from audio basenames
+- runs WhisperX with configured concurrency/retry settings.
- Parallel WhisperX invocation with bounded concurrency
+- validates each output as JSON.
- Validating produced JSON and promoting run-local outputs
+- writes run-local outputs then materializes canonical transcript outputs.
-Does not own:
+## Invariants
- Transcript merge/polish/normalize/trim/analyze
+- speaker basenames must be unique.
-
+- output path returned by adapter must match requested output path.
-## Config Fields Used
+- each successful output is validated before stage success.
 - `session.session_id`
 - `session.campaign`
 - `pipeline.workspace.root`
 - `pipeline.whisperx.transcribe_url`
 - `pipeline.whisperx.language`
 - `pipeline.whisperx.timeout`
 - `pipeline.whisperx.retries`
 - `pipeline.whisperx.retry_delay`
 - `pipeline.whisperx.concurrency`
 ## External Adapters Used
 - WhisperX adapter (`env.WhisperX.Transcribe`).
 ## State and Manifest Behavior
 - Uses run-local output paths under `runs/{run_id}/transcribe/outputs/...` when run layout is enabled.
 - Validates each generated transcript JSON before promotion.
 - Promotes canonical outputs to `transcripts/raw/*.json`.
 - Records per-file metadata (attempts/status/duration/output path) in stage metadata.
 ## Skip and Resume Behavior
 - Runner-level skip applies for previously succeeded stage unless forced.
 - On forced upstream reruns, downstream succeeded stages can be marked `stale` by runner logic.
 ## Failure Behavior
 - Fails if no prepared audio exists, duplicate speaker basenames are detected, adapter output path mismatches expected path, any output JSON is invalid, or one worker fails.
 - Cancels in-flight workers after first terminal error.
 ## Tests to Inspect Before Changing
 - `internal/stage/transcribe_test.go`
 - `internal/app/whisperx_wiring_test.go`
 ## Architectural Invariants
 - Speaker identity is derived from `.flac` basename and must be unique.
 - Every successful speaker output must be valid JSON before promotion.
 - Canonical raw transcript set is the only supported merge input surface.
--- a/docs/internal/stage-trim.md
+++ b/docs/internal/stage-trim.md
@@ -1,75 +1,28 @@
 # Stage: trim
 ## Purpose
-Optionally trim the normalized transcript to session bounds; always produce a durable trimmed transcript.
+Produce a final-trimmed transcript; optionally generate bounds-driven trim.
-## Inputs and Outputs
+## Inputs
-Inputs:
+- `transcripts/final.json`
 - `transcripts/normalized.json`
-Outputs:
+## Outputs
- `transcripts/trimmed.json` (or configured trim output path)
+- `transcripts/final.trimmed.json` (or configured trim output path)
 - when trim enabled: `artifacts/session_bounds.json`
-## Boundaries
+## Key Behavior
-Owns:
+When `trim.enabled=false`:
- Trim-enabled switch behavior
+- copies normalized transcript to trimmed output.
 - Bounds generation via Scriptorium artifact run
 - Bounds validation against normalized transcript
 - Keep-selector derivation and Seriatim trim invocation
 - Copy-through behavior when disabled or bounds indicate unchanged transcript
-Does not own:
+When `trim.enabled=true`:
- Upstream normalization
+- runs Scriptorium bounds artifact generation;
- Downstream artifact analysis
+- optionally runs render-debug output generation;
 - validates bounds payload against transcript;
 - derives keep selector;
 - either copies unchanged transcript or runs Seriatim trim;
 - validates trimmed transcript and materializes bounds output.
-## Config Fields Used
+## Invariants
- `session.session_id`
+- normalized transcript is required input.
- `session.campaign`
+- bounds output exists only in enabled trim path.
- `pipeline.workspace.root`
+- render-debug output is diagnostic and not a declared stage output.
 - `pipeline.trim.enabled`
 - `pipeline.trim.output_path`
 - `pipeline.trim.bounds.prompt_id`
 - `pipeline.trim.bounds.profile_id`
 - `pipeline.trim.bounds.timeout`
 - `pipeline.trim.bounds.output_path`
 - `pipeline.trim.bounds.transcript_input_name`
 - `pipeline.trim.bounds.render_debug`
 - `pipeline.trim.bounds.render_output_path`
 - `pipeline.seriatim.binary`
 - `pipeline.seriatim.timeout`
 - `pipeline.scriptorium.binary`
 - `pipeline.scriptorium.config_path`
 - `pipeline.scriptorium.timeout`
 ## External Adapters Used
 - Scriptorium adapter:
  - optional `RenderArtifact` for bounds debug render
  - `RunArtifact` for bounds output
 - Seriatim adapter:
  - `Trim` when bounds indicate trimming is required
 ## State and Manifest Behavior
 - Reads normalized transcript from normalize manifest outputs when available; falls back to canonical path.
 - Uses run-local outputs/logs/reports/config/scratch paths when run layout is enabled.
 - Promotes canonical trimmed transcript; promotes session bounds when trim enabled.
 - Records bounds diagnostics, trim action, keep selector, and adapter metadata.
 ## Skip and Resume Behavior
 - Runner-level skip applies when already succeeded and not forced.
 - Forced reruns can stale downstream succeeded stages.
 - When `trim.enabled=false`, stage still succeeds by copying normalized to trimmed output.
 ## Failure Behavior
 - Fails on missing/invalid normalized transcript.
 - With trim enabled, fails on missing adapters/config, bounds generation/validation errors, invalid bounds JSON, invalid range/segment ids, trim adapter failures, or invalid trimmed output.
 ## Tests to Inspect Before Changing
 - `internal/stage/trim_test.go`
 - `internal/adapters/scriptorium/subprocess_test.go`
 - `internal/adapters/seriatim/subprocess_test.go`
 ## Architectural Invariants
 - Trim never falls back to processed transcript; normalized transcript is required input.
 - `session_bounds` output exists only for enabled trim path.
 - Render-debug artifacts are diagnostics and not declared stage outputs.
--- a/docs/internal/storage.md
+++ b/docs/internal/storage.md
@@ -1,75 +1,37 @@
 # Internal: Storage
 ## Purpose
-Document Narratio's remote storage backend contracts and implementations under `internal/adapters/storage`.
+Document remote object-store contracts and S3 implementation behavior.
-## Inputs and outputs
+## Primary Contract
-Inputs:
+`storage.ObjectStore` interface:
- Resolved storage config (`pipeline.storage.*`).
+- `List(ctx, prefix)`
- Already-loaded environment variables for configured S3 credentials.
+- `Download(ctx, key, localPath)`
- Bucket-relative object keys and local file paths from app/stage orchestration.
+- `Upload(ctx, localPath, key, opts)`
 - `Exists(ctx, key)`
-Outputs:
+Key invariant:
- Listed/downloaded/uploaded object metadata (`ObjectInfo`).
+- callers pass full bucket-relative keys;
- Existence checks and storage-layer errors.
+- storage implementations do not infer campaign/session/run prefixes.
-## Boundaries
+## Configuration
-Owns:
+`NewObjectStoreFromConfig` currently supports S3-backed stores from `pipeline.storage.*` config.
 - Remote object-store interface and implementation details.
 - S3 client wiring and API calls.
 - Object key normalization and upload/download/list primitives.
-Does not own:
+S3 constructor behavior:
- Session/run prefix semantics.
+- requires configured bucket;
- Archive commit order semantics.
+- uses region/endpoint/path-style options when set;
- Manifest updates.
+- resolves credentials from configured env var names (with defaults).
 - Filesystem secret loading from `pipeline.secrets.env_dir`.
-## Config fields used
+## S3 Backend Behavior
- `pipeline.storage.backend`
+- normalizes object keys.
- `pipeline.storage.s3.bucket`
+- `List` paginates and returns normalized `ObjectInfo`.
- `pipeline.storage.s3.region`
+- `Download` writes local files with parent directory creation.
- `pipeline.storage.s3.endpoint`
+- `Upload` streams local file and returns remote metadata.
- `pipeline.storage.s3.force_path_style`
+- `Exists` maps not-found responses to `false`.
 - `pipeline.storage.s3.access_key_id_env`
 - `pipeline.storage.s3.secret_access_key_env`
-## External adapters used
+## Legacy Compatibility Interface
-Storage package contracts:
+`storage.Backend` (with `ArchiveRequest`) remains as compatibility surface with `NoopBackend`; it is not used by current stage execution.
 - `ObjectStore` (active remote object-store boundary): `List`, `Download`, `Upload`, `Exists`.
 - `Backend` (archive request boundary): currently implemented with `NoopBackend` only.
-Implementations:
+## Invariants
- `S3Backend`: AWS SDK-backed `ObjectStore` implementation.
+- storage layer is stateless regarding manifest/stage progression.
- `FakeBackend`: deterministic test `ObjectStore` and archive backend.
+- publish ordering semantics are owned by stage/app code, not storage adapters.
 - `NoopBackend`: deterministic no-op archive backend for compatibility wiring.
 ## State and manifest behavior
 - Storage implementations are stateless with respect to manifest/session lifecycle.
 - Caller supplies fully-qualified bucket-relative keys.
 - Storage layer does not infer campaign/session/run/root-prefix semantics.
 - Caller controls publish ordering; storage layer executes individual operations in the order invoked.
 ## Skip and resume behavior
 - No storage-level skip/resume behavior.
 - Skip/resume decisions are made by stage/app logic before storage calls occur.
 ## Failure behavior
 - `NewObjectStoreFromConfig` fails when no remote backend is configured or required S3 config is missing.
 - `S3Backend` constructor fails when required bucket is missing or AWS client setup fails.
 - App command orchestration loads configured filesystem secrets before calling the object-store factory.
 - CRUD operations return contextual errors (including not-found behavior via `Exists`).
 - Key normalization is applied before operations (`\\` to `/`, leading slash trimmed).
 - Remote session loading uses `List` to find the exact `session.yml` key and `Download` to materialize it to a local temp file.
 ## Tests to inspect before changing
 - `internal/adapters/storage/factory_test.go`
 - `internal/adapters/storage/s3_backend_test.go`
 - `internal/adapters/storage/fake_test.go`
 - `internal/adapters/storage/keys_test.go`
 - `internal/adapters/storage/archive.go` + consumers in stage tests (`prepare`, `archive`)
 ## Architectural invariants
 - Callers pass full bucket-relative keys.
 - Storage backends must not prepend or infer narratio prefixes.
 - Remote transport details remain isolated to storage adapter implementations.
--- a/docs/internal/workspace.md
+++ b/docs/internal/workspace.md
@@ -1,77 +1,57 @@
-# Workspace internals
+# Internal: Workspace
 ## Purpose
-Define the local durable and run-local workspace model used by stages, manifests, resume, and archive.
+Define local session layout, run-local stage layout, and cleanup guardrails.
-## Inputs and Outputs
+## Canonical Session Layout
-Inputs:
+Session root:
- `pipeline.workspace.root`
+- `{workspace.root}/work/{campaign}/{session_id}`
 - `session.campaign`
 - `session.session_id`
 - generated `run_id`
-Outputs:
+Core directories/files:
- Session manifest at `{workspace.root}/work/{campaign}/{session_id}/manifest.json`
+- `inputs/`
- Run manifest at `{workspace.root}/work/{campaign}/{session_id}/runs/{run_id}/manifest.json`
+- `audio/`
- Canonical durable session directories and run-local stage trees
+- `transcripts/`
 - `artifacts/`
 - `reports/`
 - `logs/`
 - `config/`
 - `current/`
 - `runs/`
 - `previous/`
 - `manifest.json`
 - `.lock`
-## Boundaries
+`previous/` reserved files:
-Owns:
+- `previous/manifest.json`
- Session-level path layout (`inputs/`, `audio/`, `transcripts/`, `artifacts/`, `reports/`, `logs/`, `config/`, `current/`, `runs/`, `previous/`)
+- `previous/artifacts/**`
  - `previous/manifest.json` and `previous/artifacts/**` are reserved for prepared previous-session state
 - Run-local stage sandbox layout under `runs/{run_id}/{stage}/`
 - Session lock acquisition/release (`.lock`)
-Does not own:
+## Run-Local Stage Layout
- Stage business logic
+When run context is available, stages use:
- Remote archive semantics (documented in `stage-archive.md`)
+- `runs/{run_id}/{stage}/outputs/`
- CLI argument parsing
+- `runs/{run_id}/{stage}/logs/`
 - `runs/{run_id}/{stage}/reports/`
 - `runs/{run_id}/{stage}/config/`
 - `runs/{run_id}/{stage}/scratch/`
-## Config Fields Used
+Run-local outputs are materialized back into canonical session paths before stage success.
- `pipeline.workspace.root`
+`previous/**` writes are never redirected to run-local output paths.
 - `pipeline.workspace.cleanup_after_archive`
 - `pipeline.spool.root`
 - `pipeline.spool.delete_audio_after_archive`
 - `pipeline.cache.root`
 - `pipeline.cache.s3_audio`
 - `session.campaign`
 - `session.session_id`
-## External Adapters Used
+## Locking
-None directly in this subsystem. Stages may use object storage adapters and then write local outputs into this layout.
+`artifacts.LocalStore` enforces single-writer session lock via `.lock` file (`ErrLockConflict` on contention).
-## State and Manifest Behavior
+## Cleanup Semantics
- Session state is persisted in the session manifest (`manifest.Manifest`).
+Automatic post-publish cleanup (`runPostArchiveCleanup`):
- Invocation history is persisted per run in run manifests under `runs/{run_id}/manifest.json`.
+- only runs when publish actually executed and succeeded;
- During each run, stage outputs are often written run-local first (`runs/{run_id}/{stage}/outputs/...`) and promoted to canonical session paths after stage success.
+- requires `uploaded=true` and `current_pointer_written=true` metadata;
- `manifest.Artifacts` entries record `ProducerRunID` for durable outputs.
+- respects `pipeline.spool.delete_audio_after_publish` and `pipeline.workspace.cleanup_after_publish`;
- For S3 audio sessions, `prepare` records work/cache paths, S3 provenance, and spool path when the invocation downloaded the object.
+- refuses unsafe deletes (root delete, out-of-root delete, symlink paths).
 - Durable cache state under `pipeline.cache.root` is not workspace state and is preserved by default by `narratio clean`.
 - `narratio clean --session-id <id>` removes the session work root and session spool root.
 - `narratio clean --all` removes all local session work under `workspace.root/work` and spool children under `spool.root`.
 - `narratio clean --clear-cache` is the explicit opt-in for deleting matching S3 audio cache entries.
-## Skip and Resume Behavior
+Manual clean command:
- Skip/resume decisions are made in `internal/app` (`run_control.go`, `resume.go`) using stage status in the session manifest.
+- `clean <session_id>` removes session work and spool subtree.
- `--force` reruns selected stages and marks downstream previously-succeeded stages as `stale`.
+- `clean --all` removes all workspace work and spool children.
- Workspace layout is idempotent (`EnsureLayoutFor`) and reused across runs.
+- durable cache is preserved unless `--clear-cache` is requested.
-## Failure Behavior
+## Invariants
- Failures preserve manifests and run-local files for inspection.
+- campaign-aware session root is mandatory.
- Lock conflicts fail fast via `ErrLockConflict`.
+- manifest-driven stage state is durable across runs.
- Cleanup can fail post-archive; failure is recorded in archive stage metadata and returned by the run.
+- cleanup guardrails prevent destructive root/out-of-scope deletion.
 ## Tests to Inspect Before Changing
 - `internal/artifacts/local_test.go`
 - `internal/stage/run_local_test.go`
 - `internal/app/run_control_test.go`
 - `internal/app/resume_run_stage_test.go`
 - `internal/app/post_archive_cleanup_test.go`
 ## Architectural Invariants
 - Session root is campaign-aware: `{workspace.root}/work/{campaign}/{session_id}`.
 - Run roots are always nested: `runs/{run_id}` under the session root.
 - Run-local output promotion must end in canonical session paths.
 - `previous/**` is session-durable state and must not be treated as run-local output scratch state.
 - Automatic post-archive cleanup only targets run-scoped directories and must never delete configured root directories.
 - Manual `clean` may delete session-scoped directories or the `workspace.root/work` directory, but it must preserve configured root directories and reject unsafe targets.
--- a/docs/operations.md
+++ b/docs/operations.md
@@ -1,279 +1,249 @@
-# Operations
+# Operations Guide
-This guide describes the implemented operator lifecycle for Narratio.
+Operator workflow for running, recovering, and publishing Narratio sessions.
-For field-level configuration, see [docs/config.md](./config.md). For full command/flag reference, see [docs/cli.md](./cli.md).
+For command syntax, see [docs/cli.md](./cli.md). For field-level config, see [docs/config.md](./config.md).
-## Normal workflow (S3-first path)
+## Standard Session Workflow
-1. Create or upload `session.yml`, or pass a local `session.yml` explicitly.
+1. Select pipeline/campaign/session config.
-2. Upload session `.flac` files to object storage under the configured session audio prefix.
+2. Validate session readiness:
 3. Run Narratio:
 ```bash
-narratio run --session-id 2026-04-04
+narratio session validate 2026-04-04
 ```
-4. Read success output:
+3. (Optional) inspect stage decisions:
 - `narratio run: session <session_id>; executed=<n> skipped=<n>; manifest=<path>`
 - use `manifest=<path>` with `status` for inspection.
 Notes:
 - default config/campaign/session discovery checks system config locations unless `--config`, `--campaign`, and `--session` are passed.
 - when local `session.yml` discovery misses, `--session-id` loads remote `session.yml` from `{root_prefix}/campaigns/{campaign}/sessions/{session_id}/session.yml`.
 - S3 audio mode requires `session.inputs.audio_s3.prefix` and valid object-store access.
 Initialize a remote session skeleton:
 ```bash
-narratio session init --config /etc/narratio/pipeline.yml --campaign /etc/narratio/campaign.yml --session-id 2026-04-04 --remote
+narratio session plan 2026-04-04
 ```
-Remote init writes `{root_prefix}/campaigns/{campaign}/sessions/{session_id}/session.yml`. It fails if the object already exists unless `--force` is passed.
+4. Run the pipeline:
 Validate before running:
 ```bash
-narratio session validate --session-id 2026-04-04
+narratio run 2026-04-04
 ```
-## Restore workflow
+5. Check state:
 Use restore when local durable session state is missing or stale and archive current state is authoritative.
 Dry-run (no local writes):
 ```bash
-narratio restore --session-id 2026-04-04 --dry-run
+narratio session status 2026-04-04
 ```
-Execution:
+## Campaign and Session Selection
 Campaign selection priority:
 - `--campaign-file`
 - `--campaign`
 - `pipeline.campaigns.default_campaign_id`
 Session source priority:
 - `--session`
 - local default search paths
 - remote session object (S3) when local session file is not found and storage is configured
 ## Session Initialization
 Use `session init` to generate a concrete session file for local or remote use.
 Local file:
 ```bash
-narratio restore --session-id 2026-04-04
+narratio session init 2026-04-04 --output ./session.yml --date 2026-04-04 --title "Session 12"
 ```
-Post-restore analyze rerun pattern:
+Remote session object:
 ```bash
-narratio analyze --session-id 2026-04-04
+narratio session init 2026-04-04 --remote --force
 ```
-Restore source-of-truth:
+If `campaign.yml` sets `session_template_file`, `session init` renders it. Template variables must resolve to concrete values.
 - remote commit marker: `current/run_id.txt`
 - remote current manifest: `current/manifest.json`
-Restore default scope:
+## Stage Execution and Resume Behavior
 - includes `manifest.json`, `transcripts/**`, `artifacts/**`, `previous/**`
 - includes `audio/**` only with `--include-audio`
 - excludes `runs/**`, `logs/**`, `reports/**`, `config/**`, `inputs/**`, and `current/**` (except remote `current/manifest.json` as source)
-Reset local state before restore testing:
+Canonical stage order:
 1. `prepare`
 2. `transcribe`
 3. `merge`
 4. `polish`
 5. `normalize`
 6. `trim`
 7. `analyze`
 8. `publish`
 9. `notify`
 Execution rules:
 - succeeded stages are skipped unless `--force` is set;
 - `resume` starts at first non-succeeded stage;
 - force rerunning a succeeded upstream stage marks succeeded downstream stages as `stale`.
 Single-stage execution:
 ```bash
-narratio clean --session-id 2026-04-04 --dry-run
+narratio run-stage normalize 2026-04-04 --force
 narratio clean --session-id 2026-04-04
 narratio restore --session-id 2026-04-04 --include-audio
 ```
-`clean` removes the local session work directory and session spool directory. It preserves the durable S3 audio cache by default, so repeated restore or forced prepare tests do not re-download large audio files.
+## Artifact Selection
-## Local filesystem layout and state artifacts
+`--artifacts` can be used on `run`, `resume`, `run-stage`, `analyze`, and `publish`.
 Selection behavior:
 - validates names against `pipeline.scriptorium.artifacts`;
 - filters analyze execution to selected configured artifacts;
 - filters publish rules for `narratio.artifact.<name>` sources only;
 - does not suppress built-in transcript or bounds publish sources.
 ## Publish Workflow
 Run publish only:
 ```bash
 narratio publish 2026-04-04
 ```
 Equivalent:
 ```bash
 narratio run-stage publish 2026-04-04 --force
 ```
 Publish commit model:
 - uploads run files under `{session_prefix}/runs/{run_id}/`;
 - uploads configured published outputs;
 - uploads `previous/**` cache files when present;
 - writes `current/manifest.json`;
 - writes `current/run_id.txt` last.
 `current/run_id.txt` is the remote current-state commit marker.
 ## Publish Locks
 Lock sources:
 - static locks in `pipeline.publish.locks`
 - mutable remote locks in `{session_prefix}/locks.yml`
 Effective lock rules:
 - static and remote locks are merged;
 - static locks win on source collisions;
 - locked outputs are intentional skips;
 - lock add/remove commands mutate only remote lock state.
 Examples:
 ```bash
 narratio session locks 2026-04-04
 narratio session locks add 2026-04-04 narratio.artifact.session_recap --reason "manual edits" --force
 narratio session locks remove 2026-04-04 narratio.artifact.session_recap
 ```
 ## Restore Workflow
 Use restore when local durable session state is missing or stale and remote committed current state is authoritative.
 Dry run:
 ```bash
 narratio session restore 2026-04-04 --dry-run
 ```
 Apply:
 ```bash
 narratio session restore 2026-04-04
 ```
 Default restore scope:
 - `manifest.json`
 - `transcripts/**`
 - `artifacts/**`
 - `previous/**` when needed by configured previous-session artifact inputs
 Optional:
 - `--include-audio` to include `audio/**`
 - `--force` to overwrite local conflicts
 Restore writes an execution report at `reports/restore-latest.json`.
 ## Local State Layout
 Session root:
 - `{workspace.root}/work/{campaign}/{session_id}/`
-Primary state:
+- `{workspace.root}/work/{campaign}/{session_id}`
 - `manifest.json`: session-level stage state.
 - `runs/{run_id}/manifest.json`: invocation-level state.
 - `.lock`: session lock while a modifying command is active.
 - `inputs/campaign.yml`, `inputs/session.yml`, and `inputs/pipeline.resolved.yml`: materialized config inputs for the run.
-Canonical session directories:
+Durable session paths:
 - `inputs/`
 - `audio/`
 - `transcripts/`
 - `artifacts/`
 - `previous/`
 - `reports/`
 - `logs/`
 - `config/`
 - `current/`
 - `runs/`
-Run-local stage directories:
+- `manifest.json`
- `runs/{run_id}/{stage}/` with stage-local `outputs/`, `logs/`, `reports/`, `config/`, `scratch/`.
+- `inputs/**`
 - `audio/**`
 - `transcripts/**`
 - `artifacts/**`
 - `previous/**`
 - `reports/**`
 - `logs/**`
 - `config/**`
 - `runs/**`
-Behavior:
+Run-local layout:
 - directory creation is idempotent.
 - stage outputs are generally generated run-local first, then promoted to canonical paths on success.
 - restore installs downloaded files to canonical session paths and does not recreate historical run sandboxes.
-## Analyze artifact execution lifecycle
+- `runs/{run_id}/{stage}/outputs`
 - `runs/{run_id}/{stage}/logs`
 - `runs/{run_id}/{stage}/reports`
 - `runs/{run_id}/{stage}/config`
 - `runs/{run_id}/{stage}/scratch`
-Analyze executes configured artifacts from `pipeline.scriptorium.artifacts`.
+Spool layout (runtime/transient):
-Execution model:
+- `{spool.root}/{campaign}/{session_id}/{run_id}/...`
- executable set = enabled artifacts, filtered by `--artifacts` when provided.
+- restore audio spool under `{spool.root}/{campaign}/{session_id}/restore/audio`
 - artifact-to-artifact dependencies are declared via `depends_on`.
 - selected artifacts run in deterministic dependency order.
 - after each successful artifact run, output is promoted to configured canonical `output_path`.
-Configured artifact source reuse:
+Cache layout (durable S3 audio cache):
 - a non-executable configured artifact can satisfy inputs if its configured output file already exists and is valid.
 - reused configured artifact provenance is `filesystem.disabled_artifact_output`.
-`--artifacts` behavior:
+- `{cache.root}/s3/{bucket}/...`
 - accepted on `run`, `resume`, `run-stage analyze`, and `analyze`.
 - filters analyze execution only.
 - does not imply force on `run`, `resume`, or `run-stage`; `narratio analyze` is force-by-design.
-Canonical previous-session input behavior:
+## Cleanup
 - canonical sources use `narratio.previous_session.artifact.<artifact_key>`.
 - these inputs are hydrated by `prepare`, not `analyze`.
 - if analyze fails due to missing canonical previous cache, rerun:
  - `narratio run-stage --session-id <id> --force prepare`
-## Remote archive layout and publish contract
+Session-scoped cleanup:
 When archive is enabled and run upload is enabled, archive publishes under:
 - session prefix: `{root_prefix}/campaigns/{campaign}/sessions/{session_id}/`
 - run prefix: `{session_prefix}/runs/{run_id}/`
 Archive uploads:
 - run record files from run root (excluding `audio/`).
 - promoted files from explicit `archive.promote_artifacts` rules.
 - mutable session locks from helper commands live at `{session_prefix}/locks.yml`.
 Publish order:
 1. upload `current/manifest.json`
 2. upload `current/run_id.txt` last
 `current/run_id.txt` is the remote commit marker.
 Archive promotion is explicit and source-based:
 - Narratio does not auto-promote all generated analyze artifacts.
 - each rule resolves `source` through the artifact resolver/catalog model, then uploads to `dest`.
 - missing required promotion sources fail archive stage.
 - missing optional promotion sources are skipped.
 - invalid resolved artifacts fail archive stage.
 - `archive.locks` skips top-level promotion overwrites for locked sources while run-local uploads still publish.
 - remote locks from `{session_prefix}/locks.yml` are merged with static `archive.locks`; static locks win on duplicate sources.
 - locked required promotions are treated as intentional successful skips and are recorded in archive metadata.
 Lock helper behavior:
 - `narratio locks --session-id <id>` lists effective static and remote locks.
 - `narratio locks add --session-id <id> --reason <text> <source>` writes a remote lock.
 - `narratio locks add --session-id <id> --force --reason <text> <source>` updates an existing remote lock reason.
 - `narratio locks remove --session-id <id> <source>` removes only a remote lock.
 - `locks remove` cannot remove static pipeline locks.
 - remote lock writes check whether the lock store exists, but are not compare-and-swap atomic.
 ## Resume, retry, restore, and safe rerun behavior
 Default skip:
 - `run` and `run-stage` skip already-succeeded stages unless `--force` is set.
 Resume:
 - `resume` starts at first non-succeeded stage.
 - `resume --force` runs full stage order.
 Restore conflict policy:
 - restore classifies local differences as conflicts.
 - without `--force`, restore fails when conflicts exist.
 - with `--force`, conflicting local files are overwritten by remote archive files.
 Forced reruns:
 - force-rerunning an upstream succeeded stage marks downstream succeeded stages as `stale`.
 - ordinary `--force` does not override archive locks.
 Safe rerun pattern:
 1. rerun the changed stage with `--force`.
 2. run `resume` to rebuild downstream stages.
 ## Cleanup behavior
 Automatic post-archive cleanup is considered only when archive stage executed and succeeded.
 Automatic cleanup toggles:
 - `pipeline.spool.delete_audio_after_archive=true` deletes run-scoped spool audio.
 - `pipeline.workspace.cleanup_after_archive=true` deletes run-scoped local run directory.
 Manual cleanup:
 - `narratio clean --session-id <id>` deletes `{workspace.root}/work/{campaign}/{session_id}` and `{spool.root}/{campaign}/{session_id}`.
 - `narratio clean --all` deletes all local session work under `{workspace.root}/work` and all spool children under `{spool.root}`.
 - `--dry-run` prints targets without deleting.
 - `--clear-cache` also removes matching S3 audio cache files. Without it, cache is preserved.
 The S3 audio cache under `pipeline.cache.root` is durable input cache state, not workspace or spool state. Automatic cleanup and default manual cleanup do not delete it.
 Cleanup eligibility gates:
 - archive enabled
 - archive run upload enabled
 - run record upload completed
 - current pointer write completed (`current/run_id.txt` written)
 No cleanup for failed/incomplete/unarchived/archive-skipped runs.
 ## Failure and recovery playbooks
 After run failure, Narratio keeps:
 - session manifest
 - run manifest
 - run-local artifacts/logs/config/reports
 Failed or incomplete runs remain local-only.
 After restore failure:
 - already-installed restore files remain in place.
 - restore does not roll back prior successful installs.
 - existing local manifest is preserved if restored manifest validation/install fails.
 Recommended recovery:
 1. inspect state:
 ```bash
-narratio status --session-id 2026-04-04
+narratio clean 2026-04-04
 ```
-This reports local manifest state, committed remote current state, expected remote transcript/artifact availability, and archive locks.
+Global cleanup:
 2. for one manifest file, run:
 ```bash
-narratio status --manifest <manifest-path>
+narratio clean --all
 ```
-3. for restore-specific checks, run:
+Dry-run and cache variants:
 ```bash
-narratio restore --session-id 2026-04-04 --dry-run
+narratio clean 2026-04-04 --dry-run --clear-cache
 narratio clean --all --dry-run --clear-cache
 ```
-4. fix root cause (config/input/credentials/storage/service availability).
+Rules:
 5. continue with `resume`, or targeted `run-stage --force` followed by `resume`.
-## Restore report
+- `clean` deletes work/spool session state;
 - cache is preserved unless `--clear-cache` is set;
 - automatic post-publish cleanup is gated by successful publish commit plus:
  - `pipeline.spool.delete_audio_after_publish=true`
  - `pipeline.workspace.cleanup_after_publish=true`
-Non-dry-run restore writes a durable report at:
+## Operational Caveats
 - `reports/restore-latest.json`
-Report content includes:
+- Local and S3 audio modes are mutually exclusive.
- identity (`campaign`, `session_id`, `run_id`)
+- Publish requires prerequisite stages through analyze to be succeeded.
- mode flags (`dry_run`, `force`, `include_audio`)
+- Restore requires configured object storage and committed remote current state.
- plan counts and execution counts
+- Storage-backed commands load filesystem secrets before object-store initialization.
 - per-action status
 Dry-run does not write restore report files.
 ## Operational caveats
 - `status` with no config/session flags still requires explicit `--manifest`.
 - `status --session-id <id>` uses normal config/session loading, including remote session fallback.
 - `status --session-id <id>` includes the same promoted remote output availability view as `artifacts list --remote` when storage is configured.
 - local and S3 audio input modes are mutually exclusive.
 - archive publish requires upstream stages through `analyze` to be `succeeded`.
 - required promotion rules can fail when selected analyze artifacts did not generate a required file path.
 - restore requires configured remote object storage and committed remote current state.
--- a/docs/policy/architecture.md
+++ b/docs/policy/architecture.md
@@ -19,7 +19,7 @@ It coordinates specialized downstream systems rather than reimplementing their d
 - Audita handles transcript correction and polishing.
 - Scriptorium handles prompt execution and generated artifacts.
-Narratio owns orchestration, configuration loading, session/run state, local and remote path modeling, manifest persistence, stage sequencing, resume behavior, and archive semantics.
+Narratio owns orchestration, configuration loading, session/run state, local and remote path modeling, manifest persistence, stage sequencing, resume behavior, and publish semantics.
 Narratio should remain explicit and comprehensible. It is not intended to become a generic workflow engine.
@@ -80,7 +80,7 @@ It should record:
 - input and output refs;
 - logs and generated config refs;
 - checksums or provenance where useful;
- non-secret adapter and archive metadata.
+- non-secret adapter and publish metadata.
 Resume behavior should be manifest-driven. Filesystem state may be inspected and validated, but it should not replace manifest stage state as the source of run progress.
@@ -117,19 +117,19 @@ Narratio should not become a secondary configuration system for downstream tools
 Local and remote paths are part of Narratio’s application contract.
-Code should use centralized path helpers for workspace, spool, session, run, artifact, log, config, and archive paths. Stages should avoid reconstructing canonical paths through scattered string concatenation.
+Code should use centralized path helpers for workspace, spool, session, run, artifact, log, config, and publish/current paths. Stages should avoid reconstructing canonical paths through scattered string concatenation.
 Storage backends should receive explicit bucket-relative keys. Storage implementations should not infer campaign, session, run, or root-prefix semantics.
-## Archive Invariants
+## Publish Invariants
-Archive behavior must preserve a clear commit boundary.
+Publish behavior must preserve a clear commit boundary.
-A remote run is current only after the archive stage has successfully uploaded the run record, required promoted outputs, `current/manifest.json`, and finally `current/run_id.txt`.
+A remote run is current only after the publish stage has successfully uploaded the run record, required published outputs, `current/manifest.json`, and finally `current/run_id.txt`.
 `current/run_id.txt` is the final remote commit marker and must be written last.
-Failed, incomplete, skipped, or uncommitted archive attempts must not be presented as current remote state. Local cleanup is permitted only after successful archive commit and only when explicitly configured.
+Failed, incomplete, skipped, or uncommitted publish attempts must not be presented as current remote state. Local cleanup is permitted only after successful publish commit and only when explicitly configured.
 ## Security and Privacy
@@ -139,7 +139,7 @@ Rules:
 - Do not store raw secrets in pipeline or session YAML.
 - Use environment variable names or secret-file references for secret handling.
- Do not write raw secret values to manifests, logs, generated configs, or archive metadata.
+- Do not write raw secret values to manifests, logs, generated configs, or publish metadata.
 - Treat transcripts, generated artifacts, prompts, reports, and logs as potentially sensitive.
 - Avoid logging transcript or prompt content unless there is a deliberate diagnostic reason.
@@ -177,7 +177,7 @@ Tests should cover:
 - stage success, failure, skip, and resume behavior;
 - adapter command construction;
 - fake storage behavior;
- archive commit ordering;
+- publish commit ordering;
 - example config validity where practical.
 Live S3, WhisperX, LLM, or subprocess integration tests should be explicit integration tests, not required for ordinary unit test runs.
--- a/docs/policy/development.md
+++ b/docs/policy/development.md
@@ -75,7 +75,7 @@ Remote-storage commands must obtain object storage through the app-level command
 1. Implement stage behavior in `internal/stage` with clear input/output boundaries.
 2. Keep external transport/subprocess details in `internal/adapters`.
-3. Preserve manifest and promotion semantics expected by runner and archive logic.
+3. Preserve manifest and publish-output semantics expected by runner and publish logic.
 4. Add/update stage and adapter tests.
 5. Update internal component contracts in `docs/internal/`.
--- a/docs/policy/documentation.md
+++ b/docs/policy/documentation.md
--- a/docs/roadmap/audit.md
+++ b/docs/roadmap/audit.md
@@ -0,0 +1,556 @@
 # Roadmap: Code Quality and Deduplication Audit
 Status: Draft audit report
 This report is a pre-1.0 implementation audit focused on high-confidence opportunities to simplify, centralize, or clarify Narratio before release. It is intentionally report-only: no refactors are included here.
 The requested `docs/architecture.md` and `docs/development.md` paths do not exist in the current tree. This audit used the current policy documents at `docs/policy/architecture.md` and `docs/policy/development.md`, plus the current user, operator, and internal docs.
 ## 1. Executive Summary
 Overall code quality is solid. The codebase has strong package boundaries in the important places: storage adapters expose a narrow object-store interface, AWS SDK types do not leak into app or stage logic, config loading is strict, and pipeline execution remains explicit and stage-driven. Recent pre-1.0 work has also produced useful central points for campaign/session config loading, secret-backed object-store creation, S3 audio caching, transcript artifact naming, local session paths, and S3 key construction.
 The main release risk is not a large architectural flaw. It is policy drift from rapid feature growth. Several public-interface decisions now appear in more than one implementation path: artifact source interpretation, publish-output destination derivation, remote current-state inspection, cleanup safety checks, and session-oriented command parsing. Most of these are correct today, but a future bug fix would likely have to be made in multiple files.
 Top three refactoring targets before 1.0:
 1. Centralize artifact source and publish-output resolution across config validation, publish execution, status/artifacts output, restore, previous-cache hydration, and analyze input resolution.
 2. Consolidate shared session-command flag parsing and config-loading context for run/resume/run-stage/analyze/publish/restore/clean/session helpers without introducing a generic command framework.
 3. Finish the publish terminology cleanup internally so public `publish` behavior is not implemented through `archive`-named files, helpers, errors, and tests.
 The codebase appears ready for a limited cleanup pass. No major architecture rewrite is warranted before 1.0.
 ## 2. High-Confidence Deduplication Opportunities
 ### Artifact Source and Publish Destination Policy Is Split Across Packages
 Affected files/packages:
 - `internal/config/validate.go`
 - `internal/artifacts/artifact_resolver.go`
 - `internal/artifacts/catalog.go`
 - `internal/stage/archive.go`
 - `internal/app/operator_helpers.go`
 - `internal/previouscache/previouscache.go`
 - `internal/stage/analyze.go`
 Duplicated or near-duplicated behavior:
 - Config validation accepts and derives destinations for `pipeline.publish.outputs[]` in `publishSourceKnown` and `derivePublishOutputDest`.
 - Publish execution derives destinations again in `resolvePublishOutputDest`.
 - Status and `artifacts list` derive destination display and remote checks in `helperPublishedOutputDest`.
 - Previous-cache hydration reconstructs candidate artifact locations from manifest outputs, published paths, and configured Scriptorium paths in `artifactRelativePathCandidates`.
 - Analyze resolves previous-session, built-in, and configured artifact sources separately in `resolveScriptoriumInput`.
 Why it matters:
 Artifact source IDs now define the public contract for analyze inputs, previous-session inputs, publish outputs, locks, status, artifacts listing, restore, and validation. When source interpretation is spread across these packages, it is easy for one path to accept, reject, or resolve a source differently from another.
 Recommended refactor:
 Create one small artifact-source policy layer, likely in `internal/artifacts` or a dependency-light sibling of `internal/artifactmodel`, that can:
 - classify source IDs as built-in, configured artifact, or previous-session configured artifact;
 - validate a source against the current Scriptorium config;
 - derive the default published destination for a source;
 - normalize relative artifact destinations;
 - return consistent display metadata for status and artifacts output.
 Then update config validation, publish execution, helper commands, previous-cache planning, and analyze input resolution to call that policy instead of deriving partial answers locally.
 Suggested tests:
 - `internal/artifacts`: source classification, configured artifact validation, default destination derivation, relative destination normalization.
 - `internal/config`: publish outputs and locks validate through the shared policy.
 - `internal/stage`: publish output resolution preserves locked, optional, required, and selected-artifact behavior.
 - `internal/app`: `artifacts list`, `status`, and locks use the same source rules as publish.
 - `internal/previouscache`: previous-session source resolution still checks manifest outputs, published paths, and configured output paths in the intended order.
 Risk level: Medium. The behavior is public, but a table-driven shared policy should reduce risk if introduced behind existing tests.
 ### Publish Terminology Cleanup Is Incomplete Internally
 Affected files/packages:
 - `internal/stage/archive.go`
 - `internal/stage/archive_test.go`
 - `internal/artifacts/archive_identity.go`
 - `internal/app/post_archive_cleanup.go`
 - `internal/app/remote_locks.go`
 - `internal/app/operator_helpers.go`
 - tests under `internal/app` and `internal/config`
 - `internal/adapters/storage/archive.go`
 Duplicated or near-duplicated behavior:
 The public contract now uses `publish`, `published`, and `publish outputs`, but several internal names still use `archive`, `promotion`, or `promoted`. Examples include `archiveStage`, `ResolveArchiveSessionPrefix`, `ResolveArchiveCurrentStateKeys`, `runPostArchiveCleanup`, `staticArchiveLocks`, `normalizeArchiveRelativePath`, and test names such as `TestArchiveUploadsRunRecordPromotionsAndCurrentPointer`.
 Why it matters:
 This is mostly clarity risk, not current behavior risk. However, public docs and config now use publish terminology, while implementation and tests still use old names. This makes code review harder and increases the chance that future work reintroduces old config or command language.
 Recommended refactor:
 Do a mechanical naming cleanup after artifact-source policy is centralized:
 - rename `internal/stage/archive.go` to a publish-oriented file and rename `archiveStage` to `publishStage`;
 - rename archive identity helpers to publish/current-state helpers while keeping S3 layout unchanged;
 - rename post-archive cleanup helpers and tests to post-publish cleanup;
 - update old comments and test failure messages that still say archive/promote when they mean publish/published;
 - leave the immutable run-history path `runs/{run_id}` unchanged.
 Suggested tests:
 - Existing `internal/stage`, `internal/app`, and `internal/artifacts` tests.
 - A final term sweep for old terminology, allowing only historical roadmap references and adapter names that are intentionally retained.
 Risk level: Low to Medium. Mostly mechanical, but broad enough to create churn.
 ### Session-Oriented CLI Parsing Is Repeated
 Affected files/packages:
 - `internal/app/run.go`
 - `internal/app/resume.go`
 - `internal/app/run_stage.go`
 - `internal/app/restore.go`
 - `internal/app/clean.go`
 - `internal/app/operator_helpers.go`
 - `internal/app/session_args.go`
 Duplicated or near-duplicated behavior:
 Many commands repeat the same flag setup and session ID handling:
 - `--config`, `--campaign`, `--campaign-file`, `--session`, and `--previous-session-id`;
 - positional session ID extraction;
 - `--session-id` compatibility through `applyParsedSessionIDArg`;
 - selected artifact parsing and validation for run/resume/analyze/publish/run-stage;
 - load through `loadCommandConfig` followed by `config.Validate`.
 Why it matters:
 The command set has recently moved toward `narratio session <subcommand> <session_id>` and shorter top-level convenience commands. Repeated parser setup makes it easy for one command to miss a new flag, use a stale help string, or apply session ID precedence differently.
 Recommended refactor:
 Keep command functions explicit, but add a small internal parser helper for common session-aware commands. Avoid a generic CLI framework. A good target is a helper that returns:
 - common config flags;
 - resolved positional/flag session ID;
 - previous session override;
 - optional selected configured artifacts;
 - normalized command-specific positional validation.
 `run-stage` can remain special because it has both stage and session positional arguments, but it should reuse the same common flag registration and selected-artifact parsing.
 Suggested tests:
 - Existing app command tests for run, resume, run-stage, analyze, publish, restore, clean, and session subcommands.
 - Focused tests for positional session ID vs `--session-id` mismatch, missing session ID, and unsupported `--artifacts` by command/stage.
 Risk level: Medium. Refactor is local to app parsing but touches many public commands.
 ### Remote Current-State Discovery Is Reimplemented in Several Forms
 Affected files/packages:
 - `internal/app/restore_discovery.go`
 - `internal/previouscache/previouscache.go`
 - `internal/app/operator_helpers.go`
 - `internal/stage/prepare_previous.go`
 - `internal/app/remote_locks.go`
 Duplicated or near-duplicated behavior:
 Several paths check or download remote current state:
 - restore discovers current run ID and current manifest, validates campaign/session identity, and decodes the manifest;
 - previous-cache planning repeats current run pointer and manifest checks for the previous session;
 - session validation checks previous current state with `Exists` calls;
 - remote lock loading separately checks and downloads `locks.yml`;
 - remote session fallback lists and downloads `session.yml`.
 Why it matters:
 These workflows are similar but not identical. Some need missing remote state to be an error, while status treats it as state. Still, the low-level sequence of key construction, `Exists`, temp download, decode, and campaign/session/run validation appears multiple times.
 Recommended refactor:
 Extract narrow app-level or artifact-level helpers for remote session state objects, not a generic storage workflow engine. Candidate helpers:
 - download object to temp safely;
 - load current run pointer and manifest for a supplied session prefix;
 - validate downloaded current manifest identity;
 - represent missing current state as a typed error so status can downgrade it while restore/prepare fail.
 Keep `storage.ObjectStore` as the boundary and keep S3 key construction in `internal/artifacts`.
 Suggested tests:
 - `internal/app`: restore current-state discovery, status missing-state behavior, session validate previous-state behavior.
 - `internal/previouscache`: required vs optional previous artifact behavior with missing current pointers/manifests.
 - `internal/app`: malformed remote lock/session data still fails closed where publish-capable execution requires it.
 Risk level: Medium. The missing-state policy differs by caller, so the refactor should centralize mechanics and typed outcomes, not final command decisions.
 ### Safe Local Deletion Policy Is Duplicated
 Affected files/packages:
 - `internal/app/clean.go`
 - `internal/app/post_archive_cleanup.go`
 Duplicated or near-duplicated behavior:
 Both `clean` and post-publish cleanup implement scoped deletion checks:
 - reject empty roots/targets;
 - resolve absolute paths;
 - refuse root deletion;
 - refuse deletion outside the configured root;
 - refuse symlink deletion;
 - handle missing targets as successful no-ops.
 Why it matters:
 Deletion policy is high-risk code. Even if the current implementations agree, future fixes should not need to be made twice.
 Recommended refactor:
 Extract a small app-level cleanup safety helper, for example `cleanup_target.go`, with functions for:
 - validating a scoped directory target;
 - validating a scoped file target;
 - validating removable children under a root.
 Keep command-specific reporting in `clean.go` and manifest metadata handling in post-publish cleanup.
 Suggested tests:
 - Move the existing focused unsafe-path tests to the shared helper.
 - Preserve `clean` dry-run tests and post-publish cleanup eligibility tests.
 Risk level: Low. This is a contained refactor with clear behavior preservation.
 ### Temp Object Download Helper Is Duplicated
 Affected files/packages:
 - `internal/app/restore_discovery.go`
 - `internal/previouscache/previouscache.go`
 - `internal/app/remote_locks.go`
 - `internal/app/config_loader.go`
 Duplicated or near-duplicated behavior:
 Multiple call sites create a temp file, close it, download an object into it, and delete it on error or defer deletion. The app package has one `downloadObjectToTemp`, while `internal/previouscache` has another copy.
 Why it matters:
 Temp-download behavior affects cleanup, error wording, and future hardening. It is not worth abstracting all storage use, but this small operation is repeated enough to centralize.
 Recommended refactor:
 Add a narrow helper close to the storage boundary. Options:
 - `internal/adapters/storage` helper only if it does not learn Narratio session semantics;
 - `internal/storageutil` if a small internal utility package is acceptable;
 - app-level helper plus a previouscache dependency inversion if the team wants to avoid a new package.
 The helper should not hide `ObjectStore`; it should only implement safe temp download mechanics.
 Suggested tests:
 - temp file cleanup on failed download;
 - successful download returns a cleaned temp path;
 - callers preserve their current contextual error messages.
 Risk level: Low.
 ## 3. Medium-Confidence Opportunities
 ### Operator Helper Implementation Is Too Broad for One File
 Affected files/packages:
 - `internal/app/operator_helpers.go`
 Duplicated or near-duplicated behavior:
 This 1,100+ line file owns session validation, status, session init, artifacts listing, locks list/add/remove, lock-store mutation, artifact catalog rendering, remote output availability, finding formatting, local input validation, and template rendering.
 Why it matters:
 The code is not inherently wrong, and keeping helper commands in `internal/app` fits the architecture. The issue is discoverability and local coupling. Small changes to one helper command require navigating unrelated helper behavior.
 Recommended refactor:
 Split by command or responsibility:
 - `session_init.go`
 - `session_validate.go`
 - `status.go`
 - `artifacts_list.go`
 - `locks.go`
 - `helper_findings.go`
 - `helper_artifacts.go`
 Do this only after higher-value policy centralization so the file split does not preserve duplicated logic under new names.
 Suggested tests:
 - Existing `internal/app/operator_helpers_test.go` can be split later, but a file split alone should not require behavior changes.
 Risk level: Low.
 ### Restore Planning Contains Its Own Remote-to-Local Path Policy
 Affected files/packages:
 - `internal/app/restore_plan.go`
 Duplicated or near-duplicated behavior:
 Restore maps remote session keys back to local session paths in `restoreLocalRelativePathForKey`, with explicit include/exclude rules for `current/`, `runs/`, `logs/`, `reports/`, `config/`, `inputs/`, `transcripts/`, `artifacts/`, `previous/`, and optional `audio/`.
 Why it may be intentional:
 Restore is the only command that should translate an entire remote session prefix into a local session subset. It has command-specific conflict and `--include-audio` semantics.
 Recommended refactor:
 Do not generalize this immediately. If it changes again, move only the remote-key-to-local-restore-scope classifier into a small helper with table-driven tests. Leave restore action classification local to restore.
 Suggested tests:
 - Restore scope tests for every included/excluded root.
 - Audio-specific conflict behavior remains separate.
 Risk level: Low.
 ### Manifest Output Scanning Is Repeated but Mostly Stage-Specific
 Affected files/packages:
 - `internal/artifacts/artifact_resolver.go`
 - `internal/previouscache/previouscache.go`
 - `internal/app/runner.go`
 Duplicated or near-duplicated behavior:
 Several call sites inspect manifest stage outputs or metadata to find artifact paths, published paths, run roots, or configured artifact outputs.
 Why it may be intentional:
 Manifest state has different meanings depending on caller: runtime artifact resolution, previous-cache reconstruction, and run summary construction are not the same policy.
 Recommended refactor:
 Avoid a broad manifest-query abstraction before 1.0. Consider adding only narrow helpers for stable metadata reads, such as reading `published_paths` from the publish stage, if the previous-cache and restore paths continue to grow.
 Suggested tests:
 - Existing manifest resolver tests plus previous-cache tests.
 Risk level: Low.
 ### Command Output Formatting Could Be More Consistent
 Affected files/packages:
 - `internal/app/operator_helpers.go`
 - `internal/app/restore_report.go`
 - `internal/app/restore_plan.go`
 - `internal/app/clean.go`
 - `internal/app/plan.go`
 Duplicated or near-duplicated behavior:
 Status, session validate, artifacts list, locks, clean dry-run, restore dry-run, and plan all render text directly with `fmt.Fprintf`.
 Why it may be intentional:
 The output remains text-only and command-specific. A generic renderer would add complexity without much value.
 Recommended refactor:
 Postpone unless user-facing inconsistencies become painful. A small findings renderer already exists for validation-style output; that is enough for now.
 Suggested tests:
 - Snapshot-style output tests only for stable operator-facing lines that support workflows.
 Risk level: Low.
 ## 4. Boundary and Responsibility Concerns
 The major boundaries are healthy:
 - `internal/adapters/storage` owns external storage implementation details.
 - App code creates object stores through `newCommandObjectStore`, which loads filesystem secrets first.
 - Stage code depends on `storage.ObjectStore`, not AWS SDK types.
 - `internal/audio` correctly centralizes S3 audio cache materialization without making the storage adapter aware of cache policy.
 - `internal/artifacts` owns most local paths and S3 keys.
 Concerns to address:
 - Artifact source policy is split between `internal/config`, `internal/artifacts`, `internal/stage`, `internal/app`, and `internal/previouscache`. This is the clearest boundary drift because source IDs are a shared public contract.
 - `internal/config` currently derives default publish destinations. Validation should be able to call source policy, but the canonical mapping itself should live outside config.
 - `internal/app/operator_helpers.go` owns artifact catalog rendering and remote published-output state. That is acceptable for formatting, but destination derivation and source classification should move out.
 - `internal/stage/archive.go` implements the public `publish` stage. This does not violate boundaries, but it creates conceptual drift.
 Recommended home for shared logic:
 - Source classification and destination derivation: `internal/artifacts` or `internal/artifactmodel` plus a small adapter from Scriptorium config.
 - Remote key construction: continue using `internal/artifacts`.
 - Object-store initialization: keep in `internal/app`.
 - Command parsing: keep in `internal/app`.
 - Stage-specific execution policy: keep in `internal/stage`.
 ## 5. Path and Remote Key Construction Review
 Local path construction is mostly centralized:
 - `internal/artifacts/paths.go` owns session work roots, run roots, spool paths, previous-cache paths, and audio cache paths.
 - Stage code often gets `artifacts.SessionPaths` and joins stage-local files from those roots, which is appropriate.
 - The previous-cache redundant nested artifact path has already been addressed by `previousArtifactCacheRelativePath`.
 Remote key construction is mostly centralized:
 - `internal/artifacts/s3_keys.go` owns session prefixes, run prefixes, audio prefixes, `session.yml`, `locks.yml`, current manifest/run pointer keys, published output keys, and run-relative keys.
 - App and stage code call these helpers rather than scattering full S3 key string concatenation.
 Areas needing cleanup:
 - `ResolveArchiveBucket`, `ResolveArchiveSessionPrefix`, `ResolveArchiveRunPrefix`, and `ResolveArchiveCurrentStateKeys` should be renamed to publish/current-state terminology.
 - `normalizeArchiveRelativePath` exists in both `internal/stage/archive.go` and `internal/previouscache/previouscache.go`; `normalizeHelperArchiveRelativePath` exists in `internal/app/operator_helpers.go`. These should converge into one helper for clean relative artifact destination paths.
 - `restore_plan.go` owns `normalizeRemoteKey` and remote key scope mapping. That may remain restore-specific, but it should be watched because it overlaps with S3 key normalization helpers.
 - `downloadObjectToTemp` exists in more than one package and can be centralized.
 ## 6. Artifact/Catalog/Source Resolution Review
 Artifact source handling has a strong foundation:
 - Transcript source IDs and paths are centralized in `internal/artifactmodel/transcripts.go`.
 - Runtime artifact registry and resolver live in `internal/artifacts/artifact_resolver.go`.
 - Configured artifact source IDs are consistently formed by `artifacts.ConfiguredArtifactSourceID`.
 - Previous-session source IDs are recognized by `artifacts.PreviousSessionArtifactName`.
 - The runtime catalog supports built-ins, configured artifacts, selected artifact execution, and availability.
 The remaining issue is that consumers still build their own partial views of this model:
 - config validation validates and derives publish output destinations;
 - publish execution resolves included outputs, skipped optional outputs, skipped unselected outputs, and locked outputs;
 - status/artifacts list derives display destinations and remote published state;
 - previous-cache planning reconstructs candidate remote paths from previous manifests and publish metadata;
 - analyze input resolution has its own missing-source messages and previous-session behavior.
 Recommendation:
 Make artifact/source resolution the next cleanup target. The goal is not to create one all-purpose resolver. The goal is to centralize the public source vocabulary and destination derivation so each caller can keep its own policy for missing/required/locked behavior.
 ## 7. Config and Command-Loading Review
 Config loading is generally consistent:
 - `loadCommandConfig` is the main command path for pipeline, campaign, session, local discovery, and remote session fallback.
 - `loadPipelineCampaignConfig` covers commands that create session config and therefore cannot load an existing session.
 - `newCommandObjectStore` correctly centralizes secret-backed object-store creation.
 - `config.LoadSessionBytesWithOptions` now rejects session templates outside `session init`, preserving strict concrete session loading.
 Intentional differences:
 - `session init` loads only pipeline and campaign because it creates `session.yml`.
 - `clean --all` loads only pipeline because it is not session-specific.
 - `status --manifest` remains a compatibility/local-manifest mode.
 Likely accidental drift to clean up:
 - Common flags and help strings are repeated across commands.
 - Some helper-command messages still say archive where they now mean publish.
 - `restore` uses `fs.SetOutput(out)` while most other command parsers discard flag package output and wrap errors themselves. This may be intentional for `--help`, but it is a difference worth documenting or standardizing.
 - App tests and helper names still contain old archive/promotion terminology, making it harder to see which public contract is current.
 ## 8. Refactors to Avoid Before 1.0
 Avoid these before release:
 - A generic workflow engine or DAG abstraction. The explicit stage list is a core design choice and is working.
 - A broad manifest query framework. Add narrow helpers only where repeated policy is clear.
 - Moving secret loading into storage adapters. Secret loading is app orchestration policy and should stay out of adapters.
 - Making storage adapters infer campaign/session/root-prefix semantics. They should continue to receive concrete keys.
 - Replacing command functions with a generic CLI framework. Small shared flag parsers are enough.
 - Generalizing all file copy/download behavior. S3 audio cache materialization is intentionally special; ordinary restore/download logic has different semantics.
 - Adding compatibility aliases for old archive/promote or old transcript names during cleanup. The repo has intentionally made hard cutovers.
 ## 9. Recommended Implementation Sequence
 1. Centralize relative artifact destination normalization and temp object download helpers.
   - Scope: low-risk shared helpers for repeated mechanics.
   - Tests: `internal/artifacts` or helper-package tests, plus existing app/stage tests.
 2. Centralize artifact source and publish-output policy.
   - Scope: source classification, source validation, default published destination derivation, destination normalization.
   - Tests: `internal/artifacts`, `internal/config`, `internal/stage -run Publish`, `internal/app -run 'Artifacts|Status|Locks'`, `internal/previouscache`.
 3. Finish publish terminology cleanup.
   - Scope: rename archive-named files/helpers/tests/comments where they now mean publish; keep S3 layout stable.
   - Tests: `go test ./internal/stage -v`, `go test ./internal/app -v`, `go test ./internal/artifacts -v`.
 4. Consolidate session-aware command parsing.
   - Scope: common config/session/artifact flag registration and session ID resolution; no public CLI behavior change.
   - Tests: app command tests for run, resume, run-stage, analyze, publish, restore, clean, session helpers.
 5. Extract remote current-state mechanics.
   - Scope: shared helpers for current run pointer/manifest load and identity validation, with typed missing-state errors.
   - Tests: restore discovery, previous-cache, status, session validate.
 6. Split operator helper implementation by responsibility.
   - Scope: file organization and small formatting/helper extraction only after policy deduplication.
   - Tests: existing `internal/app` tests.
 7. Sweep dead transitional terminology and stale tests.
   - Scope: comments, test names, old strings, internal docs that still say archive/promote where publish is now canonical.
   - Tests: final `rg` sweeps plus full test run.
 ## 10. Test Strategy
 Focused package checks for cleanup work:
 - `go test ./internal/artifacts -v`
 - `go test ./internal/config -v`
 - `go test ./internal/stage -run 'Analyze|Publish|Prepare|Restore' -v`
 - `go test ./internal/app -run 'Run|RunStage|Analyze|Publish|Restore|Clean|Status|Artifacts|Locks|Session' -v`
 - `go test ./internal/previouscache -v`
 - `go test ./internal/adapters/storage -v`
 - `go test ./internal/manifest -v`
 Tests to add or strengthen during follow-up refactors:
 - one table of valid/invalid artifact source IDs used by config validation, publish, locks, status, and analyze;
 - one table of default published destination derivation for built-in and configured artifacts;
 - relative destination normalization and path traversal rejection;
 - shared remote current-state load outcomes: missing pointer, missing manifest, malformed manifest, campaign mismatch, session mismatch, run ID mismatch;
 - shared cleanup safety helper behavior for files, directories, roots, symlinks, and outside-root paths;
 - common session command parsing behavior for positional session IDs, `--session-id`, mismatch errors, and unsupported artifacts flags.
 Full validation after each cleanup commit:
 - `go test ./...`
 Useful final searches:
 - `rg -n "archive|promote|promoted|promotion" internal docs examples cmd`
 - `rg -n "ResolveArchive|archiveStage|post_archive|staticArchive|normalizeArchive" internal`
 - `rg -n "narratio.transcript.merged|narratio.transcript.full|narratio.transcript.trimmed" internal docs examples`
 - `rg -n "previous_session_artifact|promote_artifacts|pipeline.archive" internal docs examples`
 ## 11. Appendix: Findings Not Worth Acting On
 - Stage-local path joins for files inside a stage run directory are acceptable. They are local implementation details, not shared path policy.
 - Direct `fmt.Fprintf` output in simple commands is acceptable. A generic renderer would likely obscure behavior.
 - Restore's remote-session-prefix filtering is command-specific enough to stay local unless restore scope changes again.
 - `session init` template rendering should remain separate from ordinary session loading. That separation is now a useful safety boundary.
 - S3 audio cache materialization is already centralized in `internal/audio`; do not fold it into a generic downloader.
 - Manifest-driven resume behavior should not be abstracted broadly. The explicit runner behavior is easier to audit.
--- a/docs/roadmap/cleanup.md
+++ b/docs/roadmap/cleanup.md
@@ -0,0 +1,294 @@
 # Roadmap: Pre-1.0 Code Cleanup
 Status: Implemented (Stages 1-6 complete)
 This roadmap turns the findings in `docs/roadmap/audit.md` into staged cleanup work for the 1.0 release and records completion status for each selected stage.
 The cleanup work must follow the policy documents under `docs/policy/`, especially these invariants:
 - keep Narratio explicit and stage-driven;
 - do not introduce a generic workflow engine, DAG abstraction, or generic CLI framework;
 - keep external-system details behind adapters;
 - do not move campaign/session/root-prefix semantics into storage adapters;
 - keep AWS SDK types out of app and stage logic;
 - keep path and remote key construction centralized;
 - preserve manifest-driven run state;
 - keep public CLI/config behavior stable unless a stage explicitly says it is an internal naming cleanup.
 ## Non-Goals
 - Do not change public command syntax, config schema, S3 key layout, manifest schema, or artifact source IDs as part of this cleanup.
 - Do not add compatibility aliases or migration logic.
 - Do not rewrite stage execution, manifest state transitions, or adapter contracts.
 - Do not generalize text output into a generic reporting framework.
 - Do not fold S3 audio cache behavior into a generic downloader.
 - Do not move secret loading into storage adapters.
 ## Stage 1: Shared Low-Risk Mechanics
 Goal: remove duplicated mechanics that are easy to test and should not affect public behavior.
 Implementation decisions:
 - Add one shared helper for safe relative artifact destination normalization.
  - It must reject empty paths, absolute paths, `.`, `..`, and traversal outside the artifact/session scope.
  - It must normalize separators to slash-form for artifact and S3 destination logic.
  - It must be dependency-light enough to be called from config validation, app helpers, publish execution, and previous-cache planning.
 - Add one shared object-store temp download helper.
  - It must take `context.Context`, `storage.ObjectStore`, a key, and a temp-file pattern.
  - It must create and close the temp file before download, remove the temp file on failed download, and return a cleaned local path on success.
  - It must not infer bucket, campaign, session, run, or root-prefix semantics.
 - Extract shared cleanup target validation for local deletion.
  - Cover scoped directory deletion, scoped file deletion, and removable children under a root.
  - Preserve existing safety rules: reject empty roots/targets, root deletion, outside-root paths, symlinks, and wrong target types.
  - Keep command-specific output in `clean` and manifest metadata handling in post-publish cleanup.
 Expected callers:
 - replace duplicate relative destination normalization in publish execution, helper command rendering, and previous-cache planning;
 - replace duplicate temp download helpers in app and previous-cache code;
 - replace duplicate scoped deletion validation in clean and post-publish cleanup.
 Tests:
 - Add focused tests for destination normalization and path traversal rejection.
 - Add temp download tests for success, failed download cleanup, and preserved contextual caller errors.
 - Add shared cleanup validation tests for directories, files, symlinks, missing targets, root deletion, and outside-root targets.
 - Run:
  - `go test ./internal/artifacts -v`
  - `go test ./internal/adapters/storage -v`
  - `go test ./internal/app -run 'Clean|Post' -v`
  - `go test ./...`
 Completion criteria:
 - duplicated low-level mechanics are removed;
 - public behavior and output are unchanged;
 - no stage, command, or config semantics move into storage adapters.
 ## Stage 2: Artifact Source and Published Output Policy
 Goal: make artifact source IDs and published-output destination derivation a single shared policy.
 Implementation decisions:
 - Introduce `internal/artifactpolicy` as the shared source policy package.
  - This package is the long-term home because it avoids config/artifacts import cycles.
  - It may depend on dependency-light model packages, but it must not depend on app, stage, manifest stores, storage adapters, or downstream adapters.
 - Centralize these behaviors in `internal/artifactpolicy`:
  - classify source IDs as built-in, configured artifact, or previous-session configured artifact;
  - parse configured artifact keys from `narratio.artifact.<key>`;
  - parse previous-session artifact keys from `narratio.previous_session.artifact.<key>`;
  - validate configured artifact sources against `pipeline.scriptorium.artifacts`;
  - validate publish lock/output sources;
  - derive default published destinations for built-in and configured artifact sources;
  - normalize safe relative published-output destinations.
 - Update callers to consume the shared policy:
  - config validation for `publish.outputs` and `publish.locks`;
  - publish-stage output resolution;
  - status and `artifacts list` rendering;
  - locks list/add/remove validation;
  - analyze input source handling;
  - previous-cache candidate planning.
 - Preserve caller-specific policy at call sites.
  - Required vs optional behavior remains in publish, analyze, restore, and previous-cache callers.
  - Locked output behavior remains in publish.
  - Text formatting remains in app commands.
  - Manifest path scanning remains in artifact/previous-cache logic unless directly tied to source policy.
 Tests:
 - Add `internal/artifactpolicy` table tests for source classification, configured artifact validation, previous-session parsing, default destination derivation, and destination normalization.
 - Update `internal/config` tests so publish outputs and locks validate through the shared policy.
 - Update `internal/stage` publish tests for selected, unselected, optional, required, and locked output behavior.
 - Update `internal/app` tests for status, artifacts list, and locks.
 - Update `internal/previouscache` tests for previous-session candidate ordering.
 - Run:
  - `go test ./internal/artifacts -v`
  - `go test ./internal/config -v`
  - `go test ./internal/stage -run 'Analyze|Publish' -v`
  - `go test ./internal/app -run 'Artifacts|Status|Locks' -v`
  - `go test ./internal/previouscache -v`
  - `go test ./...`
 Completion criteria:
 - artifact source vocabulary and destination derivation are no longer reimplemented in config, app, stage, and previous-cache packages;
 - every caller still owns its own missing/required/optional/locked decision;
 - public behavior is unchanged.
 ## Stage 3: Publish Terminology Cleanup
 Goal: align internal implementation names with the public publish contract.
 Implementation decisions:
 - Rename archive-named internal files, types, helpers, comments, and tests that now implement publish behavior.
 - Replace names such as:
  - `archiveStage` with `publishStage`;
  - `ResolveArchiveSessionPrefix` with publish/current-state terminology;
  - `ResolveArchiveRunPrefix` with publish/run-history terminology;
  - `ResolveArchiveCurrentStateKeys` with current-state terminology;
  - `runPostArchiveCleanup` with post-publish cleanup terminology;
  - `staticArchiveLocks` with publish lock terminology.
 - Keep the S3 layout stable:
  - `{session_prefix}/runs/{run_id}/`;
  - `{session_prefix}/current/manifest.json`;
  - `{session_prefix}/current/run_id.txt`;
  - `{session_prefix}/locks.yml`.
 - Keep the public stage name `publish`.
 - Keep old archive/promote references only where they are historical roadmap context or intentionally describe immutable run history.
 Tests and checks:
 - Run:
  - `go test ./internal/stage -v`
  - `go test ./internal/app -v`
  - `go test ./internal/artifacts -v`
  - `go test ./...`
 - Run stale-term sweeps:
  - `rg -n "archive|promote|promoted|promotion" internal docs examples cmd`
  - `rg -n "ResolveArchive|archiveStage|post_archive|staticArchive|normalizeArchive" internal`
 Completion criteria:
 - public publish behavior is no longer implemented through archive/promote names;
 - remaining old terms are intentionally historical, test-fixture bucket names, or roadmap-only context;
 - no config, CLI, manifest, or S3 layout changes are introduced.
 ## Stage 4: Session Command Parsing Consolidation
 Goal: reduce command-loading drift while keeping command handlers explicit.
 Implementation decisions:
 - Add a small app-level parser helper for common session-aware commands.
 - Centralize:
  - common config flags: `--config`, `--campaign`, `--campaign-file`, `--session`;
  - positional session ID handling;
  - `--session-id` compatibility;
  - `--previous-session-id`;
  - optional selected-artifact parsing for commands that support it.
 - Keep command handlers explicit and readable.
 - Do not introduce a generic CLI framework.
 - Treat these as intentional special cases:
  - `session init` loads pipeline and campaign but not session;
  - `clean --all` loads pipeline only;
  - `status --manifest` remains local-manifest mode;
  - `run-stage` keeps its stage-name positional handling but reuses common flag parsing where practical.
 - Standardize flag help text where commands use the same semantics.
 Tests:
 - Update app command tests for:
  - positional session ID;
  - `--session-id`;
  - positional/flag mismatch;
  - missing session ID;
  - `--previous-session-id`;
  - unsupported `--artifacts` by command/stage;
  - unchanged behavior for `session init`, `clean --all`, and `status --manifest`.
 - Run:
  - `go test ./internal/app -run 'Run|RunStage|Analyze|Publish|Restore|Clean|Session' -v`
  - `go test ./internal/app -v`
  - `go test ./...`
 Completion criteria:
 - shared session flag/session ID behavior has one implementation;
 - command handlers remain command-specific;
 - public command syntax and output stay unchanged.
 ## Stage 5: Remote Current-State Mechanics
 Goal: centralize remote current-state loading mechanics without hiding caller policy.
 Implementation decisions:
 - Extract narrow helpers for remote current state.
  - Load current run pointer through `storage.ObjectStore`.
  - Load and decode current manifest through `storage.ObjectStore`.
  - Validate campaign, session, and run identity when requested by the caller.
  - Return typed missing-state errors.
 - Preserve caller policy:
  - restore treats missing or invalid current state as an error;
  - previous-cache hydration fails for required previous artifacts and skips optional missing artifacts;
  - status reports missing remote state as state, not command failure;
  - session validate emits findings and fails only for error findings.
 - Keep all remote key construction in `internal/artifacts`.
 - Keep object-store initialization in `internal/app`.
 - Do not add storage adapter knowledge of campaigns, sessions, runs, root prefixes, current state, or manifests.
 Tests:
 - Add helper tests for:
  - missing current run pointer;
  - missing current manifest;
  - empty run pointer;
  - malformed manifest;
  - campaign mismatch;
  - session mismatch;
  - run ID mismatch.
 - Update restore, previous-cache, status, and session validate tests to prove their caller-specific behavior is unchanged.
 - Run:
  - `go test ./internal/app -run 'Restore|Status|SessionValidate' -v`
  - `go test ./internal/previouscache -v`
  - `go test ./...`
 Completion criteria:
 - low-level remote current-state mechanics are shared;
 - missing-state behavior remains caller-specific;
 - storage adapter boundaries remain unchanged.
 ## Stage 6: Operator Helper File Split and Final Sweep
 Goal: improve maintainability after shared policy and mechanics are already centralized.
 Implementation decisions:
 - Split the large operator helper implementation by command or responsibility.
 - Suggested file grouping:
  - session init;
  - session validate;
  - status;
  - artifacts list;
  - locks;
  - helper findings;
  - helper artifact rendering.
 - Do not change command syntax, text output, config loading, remote loading, lock behavior, or artifact catalog behavior during the split.
 - Keep output formatting text-only and command-specific unless a concrete inconsistency remains after the split.
 - Update roadmap status notes after each completed stage.
 Tests and checks:
 - Run:
  - `go test ./internal/app -v`
  - `go test ./...`
 - Final searches:
  - `rg -n "archive|promote|promoted|promotion" internal docs examples cmd`
  - `rg -n "narratio.transcript.merged|narratio.transcript.full|narratio.transcript.trimmed" internal docs examples`
  - `rg -n "previous_session_artifact|promote_artifacts|pipeline.archive" internal docs examples`
 Completion criteria:
 - operator helper code is easier to navigate;
 - stale implementation terminology is removed or intentionally documented;
 - no behavior changes are introduced by file organization.
 ## Overall Validation
 After each implementation stage:
 - run the focused tests listed for that stage;
 - run `go test ./...`;
 - run `git status --short`;
 - update this roadmap to mark the completed stage implemented only after code, tests, and documentation are aligned.
 ## Assumptions
 - This roadmap is a cleanup plan, not a feature plan.
 - Stages may be implemented as separate prompts/commits.
 - `internal/artifactpolicy` is the chosen home for shared source policy.
 - Shared object-store temp download helpers must not learn Narratio session semantics.
 - Public behavior must remain stable unless a stage explicitly says it is internal terminology cleanup.
--- a/docs/roadmap/documentation-stage1-audit.md
+++ b/docs/roadmap/documentation-stage1-audit.md
@@ -0,0 +1,105 @@
 # Documentation Pass: Stage 1 Audit
 Status: Completed (2026-05-23)
 ## Scope Reviewed
 - All non-policy documentation files under `docs/`
 - `README.md`
 - Documentation references to maintained `examples/` files
 - Documentation-related expectations in tests under `internal/**`
 ## File Inventory and Canonical Scope
 | File | Intended audience | Canonical scope (per policy) | Primary source-of-truth anchors |
 | --- | --- | --- | --- |
 | `README.md` | Users, operators | Project orientation and links | `cmd/narratio`, `internal/app/commands.go`, docs index files |
 | `docs/cli.md` | Users, operators | CLI syntax, flags, command workflows | `internal/app/*.go`, `internal/app/*_test.go` |
 | `docs/config.md` | Operators, advanced users | Config discovery, schema, defaults, examples | `internal/config/*.go`, `internal/config/*_test.go`, `examples/*` |
 | `docs/operations.md` | Operators | Run/resume/publish/restore/cleanup workflows | `internal/app/runner.go`, `internal/app/restore*.go`, `internal/stage/archive.go`, `internal/artifacts/*.go` |
 | `docs/troubleshooting.md` | Operators | Failure diagnosis and safe fixes | `internal/app`, `internal/stage`, related tests |
 | `docs/internal/README.md` | Developers, LLM coding agents | Internal docs index and scope boundaries | `docs/internal/*.md`, policy docs |
 | `docs/internal/adapters.md` | Developers, LLM coding agents | Adapter boundaries and ownership | `internal/adapters/*`, `internal/stage/*` |
 | `docs/internal/artifacts.md` | Developers, LLM coding agents | Artifact catalog and source resolution contracts | `internal/artifacts/*`, `internal/stage/analyze.go`, `internal/stage/prepare_previous.go` |
 | `docs/internal/command-restore.md` | Developers, LLM coding agents | Restore command architecture and contracts | `internal/app/restore*.go`, `internal/app/restore*_test.go` |
 | `docs/internal/manifest.md` | Developers, LLM coding agents | Session/run manifest contracts and transitions | `internal/manifest/*`, `internal/app/runner.go`, `internal/stage/*` |
 | `docs/internal/stage-prepare.md` | Developers, LLM coding agents | Prepare stage IO and invariants | `internal/stage/prepare.go`, `internal/stage/prepare*_test.go` |
 | `docs/internal/stage-transcribe.md` | Developers, LLM coding agents | Transcribe stage IO and invariants | `internal/stage/transcribe.go`, `internal/stage/transcribe_test.go` |
 | `docs/internal/stage-merge.md` | Developers, LLM coding agents | Merge stage IO and invariants | `internal/stage/merge.go`, `internal/stage/merge_test.go` |
 | `docs/internal/stage-polish.md` | Developers, LLM coding agents | Polish stage IO and invariants | `internal/stage/polish.go`, `internal/stage/polish_test.go` |
 | `docs/internal/stage-normalize.md` | Developers, LLM coding agents | Normalize stage IO and invariants | `internal/stage/normalize.go`, `internal/stage/normalize_test.go` |
 | `docs/internal/stage-trim.md` | Developers, LLM coding agents | Trim stage IO and invariants | `internal/stage/trim.go`, `internal/stage/trim_test.go` |
 | `docs/internal/stage-analyze.md` | Developers, LLM coding agents | Analyze stage artifact execution and selection | `internal/stage/analyze.go`, `internal/stage/analyze_test.go` |
 | `docs/internal/stage-publish.md` | Developers, LLM coding agents | Publish-stage commit/upload invariants | `internal/stage/archive.go`, `internal/stage/archive_test.go` |
 | `docs/internal/storage.md` | Developers, LLM coding agents | Storage adapter contracts and semantics | `internal/adapters/storage/*`, `internal/app/object_store.go` |
 | `docs/internal/workspace.md` | Developers, LLM coding agents | Local workspace/session/run path model | `internal/artifacts/*`, `internal/app/runner.go`, `internal/stage/run_local.go` |
 | `docs/integrations/README.md` | Developers, LLM coding agents | Integration docs index | `docs/integrations/*.md` |
 | `docs/integrations/audita.md` | Developers, integration maintainers | Audita adapter contract | `internal/adapters/audita/*`, `internal/stage/polish.go` |
 | `docs/integrations/seriatim.md` | Developers, integration maintainers | Seriatim adapter contract | `internal/adapters/seriatim/*`, `internal/stage/merge.go`, `internal/stage/normalize.go`, `internal/stage/trim.go` |
 | `docs/integrations/scriptorium.md` | Developers, integration maintainers | Scriptorium adapter contract | `internal/adapters/scriptorium/*`, `internal/stage/analyze.go`, `internal/stage/trim.go` |
 | `docs/roadmap/documentation.md` | Developers, maintainers | Planning and implementation sequencing for documentation pass | N/A (planning artifact) |
 | `docs/roadmap/documentation-stage1-audit.md` | Developers, maintainers | Stage-1 inventory and source-of-truth audit record | N/A (planning artifact) |
 ## Source-of-Truth Mapping Summary
 - CLI behaviors and command names are grounded in `internal/app/commands.go` and command handlers in `internal/app/*.go`.
 - Stage order and canonical stage names are grounded in `internal/stage/placeholders.go` (`prepare` -> `transcribe` -> `merge` -> `polish` -> `normalize` -> `trim` -> `analyze` -> `publish` -> `notify`).
 - Publish behavior and current-pointer commit semantics are grounded in `internal/stage/archive.go`.
 - Config schema/defaults/validation are grounded in `internal/config/*`.
 - Local/remote paths, publish keys, and workspace layout are grounded in `internal/artifacts/*`.
 - Restore behavior and report contracts are grounded in `internal/app/restore*.go`.
 - Maintained examples and schema compatibility are grounded in `examples/*` plus `internal/config/load_validate_test.go` (`TestExamplesLoadAndValidate`).
 ## Findings
 ### Broken or stale references
 1. `README.md` linked to non-existent files:
   - `docs/development.md`
   - `docs/architecture.md`
 2. `docs/internal/README.md` and `docs/integrations/README.md` linked to non-existent path:
   - `docs/documentation/policy.md`
 Stage-1 fix applied:
 - Updated those links to existing policy docs under `docs/policy/`.
 ### Stale terminology sweep
 Sweep terms used: `archive`, `promote`, `promoted`, `promote_artifacts`, `run-stage archive`.
 Findings:
 - User-facing docs in scope did not show obvious stale command examples requiring immediate correction.
 - Internal code and tests still contain historical `archive` identifiers while user-facing command/stage naming is `publish` (for example, `internal/stage/archive.go` type names). This is acceptable for now but should be normalized deliberately, not incidentally.
 Stage-1 fix applied:
 - Updated clearly stale publish-related wording in test expectation messages/comments:
  - `internal/app/commands_test.go`
  - `internal/app/operator_helpers_test.go`
 ### Example path validation
 - All `examples/...` paths referenced from non-policy docs resolve to existing files.
 - `internal/config/load_validate_test.go` includes `TestExamplesLoadAndValidate` and points to current example files.
 ### Roadmap leakage into current-behavior docs
 - No obvious roadmap-only behavior leakage found in non-roadmap docs during this sweep.
 ### Duplicate content and scope drift
 - No severe duplication requiring immediate rewrite in this stage.
 - Existing docs still need full content rewrite for 1.0 readiness in later stages (user/operator first, then internal/integrations), as planned.
 ### Canonical-home inconsistency to resolve in rewrite stages
 - Policy canonical-home language names `docs/architecture.md` and `docs/development.md`, while current repository stores those policy documents under `docs/policy/`.
 - Stage 1 preserves repository behavior by fixing broken links to existing files. Later rewrite stages should converge canonical-home paths and references consistently across docs.
 ## Stage-1 Completion Check
 Completed for this stage:
 - Full non-policy file inventory with audience and scope mapping.
 - Source-of-truth crosswalk to code/tests.
 - Stale-term, link, and example-path sweeps.
 - Documentation-related stale test wording corrections.
 - Minimal fixes only; broad rewrites intentionally deferred.
--- a/docs/roadmap/documentation.md
+++ b/docs/roadmap/documentation.md
@@ -0,0 +1,237 @@
 # Roadmap: 1.0 Documentation Pass
 Status: Completed (2026-05-23)
 ## Goal
 Prepare Narratio documentation for a 1.0 release by reviewing and rewriting
 every non-policy document under `docs/` against the implemented codebase.
 The finished documentation set should be accurate, concise, complete for its
 audience, and compliant with:
 - `docs/policy/documentation.md`
 - `docs/policy/architecture.md`
 - `docs/policy/development.md`
 Do not modify files under `docs/policy/` during this pass.
 Current behavior belongs in canonical docs. Future, planned, aspirational, or
 unimplemented behavior belongs only under `docs/roadmap/`.
 ## Scope
 In scope:
 - `docs/*.md`
 - `docs/internal/*.md`
 - `docs/integrations/*.md`
 - `docs/roadmap/*.md`
 - documentation references to files under `examples/`
 - test expectation fixes when the documentation review exposes stale or
  incorrect doc/example/path expectations
 Out of scope:
 - product/runtime code changes
 - feature implementation
 - edits under `docs/policy/`
 - adding roadmap behavior to current-behavior docs before that behavior is
  implemented
 ## Implementation Stages
 ### Stage 1: Inventory and Source-of-Truth Audit
 Status: Completed (2026-05-23)
 Create a file-by-file inventory of all non-policy docs before rewriting.
 Implementation requirements:
 - List every non-policy documentation file and assign its intended audience.
 - Identify each document's canonical scope using `docs/policy/documentation.md`.
 - Compare docs against the current code and tests, especially:
  - `internal/app`
  - `internal/config`
  - `internal/stage`
  - `internal/artifacts`
  - `examples`
  - relevant tests under `internal/**`
 - Record stale terminology, broken links, stale example paths, duplicate
  content, and roadmap-only behavior that leaked into current-behavior docs.
 - Record stale test expectations related to docs, examples, paths, or command
  text.
 - Do not rewrite content in this stage except obvious broken links or test
  corrections needed to make documentation validation meaningful.
 Acceptance criteria:
 - The rewrite has a concrete file inventory and source-of-truth map.
 - The team knows which docs are canonical and which should link elsewhere.
 - Known stale terms and broken references are identified before broad edits.
 ### Stage 2: User and Operator Docs
 Status: Completed (2026-05-23)
 Rewrite the user-facing and operator-facing docs first.
 Implementation requirements:
 - Rewrite these docs as fresh, concise current-behavior references:
  - `README.md`, if present
  - `docs/cli.md`
  - `docs/config.md`
  - `docs/operations.md`
  - `docs/troubleshooting.md`
 - Verify every command, flag, config field, discovery rule, path, and workflow
  against implemented behavior.
 - Cover implemented 1.0 behavior, including:
  - campaign registry selection;
  - concrete session loading and template-driven `session init`;
  - session-oriented helper commands;
  - clean, restore, analyze, and publish workflows;
  - artifact selection behavior;
  - locks and published output behavior;
  - workspace, spool, and cache behavior;
  - secrets loading and S3-backed operation.
 - Keep examples short and link to maintained files under `examples/` instead
  of duplicating large config blocks.
 - Fix tests only when they assert stale doc paths, example paths, command
  names, or current-behavior text.
 Acceptance criteria:
 - User/operator docs are task-oriented and match actual CLI/config behavior.
 - Current-behavior docs do not depend on roadmaps for normal usage.
 - No current-behavior doc describes unimplemented roadmap items.
 ### Stage 3: Internal Developer Docs
 Status: Completed (2026-05-23)
 Rewrite implemented internal component docs after public docs stabilize.
 Implementation requirements:
 - Rewrite:
  - `docs/internal/README.md`
  - `docs/internal/adapters.md`
  - `docs/internal/artifacts.md`
  - `docs/internal/command-restore.md`
  - `docs/internal/manifest.md`
  - `docs/internal/stage-*.md`
  - `docs/internal/storage.md`
  - `docs/internal/workspace.md`
 - Verify stage docs against current stage names, stage ordering, manifest
  records, declared inputs/outputs, adapters, path helpers, storage behavior,
  publish/current-state behavior, restore behavior, cache behavior, and
  workspace cleanup.
 - Keep implementation details in `docs/internal/`, not in user-facing docs.
 - Avoid turning internal docs into duplicate config or CLI references; link to
  canonical docs when needed.
 Acceptance criteria:
 - Internal docs are accurate enough for developers and LLM coding agents to
  change the system safely.
 - Stage and adapter boundaries match `docs/policy/architecture.md`.
 - Manifest, path, storage, and publish invariants are explicit and current.
 ### Stage 4: Integrations and Examples
 Status: Completed (2026-05-23)
 Review integration docs and maintained examples after core docs are rewritten.
 Implementation requirements:
 - Rewrite:
  - `docs/integrations/README.md`
  - `docs/integrations/audita.md`
  - `docs/integrations/scriptorium.md`
  - `docs/integrations/seriatim.md`
 - Verify integration docs against current adapter contracts and expected
  downstream tool behavior.
 - Confirm every referenced example file exists.
 - Confirm examples match current schema and command usage.
 - Run or rely on example validation tests.
 - Fix tests when they reference moved, renamed, or intentionally retired
  examples.
 Acceptance criteria:
 - Integration docs describe only implemented adapter expectations.
 - Maintained examples are valid, secret-free, and linked from canonical docs.
 - Example validation tests reflect the documented example set.
 ### Stage 5: Roadmap Cleanup and Final Sweep
 Status: Completed (2026-05-23)
 Clean up roadmap state and run final documentation validation.
 Implementation requirements:
 - Review `docs/roadmap/**` for implemented items that should be marked
  implemented, retired, or left planned.
 - Keep historical and planned behavior in roadmaps only.
 - Run final link/path/term sweeps.
 - Run validation commands:
  - `go test ./internal/config -run TestExamplesLoadAndValidate -v`
  - `go test ./internal/app -run TestExecute -v`
  - `go test ./...`
 Acceptance criteria:
 - All non-policy docs are current for the 1.0 release.
 - Roadmaps do not serve as required user/operator documentation.
 - Tests pass after allowed documentation-related test expectation fixes.
 ## Required Checks
 Run searches for stale terminology and references during the pass.
 Stale terminology:
 - `archive`
 - `promote`
 - `promoted`
 - `promote_artifacts`
 - legacy campaign path/discovery language
 - old transcript names and paths
 - removed CLI commands or aliases
 Broken or stale references:
 - missing local doc links;
 - stale `examples/` paths;
 - stale internal doc filenames;
 - references to `docs/policy/**` as editable targets;
 - command examples that no longer match the CLI.
 Policy checks:
 - Current-behavior docs mention only implemented behavior.
 - Planned behavior appears only under `docs/roadmap/`.
 - Docs do not expose raw secrets or recommend storing secrets in config.
 - Docs use canonical homes:
  - `docs/config.md` for config schema;
  - `docs/cli.md` for command syntax;
  - `docs/operations.md` for operator workflows;
  - `docs/troubleshooting.md` for failure diagnosis;
  - `docs/internal/` for implementation contracts;
  - `docs/integrations/` for downstream tool integration notes;
  - `docs/roadmap/` for future work.
 ## Assumptions
 - `docs/policy/**` is read-only for this documentation pass.
 - This pass is for 1.0 release readiness, not feature implementation.
 - Product and runtime code changes are out of scope.
 - Test fixes are in scope when they correct stale documentation, example, path,
  command, or current-behavior expectations uncovered during the review.
 - Roadmap files may remain as planning and historical records.
 - Current-behavior docs must be sufficient for normal use without requiring
  readers to consult roadmaps.
--- a/docs/roadmap/operations.md
+++ b/docs/roadmap/operations.md
@@ -1,52 +0,0 @@
 # Roadmap: Operator Helper Commands
 ## Status
 Implemented.
 The operator helper command set is no longer conceptual. Current behavior is documented in:
 - `docs/cli.md`
 - `docs/operations.md`
 - `docs/config.md`
 - `docs/internal/artifacts.md`
 - `docs/internal/stage-archive.md`
 ## Implemented Commands
 - `narratio session validate`
 - `narratio status --manifest <path>`
 - `narratio status --session-id <id>`
 - `narratio session init --output <path>`
 - `narratio session init --remote`
 - `narratio artifacts list`
 - `narratio artifacts list --remote`
 - `narratio locks`
 - `narratio locks add <source>`
 - `narratio locks remove <source>`
 ## Implemented Decisions
 - Helper output is text-only. No JSON schema exists yet.
 - `status` remains a top-level command.
 - `session validate`, `session init`, and `artifacts list` are nested helper commands.
 - `locks` is the single top-level command for listing, adding, and removing archive promotion locks.
 - Remote session initialization requires explicit `--remote`.
 - Local session initialization requires `--output`.
 - Remote artifact availability is opt-in with `artifacts list --remote`.
 - Mutable locks are source-based and stored at `{session_prefix}/locks.yml`.
 - The remote lock store uses strict YAML with top-level `locks`.
 - Static `pipeline.archive.locks` and remote locks are merged; static locks win on duplicate sources.
 - `locks remove` removes only remote locks.
 - Ordinary execution `--force` does not override locks.
 - Remote lock writes use existence checks and `--force` for updates; there is no compare-and-swap protection.
 ## Remaining Future Enhancements
 These are intentionally not implemented:
 - `--json` output for helper commands.
 - Optimistic concurrency or ETag compare-and-swap for remote lock mutations.
 - Rich remote artifact availability across historical run-local objects.
 - Session-lock acquisition for remote mutation helpers.
 - Broader campaign helper commands such as `campaign validate` or `campaign publish`.
--- a/docs/troubleshooting.md
+++ b/docs/troubleshooting.md
@@ -1,380 +1,273 @@
 # Troubleshooting
-## Purpose
+Operational diagnosis guide for common Narratio failures.
 Canonical operator troubleshooting guide for recurring implemented Narratio failures.
-## Config file discovery failure
+## Config file not found
 Symptom:
 - `run`, `plan`, `resume`, `run-stage`, or `restore` fails with config/session not found.
-Likely Cause:
+- command fails to resolve `pipeline.yml`, `campaign.yml`, or `session.yml`.
- `pipeline.yml`, `campaign.yml`, or `session.yml` is missing from system discovery paths.
+
- a local working-directory config file was not passed explicitly.
+Likely causes:
 - missing files in default search paths;
 - wrong campaign selection;
 - omitted explicit flags.
 Diagnostics:
 ```bash
-ls -l /usr/local/etc/narratio/pipeline.yml /etc/narratio/pipeline.yml
+narratio session plan 2026-04-04
 ls -l /usr/local/etc/narratio/campaign.yml /etc/narratio/campaign.yml
 ls -l /usr/local/etc/narratio/session.yml /etc/narratio/session.yml
 ```
-Safe Fix:
+Safe fix:
 - pass explicit `--config`, `--campaign`, and `--session`.
 - or place files in documented discovery paths.
-Links:
+- pass explicit `--config`, `--campaign` or `--campaign-file`, and `--session`.
 - [docs/config.md](./config.md)
 - [docs/cli.md](./cli.md)
-## Session template rendering failure
+## Session template placeholders rejected
 Symptom:
 - load fails with unresolved placeholder or `session_id` mismatch.
-Likely Cause:
+- load error says session file must be concrete or contains `{{ ... }}` placeholders.
- templated `session.yml` used without `--session-id`.
+
- rendered `session_id` differs from passed `--session-id`.
+Likely cause:
 - using template content as runtime session config.
 Diagnostics:
 ```bash
-narratio plan --config /path/to/pipeline.yml --campaign /path/to/campaign.yml --session ./session.yml --session-id 2026-04-04
+narratio session validate 2026-04-04 --session /path/session.yml
 ```
-Safe Fix:
+Safe fix:
 - pass `--session-id` when template placeholders are present.
 - ensure rendered `session_id` matches intended run session id.
-Links:
+- generate concrete session YAML with `narratio session init`.
 - [docs/config.md](./config.md)
-## Strict YAML decode or validation failure
+## Strict decode or schema validation failure
 Symptom:
 - config load fails with unknown field or validation error.
-Likely Cause:
+- unknown field / invalid value error during config load.
- typo/stale field name.
+
- missing required fields or invalid constraints.
+Likely cause:
 - stale field name, typo, invalid enum, or invalid duration/path format.
 Diagnostics:
 ```bash
-narratio plan --config /path/to/pipeline.yml --campaign /path/to/campaign.yml --session /path/to/session.yml --session-id 2026-04-04
+narratio session plan 2026-04-04 --config /path/pipeline.yml --campaign-file /path/campaign.yml --session /path/session.yml
 ```
-Safe Fix:
+Safe fix:
 - align fields/values to canonical config reference and examples.
-Links:
+- align config with [docs/config.md](./config.md) and maintained files under `examples/`.
 - [docs/config.md](./config.md)
 - [examples/](../examples/)
-## `--artifacts` selection failure
+## Audio mode conflict
 Symptom:
 - `run`/`resume`/`run-stage` fails with invalid or unknown artifact selection.
-Likely Cause:
+- validation fails on session audio configuration.
- `--artifacts` contains blank names or unknown artifact keys.
+
- `pipeline.scriptorium.artifacts` missing while using `--artifacts`.
+Likely cause:
 - configured both local and S3 session audio inputs.
 Safe fix:
 - use local mode (`audio_dir` or `audio_files`) or S3 mode (`audio_s3.prefix`), not both.
 ## `--artifacts` selection error
 Symptom:
 - unknown artifact key or invalid `--artifacts` usage.
 Likely causes:
 - key not defined in `pipeline.scriptorium.artifacts`;
 - empty list entry (for example trailing comma);
 - `run-stage` used with non-`analyze`/`publish` target.
 Safe fix:
 - provide only configured keys and use `--artifacts` with supported commands/stages.
 ## Previous-session artifact input missing
 Symptom:
 - prepare/analyze fails due to missing required previous-session artifact cache input.
 Likely causes:
 - missing `session.previous_session_id`;
 - previous artifact not restored/published for source session.
 Diagnostics:
 ```bash
-narratio run --config /path/to/pipeline.yml --campaign /path/to/campaign.yml --session /path/to/session.yml --session-id 2026-04-04 --artifacts player_handout
+narratio session validate 2026-04-04
 narratio session status 2026-04-04
 ```
-Safe Fix:
+Safe fix:
 - use configured artifact keys only.
 - ensure `pipeline.scriptorium.artifacts` is defined.
 Links:
 - [docs/cli.md](./cli.md)
 - [docs/config.md](./config.md)
 ## `run-stage --artifacts` on non-analyze stage
 Symptom:
 - `run-stage` fails with `--artifacts is only supported for stage "analyze"`.
 Likely Cause:
 - `--artifacts` was used with a non-`analyze` stage.
 Diagnostics:
 ```bash
-narratio run-stage --config /path/to/pipeline.yml --campaign /path/to/campaign.yml --session /path/to/session.yml --session-id 2026-04-04 --artifacts session_recap polish
+narratio session restore 2026-04-04
 ```
-Safe Fix:
+or rerun prepare after correcting session config:
 - use `--artifacts` only with `run-stage ... analyze`.
 Links:
 - [docs/cli.md](./cli.md)
 ## Configured artifact dependency/input validation failure
 Symptom:
 - config validation fails for `depends_on`, `narratio.artifact.<name>` source, or artifact output path.
 Likely Cause:
 - `narratio.artifact.<name>` source missing matching `depends_on` key.
 - dependency references unknown artifact key.
 - dependency self-reference or enabled dependency cycle.
 - artifact output path missing/invalid/outside `artifacts/` root.
 Diagnostics:
 ```bash
-narratio plan --config /path/to/pipeline.yml --campaign /path/to/campaign.yml --session /path/to/session.yml --session-id 2026-04-04
+narratio run-stage prepare 2026-04-04 --force
 ```
 Safe Fix:
 - ensure artifact-to-artifact inputs have explicit `depends_on` entries using artifact keys.
 - ensure referenced artifacts exist and define valid `output_path` values.
 - keep output paths relative and under `artifacts/`.
 Links:
 - [docs/config.md](./config.md)
 - [docs/internal/stage-analyze.md](./internal/stage-analyze.md)
 ## Required configured artifact input unavailable at analyze time
 Symptom:
 - analyze fails because configured input source is unavailable.
 Likely Cause:
 - required upstream configured artifact was not selected/executed this run.
 - non-executable dependency output file is missing or invalid on disk.
 Diagnostics:
 ```bash
 narratio status --manifest /path/to/manifest.json
 narratio run-stage --config /path/to/pipeline.yml --campaign /path/to/campaign.yml --session /path/to/session.yml --session-id 2026-04-04 --artifacts player_handout analyze
 ```
 Safe Fix:
 - run analyze with needed artifacts selected.
 - or ensure dependency output file exists at configured path and is valid.
 Links:
 - [docs/operations.md](./operations.md)
 - [docs/config.md](./config.md)
 ## Manifest/status path failure
 Symptom:
 - `status` fails because manifest path is missing, unreadable, or invalid.
 Likely Cause:
 - wrong manifest path.
 - manifest removed after cleanup.
 - `--manifest` omitted.
 Diagnostics:
 ```bash
 narratio status --manifest /path/to/manifest.json
 ls -l /path/to/manifest.json
 ```
 Safe Fix:
 - use manifest path printed by `run`, `resume`, or `run-stage`.
 Links:
 - [docs/cli.md](./cli.md)
 - [docs/operations.md](./operations.md)
 ## Session lock conflict (`.lock`)
 Symptom:
 - `run`, `resume`, `run-stage`, or `restore` fails with lock conflict for session workdir.
-Likely Cause:
+- command fails acquiring session lock.
- another Narratio process is running same session.
+
- stale lock from interrupted prior run.
+Likely causes:
 - another process is running for the same session;
 - stale lock left by interrupted process.
 Diagnostics:
 ```bash
 ls -l {workspace.root}/work/{campaign}/{session_id}/.lock
 cat {workspace.root}/work/{campaign}/{session_id}/.lock
 ps aux | grep narratio
 ```
-Safe Fix:
+Safe fix:
 - wait for active process to finish.
 - if no process is active, remove only stale session `.lock` file.
-Links:
+- wait for active process completion;
- [docs/operations.md](./operations.md)
+- remove stale lock only after confirming no live process owns it.
 - [docs/internal/workspace.md](./internal/workspace.md)
 ## Restore remote current pointer or manifest missing
 Symptom:
 - `restore` fails with remote current pointer or current manifest errors.
 Likely Cause:
 - `current/run_id.txt` was never published.
 - `current/manifest.json` is missing for the session prefix.
 - archive commit did not complete.
 Diagnostics:
 ```bash
 narratio restore --config /path/to/pipeline.yml --campaign /path/to/campaign.yml --session /path/to/session.yml --session-id 2026-04-04 --dry-run
 ```
 Safe Fix:
 - verify archive stage succeeded for the target session.
 - rerun/archive from a healthy source workspace so current pointers are published.
 Links:
 - [docs/operations.md](./operations.md)
 - [docs/internal/stage-archive.md](./internal/stage-archive.md)
 ## Restore manifest identity mismatch
 Symptom:
 - `restore` fails because remote manifest session or campaign does not match requested values.
 Likely Cause:
 - wrong `--session-id` or wrong session config selected.
 - archive prefix points to a different campaign/session.
 Diagnostics:
 ```bash
 narratio restore --config /path/to/pipeline.yml --campaign /path/to/campaign.yml --session /path/to/session.yml --session-id 2026-04-04 --dry-run
 ```
 Safe Fix:
 - use the correct session config and `--session-id`.
 - verify campaign/session identity in local config before restore.
 Links:
 - [docs/config.md](./config.md)
 - [docs/operations.md](./operations.md)
 ## Restore conflict without `--force`
 Symptom:
 - `restore` fails with `restore conflict` and conflict counts.
-Likely Cause:
+- restore fails with conflict count.
- local durable file differs from remote file for one or more planned restore paths.
+
 Likely cause:
 - local durable files differ from remote restore sources.
 Diagnostics:
 ```bash
-narratio restore --config /path/to/pipeline.yml --campaign /path/to/campaign.yml --session /path/to/session.yml --session-id 2026-04-04 --dry-run
+narratio session restore 2026-04-04 --dry-run
 ```
-Safe Fix:
+Safe fix:
 - review planned conflicts.
 - rerun with `--force` only when remote state should overwrite local state.
-Links:
+- review conflicts;
- [docs/cli.md](./cli.md)
+- rerun with `--force` only when remote state should overwrite local.
 - [docs/operations.md](./operations.md)
-## Restore report expectations
+## Restore current-state discovery failure
 Symptom:
 - operator expects restore report file but does not find one.
-Likely Cause:
+- restore cannot find current pointer or current manifest.
- restore was executed in `--dry-run` mode.
+
- restore failed before report persistence path (for example lock acquisition failure).
+Likely causes:
 - no committed publish current state;
 - storage credentials or connectivity failure.
 Diagnostics:
 ```bash
-ls -l {workspace.root}/work/{campaign}/{session_id}/reports/restore-latest.json
+narratio session status 2026-04-04
 narratio session restore 2026-04-04 --dry-run
 ```
-Safe Fix:
+Safe fix:
 - run non-dry-run restore for durable report output.
 - resolve lock or early preflight failures and retry.
-Links:
+- resolve storage/auth issue;
- [docs/operations.md](./operations.md)
+- republish from healthy local state if current pointer is missing.
-## Secrets env-dir or credential-env failure
+## Publish output failure
 Symptom:
 - startup fails loading secrets directory, or stage fails due to missing credential env vars.
-Likely Cause:
+- publish fails on missing required source, upload error, or commit write.
- invalid `pipeline.secrets.env_dir` path/permissions.
+
- required credential env var unset/empty.
+Likely causes:
 - required source file not produced;
 - lock/state expectations mismatch;
 - remote storage failure.
 Diagnostics:
 ```bash
 narratio session artifacts 2026-04-04 --remote
 narratio session status 2026-04-04
 narratio run-stage publish 2026-04-04 --force
 ```
 Safe fix:
 - regenerate missing sources by rerunning prerequisite stages;
 - correct publish source/destination rules;
 - retry after storage failure is resolved.
 ## Secrets or storage credential failure
 Symptom:
 - object-store command fails at initialization/auth.
 Likely causes:
 - invalid `pipeline.secrets.env_dir`;
 - missing credential environment variables;
 - invalid S3 endpoint/bucket settings.
 Diagnostics:
 ```bash
 ls -la /path/to/secrets_dir
-env | grep -E 'AUDITA|OBJECT_STORAGE|AWS|SCRIPTORIUM'
+env | grep -E 'OBJECT_STORAGE|AWS|AUDITA|SCRIPTORIUM'
 ```
-Safe Fix:
+Safe fix:
- fix secrets directory and credential env vars.
+
 - correct secret-file path and permissions;
 - provide required env vars;
 - keep secret values out of YAML.
-Links:
+## S3 audio prepare failure
 - [docs/config.md](./config.md)
 ## S3-audio prepare failure
 Symptom:
 - `prepare` fails in S3 mode (listing/downloading/no audio/backend error).
-Likely Cause:
+- prepare fails listing/downloading session S3 audio.
- wrong `session.inputs.audio_s3.prefix`.
+
- no `.flac` files at resolved prefix.
+Likely causes:
- invalid/missing object-store credentials or backend config.
+
- mixed local+S3 audio input config.
+- incorrect `session.inputs.audio_s3.prefix`;
 - no matching `.flac` objects;
 - storage connectivity or permissions failure.
 Diagnostics:
 ```bash
-narratio run-stage --config /path/to/pipeline.yml --campaign /path/to/campaign.yml --session /path/to/session.yml --session-id 2026-04-04 prepare
+narratio run-stage prepare 2026-04-04 --force
 ```
-Safe Fix:
+Safe fix:
 - configure exactly one audio source mode.
 - verify `.flac` files and storage access.
-Links:
+- verify prefix contents and storage access;
 - keep session audio mode consistent.
 ## References
 - [docs/cli.md](./cli.md)
 - [docs/config.md](./config.md)
 - [docs/operations.md](./operations.md)
-
+- [docs/internal/stage-publish.md](./internal/stage-publish.md)
 ## Archive promotion/current-pointer failure
 Symptom:
 - archive fails on required promotion source missing or pointer write failure.
 Likely Cause:
 - required promoted file absent (including analyze outputs not generated for this run).
 - storage upload failed before `current/run_id.txt` commit marker write.
 Diagnostics:
 ```bash
 narratio status --manifest /path/to/manifest.json
 narratio run-stage --config /path/to/pipeline.yml --campaign /path/to/campaign.yml --session /path/to/session.yml --session-id 2026-04-04 archive
 ```
 Safe Fix:
 - rerun or resume upstream stages to generate required files.
 - adjust promotion `source`/`dest` rules to match artifacts that must exist.
 - retry after storage issue is resolved.
 Links:
 - [docs/operations.md](./operations.md)
 - [docs/config.md](./config.md)
 - [docs/internal/stage-archive.md](./internal/stage-archive.md)
--- a/examples/campaigns/sample-campaign/autocorrect.yml
+++ b/examples/campaigns/sample-campaign/autocorrect.yml
@@ -0,0 +1 @@
 []
--- a/examples/campaigns/sample-campaign/campaign.yml
+++ b/examples/campaigns/sample-campaign/campaign.yml
@@ -1,4 +1,5 @@
-campaign: sample-campaign
+campaign_id: sample-campaign
 session_template_file: ./session.template.yml
 inputs:
  speakers_file: ./speakers.yml
  autocorrect_file: ./autocorrect.yml
--- a/examples/campaigns/sample-campaign/glossary.yml
+++ b/examples/campaigns/sample-campaign/glossary.yml
@@ -0,0 +1 @@
 []
--- a/examples/campaigns/sample-campaign/session.template.yml
+++ b/examples/campaigns/sample-campaign/session.template.yml
@@ -0,0 +1,3 @@
 session_id: "{{ session_id }}"
 inputs:
  audio_dir: ./audio
--- a/examples/campaigns/sample-campaign/speakers.yml
+++ b/examples/campaigns/sample-campaign/speakers.yml
@@ -0,0 +1,5 @@
 match:
  - speaker: "Eric Rakestraw"
    match:
      - "Eric_Rakestraw"
      - "Eric"
--- a/examples/pipeline.full.annotated.yml
+++ b/examples/pipeline.full.annotated.yml
@@ -4,21 +4,18 @@
 workspace:
  # Optional: defaults to /var/lib/narratio.
  root: /var/lib/narratio/workspace
-  # Optional: remove run-scoped workdir after successful archive commit.
+  # Optional: remove run-scoped workdir after successful publish commit.
-  cleanup_after_archive: false
+  cleanup_after_publish: false
 # Optional: local secret file loader (directory of ENV_VAR_NAME files).
 # secrets:
 #   env_dir: ./secrets
 storage:
-  # Optional storage backend selector; use "s3" for archive + S3 audio workflows.
+  # Optional storage backend selector; use "s3" for publish + S3 audio workflows.
  backend: s3
  # Compatibility fields retained in schema.
  bucket: ""
  prefix: ""
  s3:
-    # Required when using S3 audio or S3 archive uploads.
+    # Required when using S3 audio or S3 publish uploads.
    bucket: my-dnd-archive
    # Optional; defaults to "dnd".
    root_prefix: dnd
@@ -30,20 +27,26 @@ storage:
    access_key_id_env: OBJECT_STORAGE_KEY_ID
    secret_access_key_env: OBJECT_STORAGE_KEY
 campaigns:
  # Optional; defaults to /usr/local/share/narratio/campaigns.
  root: /usr/local/share/narratio/campaigns
  # Optional command default when --campaign is omitted.
  default_campaign_id: sample-campaign
 spool:
  # Optional; defaults to /var/spool/narratio.
  root: /var/spool/narratio
-  # Optional cleanup of run-scoped spool audio after successful archive commit.
+  # Optional cleanup of run-scoped spool audio after successful publish commit.
-  delete_audio_after_archive: false
+  delete_audio_after_publish: false
-archive:
+publish:
  # Optional booleans; defaults are true.
  enabled: true
  upload_run: true
-  # Optional promotion rules; sources use Narratio artifact source IDs.
+  # Optional publish output rules; sources use Narratio artifact source IDs.
-  promote_artifacts:
+  outputs:
-    - source: narratio.transcript.trimmed
+    - source: narratio.transcript.final_trimmed
-      dest: transcripts/trimmed.json
+      dest: transcripts/final.trimmed.json
      required: true
    - source: narratio.artifact.session_recap
      dest: artifacts/session_recap.md
@@ -96,14 +99,14 @@ audita:
 normalize:
  # Optional; defaults shown explicitly.
-  output_path: transcripts/normalized.json
+  output_path: transcripts/final.json
  output_schema: seriatim-intermediate
  report: true
 trim:
  # Keep disabled unless bounds prompt integration is configured.
  enabled: false
-  output_path: transcripts/trimmed.json
+  output_path: transcripts/final.trimmed.json
  bounds:
    prompt_id: dnd.session_bounds
    profile_id: local-fast
@@ -130,7 +133,7 @@ scriptorium:
      timeout: 10m
      inputs:
        transcript:
-          source: narratio.transcript.trimmed
+          source: narratio.transcript.final_trimmed
          required: true
        previous_recap:
          source: narratio.previous_session.artifact.session_recap
@@ -158,21 +161,13 @@ scriptorium:
          source: narratio.artifact.session_recap
          required: true
        transcript:
-          source: narratio.transcript.trimmed
+          source: narratio.transcript.final_trimmed
          required: true
      vars:
        session_id: true
        campaign_name: true
        output_kind: player_handout
 analyzer:
  # Optional adapter settings.
  binary_path: ""
  timeout: 2m
  artifacts:
    output_dir: ""
    types: []
 notification:
  # Optional notification settings.
  backend: ""
--- a/examples/pipeline.minimal.yml
+++ b/examples/pipeline.minimal.yml
@@ -1,2 +1,6 @@
 campaigns:
  root: /usr/local/share/narratio/campaigns
  default_campaign_id: sample-campaign
 whisperx:
  transcribe_url: "https://transcription.example.com/transcribe"
--- a/examples/pipeline.production.yml
+++ b/examples/pipeline.production.yml
@@ -1,6 +1,6 @@
 workspace:
  root: /var/lib/narratio/workspace
-  cleanup_after_archive: true
+  cleanup_after_publish: true
 storage:
  backend: s3
@@ -11,16 +11,20 @@ storage:
    access_key_id_env: OBJECT_STORAGE_KEY_ID
    secret_access_key_env: OBJECT_STORAGE_KEY
 campaigns:
  root: /usr/local/share/narratio/campaigns
  default_campaign_id: sample-campaign
 spool:
  root: /var/spool/narratio
-  delete_audio_after_archive: true
+  delete_audio_after_publish: true
-archive:
+publish:
  enabled: true
  upload_run: true
-  promote_artifacts:
+  outputs:
-    - source: narratio.transcript.trimmed
+    - source: narratio.transcript.final_trimmed
-      dest: transcripts/trimmed.json
+      dest: transcripts/final.trimmed.json
      required: true
    - source: narratio.artifact.session_recap
      dest: artifacts/session_recap.md
@@ -57,7 +61,7 @@ audita:
  report: true
 normalize:
-  output_path: transcripts/normalized.json
+  output_path: transcripts/final.json
  output_schema: seriatim-intermediate
  report: true
@@ -78,7 +82,7 @@ scriptorium:
      timeout: 10m
      inputs:
        transcript:
-          source: narratio.transcript.trimmed
+          source: narratio.transcript.final_trimmed
          required: true
        previous_recap:
          source: narratio.previous_session.artifact.session_recap
@@ -102,14 +106,11 @@ scriptorium:
          source: narratio.artifact.session_recap
          required: true
        transcript:
-          source: narratio.transcript.trimmed
+          source: narratio.transcript.final_trimmed
          required: true
      vars:
        session_id: true
        output_kind: player_handout
 analyzer:
  timeout: 2m
 notification:
  timeout: 30s
--- a/internal/adapters/analyzer/fake.go
+++ b/internal/adapters/analyzer/fake.go
@@ -1,40 +0,0 @@
 package analyzer
 import "context"
 // NoopRunner is a deterministic no-op analyzer adapter.
 type NoopRunner struct{}
 // Run returns the requested output path with placeholder metadata.
 func (n *NoopRunner) Run(ctx context.Context, req AnalyzeRequest) (AnalyzeResult, error) {
 	if err := ctx.Err(); err != nil {
 		return AnalyzeResult{}, err
 	}
 	return AnalyzeResult{ArtifactPath: req.OutputPath, Metadata: map[string]any{"placeholder": true}}, nil
 }
 // FakeRunner captures analyze requests and returns deterministic responses.
 type FakeRunner struct {
 	Requests []AnalyzeRequest
 	Err      error
 	Result   AnalyzeResult
 }
 // Run records request and returns configured response.
 func (f *FakeRunner) Run(ctx context.Context, req AnalyzeRequest) (AnalyzeResult, error) {
 	if err := ctx.Err(); err != nil {
 		return AnalyzeResult{}, err
 	}
 	f.Requests = append(f.Requests, req)
 	if f.Err != nil {
 		return AnalyzeResult{}, f.Err
 	}
 	res := f.Result
 	if res.ArtifactPath == "" {
 		res.ArtifactPath = req.OutputPath
 	}
 	if res.Metadata == nil {
 		res.Metadata = map[string]any{"fake": true}
 	}
 	return res, nil
 }
--- a/internal/adapters/analyzer/fake_test.go
+++ b/internal/adapters/analyzer/fake_test.go
@@ -1,31 +0,0 @@
 package analyzer
 import (
 	"context"
 	"errors"
 	"testing"
 )
 func TestFakeRunnerCapturesRequestAndReturnsPath(t *testing.T) {
 	fake := &FakeRunner{}
 	req := AnalyzeRequest{ArtifactType: "session-log", OutputPath: "artifacts/session-log.md"}
 	res, err := fake.Run(context.Background(), req)
 	if err != nil {
 		t.Fatalf("Run() error = %v", err)
 	}
 	if len(fake.Requests) != 1 || fake.Requests[0].ArtifactType != "session-log" {
 		t.Fatalf("requests = %#v, want captured request", fake.Requests)
 	}
 	if res.ArtifactPath != req.OutputPath {
 		t.Fatalf("artifact path = %q, want %q", res.ArtifactPath, req.OutputPath)
 	}
 }
 func TestFakeRunnerError(t *testing.T) {
 	fake := &FakeRunner{Err: errors.New("boom")}
 	_, err := fake.Run(context.Background(), AnalyzeRequest{})
 	if err == nil {
 		t.Fatal("expected error, got nil")
 	}
 }
--- a/internal/adapters/analyzer/runner.go
+++ b/internal/adapters/analyzer/runner.go
@@ -1,28 +0,0 @@
 // Package analyzer declares the adapter contract for artifact analysis generation.
 package analyzer
 import "context"
 // TODO: implement analyzer integration once the analyzer contract is finalized.
 // Runner is the adapter boundary for analyzer invocations.
 type Runner interface {
 	Run(ctx context.Context, req AnalyzeRequest) (AnalyzeResult, error)
 }
 // AnalyzeRequest describes one analyzer artifact generation request.
 type AnalyzeRequest struct {
 	ArtifactType            string
 	ProcessedTranscriptPath string
 	ContextReferences       []string
 	OutputPath              string
 	GeneratedConfigPath     string
 	StdoutLogPath           string
 	StderrLogPath           string
 }
 // AnalyzeResult describes analyzer output.
 type AnalyzeResult struct {
 	ArtifactPath string
 	Metadata     map[string]any
 }
--- a/internal/adapters/audita/fake_test.go
+++ b/internal/adapters/audita/fake_test.go
@@ -14,7 +14,7 @@ func TestFakeRunnerCapturesRequestAndReturnsPath(t *testing.T) {
 	dir := t.TempDir()
 	req := PolishRequest{
 		GeneratedConfigPath: filepath.Join(dir, "config", "audita.yml"),
-		OutputProcessedPath: filepath.Join(dir, "transcripts", "processed.json"),
+		OutputProcessedPath: filepath.Join(dir, "transcripts", "polished.json"),
 		StdoutLogPath:       filepath.Join(dir, "logs", "audita.stdout.log"),
 		StderrLogPath:       filepath.Join(dir, "logs", "audita.stderr.log"),
 	}
--- a/internal/adapters/audita/subprocess_test.go
+++ b/internal/adapters/audita/subprocess_test.go
@@ -52,9 +52,9 @@ func TestSubprocessRunnerSuccessArgsEnvAndValidation(t *testing.T) {
 	dir := t.TempDir()
 	req := PolishRequest{
 		GeneratedConfigPath:  filepath.Join(dir, "audita.generated.yml"),
-		MergedTranscriptPath: filepath.Join(dir, "merged.json"),
+		MergedTranscriptPath: filepath.Join(dir, "base.json"),
 		GlossaryPath:         filepath.Join(dir, "glossary.yml"),
-		OutputProcessedPath:  filepath.Join(dir, "processed.json"),
+		OutputProcessedPath:  filepath.Join(dir, "polished.json"),
 		ReportPath:           filepath.Join(dir, "audita.report.json"),
 		WorkDir:              filepath.Join(dir, "artifacts", "audita-work"),
 		StdoutLogPath:        filepath.Join(dir, "audita.stdout.log"),
@@ -571,7 +571,7 @@ func mustAuditaRunner(t *testing.T, cfg SubprocessRunnerConfig) *SubprocessRunne
 func auditaReqForTest(t *testing.T, withReport bool) PolishRequest {
 	t.Helper()
 	dir := t.TempDir()
-	merged := filepath.Join(dir, "merged.json")
+	merged := filepath.Join(dir, "base.json")
 	glossary := filepath.Join(dir, "glossary.yml")
 	writeAuditaTestFile(t, merged, `{"segments":[]}`)
 	writeAuditaTestFile(t, glossary, "terms: []\n")
@@ -579,7 +579,7 @@ func auditaReqForTest(t *testing.T, withReport bool) PolishRequest {
 		GeneratedConfigPath:  filepath.Join(dir, "audita.generated.yml"),
 		MergedTranscriptPath: merged,
 		GlossaryPath:         glossary,
-		OutputProcessedPath:  filepath.Join(dir, "processed.json"),
+		OutputProcessedPath:  filepath.Join(dir, "polished.json"),
 		WorkDir:              filepath.Join(dir, "artifacts", "audita-work"),
 		StdoutLogPath:        filepath.Join(dir, "audita.stdout.log"),
 		StderrLogPath:        filepath.Join(dir, "audita.stderr.log"),
--- a/internal/adapters/scriptorium/subprocess_test.go
+++ b/internal/adapters/scriptorium/subprocess_test.go
@@ -31,7 +31,7 @@ func TestSubprocessRunnerRunSuccessBuildsDeterministicArgsAndCapturesLogs(t *tes
 		ConfigPath:          "/etc/scriptorium/config.yml",
 		PromptID:            "dnd.session_recap",
 		ProfileID:           "local-quality",
-		InputPaths:          map[string]string{"transcript": filepath.Join(dir, "processed.json"), "other": filepath.Join(dir, "other.md")},
+		InputPaths:          map[string]string{"transcript": filepath.Join(dir, "polished.json"), "other": filepath.Join(dir, "other.md")},
 		Vars:                map[string]string{"session_id": "2026-05-03", "campaign_name": "Icewind Dale"},
 		OutputPath:          filepath.Join(dir, "artifacts", "session_recap.md"),
 		StdoutLogPath:       filepath.Join(dir, "logs", "scriptorium.run.stdout.log"),
@@ -180,7 +180,7 @@ func TestSubprocessRunnerRenderSuccess(t *testing.T) {
 	req := RenderArtifactRequest{
 		Binary:              wrapper,
 		PromptID:            "dnd.session_recap",
-		InputPaths:          map[string]string{"transcript": filepath.Join(dir, "processed.json")},
+		InputPaths:          map[string]string{"transcript": filepath.Join(dir, "polished.json")},
 		OutputPath:          filepath.Join(dir, "artifacts", "session_recap.render.json"),
 		StdoutLogPath:       filepath.Join(dir, "logs", "scriptorium.render.stdout.log"),
 		StderrLogPath:       filepath.Join(dir, "logs", "scriptorium.render.stderr.log"),
@@ -285,7 +285,7 @@ type scriptoriumHelperRecord struct {
 func runReqForTest(t *testing.T, binary string) RunArtifactRequest {
 	t.Helper()
 	dir := t.TempDir()
-	transcriptPath := filepath.Join(dir, "processed.json")
+	transcriptPath := filepath.Join(dir, "polished.json")
 	writeScriptoriumFile(t, transcriptPath, `{"segments":[]}`)
 	return RunArtifactRequest{
 		Binary:              binary,
--- a/internal/adapters/seriatim/fake_test.go
+++ b/internal/adapters/seriatim/fake_test.go
@@ -14,7 +14,7 @@ func TestFakeRunnerCapturesRequestAndReturnsPath(t *testing.T) {
 	dir := t.TempDir()
 	req := MergeRequest{
 		GeneratedConfigPath:        filepath.Join(dir, "config", "seriatim.yml"),
-		OutputMergedTranscriptPath: filepath.Join(dir, "transcripts", "merged.json"),
+		OutputMergedTranscriptPath: filepath.Join(dir, "transcripts", "base.json"),
 		StdoutLogPath:              filepath.Join(dir, "logs", "seriatim.stdout.log"),
 		StderrLogPath:              filepath.Join(dir, "logs", "seriatim.stderr.log"),
 	}
@@ -57,8 +57,8 @@ func TestFakeRunnerTrimCapturesRequestAndReturnsPath(t *testing.T) {
 	dir := t.TempDir()
 	req := TrimRequest{
 		GeneratedConfigPath: filepath.Join(dir, "config", "seriatim.trim.yml"),
-		InputTranscriptPath: filepath.Join(dir, "transcripts", "processed.json"),
+		InputTranscriptPath: filepath.Join(dir, "transcripts", "polished.json"),
-		OutputTrimmedPath:   filepath.Join(dir, "transcripts", "trimmed.json"),
+		OutputTrimmedPath:   filepath.Join(dir, "transcripts", "final.trimmed.json"),
 		KeepSelector:        "1-10",
 		StdoutLogPath:       filepath.Join(dir, "logs", "seriatim.trim.stdout.log"),
 		StderrLogPath:       filepath.Join(dir, "logs", "seriatim.trim.stderr.log"),
@@ -105,8 +105,8 @@ func TestFakeRunnerNormalizeCapturesRequestAndReturnsPath(t *testing.T) {
 	dir := t.TempDir()
 	req := NormalizeRequest{
 		GeneratedConfigPath:  filepath.Join(dir, "config", "seriatim.normalize.yml"),
-		InputTranscriptPath:  filepath.Join(dir, "transcripts", "processed.json"),
+		InputTranscriptPath:  filepath.Join(dir, "transcripts", "polished.json"),
-		OutputNormalizedPath: filepath.Join(dir, "transcripts", "normalized.json"),
+		OutputNormalizedPath: filepath.Join(dir, "transcripts", "final.json"),
 		OutputSchema:         "seriatim-intermediate",
 		ReportPath:           filepath.Join(dir, "artifacts", "seriatim.normalize.report.json"),
 		StdoutLogPath:        filepath.Join(dir, "logs", "seriatim.normalize.stdout.log"),
--- a/internal/adapters/seriatim/subprocess_test.go
+++ b/internal/adapters/seriatim/subprocess_test.go
@@ -50,7 +50,7 @@ func TestSubprocessRunnerSuccessWithReportArgsAndEnv(t *testing.T) {
 	req := MergeRequest{
 		GeneratedConfigPath:        filepath.Join(dir, "seriatim.generated.yml"),
 		InputTranscriptPaths:       []string{filepath.Join(dir, "a.json"), filepath.Join(dir, "b.json")},
-		OutputMergedTranscriptPath: filepath.Join(dir, "merged.json"),
+		OutputMergedTranscriptPath: filepath.Join(dir, "base.json"),
 		ReportPath:                 filepath.Join(dir, "seriatim.report.json"),
 		SpeakersPath:               filepath.Join(dir, "speakers.yml"),
 		AutocorrectPath:            filepath.Join(dir, "autocorrect.yml"),
@@ -732,7 +732,7 @@ func mergeReqForTest(t *testing.T, withReport bool) MergeRequest {
 	req := MergeRequest{
 		GeneratedConfigPath:        filepath.Join(dir, "seriatim.generated.yml"),
 		InputTranscriptPaths:       []string{in1, in2},
-		OutputMergedTranscriptPath: filepath.Join(dir, "merged.json"),
+		OutputMergedTranscriptPath: filepath.Join(dir, "base.json"),
 		StdoutLogPath:              filepath.Join(dir, "seriatim.stdout.log"),
 		StderrLogPath:              filepath.Join(dir, "seriatim.stderr.log"),
 	}
@@ -745,11 +745,11 @@ func mergeReqForTest(t *testing.T, withReport bool) MergeRequest {
 func trimReqForTest(t *testing.T) TrimRequest {
 	t.Helper()
 	dir := t.TempDir()
-	input := filepath.Join(dir, "processed.json")
+	input := filepath.Join(dir, "polished.json")
 	writeSeriatimFile(t, input, `{"schema":"seriatim.intermediate.v1","segments":[]}`)
 	return TrimRequest{
 		InputTranscriptPath: input,
-		OutputTrimmedPath:   filepath.Join(dir, "trimmed.json"),
+		OutputTrimmedPath:   filepath.Join(dir, "final.trimmed.json"),
 		KeepSelector:        "5-12",
 		GeneratedConfigPath: filepath.Join(dir, "seriatim.trim.generated.yml"),
 		StdoutLogPath:       filepath.Join(dir, "seriatim.trim.stdout.log"),
@@ -760,12 +760,12 @@ func trimReqForTest(t *testing.T) TrimRequest {
 func normalizeReqForTest(t *testing.T, withReport bool) NormalizeRequest {
 	t.Helper()
 	dir := t.TempDir()
-	input := filepath.Join(dir, "processed.json")
+	input := filepath.Join(dir, "polished.json")
 	writeSeriatimFile(t, input, `{"schema":"audita.processed.v1","segments":[]}`)
 	req := NormalizeRequest{
 		InputTranscriptPath:  input,
-		OutputNormalizedPath: filepath.Join(dir, "normalized.json"),
+		OutputNormalizedPath: filepath.Join(dir, "final.json"),
 		OutputSchema:         "seriatim-intermediate",
 		GeneratedConfigPath:  filepath.Join(dir, "seriatim.normalize.generated.yml"),
 		StdoutLogPath:        filepath.Join(dir, "seriatim.normalize.stdout.log"),
--- a/internal/adapters/storage/temp_download.go
+++ b/internal/adapters/storage/temp_download.go
@@ -0,0 +1,36 @@
 package storage
 import (
 	"context"
 	"fmt"
 	"os"
 	"path/filepath"
 	"strings"
 )
 // DownloadObjectToTemp downloads an object into a temporary file and returns
 // the cleaned local path.
 func DownloadObjectToTemp(ctx context.Context, store ObjectStore, key, pattern string) (string, error) {
 	if store == nil {
 		return "", fmt.Errorf("object store is required")
 	}
 	if strings.TrimSpace(pattern) == "" {
 		return "", fmt.Errorf("temp file pattern is required")
 	}
 	tmp, err := os.CreateTemp("", pattern)
 	if err != nil {
 		return "", fmt.Errorf("create temp file: %w", err)
 	}
 	path := tmp.Name()
 	if err := tmp.Close(); err != nil {
 		_ = os.Remove(path)
 		return "", fmt.Errorf("close temp file: %w", err)
 	}
 	if err := store.Download(ctx, key, path); err != nil {
 		_ = os.Remove(path)
 		return "", err
 	}
 	return filepath.Clean(path), nil
 }
--- a/internal/adapters/storage/temp_download_test.go
+++ b/internal/adapters/storage/temp_download_test.go
@@ -0,0 +1,69 @@
 package storage
 import (
 	"context"
 	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 )
 func TestDownloadObjectToTempSuccess(t *testing.T) {
 	store := &FakeBackend{}
 	store.SeedObject(FakeObject{Key: "sessions/a/current/run_id.txt", Data: []byte("run-123\n")})
 	path, err := DownloadObjectToTemp(context.Background(), store, "sessions/a/current/run_id.txt", "narratio-test-*.txt")
 	if err != nil {
 		t.Fatalf("DownloadObjectToTemp() error = %v", err)
 	}
 	t.Cleanup(func() { _ = os.Remove(path) })
 	data, err := os.ReadFile(path)
 	if err != nil {
 		t.Fatalf("ReadFile() error = %v", err)
 	}
 	if string(data) != "run-123\n" {
 		t.Fatalf("downloaded data = %q, want %q", string(data), "run-123\n")
 	}
 }
 func TestDownloadObjectToTempFailedDownloadRemovesTempFile(t *testing.T) {
 	sentinel := errors.New("download failed")
 	store := &FakeBackend{DownloadErr: sentinel}
 	pattern := "narratio-test-fail-*.txt"
 	before, err := filepath.Glob(filepath.Join(os.TempDir(), "narratio-test-fail-*.txt"))
 	if err != nil {
 		t.Fatalf("Glob(before) error = %v", err)
 	}
 	path, err := DownloadObjectToTemp(context.Background(), store, "sessions/a/current/run_id.txt", pattern)
 	if !errors.Is(err, sentinel) {
 		t.Fatalf("DownloadObjectToTemp() error = %v, want %v", err, sentinel)
 	}
 	if strings.TrimSpace(path) != "" {
 		t.Fatalf("DownloadObjectToTemp() path = %q, want empty on failure", path)
 	}
 	after, err := filepath.Glob(filepath.Join(os.TempDir(), "narratio-test-fail-*.txt"))
 	if err != nil {
 		t.Fatalf("Glob(after) error = %v", err)
 	}
 	if len(after) != len(before) {
 		t.Fatalf("temp file count changed after failed download: before=%d after=%d", len(before), len(after))
 	}
 }
 func TestDownloadObjectToTempCallerContextWrappingPreservesCause(t *testing.T) {
 	sentinel := errors.New("object missing")
 	store := &FakeBackend{DownloadErr: sentinel}
 	_, err := DownloadObjectToTemp(context.Background(), store, "sessions/a/current/run_id.txt", "narratio-test-*.txt")
 	if err == nil {
 		t.Fatal("DownloadObjectToTemp() error = nil, want error")
 	}
 	err = fmt.Errorf("download run pointer failed: %w", err)
 	if !errors.Is(err, sentinel) {
 		t.Fatalf("wrapped error does not preserve sentinel cause: %v", err)
 	}
 }
--- a/internal/app/analyze_artifacts.go
+++ b/internal/app/analyze_artifacts.go
@@ -46,7 +46,7 @@ func (f *artifactSelectionFlag) Normalize() ([]string, error) {
 	return out, nil
 }
-func validateSelectedAnalyzeArtifacts(cfg *config.Config, selected []string) error {
+func validateSelectedArtifacts(cfg *config.Config, selected []string) error {
 	if len(selected) == 0 {
 		return nil
 	}
--- a/internal/app/analyze_artifacts_commands_test.go
+++ b/internal/app/analyze_artifacts_commands_test.go
@@ -14,25 +14,67 @@ import (
 	"gitea.maximumdirect.net/eric/narratio/internal/stage"
 )
-func TestExecuteRunStageArtifactsNonAnalyzeFails(t *testing.T) {
+func TestExecuteRunStageArtifactsUnsupportedStageFails(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFilesWithScriptoriumArtifacts(t, workspaceRoot)
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute(
-		[]string{"run-stage", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "--artifacts", "session_recap", "polish"},
+		[]string{"run-stage", "polish", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath, "--artifacts", "session_recap"},
 		&stdout,
 		&stderr,
 	)
 	if code == 0 {
 		t.Fatal("exit code = 0, want non-zero")
 	}
-	if !strings.Contains(stderr.String(), `run-stage: --artifacts is only supported for stage "analyze"`) {
+	if !strings.Contains(stderr.String(), `run-stage: --artifacts is only supported for stages "analyze" and "publish"`) {
 		t.Fatalf("stderr = %q, want stage-gating error", stderr.String())
 	}
 }
 func TestExecuteRunStagePublishPropagatesSelectedArtifacts(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFilesWithScriptoriumArtifacts(t, workspaceRoot)
 	var capturedStages []string
 	var capturedArtifacts []string
 	origExecuteStagesFn := executeStagesFn
 	t.Cleanup(func() {
 		executeStagesFn = origExecuteStagesFn
 	})
 	executeStagesFn = func(_ context.Context, _ *config.Config, stages []stage.Stage, opts RunOptions) (*RunSummary, error) {
 		for _, s := range stages {
 			capturedStages = append(capturedStages, s.Name())
 		}
 		capturedArtifacts = append([]string(nil), opts.SelectedArtifacts...)
 		return &RunSummary{ManifestPath: filepath.Join(workspaceRoot, "manifest.json"), Executed: []string{"publish"}}, nil
 	}
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute(
 		[]string{
 			"run-stage", "publish", "2026-05-03",
 			"--config", pipelinePath,
 			"--campaign-file", campaignPath,
 			"--session", sessionPath,
 			"--artifacts", "session_recap",
 		},
 		&stdout,
 		&stderr,
 	)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
 	if len(capturedStages) != 1 || capturedStages[0] != "publish" {
 		t.Fatalf("captured stages = %#v, want [publish]", capturedStages)
 	}
 	if strings.Join(capturedArtifacts, ",") != "session_recap" {
 		t.Fatalf("captured artifacts = %#v, want [session_recap]", capturedArtifacts)
 	}
 }
 func TestExecuteUnknownArtifactsFailValidation(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFilesWithScriptoriumArtifacts(t, workspaceRoot)
@@ -40,7 +82,7 @@ func TestExecuteUnknownArtifactsFailValidation(t *testing.T) {
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute(
-		[]string{"run", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "--artifacts", "unknown_artifact"},
+		[]string{"run", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath, "--artifacts", "unknown_artifact"},
 		&stdout,
 		&stderr,
 	)
@@ -67,7 +109,7 @@ func TestRunStageArtifactsDoesNotImplyForce(t *testing.T) {
 	var out bytes.Buffer
 	err := RunStage(
 		context.Background(),
-		[]string{"--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "--artifacts", "session_recap,session_recap", "analyze"},
+		[]string{"analyze", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath, "--artifacts", "session_recap,session_recap"},
 		&out,
 	)
 	if err != nil {
@@ -85,7 +127,7 @@ func TestResumeArtifactsWithSucceededAnalyzeSkipsUnlessForced(t *testing.T) {
 	store := &manifest.LocalStore{}
 	seed := manifest.New("2026-05-03", time.Date(2026, 5, 3, 10, 0, 0, 0, time.UTC))
-	for _, stageName := range []string{"prepare", "transcribe", "merge", "polish", "normalize", "trim", "analyze", "archive", "notify"} {
+	for _, stageName := range []string{"prepare", "transcribe", "merge", "polish", "normalize", "trim", "analyze", "publish", "notify"} {
 		seed.MarkStageSucceeded(stageName, time.Date(2026, 5, 3, 10, 1, 0, 0, time.UTC), nil)
 	}
 	if err := store.Save(context.Background(), manifestPath, seed); err != nil {
@@ -95,7 +137,7 @@ func TestResumeArtifactsWithSucceededAnalyzeSkipsUnlessForced(t *testing.T) {
 	var out bytes.Buffer
 	err := Resume(
 		context.Background(),
-		[]string{"--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "--artifacts", "session_recap"},
+		[]string{"2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath, "--artifacts", "session_recap"},
 		&out,
 	)
 	if err != nil {
@@ -130,7 +172,7 @@ func TestExecuteAnalyzeForceRunsAnalyze(t *testing.T) {
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute(
-		[]string{"analyze", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath},
+		[]string{"analyze", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath},
 		&stdout,
 		&stderr,
 	)
@@ -167,8 +209,9 @@ func TestExecuteAnalyzePropagatesSelectedArtifacts(t *testing.T) {
 	code := Execute(
 		[]string{
 			"analyze",
 			"2026-05-03",
 			"--config", pipelinePath,
-			"--campaign", campaignPath,
+			"--campaign-file", campaignPath,
 			"--session", sessionPath,
 			"--artifacts", "player_handout,session_recap",
 		},
@@ -190,7 +233,7 @@ func TestExecuteAnalyzeUnknownArtifactFailsValidation(t *testing.T) {
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute(
-		[]string{"analyze", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "--artifacts", "unknown_artifact"},
+		[]string{"analyze", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath, "--artifacts", "unknown_artifact"},
 		&stdout,
 		&stderr,
 	)
@@ -208,7 +251,7 @@ func TestExecuteAnalyzeRejectsPositionalArgsAndForceFlag(t *testing.T) {
 		args []string
 		want string
 	}{
-		{name: "positional", args: []string{"analyze", "extra"}, want: "analyze: unexpected positional arguments"},
+		{name: "extra positional", args: []string{"analyze", "2026-05-03", "extra"}, want: "analyze: unexpected positional arguments"},
 		{name: "force flag", args: []string{"analyze", "--force"}, want: "analyze: invalid flags: flag provided but not defined: -force"},
 	}
 	for _, tc := range cases {
@@ -229,7 +272,7 @@ func TestExecuteAnalyzeRejectsPositionalArgsAndForceFlag(t *testing.T) {
 func TestExecuteAnalyzeMissingConfigUsesRunStageLoadingPath(t *testing.T) {
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"analyze"}, &stdout, &stderr)
+	code := Execute([]string{"analyze", "2026-05-03"}, &stdout, &stderr)
 	if code == 0 {
 		t.Fatal("exit code = 0, want non-zero")
 	}
@@ -238,7 +281,109 @@ func TestExecuteAnalyzeMissingConfigUsesRunStageLoadingPath(t *testing.T) {
 	}
 }
-func TestExecuteUsageIncludesAnalyze(t *testing.T) {
+func TestExecutePublishForceRunsPublish(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFilesWithScriptoriumArtifacts(t, workspaceRoot)
 	var capturedStages []string
 	var capturedForce bool
 	var capturedArtifacts []string
 	origExecuteStagesFn := executeStagesFn
 	t.Cleanup(func() {
 		executeStagesFn = origExecuteStagesFn
 	})
 	executeStagesFn = func(_ context.Context, _ *config.Config, stages []stage.Stage, opts RunOptions) (*RunSummary, error) {
 		for _, s := range stages {
 			capturedStages = append(capturedStages, s.Name())
 		}
 		capturedForce = opts.Force
 		capturedArtifacts = append([]string(nil), opts.SelectedArtifacts...)
 		return &RunSummary{
 			ManifestPath: filepath.Join(workspaceRoot, "work", "sample-campaign", "2026-05-03", "manifest.json"),
 			Executed:     []string{"publish"},
 		}, nil
 	}
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute(
 		[]string{"publish", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath, "--artifacts", "session_recap"},
 		&stdout,
 		&stderr,
 	)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
 	if len(capturedStages) != 1 || capturedStages[0] != "publish" {
 		t.Fatalf("captured stages = %#v, want [publish]", capturedStages)
 	}
 	if !capturedForce {
 		t.Fatal("captured force = false, want true")
 	}
 	if strings.Join(capturedArtifacts, ",") != "session_recap" {
 		t.Fatalf("captured artifacts = %#v, want [session_recap]", capturedArtifacts)
 	}
 	if !strings.Contains(stdout.String(), "narratio publish: executed=1 skipped=0 force=true; manifest=") {
 		t.Fatalf("stdout = %q, want publish summary", stdout.String())
 	}
 }
 func TestExecutePublishRejectsUnsupportedArgsAndFlags(t *testing.T) {
 	cases := []struct {
 		name string
 		args []string
 		want string
 	}{
 		{name: "extra positional", args: []string{"publish", "2026-05-03", "extra"}, want: "publish: unexpected positional arguments"},
 		{name: "force flag", args: []string{"publish", "--force"}, want: "publish: invalid flags: flag provided but not defined: -force"},
 	}
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
 			var stdout bytes.Buffer
 			var stderr bytes.Buffer
 			code := Execute(tc.args, &stdout, &stderr)
 			if code == 0 {
 				t.Fatal("exit code = 0, want non-zero")
 			}
 			if !strings.Contains(stderr.String(), tc.want) {
 				t.Fatalf("stderr = %q, want %q", stderr.String(), tc.want)
 			}
 		})
 	}
 }
 func TestExecutePublishUnknownArtifactFailsValidation(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFilesWithScriptoriumArtifacts(t, workspaceRoot)
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute(
 		[]string{"publish", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath, "--artifacts", "unknown_artifact"},
 		&stdout,
 		&stderr,
 	)
 	if code == 0 {
 		t.Fatal("exit code = 0, want non-zero")
 	}
 	if !strings.Contains(stderr.String(), `publish: --artifacts includes unknown artifact "unknown_artifact"`) {
 		t.Fatalf("stderr = %q, want unknown-artifact validation error", stderr.String())
 	}
 }
 func TestExecutePublishMissingConfigUsesRunStageLoadingPath(t *testing.T) {
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute([]string{"publish", "2026-05-03"}, &stdout, &stderr)
 	if code == 0 {
 		t.Fatal("exit code = 0, want non-zero")
 	}
 	if !strings.Contains(stderr.String(), "publish: no pipeline config path provided and no default pipeline config found; searched:") {
 		t.Fatalf("stderr = %q, want pipeline discovery error", stderr.String())
 	}
 }
 func TestExecuteUsageIncludesAnalyzeAndPublish(t *testing.T) {
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute(nil, &stdout, &stderr)
@@ -248,6 +393,9 @@ func TestExecuteUsageIncludesAnalyze(t *testing.T) {
 	if !strings.Contains(stderr.String(), "analyze") {
 		t.Fatalf("stderr = %q, want usage to include analyze", stderr.String())
 	}
 	if !strings.Contains(stderr.String(), "publish") {
 		t.Fatalf("stderr = %q, want usage to include publish", stderr.String())
 	}
 }
 func writeValidConfigFilesWithScriptoriumArtifacts(t *testing.T, workspaceRoot string) (string, string, string) {
--- a/internal/app/analyze_artifacts_test.go
+++ b/internal/app/analyze_artifacts_test.go
@@ -64,7 +64,7 @@ func TestArtifactSelectionFlagNormalize(t *testing.T) {
 	}
 }
-func TestValidateSelectedAnalyzeArtifacts(t *testing.T) {
+func TestValidateSelectedArtifacts(t *testing.T) {
 	tests := []struct {
 		name     string
 		cfg      *config.Config
@@ -114,7 +114,7 @@ func TestValidateSelectedAnalyzeArtifacts(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			err := validateSelectedAnalyzeArtifacts(tt.cfg, tt.selected)
+			err := validateSelectedArtifacts(tt.cfg, tt.selected)
 			if tt.wantErr != "" {
 				if err == nil {
 					t.Fatalf("error = nil, want %q", tt.wantErr)
--- a/internal/app/campaign_config_path.go
+++ b/internal/app/campaign_config_path.go
@@ -1,49 +1,44 @@
 package app
 import (
 	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
 	"strings"
 	"gitea.maximumdirect.net/eric/narratio/internal/config"
 )
-func resolveCampaignConfigPath(flagValue string) (string, error) {
+func resolveCampaignConfigPath(pipelineCfg *config.PipelineConfig, campaignIDFlag, campaignFileFlag string) (string, error) {
-	return resolveCampaignConfigPathWithCandidates(flagValue, config.DefaultCampaignConfigSearchPaths)
+	campaignID := strings.TrimSpace(campaignIDFlag)
 	campaignFile := strings.TrimSpace(campaignFileFlag)
 	if campaignID != "" && campaignFile != "" {
 		return "", fmt.Errorf("--campaign and --campaign-file are mutually exclusive")
 	}
 	if campaignFile != "" {
 		return filepath.Clean(campaignFile), nil
 	}
 	if campaignID == "" && pipelineCfg != nil {
 		campaignID = strings.TrimSpace(pipelineCfg.Campaigns.DefaultCampaignID)
 	}
 	if campaignID == "" {
 		return "", fmt.Errorf("no campaign selected; pass --campaign <id> or set pipeline.campaigns.default_campaign_id")
 	}
 	if err := validateCampaignIDToken(campaignID); err != nil {
 		return "", err
 	}
 	if pipelineCfg == nil || strings.TrimSpace(pipelineCfg.Campaigns.Root) == "" {
 		return "", fmt.Errorf("pipeline.campaigns.root is required to select campaign %q", campaignID)
 	}
 	return filepath.Clean(filepath.Join(pipelineCfg.Campaigns.Root, campaignID, "campaign.yml")), nil
 }
-func resolveCampaignConfigPathWithCandidates(flagValue string, candidates []string) (string, error) {
+func validateCampaignIDToken(campaignID string) error {
-	if explicit := strings.TrimSpace(flagValue); explicit != "" {
+	if filepath.IsAbs(campaignID) ||
-		return explicit, nil
+		strings.Contains(campaignID, "/") ||
 		strings.Contains(campaignID, `\`) ||
 		campaignID == "." ||
 		campaignID == ".." {
 		return fmt.Errorf("campaign id %q must be a single path segment", campaignID)
 	}
-
+	return nil
 	ordered := make([]string, 0, len(candidates))
 	for _, raw := range candidates {
 		path := strings.TrimSpace(raw)
 		if path == "" {
 			continue
 		}
 		ordered = append(ordered, path)
 		info, err := os.Stat(path)
 		if err == nil {
 			if info.IsDir() {
 				continue
 			}
 			return filepath.Clean(path), nil
 		}
 		if errors.Is(err, os.ErrNotExist) {
 			continue
 		}
 		return "", fmt.Errorf("check default campaign config %q: %w", path, err)
 	}
 	if len(ordered) == 0 {
 		return "", fmt.Errorf("no campaign config path provided and no default locations configured")
 	}
 	return "", fmt.Errorf(
 		"no campaign config path provided and no default campaign config found; searched: %s; pass --campaign to use an explicit path",
 		strings.Join(ordered, ", "),
 	)
 }
--- a/internal/app/campaign_config_path_test.go
+++ b/internal/app/campaign_config_path_test.go
@@ -1,49 +1,84 @@
 package app
 import (
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 	"gitea.maximumdirect.net/eric/narratio/internal/config"
 )
-func TestResolveCampaignConfigPathExplicitWins(t *testing.T) {
+func TestResolveCampaignConfigPathCampaignFileWins(t *testing.T) {
 	explicit := filepath.Join(t.TempDir(), "custom-campaign.yml")
-	got, err := resolveCampaignConfigPathWithCandidates(explicit, []string{filepath.Join(t.TempDir(), "campaign.yml")})
+	got, err := resolveCampaignConfigPath(&config.PipelineConfig{}, "", explicit)
 	if err != nil {
-		t.Fatalf("resolveCampaignConfigPathWithCandidates() error = %v", err)
+		t.Fatalf("resolveCampaignConfigPath() error = %v", err)
 	}
 	if got != explicit {
 		t.Fatalf("path = %q, want explicit path %q", got, explicit)
 	}
 }
-func TestResolveCampaignConfigPathUsesFirstExistingDefault(t *testing.T) {
+func TestResolveCampaignConfigPathUsesSelectedCampaignID(t *testing.T) {
 	dir := t.TempDir()
-	missing := filepath.Join(dir, "missing.yml")
+	pipelineCfg := &config.PipelineConfig{}
-	found := filepath.Join(dir, "campaign.yml")
+	pipelineCfg.Campaigns.Root = dir
 	if err := os.WriteFile(found, []byte("campaign: sample-campaign\n"), 0o644); err != nil {
 		t.Fatalf("write campaign.yml: %v", err)
 	}
-	got, err := resolveCampaignConfigPathWithCandidates("", []string{missing, found})
+	got, err := resolveCampaignConfigPath(pipelineCfg, "icewind", "")
 	if err != nil {
-		t.Fatalf("resolveCampaignConfigPathWithCandidates() error = %v", err)
+		t.Fatalf("resolveCampaignConfigPath() error = %v", err)
 	}
-	if got != filepath.Clean(found) {
+	want := filepath.Join(dir, "icewind", "campaign.yml")
-		t.Fatalf("path = %q, want %q", got, filepath.Clean(found))
+	if got != filepath.Clean(want) {
 		t.Fatalf("path = %q, want %q", got, filepath.Clean(want))
 	}
 }
-func TestResolveCampaignConfigPathErrorIncludesSearchedPaths(t *testing.T) {
+func TestResolveCampaignConfigPathUsesDefaultCampaignID(t *testing.T) {
-	_, err := resolveCampaignConfigPathWithCandidates("", []string{"/usr/local/etc/narratio/campaign.yml", "/etc/narratio/campaign.yml"})
+	dir := t.TempDir()
 	pipelineCfg := &config.PipelineConfig{}
 	pipelineCfg.Campaigns.Root = dir
 	pipelineCfg.Campaigns.DefaultCampaignID = "dilfs"
 	got, err := resolveCampaignConfigPath(pipelineCfg, "", "")
 	if err != nil {
 		t.Fatalf("resolveCampaignConfigPath() error = %v", err)
 	}
 	want := filepath.Join(dir, "dilfs", "campaign.yml")
 	if got != filepath.Clean(want) {
 		t.Fatalf("path = %q, want %q", got, filepath.Clean(want))
 	}
 }
 func TestResolveCampaignConfigPathRejectsCampaignIDAndFile(t *testing.T) {
 	_, err := resolveCampaignConfigPath(&config.PipelineConfig{}, "dilfs", filepath.Join(t.TempDir(), "campaign.yml"))
 	if err == nil {
 		t.Fatal("expected error, got nil")
 	}
-	if !strings.Contains(err.Error(), "searched") {
+	if !strings.Contains(err.Error(), "mutually exclusive") {
-		t.Fatalf("error = %q, want searched paths", err.Error())
+		t.Fatalf("error = %q, want mutual exclusion", err.Error())
-	}
+	}
-	if !strings.Contains(err.Error(), "pass --campaign") {
+}
-		t.Fatalf("error = %q, want explicit-campaign guidance", err.Error())
+
 func TestResolveCampaignConfigPathRequiresCampaignSelection(t *testing.T) {
 	_, err := resolveCampaignConfigPath(&config.PipelineConfig{}, "", "")
 	if err == nil {
 		t.Fatal("expected error, got nil")
 	}
 	if !strings.Contains(err.Error(), "no campaign selected") {
 		t.Fatalf("error = %q, want missing selection guidance", err.Error())
 	}
 }
 func TestResolveCampaignConfigPathRejectsPathLikeCampaignID(t *testing.T) {
 	pipelineCfg := &config.PipelineConfig{}
 	pipelineCfg.Campaigns.Root = t.TempDir()
 	_, err := resolveCampaignConfigPath(pipelineCfg, "../icewind", "")
 	if err == nil {
 		t.Fatal("expected error, got nil")
 	}
 	if !strings.Contains(err.Error(), "single path segment") {
 		t.Fatalf("error = %q, want path segment guidance", err.Error())
 	}
 }
--- a/internal/app/clean.go
+++ b/internal/app/clean.go
@@ -26,11 +26,8 @@ func Clean(ctx context.Context, args []string, out io.Writer) error {
 	fs.BoolVar(&all, "all", false, "clean all local session work/spool state")
 	fs.BoolVar(&dryRun, "dry-run", false, "print cleanup targets without deleting")
 	fs.BoolVar(&clearCache, "clear-cache", false, "also clear durable S3 audio cache entries")
-	if err := fs.Parse(args); err != nil {
+	if err := parseSessionAwareFlags("clean", fs, args, &flags.sessionID); err != nil {
-		return fmt.Errorf("clean: invalid flags: %w", err)
+		return err
 	}
 	if fs.NArg() != 0 {
 		return fmt.Errorf("clean: unexpected positional arguments")
 	}
 	if all {
 		return cleanAllLocal(flags, dryRun, clearCache, out)
@@ -40,9 +37,9 @@ func Clean(ctx context.Context, args []string, out io.Writer) error {
 func cleanSession(ctx context.Context, flags commonConfigFlags, dryRun, clearCache bool, out io.Writer) error {
 	if strings.TrimSpace(flags.sessionID) == "" {
-		return fmt.Errorf("clean: --session-id is required unless --all is set")
+		return fmt.Errorf("clean: session_id is required unless --all is set")
 	}
-	cfg, err := loadCommandConfig(ctx, flags.pipelinePath, flags.campaignPath, flags.sessionPath, flags.sessionOptions())
+	cfg, err := loadCommandConfig(ctx, flags.pipelinePath, flags.campaignPath, flags.campaignFilePath, flags.sessionPath, flags.sessionOptions())
 	if err != nil {
 		return fmt.Errorf("clean: %w", err)
 	}
@@ -82,10 +79,11 @@ func cleanSession(ctx context.Context, flags commonConfigFlags, dryRun, clearCac
 func cleanAllLocal(flags commonConfigFlags, dryRun, clearCache bool, out io.Writer) error {
 	if strings.TrimSpace(flags.campaignPath) != "" ||
 		strings.TrimSpace(flags.campaignFilePath) != "" ||
 		strings.TrimSpace(flags.sessionPath) != "" ||
 		strings.TrimSpace(flags.sessionID) != "" ||
 		strings.TrimSpace(flags.previousSessionID) != "" {
-		return fmt.Errorf("clean: --all cannot be combined with --campaign, --session, --session-id, or --previous-session-id")
+		return fmt.Errorf("clean: --all cannot be combined with --campaign, --campaign-file, --session, a session_id, or --previous-session-id")
 	}
 	resolvedPipelinePath, err := resolvePipelineConfigPath(flags.pipelinePath)
 	if err != nil {
@@ -171,26 +169,12 @@ func reportCleanRootChildren(out io.Writer, root, policy string, dryRun bool) er
 }
 func cleanableRootChildren(root, policy string) (string, []string, error) {
-	cleanRoot := strings.TrimSpace(root)
+	rootAbs, exists, err := validateCleanRoot(root, policy)
 	if cleanRoot == "" {
 		return "", nil, fmt.Errorf("cleanup policy %s: root path is required", policy)
 	}
 	rootAbs, err := filepath.Abs(cleanRoot)
 	if err != nil {
-		return "", nil, fmt.Errorf("cleanup policy %s: resolve root %q: %w", policy, cleanRoot, err)
+		return "", nil, err
 	}
-	info, err := os.Lstat(rootAbs)
+	if !exists {
-	if err != nil {
+		return rootAbs, nil, nil
 		if os.IsNotExist(err) {
 			return rootAbs, nil, nil
 		}
 		return "", nil, fmt.Errorf("cleanup policy %s: stat root %q: %w", policy, rootAbs, err)
 	}
 	if info.Mode()&os.ModeSymlink != 0 {
 		return "", nil, fmt.Errorf("cleanup policy %s: refusing to clean symlink root %q", policy, rootAbs)
 	}
 	if !info.IsDir() {
 		return "", nil, fmt.Errorf("cleanup policy %s: root %q is not a directory", policy, rootAbs)
 	}
 	entries, err := os.ReadDir(rootAbs)
 	if err != nil {
@@ -289,46 +273,7 @@ func reportCleanScopedFile(out io.Writer, root, target, policy string, dryRun bo
 }
 func validateScopedFile(root, target, policy string) (scopedDir, error) {
-	cleanRoot := strings.TrimSpace(root)
+	return validateScopedTarget(root, target, policy, false)
 	cleanTarget := strings.TrimSpace(target)
 	if cleanRoot == "" {
 		return scopedDir{}, fmt.Errorf("cleanup policy %s: root path is required", policy)
 	}
 	if cleanTarget == "" {
 		return scopedDir{}, fmt.Errorf("cleanup policy %s: target path is required", policy)
 	}
 	rootAbs, err := filepath.Abs(cleanRoot)
 	if err != nil {
 		return scopedDir{}, fmt.Errorf("cleanup policy %s: resolve root %q: %w", policy, cleanRoot, err)
 	}
 	targetAbs, err := filepath.Abs(cleanTarget)
 	if err != nil {
 		return scopedDir{}, fmt.Errorf("cleanup policy %s: resolve target %q: %w", policy, cleanTarget, err)
 	}
 	rel, err := filepath.Rel(rootAbs, targetAbs)
 	if err != nil {
 		return scopedDir{}, fmt.Errorf("cleanup policy %s: relative path from %q to %q: %w", policy, rootAbs, targetAbs, err)
 	}
 	if rel == "." {
 		return scopedDir{}, fmt.Errorf("cleanup policy %s: refusing to delete root directory %q", policy, rootAbs)
 	}
 	if rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) {
 		return scopedDir{}, fmt.Errorf("cleanup policy %s: refusing to delete path outside root: root=%q target=%q", policy, rootAbs, targetAbs)
 	}
 	info, err := os.Lstat(targetAbs)
 	if err != nil {
 		if os.IsNotExist(err) {
 			return scopedDir{RootAbs: rootAbs, TargetAbs: targetAbs, Exists: false}, nil
 		}
 		return scopedDir{}, fmt.Errorf("cleanup policy %s: stat target %q: %w", policy, targetAbs, err)
 	}
 	if info.Mode()&os.ModeSymlink != 0 {
 		return scopedDir{}, fmt.Errorf("cleanup policy %s: refusing to delete symlink path %q", policy, targetAbs)
 	}
 	if info.IsDir() {
 		return scopedDir{}, fmt.Errorf("cleanup policy %s: target %q is a directory", policy, targetAbs)
 	}
 	return scopedDir{RootAbs: rootAbs, TargetAbs: targetAbs, Exists: true}, nil
 }
 func cleanIsFlac(path string) bool {
--- a/internal/app/clean_test.go
+++ b/internal/app/clean_test.go
@@ -26,7 +26,7 @@ func TestExecuteCleanSessionDeletesWorkAndSpoolButPreservesCache(t *testing.T) {
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"clean", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "--session-id", "2026-05-03"}, &stdout, &stderr)
+	code := Execute([]string{"clean", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
@@ -48,7 +48,7 @@ func TestExecuteCleanSessionDryRunDeletesNothing(t *testing.T) {
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"clean", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "--session-id", "2026-05-03", "--dry-run"}, &stdout, &stderr)
+	code := Execute([]string{"clean", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath, "--dry-run"}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
@@ -65,7 +65,7 @@ func TestExecuteCleanMissingSessionPathsSucceeds(t *testing.T) {
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"clean", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "--session-id", "2026-05-03"}, &stdout, &stderr)
+	code := Execute([]string{"clean", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
@@ -105,7 +105,7 @@ inputs:
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"clean", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "--session-id", "2026-05-03", "--clear-cache"}, &stdout, &stderr)
+	code := Execute([]string{"clean", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath, "--clear-cache"}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
@@ -122,7 +122,7 @@ func TestExecuteCleanLocalAudioClearCacheIsNoop(t *testing.T) {
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"clean", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "--session-id", "2026-05-03", "--clear-cache"}, &stdout, &stderr)
+	code := Execute([]string{"clean", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath, "--clear-cache"}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
@@ -184,7 +184,7 @@ func TestExecuteCleanAllRejectsSessionScopedFlags(t *testing.T) {
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"clean", "--config", pipelinePath, "--campaign", campaignPath, "--all"}, &stdout, &stderr)
+	code := Execute([]string{"clean", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--all"}, &stdout, &stderr)
 	if code == 0 {
 		t.Fatal("exit code = 0, want non-zero")
 	}
@@ -200,7 +200,7 @@ func TestCleanRequiresSessionID(t *testing.T) {
 	if code == 0 {
 		t.Fatal("exit code = 0, want non-zero")
 	}
-	if !strings.Contains(stderr.String(), "--session-id is required unless --all is set") {
+	if !strings.Contains(stderr.String(), "session_id is required unless --all is set") {
 		t.Fatalf("stderr = %q, want missing session-id", stderr.String())
 	}
 }
--- a/internal/app/cleanup_targets.go
+++ b/internal/app/cleanup_targets.go
@@ -0,0 +1,82 @@
 package app
 import (
 	"fmt"
 	"os"
 	"path/filepath"
 	"strings"
 )
 func validateScopedTarget(root, target, policy string, requireDir bool) (scopedDir, error) {
 	cleanRoot := strings.TrimSpace(root)
 	cleanTarget := strings.TrimSpace(target)
 	if cleanRoot == "" {
 		return scopedDir{}, fmt.Errorf("cleanup policy %s: root path is required", policy)
 	}
 	if cleanTarget == "" {
 		return scopedDir{}, fmt.Errorf("cleanup policy %s: target path is required", policy)
 	}
 	rootAbs, err := filepath.Abs(cleanRoot)
 	if err != nil {
 		return scopedDir{}, fmt.Errorf("cleanup policy %s: resolve root %q: %w", policy, cleanRoot, err)
 	}
 	targetAbs, err := filepath.Abs(cleanTarget)
 	if err != nil {
 		return scopedDir{}, fmt.Errorf("cleanup policy %s: resolve target %q: %w", policy, cleanTarget, err)
 	}
 	rel, err := filepath.Rel(rootAbs, targetAbs)
 	if err != nil {
 		return scopedDir{}, fmt.Errorf("cleanup policy %s: relative path from %q to %q: %w", policy, rootAbs, targetAbs, err)
 	}
 	if rel == "." {
 		return scopedDir{}, fmt.Errorf("cleanup policy %s: refusing to delete root directory %q", policy, rootAbs)
 	}
 	if rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) {
 		return scopedDir{}, fmt.Errorf("cleanup policy %s: refusing to delete path outside root: root=%q target=%q", policy, rootAbs, targetAbs)
 	}
 	info, err := os.Lstat(targetAbs)
 	if err != nil {
 		if os.IsNotExist(err) {
 			return scopedDir{RootAbs: rootAbs, TargetAbs: targetAbs, Exists: false}, nil
 		}
 		return scopedDir{}, fmt.Errorf("cleanup policy %s: stat target %q: %w", policy, targetAbs, err)
 	}
 	if info.Mode()&os.ModeSymlink != 0 {
 		return scopedDir{}, fmt.Errorf("cleanup policy %s: refusing to delete symlink path %q", policy, targetAbs)
 	}
 	if requireDir && !info.IsDir() {
 		return scopedDir{}, fmt.Errorf("cleanup policy %s: target %q is not a directory", policy, targetAbs)
 	}
 	if !requireDir && info.IsDir() {
 		return scopedDir{}, fmt.Errorf("cleanup policy %s: target %q is a directory", policy, targetAbs)
 	}
 	return scopedDir{RootAbs: rootAbs, TargetAbs: targetAbs, Exists: true}, nil
 }
 func validateCleanRoot(root, policy string) (string, bool, error) {
 	cleanRoot := strings.TrimSpace(root)
 	if cleanRoot == "" {
 		return "", false, fmt.Errorf("cleanup policy %s: root path is required", policy)
 	}
 	rootAbs, err := filepath.Abs(cleanRoot)
 	if err != nil {
 		return "", false, fmt.Errorf("cleanup policy %s: resolve root %q: %w", policy, cleanRoot, err)
 	}
 	info, err := os.Lstat(rootAbs)
 	if err != nil {
 		if os.IsNotExist(err) {
 			return rootAbs, false, nil
 		}
 		return "", false, fmt.Errorf("cleanup policy %s: stat root %q: %w", policy, rootAbs, err)
 	}
 	if info.Mode()&os.ModeSymlink != 0 {
 		return "", false, fmt.Errorf("cleanup policy %s: refusing to clean symlink root %q", policy, rootAbs)
 	}
 	if !info.IsDir() {
 		return "", false, fmt.Errorf("cleanup policy %s: root %q is not a directory", policy, rootAbs)
 	}
 	return rootAbs, true, nil
 }
--- a/internal/app/cleanup_targets_test.go
+++ b/internal/app/cleanup_targets_test.go
@@ -0,0 +1,103 @@
 package app
 import (
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 )
 func TestCleanValidateScopedDirAndFile(t *testing.T) {
 	root := t.TempDir()
 	dirTarget := filepath.Join(root, "runs", "run-1")
 	fileTarget := filepath.Join(root, "cache", "a.flac")
 	if err := os.MkdirAll(dirTarget, 0o755); err != nil {
 		t.Fatalf("MkdirAll(dirTarget) error = %v", err)
 	}
 	if err := os.MkdirAll(filepath.Dir(fileTarget), 0o755); err != nil {
 		t.Fatalf("MkdirAll(file parent) error = %v", err)
 	}
 	if err := os.WriteFile(fileTarget, []byte("audio"), 0o644); err != nil {
 		t.Fatalf("WriteFile(fileTarget) error = %v", err)
 	}
 	if _, err := validateScopedDir(root, dirTarget, "test.dir"); err != nil {
 		t.Fatalf("validateScopedDir() error = %v", err)
 	}
 	if _, err := validateScopedFile(root, fileTarget, "test.file"); err != nil {
 		t.Fatalf("validateScopedFile() error = %v", err)
 	}
 }
 func TestCleanValidateScopedTargetSafetyRules(t *testing.T) {
 	root := t.TempDir()
 	outside := t.TempDir()
 	target := filepath.Join(root, "runs", "run-1")
 	if err := os.MkdirAll(target, 0o755); err != nil {
 		t.Fatalf("MkdirAll(target) error = %v", err)
 	}
 	fileTarget := filepath.Join(root, "cache", "a.flac")
 	if err := os.MkdirAll(filepath.Dir(fileTarget), 0o755); err != nil {
 		t.Fatalf("MkdirAll(file parent) error = %v", err)
 	}
 	if err := os.WriteFile(fileTarget, []byte("audio"), 0o644); err != nil {
 		t.Fatalf("WriteFile(fileTarget) error = %v", err)
 	}
 	symlinkTarget := filepath.Join(root, "symlink")
 	if err := os.Symlink(target, symlinkTarget); err != nil {
 		t.Fatalf("Symlink() error = %v", err)
 	}
 	if _, err := validateScopedDir(root, root, "test.root"); err == nil || !strings.Contains(err.Error(), "refusing to delete root directory") {
 		t.Fatalf("validateScopedDir(root) error = %v, want root deletion rejection", err)
 	}
 	if _, err := validateScopedDir(root, filepath.Join(outside, "x"), "test.outside"); err == nil || !strings.Contains(err.Error(), "outside root") {
 		t.Fatalf("validateScopedDir(outside) error = %v, want outside-root rejection", err)
 	}
 	if _, err := validateScopedDir(root, fileTarget, "test.file-as-dir"); err == nil || !strings.Contains(err.Error(), "is not a directory") {
 		t.Fatalf("validateScopedDir(file) error = %v, want not-a-directory rejection", err)
 	}
 	if _, err := validateScopedFile(root, target, "test.dir-as-file"); err == nil || !strings.Contains(err.Error(), "is a directory") {
 		t.Fatalf("validateScopedFile(dir) error = %v, want is-a-directory rejection", err)
 	}
 	if _, err := validateScopedDir(root, symlinkTarget, "test.symlink"); err == nil || !strings.Contains(err.Error(), "refusing to delete symlink path") {
 		t.Fatalf("validateScopedDir(symlink) error = %v, want symlink rejection", err)
 	}
 }
 func TestCleanableRootChildrenRejectsSymlinkChild(t *testing.T) {
 	root := t.TempDir()
 	realChild := filepath.Join(root, "runs")
 	if err := os.MkdirAll(realChild, 0o755); err != nil {
 		t.Fatalf("MkdirAll(realChild) error = %v", err)
 	}
 	if err := os.Symlink(realChild, filepath.Join(root, "link")); err != nil {
 		t.Fatalf("Symlink() error = %v", err)
 	}
 	_, _, err := cleanableRootChildren(root, "test.root.children")
 	if err == nil || !strings.Contains(err.Error(), "refusing to delete symlink path") {
 		t.Fatalf("cleanableRootChildren() error = %v, want symlink rejection", err)
 	}
 }
 func TestCleanValidateScopedTargetMissing(t *testing.T) {
 	root := t.TempDir()
 	missingDir := filepath.Join(root, "runs", "missing")
 	got, err := validateScopedDir(root, missingDir, "test.missing")
 	if err != nil {
 		t.Fatalf("validateScopedDir(missing) error = %v", err)
 	}
 	if got.Exists {
 		t.Fatalf("validateScopedDir(missing).Exists = true, want false")
 	}
 	missingFile := filepath.Join(root, "cache", "missing.flac")
 	got, err = validateScopedFile(root, missingFile, "test.missing.file")
 	if err != nil {
 		t.Fatalf("validateScopedFile(missing) error = %v", err)
 	}
 	if got.Exists {
 		t.Fatalf("validateScopedFile(missing).Exists = true, want false")
 	}
 }
--- a/internal/app/commands.go
+++ b/internal/app/commands.go
@@ -7,7 +7,7 @@ import (
 	"strings"
 )
-var supportedCommands = []string{"run", "plan", "status", "resume", "run-stage", "analyze", "restore", "session", "artifacts", "locks", "clean"}
+var supportedCommands = []string{"run", "run-stage", "resume", "analyze", "publish", "clean", "session"}
 // Execute dispatches CLI commands and returns a process exit code.
 func Execute(args []string, stdout, stderr io.Writer) int {
@@ -24,24 +24,16 @@ func Execute(args []string, stdout, stderr io.Writer) int {
 	switch cmd {
 	case "run":
 		err = Run(ctx, cmdArgs, stdout)
 	case "plan":
 		err = Plan(ctx, cmdArgs, stdout)
 	case "status":
 		err = Status(ctx, cmdArgs, stdout)
 	case "resume":
 		err = Resume(ctx, cmdArgs, stdout)
 	case "run-stage":
 		err = RunStage(ctx, cmdArgs, stdout)
 	case "analyze":
 		err = Analyze(ctx, cmdArgs, stdout)
-	case "restore":
+	case "publish":
-		err = Restore(ctx, cmdArgs, stdout)
+		err = Publish(ctx, cmdArgs, stdout)
 	case "session":
 		err = Session(ctx, cmdArgs, stdout)
 	case "artifacts":
 		err = Artifacts(ctx, cmdArgs, stdout)
 	case "locks":
 		err = Locks(ctx, cmdArgs, stdout)
 	case "clean":
 		err = Clean(ctx, cmdArgs, stdout)
 	default:
--- a/internal/app/commands_test.go
+++ b/internal/app/commands_test.go
@@ -25,18 +25,17 @@ func TestExecuteValidCommands(t *testing.T) {
 	defer srv.Close()
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot, srv.URL)
 	manifestPath := writeManifestPathForExecute(t)
 	cases := []struct {
 		name    string
 		args    []string
 		wantOut string
 	}{
-		{name: "run", args: []string{"run", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath}, wantOut: "narratio run: session 2026-05-03; executed=9 skipped=0; manifest="},
+		{name: "run", args: []string{"run", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath}, wantOut: "narratio run: session 2026-05-03; executed=9 skipped=0; manifest="},
-		{name: "plan", args: []string{"plan", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath}, wantOut: "prepare: skip\ntranscribe: skip\nmerge: skip\npolish: skip\nnormalize: skip\ntrim: skip\nanalyze: skip\narchive: skip\nnotify: skip"},
+		{name: "session plan", args: []string{"session", "plan", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath}, wantOut: "prepare: skip\ntranscribe: skip\nmerge: skip\npolish: skip\nnormalize: skip\ntrim: skip\nanalyze: skip\npublish: skip\nnotify: skip"},
-		{name: "status", args: []string{"status", "--manifest", manifestPath}, wantOut: "session_id: 2026-05-03"},
+		{name: "session status", args: []string{"session", "status", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath}, wantOut: "Session: 2026-05-03"},
-		{name: "resume", args: []string{"resume", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath}, wantOut: "narratio resume: session 2026-05-03 has no remaining stages"},
+		{name: "resume", args: []string{"resume", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath}, wantOut: "narratio resume: session 2026-05-03 has no remaining stages"},
-		{name: "run-stage", args: []string{"run-stage", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "polish"}, wantOut: "narratio run-stage: stage=polish executed=0 skipped=1 force=false; manifest="},
+		{name: "run-stage", args: []string{"run-stage", "polish", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath}, wantOut: "narratio run-stage: stage=polish executed=0 skipped=1 force=false; manifest="},
 	}
 	for _, tc := range cases {
@@ -64,13 +63,13 @@ func TestExecuteMissingRequiredFlags(t *testing.T) {
 		args []string
 		want string
 	}{
-		{name: "run missing flags", args: []string{"run"}, want: "run: no pipeline config path provided and no default pipeline config found; searched:"},
+		{name: "run missing session", args: []string{"run"}, want: "run: session_id is required"},
-		{name: "plan missing flags", args: []string{"plan"}, want: "plan: no pipeline config path provided and no default pipeline config found; searched:"},
+		{name: "plan old top-level removed", args: []string{"plan"}, want: `unknown command: "plan"`},
-		{name: "status missing flags", args: []string{"status"}, want: "status: --manifest is required"},
+		{name: "status old top-level removed", args: []string{"status"}, want: `unknown command: "status"`},
-		{name: "resume missing flags", args: []string{"resume"}, want: "resume: no pipeline config path provided and no default pipeline config found; searched:"},
+		{name: "resume missing session", args: []string{"resume"}, want: "resume: session_id is required"},
-		{name: "run-stage missing name", args: []string{"run-stage", "--config", "a", "--session", "b"}, want: "run-stage: expected exactly one stage name"},
+		{name: "run-stage missing name", args: []string{"run-stage", "--config", "a", "--session", "b"}, want: "run-stage: expected stage name and session_id"},
-		{name: "run-stage missing config flags", args: []string{"run-stage", "polish"}, want: "run-stage: no pipeline config path provided and no default pipeline config found; searched:"},
+		{name: "run-stage missing session", args: []string{"run-stage", "polish"}, want: "run-stage: expected stage name and session_id"},
-		{name: "run missing config uses defaults", args: []string{"run", "--session", "session.yml"}, want: "run: no pipeline config path provided and no default pipeline config found; searched:"},
+		{name: "run missing config uses defaults", args: []string{"run", "2026-05-03", "--session", "session.yml"}, want: "run: no pipeline config path provided and no default pipeline config found; searched:"},
 	}
 	for _, tc := range cases {
@@ -99,7 +98,7 @@ func TestExecuteRunStageUnknownFails(t *testing.T) {
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"run-stage", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "unknown"}, &stdout, &stderr)
+	code := Execute([]string{"run-stage", "unknown", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath}, &stdout, &stderr)
 	if code == 0 {
 		t.Fatal("exit code = 0, want non-zero")
 	}
@@ -108,16 +107,32 @@ func TestExecuteRunStageUnknownFails(t *testing.T) {
 	}
 }
-func TestExecuteRunStageNormalizeIsAccepted(t *testing.T) {
+func TestExecuteRunStageArchiveAliasFails(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot, "https://example.com/transcribe")
 	workRoot := filepath.Join(workspaceRoot, "work", "sample-campaign", "2026-05-03")
 	mustWriteTestFile(t, filepath.Join(workRoot, "transcripts", "processed.json"), `{"segments":[{"id":1}]}`)
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"run-stage", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "normalize"}, &stdout, &stderr)
+	code := Execute([]string{"run-stage", "archive", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath}, &stdout, &stderr)
 	if code == 0 {
 		t.Fatal("exit code = 0, want non-zero")
 	}
 	if !strings.Contains(stderr.String(), `unknown stage "archive"`) {
 		t.Fatalf("stderr = %q, want unknown stage alias error", stderr.String())
 	}
 }
 func TestExecuteRunStageNormalizeIsAccepted(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot, "https://example.com/transcribe")
 	workRoot := filepath.Join(workspaceRoot, "work", "sample-campaign", "2026-05-03")
 	mustWriteTestFile(t, filepath.Join(workRoot, "transcripts", "polished.json"), `{"segments":[{"id":1}]}`)
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute([]string{"run-stage", "normalize", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
@@ -141,14 +156,14 @@ func TestExecuteRunStageTranscribeUsesConfiguredWhisperXServer(t *testing.T) {
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"run-stage", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "prepare"}, &stdout, &stderr)
+	code := Execute([]string{"run-stage", "prepare", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("prepare exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
 	stdout.Reset()
 	stderr.Reset()
-	code = Execute([]string{"run-stage", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "--force", "transcribe"}, &stdout, &stderr)
+	code = Execute([]string{"run-stage", "transcribe", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath, "--force"}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("transcribe exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
@@ -203,8 +218,6 @@ seriatim:
 audita:
  binary: ` + auditaBinary + `
  llm_api_key_env: OPENROUTER_API_KEY
 analyzer:
  timeout: 20m
 notification:
  timeout: 10s
 `
@@ -235,12 +248,12 @@ inputs:
 	})
 	workRoot := filepath.Join(workspaceRoot, "work", "sample-campaign", sessionID)
-	mustWriteTestFile(t, filepath.Join(workRoot, "transcripts", "merged.json"), `{"schema":"seriatim-intermediate","segments":[]}`)
+	mustWriteTestFile(t, filepath.Join(workRoot, "transcripts", "base.json"), `{"schema":"seriatim-intermediate","segments":[]}`)
 	mustWriteTestFile(t, filepath.Join(workRoot, "inputs", "glossary.yml"), "[]\n")
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"run-stage", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "--force", "polish"}, &stdout, &stderr)
+	code := Execute([]string{"run-stage", "polish", sessionID, "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath, "--force"}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
@@ -268,8 +281,6 @@ seriatim:
  binary: seriatim
 audita:
  binary: audita
 analyzer:
  timeout: 20m
 notification:
  timeout: 10s
 `
@@ -290,7 +301,7 @@ inputs:
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"run", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath}, &stdout, &stderr)
+	code := Execute([]string{"run", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath}, &stdout, &stderr)
 	if code == 0 {
 		t.Fatal("exit code = 0, want non-zero")
 	}
@@ -309,17 +320,15 @@ func TestExecuteUsesDefaultPipelineConfigPathWhenConfigFlagOmitted(t *testing.T)
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot, srv.URL)
 	originalDefaults := append([]string(nil), config.DefaultPipelineConfigSearchPaths...)
 	originalCampaignDefaults := append([]string(nil), config.DefaultCampaignConfigSearchPaths...)
 	config.DefaultPipelineConfigSearchPaths = []string{pipelinePath}
 	config.DefaultCampaignConfigSearchPaths = []string{campaignPath}
 	defer func() {
 		config.DefaultPipelineConfigSearchPaths = originalDefaults
 		config.DefaultCampaignConfigSearchPaths = originalCampaignDefaults
 	}()
 	_ = campaignPath
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"run", "--session", sessionPath}, &stdout, &stderr)
+	code := Execute([]string{"run", "2026-05-03", "--session", sessionPath}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
@@ -328,30 +337,83 @@ func TestExecuteUsesDefaultPipelineConfigPathWhenConfigFlagOmitted(t *testing.T)
 	}
 }
-func TestExecuteMissingCampaignConfigReportsSearchedPaths(t *testing.T) {
+func TestExecuteMissingCampaignConfigReportsRegistryPath(t *testing.T) {
 	workspaceRoot := t.TempDir()
-	pipelinePath, _, sessionPath := writeValidConfigFiles(t, workspaceRoot)
+	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
-	missingCampaignPath := filepath.Join(t.TempDir(), "campaign.yml")
+	if err := os.Remove(campaignPath); err != nil {
-	originalCampaignDefaults := append([]string(nil), config.DefaultCampaignConfigSearchPaths...)
+		t.Fatalf("remove campaign config: %v", err)
-	config.DefaultCampaignConfigSearchPaths = []string{missingCampaignPath}
+	}
 	defer func() {
 		config.DefaultCampaignConfigSearchPaths = originalCampaignDefaults
 	}()
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"run", "--config", pipelinePath, "--session", sessionPath}, &stdout, &stderr)
+	code := Execute([]string{"run", "2026-05-03", "--config", pipelinePath, "--session", sessionPath}, &stdout, &stderr)
 	if code == 0 {
 		t.Fatal("exit code = 0, want non-zero")
 	}
 	if stdout.Len() != 0 {
 		t.Fatalf("stdout = %q, want empty", stdout.String())
 	}
-	if !strings.Contains(stderr.String(), "no campaign config path provided and no default campaign config found; searched:") {
+	if !strings.Contains(stderr.String(), "load campaign config") {
 		t.Fatalf("stderr = %q, want campaign discovery failure", stderr.String())
 	}
-	if !strings.Contains(stderr.String(), "pass --campaign") {
+	if !strings.Contains(stderr.String(), filepath.ToSlash(filepath.Join("campaigns", "sample-campaign", "campaign.yml"))) {
-		t.Fatalf("stderr = %q, want explicit campaign guidance", stderr.String())
+		t.Fatalf("stderr = %q, want campaign registry path", stderr.String())
 	}
 }
 func TestExecuteUsesPipelineDefaultCampaignID(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, _, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute([]string{"session", "status", "2026-05-03", "--config", pipelinePath, "--session", sessionPath}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
 	if !strings.Contains(stdout.String(), "Campaign: sample-campaign") {
 		t.Fatalf("stdout = %q, want default campaign", stdout.String())
 	}
 }
 func TestExecuteCampaignIDSelectsRegistryCampaign(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 	campaignRoot := filepath.Dir(filepath.Dir(campaignPath))
 	otherDir := filepath.Join(campaignRoot, "icewind")
 	mustWriteTestFile(t, filepath.Join(otherDir, "campaign.yml"), `campaign_id: icewind
 inputs:
  speakers_file: ./speakers.yml
  autocorrect_file: ./autocorrect.yml
  glossary_file: ./glossary.yml
 `)
 	mustWriteTestFile(t, filepath.Join(otherDir, "speakers.yml"), "match:\n  - speaker: Alice\n    match: [\"alice\"]\n")
 	mustWriteTestFile(t, filepath.Join(otherDir, "autocorrect.yml"), "[]\n")
 	mustWriteTestFile(t, filepath.Join(otherDir, "glossary.yml"), "[]\n")
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute([]string{"session", "status", "2026-05-03", "--config", pipelinePath, "--campaign", "icewind", "--session", sessionPath}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
 	if !strings.Contains(stdout.String(), "Campaign: icewind") {
 		t.Fatalf("stdout = %q, want selected campaign", stdout.String())
 	}
 }
 func TestExecuteRejectsCampaignIDAndCampaignFile(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute([]string{"session", "status", "2026-05-03", "--config", pipelinePath, "--campaign", "sample-campaign", "--campaign-file", campaignPath, "--session", sessionPath}, &stdout, &stderr)
 	if code == 0 {
 		t.Fatal("exit code = 0, want non-zero")
 	}
 	if !strings.Contains(stderr.String(), "mutually exclusive") {
 		t.Fatalf("stderr = %q, want mutually exclusive error", stderr.String())
 	}
 }
@@ -396,7 +458,9 @@ func writeValidConfigFiles(t *testing.T, workspaceRoot string, transcribeURL ...
 	dir := t.TempDir()
 	pipelinePath := filepath.Join(dir, "pipeline.yml")
-	campaignPath := filepath.Join(dir, "campaign.yml")
+	campaignRoot := filepath.Join(dir, "campaigns")
 	campaignDir := filepath.Join(campaignRoot, "sample-campaign")
 	campaignPath := filepath.Join(campaignDir, "campaign.yml")
 	sessionPath := filepath.Join(dir, "session.yml")
 	url := "https://example.com/transcribe"
 	if len(transcribeURL) > 0 && strings.TrimSpace(transcribeURL[0]) != "" {
@@ -410,6 +474,9 @@ func writeValidConfigFiles(t *testing.T, workspaceRoot string, transcribeURL ...
 	pipelineYAML := `workspace:
  root: ` + workspaceRoot + `
 campaigns:
  root: ` + campaignRoot + `
  default_campaign_id: sample-campaign
 cache:
  root: ` + filepath.Join(workspaceRoot, "cache") + `
 spool:
@@ -418,7 +485,7 @@ storage:
  backend: s3
  s3:
    bucket: test-bucket
-archive:
+publish:
  enabled: true
  upload_run: false
 whisperx:
@@ -435,10 +502,6 @@ seriatim:
  report: true
 audita:
  binary: ` + auditaBinary + `
 analyzer:
  timeout: 20m
  artifacts:
    output_dir: artifacts
 notification:
  timeout: 10s
 `
@@ -447,7 +510,7 @@ notification:
 inputs:
  audio_dir: ./audio
 `
-	campaignYAML := `campaign: sample-campaign
+	campaignYAML := `campaign_id: sample-campaign
 inputs:
  speakers_file: ./speakers.yml
  autocorrect_file: ./autocorrect.yml
@@ -457,6 +520,9 @@ inputs:
 	if err := os.WriteFile(pipelinePath, []byte(pipelineYAML), 0o644); err != nil {
 		t.Fatalf("write pipeline config: %v", err)
 	}
 	if err := os.MkdirAll(campaignDir, 0o755); err != nil {
 		t.Fatalf("create campaign dir: %v", err)
 	}
 	if err := os.WriteFile(campaignPath, []byte(campaignYAML), 0o644); err != nil {
 		t.Fatalf("write campaign config: %v", err)
 	}
@@ -464,9 +530,9 @@ inputs:
 		t.Fatalf("write session config: %v", err)
 	}
-	mustWriteTestFile(t, filepath.Join(dir, "speakers.yml"), "match:\n  - speaker: Alice\n    match: [\"alice\"]\n")
+	mustWriteTestFile(t, filepath.Join(campaignDir, "speakers.yml"), "match:\n  - speaker: Alice\n    match: [\"alice\"]\n")
-	mustWriteTestFile(t, filepath.Join(dir, "autocorrect.yml"), "[]\n")
+	mustWriteTestFile(t, filepath.Join(campaignDir, "autocorrect.yml"), "[]\n")
-	mustWriteTestFile(t, filepath.Join(dir, "glossary.yml"), "[]\n")
+	mustWriteTestFile(t, filepath.Join(campaignDir, "glossary.yml"), "[]\n")
 	mustWriteTestFile(t, filepath.Join(dir, "audio", "alice.flac"), "audio-bytes")
 	return pipelinePath, campaignPath, sessionPath
@@ -475,7 +541,7 @@ inputs:
 func writeAppTestCampaignConfig(t *testing.T, dir string) string {
 	t.Helper()
 	campaignPath := filepath.Join(dir, "campaign.yml")
-	campaignYAML := `campaign: sample-campaign
+	campaignYAML := `campaign_id: sample-campaign
 inputs:
  speakers_file: ./speakers.yml
  autocorrect_file: ./autocorrect.yml
--- a/internal/app/config_loader.go
+++ b/internal/app/config_loader.go
@@ -12,18 +12,21 @@ import (
 	"gitea.maximumdirect.net/eric/narratio/internal/config"
 )
-func loadCommandConfig(ctx context.Context, pipelineFlag, campaignFlag, sessionFlag string, sessionOpts config.SessionLoadOptions) (*config.Config, error) {
+type pipelineCampaignConfig struct {
-	resolvedPipelinePath, err := resolvePipelineConfigPath(pipelineFlag)
+	PipelinePath string
-	if err != nil {
+	CampaignPath string
-		return nil, err
+	Pipeline     *config.PipelineConfig
-	}
+	Campaign     *config.CampaignConfig
-	resolvedCampaignPath, err := resolveCampaignConfigPath(campaignFlag)
+}
 func loadCommandConfig(ctx context.Context, pipelineFlag, campaignFlag, campaignFileFlag, sessionFlag string, sessionOpts config.SessionLoadOptions) (*config.Config, error) {
 	base, err := loadPipelineCampaignConfig(pipelineFlag, campaignFlag, campaignFileFlag)
 	if err != nil {
 		return nil, err
 	}
 	if explicitSession := strings.TrimSpace(sessionFlag); explicitSession != "" {
-		return config.LoadWithSessionOptions(resolvedPipelinePath, resolvedCampaignPath, explicitSession, sessionOpts)
+		return config.LoadWithSessionOptions(base.PipelinePath, base.CampaignPath, explicitSession, sessionOpts)
 	}
 	discoveredSession, err := discoverSessionConfigPathWithCandidates(config.DefaultSessionConfigSearchPaths)
@@ -31,30 +34,21 @@ func loadCommandConfig(ctx context.Context, pipelineFlag, campaignFlag, sessionF
 		return nil, err
 	}
 	if discoveredSession.Path != "" {
-		return config.LoadWithSessionOptions(resolvedPipelinePath, resolvedCampaignPath, discoveredSession.Path, sessionOpts)
+		return config.LoadWithSessionOptions(base.PipelinePath, base.CampaignPath, discoveredSession.Path, sessionOpts)
 	}
 	pipelineCfg, err := config.LoadPipeline(resolvedPipelinePath)
 	if err != nil {
 		return nil, err
 	}
 	campaignCfg, err := config.LoadCampaign(resolvedCampaignPath)
 	if err != nil {
 		return nil, err
 	}
 	sessionID := strings.TrimSpace(sessionOpts.SessionID)
 	if sessionID == "" {
-		return nil, missingSessionConfigError(discoveredSession.Searched, "remote session loading requires --session-id")
+		return nil, missingSessionConfigError(discoveredSession.Searched, "remote session loading requires a session_id")
 	}
-	sessionPrefix := artifacts.S3SessionPrefix(pipelineCfg.Storage.S3.RootPrefix, campaignCfg.Campaign, sessionID)
+	sessionPrefix := artifacts.S3SessionPrefix(base.Pipeline.Storage.S3.RootPrefix, config.CampaignID(base.Campaign), sessionID)
 	remoteKey := artifacts.S3SessionConfigKey(sessionPrefix)
 	partialCfg := &config.Config{
-		Pipeline:     pipelineCfg,
+		Pipeline:     base.Pipeline,
-		Campaign:     campaignCfg,
+		Campaign:     base.Campaign,
-		PipelinePath: resolvedPipelinePath,
+		PipelinePath: base.PipelinePath,
-		CampaignPath: resolvedCampaignPath,
+		CampaignPath: base.CampaignPath,
 	}
 	store, err := newCommandObjectStore(ctx, partialCfg, nil)
 	if err != nil {
@@ -73,22 +67,22 @@ func loadCommandConfig(ctx context.Context, pipelineFlag, campaignFlag, sessionF
 	if err != nil {
 		return nil, fmt.Errorf("read downloaded remote session %q: %w", sessionTempPath, err)
 	}
-	sessionCfg, err := config.LoadSessionBytesWithOptions("s3://"+s3BucketName(pipelineCfg)+"/"+remoteKey, sessionBytes, sessionOpts)
+	sessionCfg, err := config.LoadSessionBytesWithOptions("s3://"+s3BucketName(base.Pipeline)+"/"+remoteKey, sessionBytes, sessionOpts)
 	if err != nil {
 		return nil, err
 	}
 	return config.Resolve(
-		resolvedPipelinePath,
+		base.PipelinePath,
-		pipelineCfg,
+		base.Pipeline,
-		resolvedCampaignPath,
+		base.CampaignPath,
-		campaignCfg,
+		base.Campaign,
 		sessionTempPath,
 		sessionCfg,
 		config.SessionSource{
 			Source:    "session_config.s3",
 			LocalPath: sessionTempPath,
-			S3Bucket:  s3BucketName(pipelineCfg),
+			S3Bucket:  s3BucketName(base.Pipeline),
 			S3Key:     remoteKey,
 			S3Size:    sessionInfo.Size,
 			S3ETag:    sessionInfo.ETag,
@@ -97,6 +91,36 @@ func loadCommandConfig(ctx context.Context, pipelineFlag, campaignFlag, sessionF
 	)
 }
 func loadPipelineCampaignConfig(pipelineFlag, campaignFlag, campaignFileFlag string) (*pipelineCampaignConfig, error) {
 	resolvedPipelinePath, err := resolvePipelineConfigPath(pipelineFlag)
 	if err != nil {
 		return nil, err
 	}
 	pipelineCfg, err := config.LoadPipeline(resolvedPipelinePath)
 	if err != nil {
 		return nil, err
 	}
 	resolvedCampaignPath, err := resolveCampaignConfigPath(pipelineCfg, campaignFlag, campaignFileFlag)
 	if err != nil {
 		return nil, err
 	}
 	campaignCfg, err := config.LoadCampaign(resolvedCampaignPath)
 	if err != nil {
 		return nil, err
 	}
 	if selectedID := strings.TrimSpace(campaignFlag); selectedID != "" && strings.TrimSpace(campaignFileFlag) == "" {
 		if got := config.CampaignID(campaignCfg); got != selectedID {
 			return nil, fmt.Errorf("campaign config %q invalid: campaign_id %q does not match selected campaign %q", resolvedCampaignPath, got, selectedID)
 		}
 	}
 	return &pipelineCampaignConfig{
 		PipelinePath: resolvedPipelinePath,
 		CampaignPath: resolvedCampaignPath,
 		Pipeline:     pipelineCfg,
 		Campaign:     campaignCfg,
 	}, nil
 }
 func findRemoteSessionConfig(ctx context.Context, store storage.ObjectStore, sessionPrefix, remoteKey string) (storage.ObjectInfo, error) {
 	objects, err := store.List(ctx, sessionPrefix)
 	if err != nil {
--- a/internal/app/operator_artifact_rendering.go
+++ b/internal/app/operator_artifact_rendering.go
@@ -0,0 +1,136 @@
 package app
 import (
 	"context"
 	"fmt"
 	"io"
 	"strings"
 	"gitea.maximumdirect.net/eric/narratio/internal/adapters/storage"
 	"gitea.maximumdirect.net/eric/narratio/internal/artifactpolicy"
 	"gitea.maximumdirect.net/eric/narratio/internal/artifacts"
 	"gitea.maximumdirect.net/eric/narratio/internal/config"
 )
 func buildHelperArtifactCatalog(cfg *config.Config) (*artifacts.ArtifactCatalog, error) {
 	catalog := artifacts.NewArtifactCatalog()
 	if err := catalog.RegisterBuiltIns(); err != nil {
 		return nil, err
 	}
 	configured := map[string]artifacts.ConfiguredArtifactDefinition{}
 	if cfg.Pipeline.Scriptorium != nil {
 		for key, item := range cfg.Pipeline.Scriptorium.Artifacts {
 			configured[key] = artifacts.ConfiguredArtifactDefinition{Enabled: item.Enabled, OutputPath: item.OutputPath}
 		}
 	}
 	if err := catalog.RegisterConfiguredArtifacts(configured, nil); err != nil {
 		return nil, err
 	}
 	return catalog, nil
 }
 func writeArtifactList(out io.Writer, cfg *config.Config, catalog *artifacts.ArtifactCatalog, locks *effectiveLocks, publishedRemoteState map[string]string) {
 	lockSet := lockSourceSet(locks.All)
 	fmt.Fprintln(out, "Built-in:")
 	for _, id := range []string{
 		artifacts.ArtifactTranscriptBase,
 		artifacts.ArtifactTranscriptPolished,
 		artifacts.ArtifactTranscriptFinal,
 		artifacts.ArtifactTranscriptFinalTrimmed,
 		artifacts.ArtifactBoundsSession,
 	} {
 		writeArtifactLine(out, id, lockSet)
 	}
 	fmt.Fprintln(out, "Configured:")
 	for _, entry := range catalog.ListConfigured() {
 		writeArtifactLine(out, entry.SourceID, lockSet)
 	}
 	fmt.Fprintln(out, "Previous-session:")
 	for _, req := range artifacts.CollectPreviousArtifactRequirements(configuredScriptoriumArtifacts(cfg)) {
 		fmt.Fprintf(out, "- %s required=%t\n", artifactpolicy.PreviousSessionSourceID(req.Name), req.Required)
 	}
 	fmt.Fprintln(out, "Published:")
 	for _, rule := range cfg.Pipeline.Publish.Outputs {
 		writePublishedOutputLine(out, rule, catalog, lockSet, publishedRemoteState)
 	}
 }
 func writeArtifactLine(out io.Writer, source string, lockSet map[string]config.PublishLockRule) {
 	parts := []string{source}
 	if _, ok := lockSet[source]; ok {
 		parts = append(parts, "locked")
 	}
 	fmt.Fprintf(out, "- %s\n", strings.Join(parts, " "))
 }
 func writePublishedOutputLine(out io.Writer, rule config.PublishOutputRule, catalog *artifacts.ArtifactCatalog, lockSet map[string]config.PublishLockRule, remoteState map[string]string) {
 	source := strings.TrimSpace(rule.Source)
 	parts := []string{source}
 	if _, ok := lockSet[source]; ok {
 		parts = append(parts, "locked")
 	}
 	dest, showDest, err := helperPublishedOutputDest(rule, catalog)
 	if err != nil {
 		parts = append(parts, "remote=error")
 		fmt.Fprintf(out, "- %s\n", strings.Join(parts, " "))
 		return
 	}
 	if showDest {
 		parts = append(parts, "dest="+dest)
 	}
 	if state := remoteState[publishedOutputRemoteStateKey(source, dest)]; state != "" {
 		parts = append(parts, state)
 	}
 	fmt.Fprintf(out, "- %s\n", strings.Join(parts, " "))
 }
 func remotePublishedOutputAvailability(ctx context.Context, cfg *config.Config, store storage.ObjectStore, catalog *artifacts.ArtifactCatalog) map[string]string {
 	out := map[string]string{}
 	sessionPrefix := artifacts.S3SessionPrefix(cfg.Pipeline.Storage.S3.RootPrefix, cfg.Session.Campaign, cfg.Session.SessionID)
 	for _, rule := range cfg.Pipeline.Publish.Outputs {
 		source := strings.TrimSpace(rule.Source)
 		dest, _, err := helperPublishedOutputDest(rule, catalog)
 		if err != nil {
 			out[publishedOutputRemoteStateKey(source, "")] = "remote=error"
 			continue
 		}
 		key := artifacts.S3PublishedOutputKey(sessionPrefix, dest)
 		if exists, err := store.Exists(ctx, key); err == nil && exists {
 			out[publishedOutputRemoteStateKey(source, dest)] = "remote=published"
 		} else if err != nil {
 			out[publishedOutputRemoteStateKey(source, dest)] = "remote=error"
 		} else {
 			out[publishedOutputRemoteStateKey(source, dest)] = "remote=missing"
 		}
 	}
 	return out
 }
 func helperPublishedOutputDest(rule config.PublishOutputRule, catalog *artifacts.ArtifactCatalog) (string, bool, error) {
 	source := strings.TrimSpace(rule.Source)
 	normalized, err := artifactpolicy.ResolvePublishedDestination(source, rule.Dest, helperConfiguredOutputPathMap(catalog))
 	if err != nil {
 		return "", false, err
 	}
 	entry, ok := catalog.Lookup(source)
 	showDest := !ok || strings.TrimSpace(entry.CanonicalRelPath) != normalized
 	return normalized, showDest, nil
 }
 func helperConfiguredOutputPathMap(catalog *artifacts.ArtifactCatalog) map[string]string {
 	out := map[string]string{}
 	if catalog == nil {
 		return out
 	}
 	for _, entry := range catalog.ListConfigured() {
 		if strings.TrimSpace(entry.ConfiguredKey) == "" {
 			continue
 		}
 		out[entry.ConfiguredKey] = strings.TrimSpace(entry.CanonicalRelPath)
 	}
 	return out
 }
 func publishedOutputRemoteStateKey(source, dest string) string {
 	return strings.TrimSpace(source) + "\x00" + strings.TrimSpace(dest)
 }
--- a/internal/app/operator_artifacts_list.go
+++ b/internal/app/operator_artifacts_list.go
@@ -0,0 +1,39 @@
 package app
 import (
 	"context"
 	"flag"
 	"fmt"
 	"io"
 	"strings"
 )
 // ArtifactsList lists effective artifact sources.
 func ArtifactsList(ctx context.Context, args []string, out io.Writer) error {
 	fs := flag.NewFlagSet("artifacts list", flag.ContinueOnError)
 	fs.SetOutput(io.Discard)
 	var flags commonConfigFlags
 	var remote bool
 	addCommonConfigFlags(fs, &flags)
 	fs.BoolVar(&remote, "remote", false, "inspect remote publish availability")
 	if err := parseSessionAwareFlags("artifacts list", fs, args, &flags.sessionID); err != nil {
 		return err
 	}
 	if strings.TrimSpace(flags.sessionID) == "" {
 		return fmt.Errorf("artifacts list: session_id is required")
 	}
 	cfg, store, locks, _, err := loadHelperContext(ctx, flags, remote)
 	if err != nil {
 		return fmt.Errorf("artifacts list: %w", err)
 	}
 	catalog, err := buildHelperArtifactCatalog(cfg)
 	if err != nil {
 		return fmt.Errorf("artifacts list: %w", err)
 	}
 	publishedRemoteState := map[string]string{}
 	if remote && store != nil {
 		publishedRemoteState = remotePublishedOutputAvailability(ctx, cfg, store, catalog)
 	}
 	writeArtifactList(out, cfg, catalog, locks, publishedRemoteState)
 	return nil
 }
--- a/internal/app/operator_findings.go
+++ b/internal/app/operator_findings.go
@@ -0,0 +1,203 @@
 package app
 import (
 	"context"
 	"fmt"
 	"io"
 	"os"
 	"path/filepath"
 	"sort"
 	"strings"
 	"gitea.maximumdirect.net/eric/narratio/internal/adapters/storage"
 	"gitea.maximumdirect.net/eric/narratio/internal/artifacts"
 	"gitea.maximumdirect.net/eric/narratio/internal/config"
 	"gitea.maximumdirect.net/eric/narratio/internal/manifest"
 )
 type finding struct {
 	Severity string
 	Category string
 	Message  string
 }
 type findingError struct {
 	count int
 }
 func (e findingError) Error() string {
 	return fmt.Sprintf("%d validation error(s)", e.count)
 }
 func renderFindings(out io.Writer, campaign, sessionID string, findings []finding) error {
 	if campaign != "" || sessionID != "" {
 		fmt.Fprintf(out, "Campaign: %s\n", campaign)
 		fmt.Fprintf(out, "Session: %s\n\n", sessionID)
 	}
 	errorsCount := 0
 	for _, f := range findings {
 		if f.Severity == "ERROR" {
 			errorsCount++
 		}
 		fmt.Fprintf(out, "%-5s %-10s %s\n", f.Severity, f.Category, f.Message)
 	}
 	if errorsCount > 0 {
 		return findingError{count: errorsCount}
 	}
 	return nil
 }
 func okFinding(category, msg string) finding    { return finding{"OK", category, msg} }
 func infoFinding(category, msg string) finding  { return finding{"INFO", category, msg} }
 func warnFinding(category, msg string) finding  { return finding{"WARN", category, msg} }
 func errorFinding(category, msg string) finding { return finding{"ERROR", category, msg} }
 func sessionSourceSummary(cfg *config.Config) string {
 	source := cfg.SessionSource.Source
 	if source == "" {
 		source = "session_config"
 	}
 	if cfg.SessionSource.S3Key != "" {
 		return source + " " + cfg.SessionSource.S3Key
 	}
 	return source + " " + cfg.SessionPath
 }
 func validateStableInputFindings(cfg *config.Config) []finding {
 	items := []struct {
 		name string
 		in   config.ResolvedInputFile
 	}{
 		{"speakers", cfg.StableInputs.SpeakersFile},
 		{"autocorrect", cfg.StableInputs.AutocorrectFile},
 		{"glossary", cfg.StableInputs.GlossaryFile},
 	}
 	out := make([]finding, 0, len(items))
 	for _, item := range items {
 		path, err := resolveHelperConfigRelativePath(item.in)
 		if err != nil {
 			out = append(out, errorFinding("inputs", item.name+": "+err.Error()))
 			continue
 		}
 		if _, err := os.Stat(path); err != nil {
 			out = append(out, errorFinding("inputs", fmt.Sprintf("%s missing: %v", item.name, err)))
 		} else {
 			out = append(out, okFinding("inputs", item.name+": "+path))
 		}
 	}
 	return out
 }
 func resolveHelperConfigRelativePath(input config.ResolvedInputFile) (string, error) {
 	if strings.TrimSpace(input.ConfigPath) == "" {
 		return "", fmt.Errorf("source config path is required")
 	}
 	path := strings.TrimSpace(input.Path)
 	if path == "" {
 		return "", fmt.Errorf("path is required")
 	}
 	if filepath.IsAbs(path) {
 		return filepath.Clean(path), nil
 	}
 	return filepath.Clean(filepath.Join(filepath.Dir(input.ConfigPath), path)), nil
 }
 func validateLocalAudioFindings(cfg *config.Config) []finding {
 	if cfg.Session.Inputs.AudioS3 != nil {
 		return nil
 	}
 	audioDir := strings.TrimSpace(cfg.Session.Inputs.AudioDir)
 	if audioDir == "" && len(cfg.Session.Inputs.AudioFiles) == 0 {
 		return []finding{errorFinding("audio", "audio_dir, audio_files, or audio_s3 is required")}
 	}
 	base := filepath.Dir(cfg.SessionPath)
 	paths := []string{}
 	if audioDir != "" {
 		dir := audioDir
 		if !filepath.IsAbs(dir) {
 			dir = filepath.Join(base, dir)
 		}
 		matches, err := filepath.Glob(filepath.Join(dir, "*.flac"))
 		if err != nil || len(matches) == 0 {
 			return []finding{errorFinding("audio", "no .flac files found in "+dir)}
 		}
 		paths = append(paths, matches...)
 	}
 	for _, file := range cfg.Session.Inputs.AudioFiles {
 		p := file
 		if !filepath.IsAbs(p) {
 			p = filepath.Join(base, p)
 		}
 		paths = append(paths, p)
 	}
 	for _, p := range paths {
 		if _, err := os.Stat(p); err != nil {
 			return []finding{errorFinding("audio", fmt.Sprintf("audio file missing: %v", err))}
 		}
 	}
 	return []finding{okFinding("audio", fmt.Sprintf("%d local audio file(s)", len(paths)))}
 }
 func validateRemoteAudioFinding(ctx context.Context, cfg *config.Config, store storage.ObjectStore) finding {
 	sessionPrefix := artifacts.S3SessionPrefix(cfg.Pipeline.Storage.S3.RootPrefix, cfg.Session.Campaign, cfg.Session.SessionID)
 	audioPrefix := artifacts.S3AudioPrefix(sessionPrefix, cfg.Session.Inputs.AudioS3.Prefix)
 	objects, err := store.List(ctx, audioPrefix)
 	if err != nil {
 		return errorFinding("audio", err.Error())
 	}
 	count := 0
 	for _, obj := range objects {
 		if strings.HasSuffix(strings.ToLower(obj.Key), ".flac") {
 			count++
 		}
 	}
 	if count == 0 {
 		return errorFinding("audio", "no remote .flac objects found under "+audioPrefix)
 	}
 	return okFinding("audio", fmt.Sprintf("%d remote .flac object(s)", count))
 }
 func validatePreviousArtifactFindings(ctx context.Context, cfg *config.Config, store storage.ObjectStore, requirements []artifacts.PreviousArtifactRequirement) []finding {
 	out := []finding{}
 	prefix := artifacts.S3SessionPrefix(cfg.Pipeline.Storage.S3.RootPrefix, cfg.Session.Campaign, cfg.Session.PreviousSessionID)
 	_, err := artifacts.LoadCurrentState(ctx, store, prefix, artifacts.CurrentStateValidation{
 		ExpectedSessionID: strings.TrimSpace(cfg.Session.PreviousSessionID),
 		ExpectedCampaign:  strings.TrimSpace(cfg.Session.Campaign),
 		ValidateRunID:     true,
 	})
 	if err != nil {
 		out = append(out, errorFinding("previous", fmt.Sprintf("remote %v", err)))
 		return out
 	}
 	for _, req := range requirements {
 		out = append(out, okFinding("previous", fmt.Sprintf("%s required=%t", req.Name, req.Required)))
 	}
 	return out
 }
 func loadLocalManifest(ctx context.Context, path string) (*manifest.Manifest, error) {
 	if _, err := os.Stat(path); err != nil {
 		if os.IsNotExist(err) {
 			return nil, nil
 		}
 		return nil, err
 	}
 	store := &manifest.LocalStore{}
 	return store.Load(ctx, path)
 }
 func writeStageStatuses(out io.Writer, m *manifest.Manifest) {
 	if m == nil || len(m.Stages) == 0 {
 		fmt.Fprintln(out, "stages: no stages recorded")
 		return
 	}
 	fmt.Fprintln(out, "stages:")
 	names := make([]string, 0, len(m.Stages))
 	for name := range m.Stages {
 		names = append(names, name)
 	}
 	sort.Strings(names)
 	for _, name := range names {
 		fmt.Fprintf(out, "- %s: %s\n", name, m.Stages[name].Status)
 	}
 }
--- a/internal/app/operator_helpers.go
+++ b/internal/app/operator_helpers.go
@@ -5,47 +5,30 @@ import (
 	"flag"
 	"fmt"
 	"io"
 	"os"
 	"path/filepath"
 	"regexp"
 	"sort"
 	"strings"
 	"gitea.maximumdirect.net/eric/narratio/internal/adapters/storage"
 	"gitea.maximumdirect.net/eric/narratio/internal/artifacts"
 	"gitea.maximumdirect.net/eric/narratio/internal/config"
 	"gitea.maximumdirect.net/eric/narratio/internal/manifest"
 	"gopkg.in/yaml.v3"
 )
 type commonConfigFlags struct {
 	pipelinePath      string
 	campaignPath      string
 	campaignFilePath  string
 	sessionPath       string
 	sessionID         string
 	previousSessionID string
 }
 type finding struct {
 	Severity string
 	Category string
 	Message  string
 }
 type findingError struct {
 	count int
 }
 func (e findingError) Error() string {
 	return fmt.Sprintf("%d validation error(s)", e.count)
 }
 func addCommonConfigFlags(fs *flag.FlagSet, flags *commonConfigFlags) {
 	fs.StringVar(&flags.pipelinePath, "config", "", "path to pipeline.yml (optional; defaults searched)")
-	fs.StringVar(&flags.campaignPath, "campaign", "", "path to campaign.yml (optional; defaults searched)")
+	fs.StringVar(&flags.campaignPath, "campaign", "", "campaign ID")
 	fs.StringVar(&flags.campaignFilePath, "campaign-file", "", "path to campaign.yml")
 	fs.StringVar(&flags.sessionPath, "session", "", "path to session.yml")
-	fs.StringVar(&flags.sessionID, "session-id", "", "session identifier for session.yml templates")
+	fs.StringVar(&flags.sessionID, "session-id", "", "session identifier")
-	fs.StringVar(&flags.previousSessionID, "previous-session-id", "", "previous session identifier for session.yml templates")
+	fs.StringVar(&flags.previousSessionID, "previous-session-id", "", "expected previous session identifier")
 }
 func (f commonConfigFlags) sessionOptions() config.SessionLoadOptions {
@@ -58,18 +41,42 @@ func (f commonConfigFlags) sessionOptions() config.SessionLoadOptions {
 // Session dispatches session helper subcommands.
 func Session(ctx context.Context, args []string, out io.Writer) error {
 	if len(args) == 0 {
-		return fmt.Errorf("session: expected subcommand: validate|init")
+		return fmt.Errorf("session: expected subcommand: init|validate|status|plan|restore|artifacts|locks")
 	}
 	switch args[0] {
 	case "validate":
 		return SessionValidate(ctx, args[1:], out)
 	case "init":
 		return SessionInit(ctx, args[1:], out)
 	case "validate":
 		return SessionValidate(ctx, args[1:], out)
 	case "status":
 		return Status(ctx, args[1:], out)
 	case "plan":
 		return Plan(ctx, args[1:], out)
 	case "restore":
 		return Restore(ctx, args[1:], out)
 	case "artifacts":
 		return ArtifactsList(ctx, args[1:], out)
 	case "locks":
 		return SessionLocks(ctx, args[1:], out)
 	default:
 		return fmt.Errorf("session: unknown subcommand %q", args[0])
 	}
 }
 // SessionLocks dispatches session-oriented publish lock list and mutation
 // helpers while preserving the existing lock implementations.
 func SessionLocks(ctx context.Context, args []string, out io.Writer) error {
 	if len(args) > 0 && !isCLIFlagToken(args[0]) {
 		switch args[0] {
 		case "add":
 			return LocksAdd(ctx, args[1:], out)
 		case "remove":
 			return LocksRemove(ctx, args[1:], out)
 		}
 	}
 	return LocksList(ctx, args, out)
 }
 // Artifacts dispatches artifact helper subcommands.
 func Artifacts(ctx context.Context, args []string, out io.Writer) error {
 	if len(args) == 0 {
@@ -83,444 +90,8 @@ func Artifacts(ctx context.Context, args []string, out io.Writer) error {
 	}
 }
 // SessionValidate performs a read-only session preflight.
 func SessionValidate(ctx context.Context, args []string, out io.Writer) error {
 	fs := flag.NewFlagSet("session validate", flag.ContinueOnError)
 	fs.SetOutput(io.Discard)
 	var flags commonConfigFlags
 	addCommonConfigFlags(fs, &flags)
 	if err := fs.Parse(args); err != nil {
 		return fmt.Errorf("session validate: invalid flags: %w", err)
 	}
 	if fs.NArg() != 0 {
 		return fmt.Errorf("session validate: unexpected positional arguments")
 	}
 	findings := []finding{}
 	cfg, err := loadCommandConfig(ctx, flags.pipelinePath, flags.campaignPath, flags.sessionPath, flags.sessionOptions())
 	if err != nil {
 		findings = append(findings, errorFinding("config", err.Error()))
 		return renderFindings(out, "", "", findings)
 	}
 	if err := config.Validate(cfg); err != nil {
 		findings = append(findings, errorFinding("config", err.Error()))
 	} else {
 		findings = append(findings, okFinding("config", "resolved pipeline, campaign, and session config"))
 	}
 	findings = append(findings, okFinding("session", fmt.Sprintf("session source: %s", sessionSourceSummary(cfg))))
 	paths := artifacts.NewLocalStore(cfg.Pipeline.Workspace.Root).SessionPathsFor(cfg.Session.Campaign, cfg.Session.SessionID)
 	findings = append(findings, validateStableInputFindings(cfg)...)
 	findings = append(findings, validateLocalAudioFindings(cfg)...)
 	store, storeErr := objectStoreIfConfigured(ctx, cfg)
 	if storeErr != nil {
 		findings = append(findings, errorFinding("storage", storeErr.Error()))
 	}
 	if cfg.Session.Inputs.AudioS3 != nil {
 		if storeErr != nil {
 			findings = append(findings, errorFinding("audio", "remote audio cannot be checked because storage is unavailable"))
 		} else {
 			findings = append(findings, validateRemoteAudioFinding(ctx, cfg, store))
 		}
 	}
 	requirements := artifacts.CollectPreviousArtifactRequirements(configuredScriptoriumArtifacts(cfg))
 	if len(requirements) == 0 {
 		findings = append(findings, okFinding("previous", "no previous-session artifacts required"))
 	} else if strings.TrimSpace(cfg.Session.PreviousSessionID) == "" {
 		findings = append(findings, errorFinding("previous", "previous_session_id is required by configured previous-session artifacts"))
 	} else if storeErr != nil {
 		findings = append(findings, errorFinding("previous", "previous-session artifacts cannot be checked because storage is unavailable"))
 	} else {
 		findings = append(findings, validatePreviousArtifactFindings(ctx, cfg, store, requirements)...)
 	}
 	locks, lockErr := loadEffectiveLocks(ctx, cfg, store)
 	if lockErr != nil {
 		findings = append(findings, errorFinding("locks", lockErr.Error()))
 	} else if len(locks.All) == 0 {
 		findings = append(findings, okFinding("locks", "no effective archive locks"))
 	} else {
 		for _, lock := range locks.All {
 			findings = append(findings, warnFinding("locks", fmt.Sprintf("%s locked: %s", lock.Source, strings.TrimSpace(lock.Reason))))
 		}
 	}
 	if paths.ManifestPath != "" {
 		findings = append(findings, infoFinding("workspace", "manifest path: "+paths.ManifestPath))
 	}
 	return renderFindings(out, cfg.Session.Campaign, cfg.Session.SessionID, findings)
 }
 // Status reports either a requested manifest or effective local/remote session state.
 func Status(ctx context.Context, args []string, out io.Writer) error {
 	fs := flag.NewFlagSet("status", flag.ContinueOnError)
 	fs.SetOutput(io.Discard)
 	var manifestPath string
 	var flags commonConfigFlags
 	fs.StringVar(&manifestPath, "manifest", "", "path to manifest.json")
 	addCommonConfigFlags(fs, &flags)
 	if err := fs.Parse(args); err != nil {
 		return fmt.Errorf("status: invalid flags: %w", err)
 	}
 	if fs.NArg() != 0 {
 		return fmt.Errorf("status: unexpected positional arguments")
 	}
 	if strings.TrimSpace(manifestPath) != "" {
 		return statusManifest(ctx, manifestPath, out)
 	}
 	if flags.pipelinePath == "" && flags.campaignPath == "" && flags.sessionPath == "" && flags.sessionID == "" && flags.previousSessionID == "" {
 		return fmt.Errorf("status: --manifest is required")
 	}
 	cfg, err := loadCommandConfig(ctx, flags.pipelinePath, flags.campaignPath, flags.sessionPath, flags.sessionOptions())
 	if err != nil {
 		return fmt.Errorf("status: %w", err)
 	}
 	if err := config.Validate(cfg); err != nil {
 		return fmt.Errorf("status: %w", err)
 	}
 	paths := artifacts.NewLocalStore(cfg.Pipeline.Workspace.Root).SessionPathsFor(cfg.Session.Campaign, cfg.Session.SessionID)
 	fmt.Fprintf(out, "Session: %s\n", cfg.Session.SessionID)
 	fmt.Fprintf(out, "Campaign: %s\n", cfg.Session.Campaign)
 	fmt.Fprintf(out, "Workspace: %s\n", paths.Root)
 	fmt.Fprintf(out, "Session config: %s\n", sessionSourceSummary(cfg))
 	if m, err := loadLocalManifest(ctx, paths.ManifestPath); err != nil {
 		fmt.Fprintf(out, "Local manifest: error: %v\n", err)
 	} else if m == nil {
 		fmt.Fprintln(out, "Local manifest: missing")
 	} else {
 		fmt.Fprintf(out, "Local manifest: %s\n", paths.ManifestPath)
 		writeStageStatuses(out, m)
 	}
 	store, storeErr := objectStoreIfConfigured(ctx, cfg)
 	if storeErr != nil {
 		fmt.Fprintf(out, "Remote archive: unavailable: %v\n", storeErr)
 	} else if store != nil {
 		current, err := discoverRemoteCurrentStateFn(ctx, cfg, store)
 		if err != nil {
 			fmt.Fprintf(out, "Remote archive: missing or unavailable: %v\n", err)
 		} else {
 			fmt.Fprintf(out, "Remote archive: current run %s\n", current.RunID)
 			fmt.Fprintf(out, "Remote manifest: %s\n", current.CurrentManifestKey)
 		}
 	}
 	locks, err := loadEffectiveLocks(ctx, cfg, store)
 	if catalog, catalogErr := buildHelperArtifactCatalog(cfg); catalogErr != nil {
 		fmt.Fprintf(out, "Remote outputs: error: %v\n", catalogErr)
 	} else if storeErr == nil {
 		catalogLocks := locks
 		if err != nil {
 			catalogLocks = &effectiveLocks{
 				Static: staticArchiveLocks(cfg),
 				All:    staticArchiveLocks(cfg),
 			}
 		}
 		promotedRemoteState := map[string]string{}
 		if store != nil {
 			promotedRemoteState = remotePromotionAvailability(ctx, cfg, store, catalog)
 		}
 		fmt.Fprintln(out, "Remote outputs:")
 		writeArtifactList(out, cfg, catalog, catalogLocks, promotedRemoteState)
 	}
 	if err != nil {
 		fmt.Fprintf(out, "Archive locks: error: %v\n", err)
 	} else {
 		writeLocks(out, cfg, locks)
 	}
 	fmt.Fprintln(out, "Next actions:")
 	fmt.Fprintf(out, "- narratio session validate --session-id %s\n", cfg.Session.SessionID)
 	fmt.Fprintf(out, "- narratio restore --session-id %s --dry-run\n", cfg.Session.SessionID)
 	return nil
 }
 func statusManifest(ctx context.Context, manifestPath string, out io.Writer) error {
 	store := &manifest.LocalStore{}
 	m, err := store.Load(ctx, manifestPath)
 	if err != nil {
 		return fmt.Errorf("status: %w", err)
 	}
 	if _, err := fmt.Fprintf(out, "session_id: %s\n", m.SessionID); err != nil {
 		return err
 	}
 	if _, err := fmt.Fprintf(out, "updated_at: %s\n", m.UpdatedAt.UTC().Format("2006-01-02T15:04:05Z07:00")); err != nil {
 		return err
 	}
 	writeStageStatuses(out, m)
 	return nil
 }
 // SessionInit creates a local or remote session.yml skeleton.
 func SessionInit(ctx context.Context, args []string, out io.Writer) error {
 	fs := flag.NewFlagSet("session init", flag.ContinueOnError)
 	fs.SetOutput(io.Discard)
 	var pipelinePath, campaignPath, sessionID, previousSessionID, date, title, output, audioS3Prefix, audioDir string
 	var remote, force bool
 	fs.StringVar(&pipelinePath, "config", "", "path to pipeline.yml")
 	fs.StringVar(&campaignPath, "campaign", "", "path to campaign.yml")
 	fs.StringVar(&sessionID, "session-id", "", "session identifier")
 	fs.StringVar(&previousSessionID, "previous-session-id", "", "previous session identifier")
 	fs.StringVar(&date, "date", "", "session date")
 	fs.StringVar(&title, "title", "", "session title")
 	fs.StringVar(&output, "output", "", "local output session.yml path")
 	fs.StringVar(&audioS3Prefix, "audio-s3-prefix", "", "session audio S3 prefix")
 	fs.StringVar(&audioDir, "audio-dir", "", "local audio directory")
 	fs.BoolVar(&remote, "remote", false, "write session.yml to S3 session prefix")
 	fs.BoolVar(&force, "force", false, "overwrite existing target")
 	if err := fs.Parse(args); err != nil {
 		return fmt.Errorf("session init: invalid flags: %w", err)
 	}
 	if fs.NArg() != 0 {
 		return fmt.Errorf("session init: unexpected positional arguments")
 	}
 	if strings.TrimSpace(pipelinePath) == "" || strings.TrimSpace(campaignPath) == "" || strings.TrimSpace(sessionID) == "" {
 		return fmt.Errorf("session init: --config, --campaign, and --session-id are required")
 	}
 	if (strings.TrimSpace(output) == "") == !remote {
 		return fmt.Errorf("session init: specify exactly one target: --output <path> or --remote")
 	}
 	if strings.TrimSpace(audioDir) != "" && strings.TrimSpace(audioS3Prefix) != "" {
 		return fmt.Errorf("session init: --audio-dir and --audio-s3-prefix are mutually exclusive")
 	}
 	resolvedPipeline, err := resolvePipelineConfigPath(pipelinePath)
 	if err != nil {
 		return fmt.Errorf("session init: %w", err)
 	}
 	resolvedCampaign, err := resolveCampaignConfigPath(campaignPath)
 	if err != nil {
 		return fmt.Errorf("session init: %w", err)
 	}
 	pipelineCfg, err := config.LoadPipeline(resolvedPipeline)
 	if err != nil {
 		return fmt.Errorf("session init: %w", err)
 	}
 	campaignCfg, err := config.LoadCampaign(resolvedCampaign)
 	if err != nil {
 		return fmt.Errorf("session init: %w", err)
 	}
 	data, err := buildSessionYAML(campaignCfg.Campaign, sessionID, previousSessionID, date, title, audioS3Prefix, audioDir)
 	if err != nil {
 		return fmt.Errorf("session init: %w", err)
 	}
 	label := strings.TrimSpace(output)
 	if label == "" {
 		label = "remote session.yml"
 	}
 	sessionCfg, err := config.LoadSessionBytesWithOptions(label, data, config.SessionLoadOptions{
 		SessionID:         sessionID,
 		PreviousSessionID: previousSessionID,
 	})
 	if err != nil {
 		return fmt.Errorf("session init: %w", err)
 	}
 	cfg, err := config.Resolve(resolvedPipeline, pipelineCfg, resolvedCampaign, campaignCfg, label, sessionCfg, config.SessionSource{Source: "session_config", LocalPath: label})
 	if err != nil {
 		return fmt.Errorf("session init: %w", err)
 	}
 	if err := config.Validate(cfg); err != nil {
 		return fmt.Errorf("session init: %w", err)
 	}
 	if !remote {
 		if err := writeLocalFile(output, data, force); err != nil {
 			return fmt.Errorf("session init: %w", err)
 		}
 		_, err := fmt.Fprintf(out, "narratio session init: wrote %s\n", filepath.Clean(output))
 		return err
 	}
 	store, err := newCommandObjectStore(ctx, cfg, nil)
 	if err != nil {
 		return fmt.Errorf("session init: %w", err)
 	}
 	sessionPrefix := artifacts.S3SessionPrefix(pipelineCfg.Storage.S3.RootPrefix, campaignCfg.Campaign, sessionID)
 	key := artifacts.S3SessionConfigKey(sessionPrefix)
 	exists, err := store.Exists(ctx, key)
 	if err != nil {
 		return fmt.Errorf("session init: check remote session %q: %w", key, err)
 	}
 	if exists && !force {
 		return fmt.Errorf("session init: remote session %q already exists; pass --force to overwrite", key)
 	}
 	tmp, err := os.CreateTemp("", "narratio-session-init-*.yml")
 	if err != nil {
 		return fmt.Errorf("session init: create temp file: %w", err)
 	}
 	tmpPath := tmp.Name()
 	defer func() { _ = os.Remove(tmpPath) }()
 	if _, err := tmp.Write(data); err != nil {
 		_ = tmp.Close()
 		return fmt.Errorf("session init: write temp file: %w", err)
 	}
 	if err := tmp.Close(); err != nil {
 		return fmt.Errorf("session init: close temp file: %w", err)
 	}
 	if _, err := store.Upload(ctx, tmpPath, key, storage.UploadOptions{ContentType: "application/x-yaml; charset=utf-8"}); err != nil {
 		return fmt.Errorf("session init: upload remote session %q: %w", key, err)
 	}
 	_, err = fmt.Fprintf(out, "narratio session init: wrote s3://%s/%s\n", s3BucketName(pipelineCfg), key)
 	return err
 }
 // ArtifactsList lists effective artifact sources.
 func ArtifactsList(ctx context.Context, args []string, out io.Writer) error {
 	fs := flag.NewFlagSet("artifacts list", flag.ContinueOnError)
 	fs.SetOutput(io.Discard)
 	var flags commonConfigFlags
 	var remote bool
 	addCommonConfigFlags(fs, &flags)
 	fs.BoolVar(&remote, "remote", false, "inspect remote archive availability")
 	if err := fs.Parse(args); err != nil {
 		return fmt.Errorf("artifacts list: invalid flags: %w", err)
 	}
 	if fs.NArg() != 0 {
 		return fmt.Errorf("artifacts list: unexpected positional arguments")
 	}
 	cfg, store, locks, _, err := loadHelperContext(ctx, flags, remote)
 	if err != nil {
 		return fmt.Errorf("artifacts list: %w", err)
 	}
 	catalog, err := buildHelperArtifactCatalog(cfg)
 	if err != nil {
 		return fmt.Errorf("artifacts list: %w", err)
 	}
 	promotedRemoteState := map[string]string{}
 	if remote && store != nil {
 		promotedRemoteState = remotePromotionAvailability(ctx, cfg, store, catalog)
 	}
 	writeArtifactList(out, cfg, catalog, locks, promotedRemoteState)
 	return nil
 }
 // Locks dispatches archive lock list and mutation helpers.
 func Locks(ctx context.Context, args []string, out io.Writer) error {
 	if len(args) > 0 && !strings.HasPrefix(args[0], "-") {
 		switch args[0] {
 		case "add":
 			return LocksAdd(ctx, args[1:], out)
 		case "remove":
 			return LocksRemove(ctx, args[1:], out)
 		default:
 			return fmt.Errorf("locks: unknown subcommand %q", args[0])
 		}
 	}
 	return LocksList(ctx, args, out)
 }
 // LocksList lists effective archive locks.
 func LocksList(ctx context.Context, args []string, out io.Writer) error {
 	fs := flag.NewFlagSet("locks", flag.ContinueOnError)
 	fs.SetOutput(io.Discard)
 	var flags commonConfigFlags
 	addCommonConfigFlags(fs, &flags)
 	if err := fs.Parse(args); err != nil {
 		return fmt.Errorf("locks: invalid flags: %w", err)
 	}
 	if fs.NArg() != 0 {
 		return fmt.Errorf("locks: unexpected positional arguments")
 	}
 	if strings.TrimSpace(flags.sessionID) == "" {
 		return fmt.Errorf("locks: --session-id is required")
 	}
 	cfg, _, locks, _, err := loadHelperContext(ctx, flags, true)
 	if err != nil {
 		return fmt.Errorf("locks: %w", err)
 	}
 	writeLocks(out, cfg, locks)
 	return nil
 }
 // LocksAdd adds or updates one remote lock.
 func LocksAdd(ctx context.Context, args []string, out io.Writer) error {
 	fs := flag.NewFlagSet("locks add", flag.ContinueOnError)
 	fs.SetOutput(io.Discard)
 	var flags commonConfigFlags
 	var reason string
 	var force bool
 	addCommonConfigFlags(fs, &flags)
 	fs.StringVar(&reason, "reason", "", "lock reason")
 	fs.BoolVar(&force, "force", false, "update existing remote lock")
 	if err := fs.Parse(args); err != nil {
 		return fmt.Errorf("locks add: invalid flags: %w", err)
 	}
 	if fs.NArg() != 1 {
 		return fmt.Errorf("locks add: expected exactly one source id")
 	}
 	if strings.TrimSpace(flags.sessionID) == "" {
 		return fmt.Errorf("locks add: --session-id is required")
 	}
 	source := strings.TrimSpace(fs.Arg(0))
 	cfg, store, locks, _, err := loadHelperContext(ctx, flags, true)
 	if err != nil {
 		return fmt.Errorf("locks add: %w", err)
 	}
 	if _, err := config.ValidateArchiveLockRules([]config.ArchiveLockRule{{Source: source}}, cfg.Pipeline.Scriptorium, "locks add"); err != nil {
 		return fmt.Errorf("locks add: %w", err)
 	}
 	if _, ok := lockSourceSet(locks.Static)[source]; ok {
 		return fmt.Errorf("locks add: source %q is locked by pipeline config and cannot be modified remotely", source)
 	}
 	remoteSet := lockSourceSet(locks.Remote)
 	if _, exists := remoteSet[source]; exists && !force {
 		return fmt.Errorf("locks add: remote lock for %q already exists; pass --force to update", source)
 	}
 	remoteSet[source] = config.ArchiveLockRule{Source: source, Reason: strings.TrimSpace(reason)}
 	remoteLocks := lockMapValues(remoteSet)
 	if _, err := config.ValidateArchiveLockRules(remoteLocks, cfg.Pipeline.Scriptorium, "locks"); err != nil {
 		return fmt.Errorf("locks add: %w", err)
 	}
 	if err := uploadRemoteLockStore(ctx, store, locks.Key, &config.ArchiveLockStore{Locks: remoteLocks}); err != nil {
 		return fmt.Errorf("locks add: %w", err)
 	}
 	_, err = fmt.Fprintf(out, "narratio locks add: locked %s\n", source)
 	return err
 }
 // LocksRemove removes one remote lock.
 func LocksRemove(ctx context.Context, args []string, out io.Writer) error {
 	fs := flag.NewFlagSet("locks remove", flag.ContinueOnError)
 	fs.SetOutput(io.Discard)
 	var flags commonConfigFlags
 	addCommonConfigFlags(fs, &flags)
 	if err := fs.Parse(args); err != nil {
 		return fmt.Errorf("locks remove: invalid flags: %w", err)
 	}
 	if fs.NArg() != 1 {
 		return fmt.Errorf("locks remove: expected exactly one source id")
 	}
 	if strings.TrimSpace(flags.sessionID) == "" {
 		return fmt.Errorf("locks remove: --session-id is required")
 	}
 	source := strings.TrimSpace(fs.Arg(0))
 	cfg, store, locks, _, err := loadHelperContext(ctx, flags, true)
 	if err != nil {
 		return fmt.Errorf("locks remove: %w", err)
 	}
 	if _, err := config.ValidateArchiveLockRules([]config.ArchiveLockRule{{Source: source}}, cfg.Pipeline.Scriptorium, "locks remove"); err != nil {
 		return fmt.Errorf("locks remove: %w", err)
 	}
 	remoteSet := lockSourceSet(locks.Remote)
 	if _, ok := remoteSet[source]; !ok {
 		if _, static := lockSourceSet(locks.Static)[source]; static {
 			return fmt.Errorf("locks remove: source %q is locked by pipeline config and cannot be unlocked remotely", source)
 		}
 		return fmt.Errorf("locks remove: remote lock for %q does not exist", source)
 	}
 	delete(remoteSet, source)
 	remoteLocks := lockMapValues(remoteSet)
 	if err := uploadRemoteLockStore(ctx, store, locks.Key, &config.ArchiveLockStore{Locks: remoteLocks}); err != nil {
 		return fmt.Errorf("locks remove: %w", err)
 	}
 	_, err = fmt.Fprintf(out, "narratio locks remove: unlocked %s\n", source)
 	return err
 }
 func loadHelperContext(ctx context.Context, flags commonConfigFlags, needStore bool) (*config.Config, storage.ObjectStore, *effectiveLocks, *manifest.Manifest, error) {
-	cfg, err := loadCommandConfig(ctx, flags.pipelinePath, flags.campaignPath, flags.sessionPath, flags.sessionOptions())
+	cfg, err := loadCommandConfig(ctx, flags.pipelinePath, flags.campaignPath, flags.campaignFilePath, flags.sessionPath, flags.sessionOptions())
 	if err != nil {
 		return nil, nil, nil, nil, err
 	}
@@ -558,401 +129,3 @@ func objectStoreIfConfigured(ctx context.Context, cfg *config.Config) (storage.O
 	}
 	return store, nil
 }
 func buildSessionYAML(campaign, sessionID, previousSessionID, date, title, audioS3Prefix, audioDir string) ([]byte, error) {
 	if strings.TrimSpace(date) == "" && regexp.MustCompile(`^\d{4}-\d{2}-\d{2}$`).MatchString(strings.TrimSpace(sessionID)) {
 		date = strings.TrimSpace(sessionID)
 	}
 	type audioS3 struct {
 		Prefix string `yaml:"prefix"`
 	}
 	type inputs struct {
 		AudioDir string   `yaml:"audio_dir,omitempty"`
 		AudioS3  *audioS3 `yaml:"audio_s3,omitempty"`
 	}
 	type sessionYAML struct {
 		Campaign          string `yaml:"campaign"`
 		SessionID         string `yaml:"session_id"`
 		PreviousSessionID string `yaml:"previous_session_id,omitempty"`
 		Date              string `yaml:"date,omitempty"`
 		Title             string `yaml:"title,omitempty"`
 		Inputs            inputs `yaml:"inputs"`
 	}
 	in := inputs{AudioDir: strings.TrimSpace(audioDir)}
 	if in.AudioDir == "" {
 		prefix := strings.TrimSpace(audioS3Prefix)
 		if prefix == "" {
 			prefix = "audio/"
 		}
 		in.AudioS3 = &audioS3{Prefix: prefix}
 	}
 	data, err := yaml.Marshal(sessionYAML{
 		Campaign:          strings.TrimSpace(campaign),
 		SessionID:         strings.TrimSpace(sessionID),
 		PreviousSessionID: strings.TrimSpace(previousSessionID),
 		Date:              strings.TrimSpace(date),
 		Title:             strings.TrimSpace(title),
 		Inputs:            in,
 	})
 	if err != nil {
 		return nil, err
 	}
 	return data, nil
 }
 func renderFindings(out io.Writer, campaign, sessionID string, findings []finding) error {
 	if campaign != "" || sessionID != "" {
 		fmt.Fprintf(out, "Campaign: %s\n", campaign)
 		fmt.Fprintf(out, "Session: %s\n\n", sessionID)
 	}
 	errorsCount := 0
 	for _, f := range findings {
 		if f.Severity == "ERROR" {
 			errorsCount++
 		}
 		fmt.Fprintf(out, "%-5s %-10s %s\n", f.Severity, f.Category, f.Message)
 	}
 	if errorsCount > 0 {
 		return findingError{count: errorsCount}
 	}
 	return nil
 }
 func okFinding(category, msg string) finding    { return finding{"OK", category, msg} }
 func infoFinding(category, msg string) finding  { return finding{"INFO", category, msg} }
 func warnFinding(category, msg string) finding  { return finding{"WARN", category, msg} }
 func errorFinding(category, msg string) finding { return finding{"ERROR", category, msg} }
 func sessionSourceSummary(cfg *config.Config) string {
 	source := cfg.SessionSource.Source
 	if source == "" {
 		source = "session_config"
 	}
 	if cfg.SessionSource.S3Key != "" {
 		return source + " " + cfg.SessionSource.S3Key
 	}
 	return source + " " + cfg.SessionPath
 }
 func validateStableInputFindings(cfg *config.Config) []finding {
 	items := []struct {
 		name string
 		in   config.ResolvedInputFile
 	}{
 		{"speakers", cfg.StableInputs.SpeakersFile},
 		{"autocorrect", cfg.StableInputs.AutocorrectFile},
 		{"glossary", cfg.StableInputs.GlossaryFile},
 	}
 	out := make([]finding, 0, len(items))
 	for _, item := range items {
 		path, err := resolveHelperConfigRelativePath(item.in)
 		if err != nil {
 			out = append(out, errorFinding("inputs", item.name+": "+err.Error()))
 			continue
 		}
 		if _, err := os.Stat(path); err != nil {
 			out = append(out, errorFinding("inputs", fmt.Sprintf("%s missing: %v", item.name, err)))
 		} else {
 			out = append(out, okFinding("inputs", item.name+": "+path))
 		}
 	}
 	return out
 }
 func resolveHelperConfigRelativePath(input config.ResolvedInputFile) (string, error) {
 	if strings.TrimSpace(input.ConfigPath) == "" {
 		return "", fmt.Errorf("source config path is required")
 	}
 	path := strings.TrimSpace(input.Path)
 	if path == "" {
 		return "", fmt.Errorf("path is required")
 	}
 	if filepath.IsAbs(path) {
 		return filepath.Clean(path), nil
 	}
 	return filepath.Clean(filepath.Join(filepath.Dir(input.ConfigPath), path)), nil
 }
 func validateLocalAudioFindings(cfg *config.Config) []finding {
 	if cfg.Session.Inputs.AudioS3 != nil {
 		return nil
 	}
 	audioDir := strings.TrimSpace(cfg.Session.Inputs.AudioDir)
 	if audioDir == "" && len(cfg.Session.Inputs.AudioFiles) == 0 {
 		return []finding{errorFinding("audio", "audio_dir, audio_files, or audio_s3 is required")}
 	}
 	base := filepath.Dir(cfg.SessionPath)
 	paths := []string{}
 	if audioDir != "" {
 		dir := audioDir
 		if !filepath.IsAbs(dir) {
 			dir = filepath.Join(base, dir)
 		}
 		matches, err := filepath.Glob(filepath.Join(dir, "*.flac"))
 		if err != nil || len(matches) == 0 {
 			return []finding{errorFinding("audio", "no .flac files found in "+dir)}
 		}
 		paths = append(paths, matches...)
 	}
 	for _, file := range cfg.Session.Inputs.AudioFiles {
 		p := file
 		if !filepath.IsAbs(p) {
 			p = filepath.Join(base, p)
 		}
 		paths = append(paths, p)
 	}
 	for _, p := range paths {
 		if _, err := os.Stat(p); err != nil {
 			return []finding{errorFinding("audio", fmt.Sprintf("audio file missing: %v", err))}
 		}
 	}
 	return []finding{okFinding("audio", fmt.Sprintf("%d local audio file(s)", len(paths)))}
 }
 func validateRemoteAudioFinding(ctx context.Context, cfg *config.Config, store storage.ObjectStore) finding {
 	sessionPrefix := artifacts.S3SessionPrefix(cfg.Pipeline.Storage.S3.RootPrefix, cfg.Session.Campaign, cfg.Session.SessionID)
 	audioPrefix := artifacts.S3AudioPrefix(sessionPrefix, cfg.Session.Inputs.AudioS3.Prefix)
 	objects, err := store.List(ctx, audioPrefix)
 	if err != nil {
 		return errorFinding("audio", err.Error())
 	}
 	count := 0
 	for _, obj := range objects {
 		if strings.HasSuffix(strings.ToLower(obj.Key), ".flac") {
 			count++
 		}
 	}
 	if count == 0 {
 		return errorFinding("audio", "no remote .flac objects found under "+audioPrefix)
 	}
 	return okFinding("audio", fmt.Sprintf("%d remote .flac object(s)", count))
 }
 func validatePreviousArtifactFindings(ctx context.Context, cfg *config.Config, store storage.ObjectStore, requirements []artifacts.PreviousArtifactRequirement) []finding {
 	out := []finding{}
 	prefix := artifacts.S3SessionPrefix(cfg.Pipeline.Storage.S3.RootPrefix, cfg.Session.Campaign, cfg.Session.PreviousSessionID)
 	manifestKey, runIDKey := artifacts.ResolveArchiveCurrentStateKeys(prefix)
 	for _, key := range []string{runIDKey, manifestKey} {
 		exists, err := store.Exists(ctx, key)
 		if err != nil {
 			out = append(out, errorFinding("previous", fmt.Sprintf("check %s: %v", key, err)))
 			return out
 		}
 		if !exists {
 			out = append(out, errorFinding("previous", "missing "+key))
 			return out
 		}
 	}
 	for _, req := range requirements {
 		out = append(out, okFinding("previous", fmt.Sprintf("%s required=%t", req.Name, req.Required)))
 	}
 	return out
 }
 func loadLocalManifest(ctx context.Context, path string) (*manifest.Manifest, error) {
 	if _, err := os.Stat(path); err != nil {
 		if os.IsNotExist(err) {
 			return nil, nil
 		}
 		return nil, err
 	}
 	store := &manifest.LocalStore{}
 	return store.Load(ctx, path)
 }
 func writeStageStatuses(out io.Writer, m *manifest.Manifest) {
 	if m == nil || len(m.Stages) == 0 {
 		fmt.Fprintln(out, "stages: no stages recorded")
 		return
 	}
 	fmt.Fprintln(out, "stages:")
 	names := make([]string, 0, len(m.Stages))
 	for name := range m.Stages {
 		names = append(names, name)
 	}
 	sort.Strings(names)
 	for _, name := range names {
 		fmt.Fprintf(out, "- %s: %s\n", name, m.Stages[name].Status)
 	}
 }
 func buildHelperArtifactCatalog(cfg *config.Config) (*artifacts.ArtifactCatalog, error) {
 	catalog := artifacts.NewArtifactCatalog()
 	if err := catalog.RegisterBuiltIns(); err != nil {
 		return nil, err
 	}
 	configured := map[string]artifacts.ConfiguredArtifactDefinition{}
 	if cfg.Pipeline.Scriptorium != nil {
 		for key, item := range cfg.Pipeline.Scriptorium.Artifacts {
 			configured[key] = artifacts.ConfiguredArtifactDefinition{Enabled: item.Enabled, OutputPath: item.OutputPath}
 		}
 	}
 	if err := catalog.RegisterConfiguredArtifacts(configured, nil); err != nil {
 		return nil, err
 	}
 	return catalog, nil
 }
 func writeArtifactList(out io.Writer, cfg *config.Config, catalog *artifacts.ArtifactCatalog, locks *effectiveLocks, promotedRemoteState map[string]string) {
 	lockSet := lockSourceSet(locks.All)
 	fmt.Fprintln(out, "Built-in:")
 	for _, id := range []string{
 		artifacts.ArtifactTranscriptMerged,
 		artifacts.ArtifactTranscriptPolished,
 		artifacts.ArtifactTranscriptFull,
 		artifacts.ArtifactTranscriptTrimmed,
 		artifacts.ArtifactBoundsSession,
 	} {
 		writeArtifactLine(out, id, lockSet)
 	}
 	fmt.Fprintln(out, "Configured:")
 	for _, entry := range catalog.ListConfigured() {
 		writeArtifactLine(out, entry.SourceID, lockSet)
 	}
 	fmt.Fprintln(out, "Previous-session:")
 	for _, req := range artifacts.CollectPreviousArtifactRequirements(configuredScriptoriumArtifacts(cfg)) {
 		fmt.Fprintf(out, "- narratio.previous_session.artifact.%s required=%t\n", req.Name, req.Required)
 	}
 	fmt.Fprintln(out, "Promoted:")
 	for _, rule := range cfg.Pipeline.Archive.PromoteArtifacts {
 		writePromotedArtifactLine(out, rule, catalog, lockSet, promotedRemoteState)
 	}
 }
 func writeArtifactLine(out io.Writer, source string, lockSet map[string]config.ArchiveLockRule) {
 	parts := []string{source}
 	if _, ok := lockSet[source]; ok {
 		parts = append(parts, "locked")
 	}
 	fmt.Fprintf(out, "- %s\n", strings.Join(parts, " "))
 }
 func writePromotedArtifactLine(out io.Writer, rule config.ArchivePromotionRule, catalog *artifacts.ArtifactCatalog, lockSet map[string]config.ArchiveLockRule, remoteState map[string]string) {
 	source := strings.TrimSpace(rule.Source)
 	parts := []string{source}
 	if _, ok := lockSet[source]; ok {
 		parts = append(parts, "locked")
 	}
 	dest, showDest, err := helperPromotionDest(rule, catalog)
 	if err != nil {
 		parts = append(parts, "remote=error")
 		fmt.Fprintf(out, "- %s\n", strings.Join(parts, " "))
 		return
 	}
 	if showDest {
 		parts = append(parts, "dest="+dest)
 	}
 	if state := remoteState[promotionRemoteStateKey(source, dest)]; state != "" {
 		parts = append(parts, state)
 	}
 	fmt.Fprintf(out, "- %s\n", strings.Join(parts, " "))
 }
 func remotePromotionAvailability(ctx context.Context, cfg *config.Config, store storage.ObjectStore, catalog *artifacts.ArtifactCatalog) map[string]string {
 	out := map[string]string{}
 	sessionPrefix := artifacts.S3SessionPrefix(cfg.Pipeline.Storage.S3.RootPrefix, cfg.Session.Campaign, cfg.Session.SessionID)
 	for _, rule := range cfg.Pipeline.Archive.PromoteArtifacts {
 		source := strings.TrimSpace(rule.Source)
 		dest, _, err := helperPromotionDest(rule, catalog)
 		if err != nil {
 			out[promotionRemoteStateKey(source, "")] = "remote=error"
 			continue
 		}
 		key := artifacts.S3PromotedArtifactKey(sessionPrefix, dest)
 		if exists, err := store.Exists(ctx, key); err == nil && exists {
 			out[promotionRemoteStateKey(source, dest)] = "remote=promoted"
 		} else if err != nil {
 			out[promotionRemoteStateKey(source, dest)] = "remote=error"
 		} else {
 			out[promotionRemoteStateKey(source, dest)] = "remote=missing"
 		}
 	}
 	return out
 }
 func helperPromotionDest(rule config.ArchivePromotionRule, catalog *artifacts.ArtifactCatalog) (string, bool, error) {
 	source := strings.TrimSpace(rule.Source)
 	dest := strings.TrimSpace(rule.Dest)
 	if dest == "" {
 		entry, ok := catalog.Lookup(source)
 		if !ok {
 			return "", false, fmt.Errorf("destination omitted and source is unknown")
 		}
 		dest = strings.TrimSpace(entry.CanonicalRelPath)
 		if dest == "" {
 			return "", false, fmt.Errorf("destination omitted and no canonical destination is available")
 		}
 	}
 	normalized, err := normalizeHelperArchiveRelativePath(dest)
 	if err != nil {
 		return "", false, err
 	}
 	entry, ok := catalog.Lookup(source)
 	showDest := !ok || strings.TrimSpace(entry.CanonicalRelPath) != normalized
 	return normalized, showDest, nil
 }
 func normalizeHelperArchiveRelativePath(rel string) (string, error) {
 	trimmed := strings.TrimSpace(rel)
 	if trimmed == "" {
 		return "", fmt.Errorf("relative path is required")
 	}
 	cleaned := filepath.ToSlash(filepath.Clean(filepath.FromSlash(trimmed)))
 	if cleaned == "." || cleaned == "" {
 		return "", fmt.Errorf("relative path is required")
 	}
 	if filepath.IsAbs(trimmed) || strings.HasPrefix(cleaned, "/") || cleaned == ".." || strings.HasPrefix(cleaned, "../") {
 		return "", fmt.Errorf("path must be a clean relative path")
 	}
 	return cleaned, nil
 }
 func promotionRemoteStateKey(source, dest string) string {
 	return strings.TrimSpace(source) + "\x00" + strings.TrimSpace(dest)
 }
 func writeLocks(out io.Writer, cfg *config.Config, locks *effectiveLocks) {
 	if locks == nil || len(locks.All) == 0 {
 		fmt.Fprintln(out, "Archive locks: none")
 		return
 	}
 	fmt.Fprintln(out, "Archive locks:")
 	promoted := map[string]config.ArchivePromotionRule{}
 	if cfg != nil && cfg.Pipeline != nil && cfg.Pipeline.Archive != nil {
 		for _, rule := range cfg.Pipeline.Archive.PromoteArtifacts {
 			promoted[strings.TrimSpace(rule.Source)] = rule
 		}
 	}
 	staticSet := lockSourceSet(locks.Static)
 	for _, lock := range locks.All {
 		origin := "remote"
 		if _, ok := staticSet[lock.Source]; ok {
 			origin = "pipeline"
 		}
 		promo := "not-promoted"
 		if _, ok := promoted[lock.Source]; ok {
 			promo = "promoted"
 		}
 		reason := strings.TrimSpace(lock.Reason)
 		if reason == "" {
 			reason = "(no reason)"
 		}
 		fmt.Fprintf(out, "- %s origin=%s %s reason=%s\n", lock.Source, origin, promo, reason)
 	}
 }
 func lockMapValues(in map[string]config.ArchiveLockRule) []config.ArchiveLockRule {
 	keys := make([]string, 0, len(in))
 	for key := range in {
 		keys = append(keys, key)
 	}
 	sort.Strings(keys)
 	out := make([]config.ArchiveLockRule, 0, len(keys))
 	for _, key := range keys {
 		item := in[key]
 		item.Source = key
 		item.Reason = strings.TrimSpace(item.Reason)
 		out = append(out, item)
 	}
 	return out
 }
--- a/internal/app/operator_helpers_test.go
+++ b/internal/app/operator_helpers_test.go
@@ -25,10 +25,9 @@ func TestExecuteSessionInitRemoteWritesCanonicalSessionConfig(t *testing.T) {
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute([]string{
-		"session", "init",
+		"session", "init", "2026-06-07",
 		"--config", pipelinePath,
-		"--campaign", campaignPath,
+		"--campaign-file", campaignPath,
 		"--session-id", "2026-06-07",
 		"--title", "The Black Cabin",
 		"--remote",
 	}, &stdout, &stderr)
@@ -48,6 +47,363 @@ func TestExecuteSessionInitRemoteWritesCanonicalSessionConfig(t *testing.T) {
 	}
 }
 func TestExecuteSessionInitRemoteUsesDefaultConfigDiscovery(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, _ := writeValidConfigFiles(t, workspaceRoot)
 	withDefaultPipelineCampaignConfigs(t, pipelinePath, campaignPath)
 	fake := &storage.FakeBackend{}
 	var storeInitCalls int
 	restoreAppConfigTestGlobals(t, fake, &storeInitCalls, []string{filepath.Join(t.TempDir(), "session.yml")})
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute([]string{
 		"session", "init", "2026-06-07",
 		"--remote",
 	}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
 	key := artifacts.S3SessionConfigKey(artifacts.S3SessionPrefix("dnd", "sample-campaign", "2026-06-07"))
 	if _, ok := fake.Objects[key]; !ok {
 		t.Fatalf("remote session key %q not uploaded; objects=%v", key, fake.Objects)
 	}
 	if storeInitCalls != 1 {
 		t.Fatalf("object store init calls = %d, want 1", storeInitCalls)
 	}
 }
 func TestExecuteSessionInitLocalUsesDefaultConfigDiscovery(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, _ := writeValidConfigFiles(t, workspaceRoot)
 	withDefaultPipelineCampaignConfigs(t, pipelinePath, campaignPath)
 	outputPath := filepath.Join(t.TempDir(), "session.yml")
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute([]string{
 		"session", "init", "2026-06-07",
 		"--output", outputPath,
 	}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
 	data, err := os.ReadFile(outputPath)
 	if err != nil {
 		t.Fatalf("read generated session: %v", err)
 	}
 	if !strings.Contains(string(data), `session_id: "2026-06-07"`) || !strings.Contains(string(data), "prefix: audio/") {
 		t.Fatalf("generated session = %q", string(data))
 	}
 }
 func TestExecuteSessionInitExplicitConfigWinsOverDefaults(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	defaultPipeline, defaultCampaign, _ := writeValidConfigFiles(t, workspaceRoot)
 	withDefaultPipelineCampaignConfigs(t, defaultPipeline, defaultCampaign)
 	explicitDir := t.TempDir()
 	explicitCampaign := filepath.Join(explicitDir, "campaign.yml")
 	if err := os.WriteFile(explicitCampaign, []byte(`campaign_id: explicit-campaign
 inputs:
  speakers_file: ./speakers.yml
  autocorrect_file: ./autocorrect.yml
  glossary_file: ./glossary.yml
 `), 0o644); err != nil {
 		t.Fatalf("write explicit campaign: %v", err)
 	}
 	mustWriteTestFile(t, filepath.Join(explicitDir, "speakers.yml"), "match:\n  - speaker: Alice\n    match: [\"alice\"]\n")
 	mustWriteTestFile(t, filepath.Join(explicitDir, "autocorrect.yml"), "[]\n")
 	mustWriteTestFile(t, filepath.Join(explicitDir, "glossary.yml"), "[]\n")
 	fake := &storage.FakeBackend{}
 	var storeInitCalls int
 	restoreAppConfigTestGlobals(t, fake, &storeInitCalls, []string{filepath.Join(t.TempDir(), "session.yml")})
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute([]string{
 		"session", "init", "2026-06-07",
 		"--config", defaultPipeline,
 		"--campaign-file", explicitCampaign,
 		"--remote",
 	}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
 	explicitKey := artifacts.S3SessionConfigKey(artifacts.S3SessionPrefix("dnd", "explicit-campaign", "2026-06-07"))
 	if _, ok := fake.Objects[explicitKey]; !ok {
 		t.Fatalf("explicit campaign remote key %q not uploaded; objects=%v", explicitKey, fake.Objects)
 	}
 	defaultKey := artifacts.S3SessionConfigKey(artifacts.S3SessionPrefix("dnd", "sample-campaign", "2026-06-07"))
 	if _, ok := fake.Objects[defaultKey]; ok {
 		t.Fatalf("default campaign key %q uploaded despite explicit campaign override", defaultKey)
 	}
 }
 func TestExecuteSessionInitRequiresSessionID(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, _ := writeValidConfigFiles(t, workspaceRoot)
 	withDefaultPipelineCampaignConfigs(t, pipelinePath, campaignPath)
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute([]string{"session", "init", "--remote"}, &stdout, &stderr)
 	if code == 0 {
 		t.Fatal("exit code = 0, want non-zero")
 	}
 	if !strings.Contains(stderr.String(), "session init: session_id is required") {
 		t.Fatalf("stderr = %q, want session-id required error", stderr.String())
 	}
 }
 func TestExecuteSessionInitMissingDefaultConfigReportsSearchedPaths(t *testing.T) {
 	origPipelineDefaults := append([]string(nil), config.DefaultPipelineConfigSearchPaths...)
 	config.DefaultPipelineConfigSearchPaths = []string{filepath.Join(t.TempDir(), "missing-pipeline.yml")}
 	t.Cleanup(func() {
 		config.DefaultPipelineConfigSearchPaths = origPipelineDefaults
 	})
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute([]string{"session", "init", "2026-06-07", "--remote"}, &stdout, &stderr)
 	if code == 0 {
 		t.Fatal("exit code = 0, want non-zero")
 	}
 	if !strings.Contains(stderr.String(), "session init: no pipeline config path provided and no default pipeline config found; searched:") {
 		t.Fatalf("stderr = %q, want default pipeline searched-path error", stderr.String())
 	}
 }
 func TestExecuteSessionInitRemoteLoadsSecretsBeforeObjectStoreInit(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, _ := writeValidConfigFiles(t, workspaceRoot)
 	withDefaultPipelineCampaignConfigs(t, pipelinePath, campaignPath)
 	accessKeyEnv := "NARRATIO_TEST_SESSION_INIT_OBJECT_KEY_ID"
 	secretKeyEnv := "NARRATIO_TEST_SESSION_INIT_OBJECT_SECRET"
 	restoreEnvAfterTest(t, accessKeyEnv, secretKeyEnv)
 	secretsDir := t.TempDir()
 	mustWriteTestFile(t, filepath.Join(secretsDir, accessKeyEnv), "test-key-id\n")
 	mustWriteTestFile(t, filepath.Join(secretsDir, secretKeyEnv), "test-secret\n")
 	addSecretsToPipelineConfig(t, pipelinePath, secretsDir, accessKeyEnv, secretKeyEnv)
 	fake := &storage.FakeBackend{}
 	origStoreFn := newObjectStoreFromConfigFn
 	newObjectStoreFromConfigFn = func(context.Context, *config.Config) (storage.ObjectStore, error) {
 		if os.Getenv(accessKeyEnv) != "test-key-id" || os.Getenv(secretKeyEnv) != "test-secret" {
 			return nil, fmt.Errorf("secrets were not loaded before object store init")
 		}
 		return fake, nil
 	}
 	t.Cleanup(func() {
 		newObjectStoreFromConfigFn = origStoreFn
 	})
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute([]string{"session", "init", "2026-06-07", "--remote"}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
 }
 func TestExecuteSessionInitLocalRendersCampaignTemplate(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, _ := writeValidConfigFiles(t, workspaceRoot)
 	writeSessionInitTemplate(t, campaignPath, `session_id: "{{ session_id }}"
 previous_session_id: "{{ previous_session_id }}"
 date: "{{ date }}"
 title: "{{ title }}"
 inputs:
  audio_s3:
    prefix: "{{ audio_s3_prefix }}"
 `)
 	outputPath := filepath.Join(t.TempDir(), "session.yml")
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute([]string{
 		"session", "init", "2026-06-07",
 		"--config", pipelinePath,
 		"--campaign-file", campaignPath,
 		"--previous-session-id", "2026-05-31",
 		"--date", "2026-06-07",
 		"--title", "The Black Cabin",
 		"--audio-s3-prefix", "audio/",
 		"--output", outputPath,
 	}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
 	data, err := os.ReadFile(outputPath)
 	if err != nil {
 		t.Fatalf("read generated session: %v", err)
 	}
 	got := string(data)
 	for _, want := range []string{
 		`session_id: "2026-06-07"`,
 		`previous_session_id: "2026-05-31"`,
 		`date: "2026-06-07"`,
 		`title: "The Black Cabin"`,
 		`prefix: "audio/"`,
 	} {
 		if !strings.Contains(got, want) {
 			t.Fatalf("generated session = %q, want %q", got, want)
 		}
 	}
 	if strings.Contains(got, "{{") {
 		t.Fatalf("generated session still contains template placeholder: %q", got)
 	}
 }
 func TestExecuteSessionInitRemoteRendersCampaignTemplate(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, _ := writeValidConfigFiles(t, workspaceRoot)
 	writeSessionInitTemplate(t, campaignPath, `session_id: "{{ session_id }}"
 inputs:
  audio_s3:
    prefix: audio/
 `)
 	fake := &storage.FakeBackend{}
 	var storeInitCalls int
 	restoreAppConfigTestGlobals(t, fake, &storeInitCalls, []string{filepath.Join(t.TempDir(), "session.yml")})
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute([]string{
 		"session", "init", "2026-06-07",
 		"--config", pipelinePath,
 		"--campaign-file", campaignPath,
 		"--remote",
 	}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
 	key := artifacts.S3SessionConfigKey(artifacts.S3SessionPrefix("dnd", "sample-campaign", "2026-06-07"))
 	obj, ok := fake.Objects[key]
 	if !ok {
 		t.Fatalf("remote session key %q not uploaded; objects=%v", key, fake.Objects)
 	}
 	if strings.Contains(string(obj.Data), "{{") || !strings.Contains(string(obj.Data), `session_id: "2026-06-07"`) {
 		t.Fatalf("remote session data = %q, want rendered concrete session", string(obj.Data))
 	}
 }
 func TestExecuteSessionInitTemplatePathIsCampaignRelative(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, _ := writeValidConfigFiles(t, workspaceRoot)
 	templateDir := filepath.Join(filepath.Dir(campaignPath), "templates")
 	if err := os.MkdirAll(templateDir, 0o755); err != nil {
 		t.Fatalf("mkdir template dir: %v", err)
 	}
 	templatePath := filepath.Join(templateDir, "session.template.yml")
 	if err := os.WriteFile(templatePath, []byte(`session_id: "{{ session_id }}"
 inputs:
  audio_dir: ./audio
 `), 0o644); err != nil {
 		t.Fatalf("write session template: %v", err)
 	}
 	addSessionTemplateToCampaign(t, campaignPath, "./templates/session.template.yml")
 	outputPath := filepath.Join(t.TempDir(), "session.yml")
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute([]string{
 		"session", "init", "2026-06-07",
 		"--config", pipelinePath,
 		"--campaign-file", campaignPath,
 		"--output", outputPath,
 	}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
 	data, err := os.ReadFile(outputPath)
 	if err != nil {
 		t.Fatalf("read generated session: %v", err)
 	}
 	if !strings.Contains(string(data), `session_id: "2026-06-07"`) {
 		t.Fatalf("generated session = %q, want campaign-relative template output", string(data))
 	}
 }
 func TestExecuteSessionInitTemplateMissingVariableFails(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, _ := writeValidConfigFiles(t, workspaceRoot)
 	writeSessionInitTemplate(t, campaignPath, `session_id: "{{ session_id }}"
 date: "{{ date }}"
 inputs:
  audio_s3:
    prefix: audio/
 `)
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute([]string{
 		"session", "init", "2026-06-07",
 		"--config", pipelinePath,
 		"--campaign-file", campaignPath,
 		"--remote",
 	}, &stdout, &stderr)
 	if code == 0 {
 		t.Fatal("exit code = 0, want non-zero")
 	}
 	if !strings.Contains(stderr.String(), "missing required template variable value(s): date") {
 		t.Fatalf("stderr = %q, want missing date variable", stderr.String())
 	}
 }
 func TestExecuteSessionInitTemplateUnusedFlagFails(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, _ := writeValidConfigFiles(t, workspaceRoot)
 	writeSessionInitTemplate(t, campaignPath, `session_id: "{{ session_id }}"
 inputs:
  audio_s3:
    prefix: audio/
 `)
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute([]string{
 		"session", "init", "2026-06-07",
 		"--config", pipelinePath,
 		"--campaign-file", campaignPath,
 		"--title", "Unused Title",
 		"--remote",
 	}, &stdout, &stderr)
 	if code == 0 {
 		t.Fatal("exit code = 0, want non-zero")
 	}
 	if !strings.Contains(stderr.String(), "unused template variable value(s): title") {
 		t.Fatalf("stderr = %q, want unused title variable", stderr.String())
 	}
 }
 func TestExecuteSessionInitTemplateStrictDecodeFailure(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, _ := writeValidConfigFiles(t, workspaceRoot)
 	writeSessionInitTemplate(t, campaignPath, `session_id: "{{ session_id }}"
 unknown: true
 inputs:
  audio_s3:
    prefix: audio/
 `)
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute([]string{
 		"session", "init", "2026-06-07",
 		"--config", pipelinePath,
 		"--campaign-file", campaignPath,
 		"--remote",
 	}, &stdout, &stderr)
 	if code == 0 {
 		t.Fatal("exit code = 0, want non-zero")
 	}
 	if !strings.Contains(stderr.String(), "strict decode failed") {
 		t.Fatalf("stderr = %q, want strict decode error", stderr.String())
 	}
 }
 func TestExecuteSessionValidateLoadsSecretsBeforeObjectStoreInit(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
@@ -67,7 +423,7 @@ inputs:
 	}
 	fake := &storage.FakeBackend{}
-	audioKey := artifacts.S3PromotedArtifactKey(artifacts.S3AudioPrefix(artifacts.S3SessionPrefix("dnd", "sample-campaign", "2026-05-03"), "audio/"), "alice.flac")
+	audioKey := artifacts.S3PublishedOutputKey(artifacts.S3AudioPrefix(artifacts.S3SessionPrefix("dnd", "sample-campaign", "2026-05-03"), "audio/"), "alice.flac")
 	fake.SeedObject(storage.FakeObject{Key: audioKey, Data: []byte("audio")})
 	origStoreFn := newObjectStoreFromConfigFn
 	newObjectStoreFromConfigFn = func(context.Context, *config.Config) (storage.ObjectStore, error) {
@@ -82,7 +438,7 @@ inputs:
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"session", "validate", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath}, &stdout, &stderr)
+	code := Execute([]string{"session", "validate", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stdout=%q stderr=%q", code, stdout.String(), stderr.String())
 	}
@@ -101,13 +457,11 @@ func TestExecuteLocksAddListAndRemoveUseRemoteLockStore(t *testing.T) {
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute([]string{
-		"locks", "add",
+		"session", "locks", "add", "2026-05-03", "narratio.transcript.final_trimmed",
 		"--config", pipelinePath,
-		"--campaign", campaignPath,
+		"--campaign-file", campaignPath,
 		"--session", sessionPath,
 		"--session-id", "2026-05-03",
 		"--reason", "manual edit",
 		"narratio.transcript.trimmed",
 	}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("locks add exit code = %d, want 0; stderr=%q", code, stderr.String())
@@ -117,42 +471,39 @@ func TestExecuteLocksAddListAndRemoveUseRemoteLockStore(t *testing.T) {
 	if !ok {
 		t.Fatalf("remote locks key %q not uploaded", key)
 	}
-	if !strings.Contains(string(obj.Data), "source: narratio.transcript.trimmed") || !strings.Contains(string(obj.Data), "reason: manual edit") {
+	if !strings.Contains(string(obj.Data), "source: narratio.transcript.final_trimmed") || !strings.Contains(string(obj.Data), "reason: manual edit") {
 		t.Fatalf("lock store data = %q", string(obj.Data))
 	}
 	stdout.Reset()
 	stderr.Reset()
 	code = Execute([]string{
-		"locks",
+		"session", "locks", "2026-05-03",
 		"--config", pipelinePath,
-		"--campaign", campaignPath,
+		"--campaign-file", campaignPath,
 		"--session", sessionPath,
 		"--session-id", "2026-05-03",
 	}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("locks list exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
-	if !strings.Contains(stdout.String(), "- narratio.transcript.trimmed origin=remote") {
+	if !strings.Contains(stdout.String(), "- narratio.transcript.final_trimmed origin=remote") {
 		t.Fatalf("stdout = %q, want remote lock", stdout.String())
 	}
 	stdout.Reset()
 	stderr.Reset()
 	code = Execute([]string{
-		"locks", "remove",
+		"session", "locks", "remove", "2026-05-03", "narratio.transcript.final_trimmed",
 		"--config", pipelinePath,
-		"--campaign", campaignPath,
+		"--campaign-file", campaignPath,
 		"--session", sessionPath,
 		"--session-id", "2026-05-03",
 		"narratio.transcript.trimmed",
 	}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("locks remove exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
-	store, err := config.LoadArchiveLockStoreBytes("locks.yml", fake.Objects[key].Data, nil)
+	store, err := config.LoadPublishLockStoreBytes("locks.yml", fake.Objects[key].Data, nil)
 	if err != nil {
-		t.Fatalf("LoadArchiveLockStoreBytes() error = %v", err)
+		t.Fatalf("LoadPublishLockStoreBytes() error = %v", err)
 	}
 	if len(store.Locks) != 0 {
 		t.Fatalf("locks after remove = %#v, want empty", store.Locks)
@@ -172,13 +523,11 @@ func TestExecuteLocksAddDuplicateRequiresForce(t *testing.T) {
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute([]string{
-		"locks", "add",
+		"session", "locks", "add", "2026-05-03", "narratio.transcript.final_trimmed",
 		"--config", pipelinePath,
-		"--campaign", campaignPath,
+		"--campaign-file", campaignPath,
 		"--session", sessionPath,
 		"--session-id", "2026-05-03",
 		"--reason", "first",
 		"narratio.transcript.trimmed",
 	}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("initial locks add exit code = %d, want 0; stderr=%q", code, stderr.String())
@@ -187,13 +536,11 @@ func TestExecuteLocksAddDuplicateRequiresForce(t *testing.T) {
 	stdout.Reset()
 	stderr.Reset()
 	code = Execute([]string{
-		"locks", "add",
+		"session", "locks", "add", "2026-05-03", "narratio.transcript.final_trimmed",
 		"--config", pipelinePath,
-		"--campaign", campaignPath,
+		"--campaign-file", campaignPath,
 		"--session", sessionPath,
 		"--session-id", "2026-05-03",
 		"--reason", "second",
 		"narratio.transcript.trimmed",
 	}, &stdout, &stderr)
 	if code == 0 {
 		t.Fatal("duplicate locks add exit code = 0, want non-zero")
@@ -205,14 +552,12 @@ func TestExecuteLocksAddDuplicateRequiresForce(t *testing.T) {
 	stdout.Reset()
 	stderr.Reset()
 	code = Execute([]string{
-		"locks", "add",
+		"session", "locks", "add", "2026-05-03", "narratio.transcript.final_trimmed",
 		"--config", pipelinePath,
-		"--campaign", campaignPath,
+		"--campaign-file", campaignPath,
 		"--session", sessionPath,
 		"--session-id", "2026-05-03",
 		"--reason", "second",
 		"--force",
 		"narratio.transcript.trimmed",
 	}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("forced locks add exit code = %d, want 0; stderr=%q", code, stderr.String())
@@ -229,9 +574,9 @@ func TestExecuteLocksRequireSessionID(t *testing.T) {
 		args []string
 		want string
 	}{
-		{"list", []string{"locks"}, "locks: --session-id is required"},
+		{"list", []string{"session", "locks"}, "locks: session_id is required"},
-		{"add", []string{"locks", "add", "narratio.transcript.trimmed"}, "locks add: --session-id is required"},
+		{"add", []string{"session", "locks", "add", "narratio.transcript.final_trimmed"}, "locks add: expected session_id and source id"},
-		{"remove", []string{"locks", "remove", "narratio.transcript.trimmed"}, "locks remove: --session-id is required"},
+		{"remove", []string{"session", "locks", "remove", "narratio.transcript.final_trimmed"}, "locks remove: expected session_id and source id"},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -251,7 +596,7 @@ func TestExecuteLocksRequireSessionID(t *testing.T) {
 func TestExecuteLocksCannotModifyStaticLocks(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
-	addStaticArchiveLockToPipelineConfig(t, pipelinePath, "narratio.transcript.trimmed")
+	addStaticPublishLockToPipelineConfig(t, pipelinePath, "narratio.transcript.final_trimmed")
 	fake := &storage.FakeBackend{}
 	var storeInitCalls int
 	restoreAppConfigTestGlobals(t, fake, &storeInitCalls, []string{sessionPath})
@@ -259,12 +604,10 @@ func TestExecuteLocksCannotModifyStaticLocks(t *testing.T) {
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute([]string{
-		"locks", "add",
+		"session", "locks", "add", "2026-05-03", "narratio.transcript.final_trimmed",
 		"--config", pipelinePath,
-		"--campaign", campaignPath,
+		"--campaign-file", campaignPath,
 		"--session", sessionPath,
 		"--session-id", "2026-05-03",
 		"narratio.transcript.trimmed",
 	}, &stdout, &stderr)
 	if code == 0 {
 		t.Fatal("locks add static lock exit code = 0, want non-zero")
@@ -276,12 +619,10 @@ func TestExecuteLocksCannotModifyStaticLocks(t *testing.T) {
 	stdout.Reset()
 	stderr.Reset()
 	code = Execute([]string{
-		"locks", "remove",
+		"session", "locks", "remove", "2026-05-03", "narratio.transcript.final_trimmed",
 		"--config", pipelinePath,
-		"--campaign", campaignPath,
+		"--campaign-file", campaignPath,
 		"--session", sessionPath,
 		"--session-id", "2026-05-03",
 		"narratio.transcript.trimmed",
 	}, &stdout, &stderr)
 	if code == 0 {
 		t.Fatal("locks remove static lock exit code = 0, want non-zero")
@@ -297,7 +638,7 @@ func TestExecuteTopLevelLockAndUnlockAreRemoved(t *testing.T) {
 		t.Run(cmd, func(t *testing.T) {
 			var stdout bytes.Buffer
 			var stderr bytes.Buffer
-			code := Execute([]string{cmd, "narratio.transcript.trimmed"}, &stdout, &stderr)
+			code := Execute([]string{cmd, "narratio.transcript.final_trimmed"}, &stdout, &stderr)
 			if code == 0 {
 				t.Fatal("exit code = 0, want non-zero")
 			}
@@ -308,19 +649,53 @@ func TestExecuteTopLevelLockAndUnlockAreRemoved(t *testing.T) {
 	}
 }
-func TestExecuteArtifactsListRemoteReportsPromotedAvailability(t *testing.T) {
+func withDefaultPipelineCampaignConfigs(t *testing.T, pipelinePath, campaignPath string) {
 	t.Helper()
 	origPipelineDefaults := append([]string(nil), config.DefaultPipelineConfigSearchPaths...)
 	config.DefaultPipelineConfigSearchPaths = []string{pipelinePath}
 	t.Cleanup(func() {
 		config.DefaultPipelineConfigSearchPaths = origPipelineDefaults
 	})
 	_ = campaignPath
 }
 func writeSessionInitTemplate(t *testing.T, campaignPath, templateYAML string) {
 	t.Helper()
 	templatePath := filepath.Join(filepath.Dir(campaignPath), "session.template.yml")
 	if err := os.WriteFile(templatePath, []byte(templateYAML), 0o644); err != nil {
 		t.Fatalf("write session template: %v", err)
 	}
 	addSessionTemplateToCampaign(t, campaignPath, "./session.template.yml")
 }
 func addSessionTemplateToCampaign(t *testing.T, campaignPath, templateFile string) {
 	t.Helper()
 	data, err := os.ReadFile(campaignPath)
 	if err != nil {
 		t.Fatalf("read campaign config: %v", err)
 	}
 	if strings.Contains(string(data), "session_template_file:") {
 		t.Fatalf("campaign config already has session_template_file: %q", string(data))
 	}
 	updated := "session_template_file: " + templateFile + "\n" + string(data)
 	if err := os.WriteFile(campaignPath, []byte(updated), 0o644); err != nil {
 		t.Fatalf("write campaign config: %v", err)
 	}
 }
 func TestExecuteArtifactsListRemoteReportsPublishedAvailability(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
-	addArchivePromotionsToPipeline(t, pipelinePath, `
+	addPublishOutputsToPipeline(t, pipelinePath, `
-  promote_artifacts:
+  outputs:
-    - source: narratio.transcript.trimmed
+    - source: narratio.transcript.final_trimmed
-      dest: transcripts/trimmed.json
+      dest: transcripts/final.trimmed.json
      required: true
 `)
 	fake := &storage.FakeBackend{}
-	trimmedKey := artifacts.S3PromotedArtifactKey(
+	trimmedKey := artifacts.S3PublishedOutputKey(
 		artifacts.S3SessionPrefix("dnd", "sample-campaign", "2026-05-03"),
-		"transcripts/trimmed.json",
+		"transcripts/final.trimmed.json",
 	)
 	fake.SeedObject(storage.FakeObject{Key: trimmedKey, Data: []byte(`{"segments":[]}`)})
 	var storeInitCalls int
@@ -329,26 +704,26 @@ func TestExecuteArtifactsListRemoteReportsPromotedAvailability(t *testing.T) {
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute([]string{
-		"artifacts", "list",
+		"session", "artifacts", "2026-05-03",
 		"--config", pipelinePath,
-		"--campaign", campaignPath,
+		"--campaign-file", campaignPath,
 		"--session", sessionPath,
 		"--remote",
 	}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
-	if !strings.Contains(stdout.String(), "narratio.transcript.trimmed remote=promoted") {
+	if !strings.Contains(stdout.String(), "narratio.transcript.final_trimmed remote=published") {
-		t.Fatalf("stdout = %q, want promoted remote availability", stdout.String())
+		t.Fatalf("stdout = %q, want published remote availability", stdout.String())
 	}
 }
-func TestExecuteArtifactsListRemoteUsesPromotionDestinations(t *testing.T) {
+func TestExecuteArtifactsListRemoteUsesPublishOutputDestinations(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
-	addArchivePromotionsToPipeline(t, pipelinePath, `
+	addPublishOutputsToPipeline(t, pipelinePath, `
-  promote_artifacts:
+  outputs:
-    - source: narratio.transcript.full
+    - source: narratio.transcript.final
      dest: transcripts/full.json
      required: true
    - source: narratio.bounds.session
@@ -357,17 +732,17 @@ func TestExecuteArtifactsListRemoteUsesPromotionDestinations(t *testing.T) {
 `)
 	fake := &storage.FakeBackend{}
 	sessionPrefix := artifacts.S3SessionPrefix("dnd", "sample-campaign", "2026-05-03")
-	fake.SeedObject(storage.FakeObject{Key: artifacts.S3PromotedArtifactKey(sessionPrefix, "transcripts/full.json"), Data: []byte(`{"segments":[]}`)})
+	fake.SeedObject(storage.FakeObject{Key: artifacts.S3PublishedOutputKey(sessionPrefix, "transcripts/full.json"), Data: []byte(`{"segments":[]}`)})
-	fake.SeedObject(storage.FakeObject{Key: artifacts.S3PromotedArtifactKey(sessionPrefix, "transcripts/bounds.json"), Data: []byte(`{}`)})
+	fake.SeedObject(storage.FakeObject{Key: artifacts.S3PublishedOutputKey(sessionPrefix, "transcripts/bounds.json"), Data: []byte(`{}`)})
 	var storeInitCalls int
 	restoreAppConfigTestGlobals(t, fake, &storeInitCalls, []string{sessionPath})
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute([]string{
-		"artifacts", "list",
+		"session", "artifacts", "2026-05-03",
 		"--config", pipelinePath,
-		"--campaign", campaignPath,
+		"--campaign-file", campaignPath,
 		"--session", sessionPath,
 		"--remote",
 	}, &stdout, &stderr)
@@ -376,7 +751,7 @@ func TestExecuteArtifactsListRemoteUsesPromotionDestinations(t *testing.T) {
 	}
 	out := stdout.String()
 	for _, unwanted := range []string{
-		"narratio.transcript.full remote=missing",
+		"narratio.transcript.final remote=missing",
 		"narratio.bounds.session remote=missing",
 	} {
 		if strings.Contains(out, unwanted) {
@@ -384,8 +759,8 @@ func TestExecuteArtifactsListRemoteUsesPromotionDestinations(t *testing.T) {
 		}
 	}
 	for _, want := range []string{
-		"narratio.transcript.full dest=transcripts/full.json remote=promoted",
+		"narratio.transcript.final dest=transcripts/full.json remote=published",
-		"narratio.bounds.session dest=transcripts/bounds.json remote=promoted",
+		"narratio.bounds.session dest=transcripts/bounds.json remote=published",
 	} {
 		if !strings.Contains(out, want) {
 			t.Fatalf("stdout = %q, want %q", out, want)
@@ -396,37 +771,36 @@ func TestExecuteArtifactsListRemoteUsesPromotionDestinations(t *testing.T) {
 func TestExecuteStatusReportsRemoteArtifactCatalog(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
-	addArchivePromotionsToPipeline(t, pipelinePath, `
+	addPublishOutputsToPipeline(t, pipelinePath, `
-  promote_artifacts:
+  outputs:
-    - source: narratio.transcript.trimmed
+    - source: narratio.transcript.final_trimmed
-      dest: transcripts/trimmed.json
+      dest: transcripts/final.trimmed.json
      required: true
-    - source: narratio.transcript.full
+    - source: narratio.transcript.final
      dest: transcripts/full.json
      required: true
 `)
 	fake := &storage.FakeBackend{}
 	sessionPrefix := artifacts.S3SessionPrefix("dnd", "sample-campaign", "2026-05-03")
-	manifestKey, runIDKey := artifacts.ResolveArchiveCurrentStateKeys(sessionPrefix)
+	manifestKey, runIDKey := artifacts.ResolveCurrentStateKeys(sessionPrefix)
-	trimmedKey := artifacts.S3PromotedArtifactKey(sessionPrefix, "transcripts/trimmed.json")
+	trimmedKey := artifacts.S3PublishedOutputKey(sessionPrefix, "transcripts/final.trimmed.json")
-	fullKey := artifacts.S3PromotedArtifactKey(sessionPrefix, "transcripts/full.json")
+	fullKey := artifacts.S3PublishedOutputKey(sessionPrefix, "transcripts/full.json")
 	lockKey := artifacts.S3SessionLocksKey(sessionPrefix)
 	fake.SeedObject(storage.FakeObject{Key: runIDKey, Data: []byte("20260519T010203Z-a1b2c3d4\n")})
 	fake.SeedObject(storage.FakeObject{Key: manifestKey, Data: restoreManifestJSON(t, "2026-05-03", "sample-campaign")})
 	fake.SeedObject(storage.FakeObject{Key: trimmedKey, Data: []byte(`{"segments":[]}`)})
 	fake.SeedObject(storage.FakeObject{Key: fullKey, Data: []byte(`{"segments":[]}`)})
-	fake.SeedObject(storage.FakeObject{Key: lockKey, Data: []byte("locks:\n  - source: narratio.transcript.trimmed\n    reason: remote review\n")})
+	fake.SeedObject(storage.FakeObject{Key: lockKey, Data: []byte("locks:\n  - source: narratio.transcript.final_trimmed\n    reason: remote review\n")})
 	var storeInitCalls int
 	restoreAppConfigTestGlobals(t, fake, &storeInitCalls, []string{sessionPath})
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute([]string{
-		"status",
+		"session", "status", "2026-05-03",
 		"--config", pipelinePath,
-		"--campaign", campaignPath,
+		"--campaign-file", campaignPath,
 		"--session", sessionPath,
 		"--session-id", "2026-05-03",
 	}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
@@ -437,16 +811,16 @@ func TestExecuteStatusReportsRemoteArtifactCatalog(t *testing.T) {
 		"Built-in:",
 		"Configured:",
 		"Previous-session:",
-		"Promoted:",
+		"Published:",
-		"narratio.transcript.trimmed locked",
+		"narratio.transcript.final_trimmed locked",
-		"narratio.transcript.trimmed locked remote=promoted",
+		"narratio.transcript.final_trimmed locked remote=published",
-		"narratio.transcript.full dest=transcripts/full.json remote=promoted",
+		"narratio.transcript.final dest=transcripts/full.json remote=published",
 	} {
 		if !strings.Contains(out, want) {
 			t.Fatalf("stdout = %q, want %q", out, want)
 		}
 	}
-	if strings.Contains(out, "narratio.transcript.merged remote=missing") {
+	if strings.Contains(out, "narratio.transcript.base remote=missing") {
 		t.Fatalf("stdout = %q, did not want catalog remote marker", out)
 	}
 }
@@ -454,10 +828,10 @@ func TestExecuteStatusReportsRemoteArtifactCatalog(t *testing.T) {
 func TestExecuteStatusReportsRemoteArtifactCatalogErrorsWithoutFailing(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
-	addArchivePromotionsToPipeline(t, pipelinePath, `
+	addPublishOutputsToPipeline(t, pipelinePath, `
-  promote_artifacts:
+  outputs:
-    - source: narratio.transcript.trimmed
+    - source: narratio.transcript.final_trimmed
-      dest: transcripts/trimmed.json
+      dest: transcripts/final.trimmed.json
      required: true
 `)
 	fake := &storage.FakeBackend{ExistsErr: fmt.Errorf("exists failed")}
@@ -467,71 +841,139 @@ func TestExecuteStatusReportsRemoteArtifactCatalogErrorsWithoutFailing(t *testin
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute([]string{
-		"status",
+		"session", "status", "2026-05-03",
 		"--config", pipelinePath,
-		"--campaign", campaignPath,
+		"--campaign-file", campaignPath,
 		"--session", sessionPath,
 		"--session-id", "2026-05-03",
 	}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
 	out := stdout.String()
-	if !strings.Contains(out, "Remote archive: missing or unavailable:") {
+	if !strings.Contains(out, "Remote publish: missing or unavailable:") {
-		t.Fatalf("stdout = %q, want remote archive unavailable state", out)
+		t.Fatalf("stdout = %q, want remote publish unavailable state", out)
 	}
-	if !strings.Contains(out, "Remote outputs:") || !strings.Contains(out, "narratio.transcript.trimmed remote=error") {
+	if !strings.Contains(out, "Remote outputs:") || !strings.Contains(out, "narratio.transcript.final_trimmed remote=error") {
 		t.Fatalf("stdout = %q, want remote output error state", out)
 	}
-	if !strings.Contains(out, "Archive locks: error:") {
+	if !strings.Contains(out, "Publish locks: error:") {
-		t.Fatalf("stdout = %q, want archive locks error", out)
+		t.Fatalf("stdout = %q, want publish locks error", out)
 	}
 }
-func TestExecuteArchiveLoadsRemoteLocks(t *testing.T) {
+func TestExecuteStatusReportsMissingRemoteCurrentStateWithoutFailing(t *testing.T) {
 	workspaceRoot := t.TempDir()
-	pipelinePath, campaignPath, sessionPath := writeValidArchiveConfigFiles(t, workspaceRoot)
+	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 	fake := &storage.FakeBackend{}
 	var storeInitCalls int
 	restoreAppConfigTestGlobals(t, fake, &storeInitCalls, []string{sessionPath})
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute([]string{
 		"session", "status", "2026-05-03",
 		"--config", pipelinePath,
 		"--campaign-file", campaignPath,
 		"--session", sessionPath,
 	}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
 	if !strings.Contains(stdout.String(), "Remote publish: missing or unavailable: remote current run pointer missing") {
 		t.Fatalf("stdout = %q, want missing remote current-state line", stdout.String())
 	}
 }
 func TestExecuteSessionValidateReportsPreviousStateFindingAndReturnsFindingError(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFilesWithScriptoriumArtifacts(t, workspaceRoot)
 	replaceInFileOrFatal(t, pipelinePath, "source: narratio.artifact.session_recap", "source: narratio.previous_session.artifact.session_recap")
 	replaceInFileOrFatal(t, sessionPath, "session_id: 2026-05-03\n", "session_id: 2026-05-03\nprevious_session_id: 2026-04-26\n")
 	fake := &storage.FakeBackend{}
 	var storeInitCalls int
 	restoreAppConfigTestGlobals(t, fake, &storeInitCalls, []string{sessionPath})
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute([]string{
 		"session", "validate", "2026-05-03",
 		"--config", pipelinePath,
 		"--campaign-file", campaignPath,
 		"--session", sessionPath,
 	}, &stdout, &stderr)
 	if code == 0 {
 		t.Fatal("exit code = 0, want non-zero")
 	}
 	if !strings.Contains(stdout.String(), "ERROR previous") {
 		t.Fatalf("stdout = %q, want previous finding error", stdout.String())
 	}
 	if !strings.Contains(stdout.String(), "remote current run pointer missing") {
 		t.Fatalf("stdout = %q, want missing run pointer finding", stdout.String())
 	}
 	if !strings.Contains(stderr.String(), "validation error(s)") {
 		t.Fatalf("stderr = %q, want finding error summary", stderr.String())
 	}
 }
 func TestExecutePublishLoadsRemoteLocks(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, sessionPath := writeValidPublishRunConfigFiles(t, workspaceRoot)
 	fake := &storage.FakeBackend{}
 	lockKey := artifacts.S3SessionLocksKey(artifacts.S3SessionPrefix("dnd", "sample-campaign", "2026-05-03"))
-	fake.SeedObject(storage.FakeObject{Key: lockKey, Data: []byte("locks:\n  - source: narratio.transcript.trimmed\n    reason: remote review\n")})
+	fake.SeedObject(storage.FakeObject{Key: lockKey, Data: []byte("locks:\n  - source: narratio.transcript.final_trimmed\n    reason: remote review\n")})
 	var storeInitCalls int
 	restoreAppConfigTestGlobals(t, fake, &storeInitCalls, []string{sessionPath})
 	workRoot := filepath.Join(workspaceRoot, "work", "sample-campaign", "2026-05-03")
 	for _, stageName := range []string{"prepare", "transcribe", "merge", "polish", "normalize", "trim", "analyze"} {
-		// The archive stage only checks the manifest statuses and source files.
+		// The publish stage only checks the manifest statuses and source files.
 		_ = stageName
 	}
-	mustWriteTestFile(t, filepath.Join(workRoot, "transcripts", "trimmed.json"), `{"segments":[]}`)
+	mustWriteTestFile(t, filepath.Join(workRoot, "transcripts", "final.trimmed.json"), `{"segments":[]}`)
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"run-stage", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "--force", "archive"}, &stdout, &stderr)
+	code := Execute([]string{"run-stage", "publish", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath, "--force"}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
-	promotedKey := artifacts.S3PromotedArtifactKey(artifacts.S3SessionPrefix("dnd", "sample-campaign", "2026-05-03"), "transcripts/trimmed.json")
+	publishedKey := artifacts.S3PublishedOutputKey(artifacts.S3SessionPrefix("dnd", "sample-campaign", "2026-05-03"), "transcripts/final.trimmed.json")
-	if _, ok := fake.Objects[promotedKey]; ok {
+	if _, ok := fake.Objects[publishedKey]; ok {
-		t.Fatalf("locked promoted key %q was uploaded", promotedKey)
+		t.Fatalf("locked published key %q was uploaded", publishedKey)
 	}
 }
-func addArchivePromotionsToPipeline(t *testing.T, pipelinePath, archiveYAML string) {
+func addPublishOutputsToPipeline(t *testing.T, pipelinePath, publishYAML string) {
 	t.Helper()
 	data, err := os.ReadFile(pipelinePath)
 	if err != nil {
 		t.Fatalf("read pipeline: %v", err)
 	}
-	updated := strings.Replace(string(data), "  upload_run: false\n", "  upload_run: false\n"+archiveYAML, 1)
+	updated := strings.Replace(string(data), "  upload_run: false\n", "  upload_run: false\n"+publishYAML, 1)
 	if updated == string(data) {
-		t.Fatalf("pipeline %q did not contain archive upload_run marker", pipelinePath)
+		t.Fatalf("pipeline %q did not contain publish upload_run marker", pipelinePath)
 	}
 	if err := os.WriteFile(pipelinePath, []byte(updated), 0o644); err != nil {
 		t.Fatalf("write pipeline: %v", err)
 	}
 }
-func writeValidArchiveConfigFiles(t *testing.T, workspaceRoot string) (string, string, string) {
+func replaceInFileOrFatal(t *testing.T, path, old, new string) {
 	t.Helper()
 	data, err := os.ReadFile(path)
 	if err != nil {
 		t.Fatalf("read %s: %v", path, err)
 	}
 	updated := strings.Replace(string(data), old, new, 1)
 	if updated == string(data) {
 		t.Fatalf("%s did not contain %q", path, old)
 	}
 	if err := os.WriteFile(path, []byte(updated), 0o644); err != nil {
 		t.Fatalf("write %s: %v", path, err)
 	}
 }
 func writeValidPublishRunConfigFiles(t *testing.T, workspaceRoot string) (string, string, string) {
 	t.Helper()
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 	data, err := os.ReadFile(pipelinePath)
@@ -568,7 +1010,7 @@ func writeValidArchiveConfigFiles(t *testing.T, workspaceRoot string) (string, s
 	return pipelinePath, campaignPath, sessionPath
 }
-func addStaticArchiveLockToPipelineConfig(t *testing.T, pipelinePath, source string) {
+func addStaticPublishLockToPipelineConfig(t *testing.T, pipelinePath, source string) {
 	t.Helper()
 	data, err := os.ReadFile(pipelinePath)
 	if err != nil {
@@ -576,12 +1018,12 @@ func addStaticArchiveLockToPipelineConfig(t *testing.T, pipelinePath, source str
 	}
 	updated := strings.Replace(
 		string(data),
-		"archive:\n  enabled: true\n  upload_run: false\n",
+		"publish:\n  enabled: true\n  upload_run: false\n",
-		"archive:\n  enabled: true\n  upload_run: false\n  locks:\n    - source: "+source+"\n      reason: static review\n",
+		"publish:\n  enabled: true\n  upload_run: false\n  locks:\n    - source: "+source+"\n      reason: static review\n",
 		1,
 	)
 	if updated == string(data) {
-		t.Fatalf("archive section not found in pipeline config")
+		t.Fatalf("publish section not found in pipeline config")
 	}
 	if err := os.WriteFile(pipelinePath, []byte(updated), 0o644); err != nil {
 		t.Fatalf("write pipeline: %v", err)
--- a/internal/app/operator_locks.go
+++ b/internal/app/operator_locks.go
@@ -0,0 +1,222 @@
 package app
 import (
 	"context"
 	"flag"
 	"fmt"
 	"io"
 	"sort"
 	"strings"
 	"gitea.maximumdirect.net/eric/narratio/internal/config"
 )
 // Locks dispatches publish lock list and mutation helpers.
 func Locks(ctx context.Context, args []string, out io.Writer) error {
 	if len(args) > 0 && !strings.HasPrefix(args[0], "-") {
 		switch args[0] {
 		case "add":
 			return LocksAdd(ctx, args[1:], out)
 		case "remove":
 			return LocksRemove(ctx, args[1:], out)
 		default:
 			return fmt.Errorf("locks: unknown subcommand %q", args[0])
 		}
 	}
 	return LocksList(ctx, args, out)
 }
 // LocksList lists effective publish locks.
 func LocksList(ctx context.Context, args []string, out io.Writer) error {
 	fs := flag.NewFlagSet("locks", flag.ContinueOnError)
 	fs.SetOutput(io.Discard)
 	var flags commonConfigFlags
 	addCommonConfigFlags(fs, &flags)
 	if err := parseSessionAwareFlags("locks", fs, args, &flags.sessionID); err != nil {
 		return err
 	}
 	if strings.TrimSpace(flags.sessionID) == "" {
 		return fmt.Errorf("locks: session_id is required")
 	}
 	cfg, _, locks, _, err := loadHelperContext(ctx, flags, true)
 	if err != nil {
 		return fmt.Errorf("locks: %w", err)
 	}
 	writeLocks(out, cfg, locks)
 	return nil
 }
 // LocksAdd adds or updates one remote lock.
 func LocksAdd(ctx context.Context, args []string, out io.Writer) error {
 	var positionalSessionID string
 	var source string
 	if len(args) >= 2 && !isCLIFlagToken(args[0]) && !isCLIFlagToken(args[1]) {
 		positionalSessionID = strings.TrimSpace(args[0])
 		source = strings.TrimSpace(args[1])
 		args = append([]string(nil), args[2:]...)
 	}
 	fs := flag.NewFlagSet("locks add", flag.ContinueOnError)
 	fs.SetOutput(io.Discard)
 	var flags commonConfigFlags
 	var reason string
 	var force bool
 	addCommonConfigFlags(fs, &flags)
 	fs.StringVar(&reason, "reason", "", "lock reason")
 	fs.BoolVar(&force, "force", false, "update existing remote lock")
 	if err := fs.Parse(args); err != nil {
 		return fmt.Errorf("locks add: invalid flags: %w", err)
 	}
 	if source == "" {
 		switch fs.NArg() {
 		case 2:
 			positionalSessionID = strings.TrimSpace(fs.Arg(0))
 			source = strings.TrimSpace(fs.Arg(1))
 		case 1:
 			if strings.TrimSpace(flags.sessionID) == "" {
 				return fmt.Errorf("locks add: expected session_id and source id")
 			}
 			source = strings.TrimSpace(fs.Arg(0))
 		default:
 			return fmt.Errorf("locks add: expected session_id and source id")
 		}
 	} else if fs.NArg() != 0 {
 		return fmt.Errorf("locks add: unexpected positional arguments")
 	}
 	if err := applyPositionalSessionID("locks add", positionalSessionID, &flags.sessionID); err != nil {
 		return err
 	}
 	if strings.TrimSpace(flags.sessionID) == "" {
 		return fmt.Errorf("locks add: session_id is required")
 	}
 	cfg, store, locks, _, err := loadHelperContext(ctx, flags, true)
 	if err != nil {
 		return fmt.Errorf("locks add: %w", err)
 	}
 	if _, err := config.ValidatePublishLockRules([]config.PublishLockRule{{Source: source}}, cfg.Pipeline.Scriptorium, "locks add"); err != nil {
 		return fmt.Errorf("locks add: %w", err)
 	}
 	if _, ok := lockSourceSet(locks.Static)[source]; ok {
 		return fmt.Errorf("locks add: source %q is locked by pipeline config and cannot be modified remotely", source)
 	}
 	remoteSet := lockSourceSet(locks.Remote)
 	if _, exists := remoteSet[source]; exists && !force {
 		return fmt.Errorf("locks add: remote lock for %q already exists; pass --force to update", source)
 	}
 	remoteSet[source] = config.PublishLockRule{Source: source, Reason: strings.TrimSpace(reason)}
 	remoteLocks := lockMapValues(remoteSet)
 	if _, err := config.ValidatePublishLockRules(remoteLocks, cfg.Pipeline.Scriptorium, "locks"); err != nil {
 		return fmt.Errorf("locks add: %w", err)
 	}
 	if err := uploadRemoteLockStore(ctx, store, locks.Key, &config.PublishLockStore{Locks: remoteLocks}); err != nil {
 		return fmt.Errorf("locks add: %w", err)
 	}
 	_, err = fmt.Fprintf(out, "narratio session locks add: locked %s\n", source)
 	return err
 }
 // LocksRemove removes one remote lock.
 func LocksRemove(ctx context.Context, args []string, out io.Writer) error {
 	var positionalSessionID string
 	var source string
 	if len(args) >= 2 && !isCLIFlagToken(args[0]) && !isCLIFlagToken(args[1]) {
 		positionalSessionID = strings.TrimSpace(args[0])
 		source = strings.TrimSpace(args[1])
 		args = append([]string(nil), args[2:]...)
 	}
 	fs := flag.NewFlagSet("locks remove", flag.ContinueOnError)
 	fs.SetOutput(io.Discard)
 	var flags commonConfigFlags
 	addCommonConfigFlags(fs, &flags)
 	if err := fs.Parse(args); err != nil {
 		return fmt.Errorf("locks remove: invalid flags: %w", err)
 	}
 	if source == "" {
 		switch fs.NArg() {
 		case 2:
 			positionalSessionID = strings.TrimSpace(fs.Arg(0))
 			source = strings.TrimSpace(fs.Arg(1))
 		case 1:
 			if strings.TrimSpace(flags.sessionID) == "" {
 				return fmt.Errorf("locks remove: expected session_id and source id")
 			}
 			source = strings.TrimSpace(fs.Arg(0))
 		default:
 			return fmt.Errorf("locks remove: expected session_id and source id")
 		}
 	} else if fs.NArg() != 0 {
 		return fmt.Errorf("locks remove: unexpected positional arguments")
 	}
 	if err := applyPositionalSessionID("locks remove", positionalSessionID, &flags.sessionID); err != nil {
 		return err
 	}
 	if strings.TrimSpace(flags.sessionID) == "" {
 		return fmt.Errorf("locks remove: session_id is required")
 	}
 	cfg, store, locks, _, err := loadHelperContext(ctx, flags, true)
 	if err != nil {
 		return fmt.Errorf("locks remove: %w", err)
 	}
 	if _, err := config.ValidatePublishLockRules([]config.PublishLockRule{{Source: source}}, cfg.Pipeline.Scriptorium, "locks remove"); err != nil {
 		return fmt.Errorf("locks remove: %w", err)
 	}
 	remoteSet := lockSourceSet(locks.Remote)
 	if _, ok := remoteSet[source]; !ok {
 		if _, static := lockSourceSet(locks.Static)[source]; static {
 			return fmt.Errorf("locks remove: source %q is locked by pipeline config and cannot be unlocked remotely", source)
 		}
 		return fmt.Errorf("locks remove: remote lock for %q does not exist", source)
 	}
 	delete(remoteSet, source)
 	remoteLocks := lockMapValues(remoteSet)
 	if err := uploadRemoteLockStore(ctx, store, locks.Key, &config.PublishLockStore{Locks: remoteLocks}); err != nil {
 		return fmt.Errorf("locks remove: %w", err)
 	}
 	_, err = fmt.Fprintf(out, "narratio session locks remove: unlocked %s\n", source)
 	return err
 }
 func writeLocks(out io.Writer, cfg *config.Config, locks *effectiveLocks) {
 	if locks == nil || len(locks.All) == 0 {
 		fmt.Fprintln(out, "Publish locks: none")
 		return
 	}
 	fmt.Fprintln(out, "Publish locks:")
 	published := map[string]config.PublishOutputRule{}
 	if cfg != nil && cfg.Pipeline != nil && cfg.Pipeline.Publish != nil {
 		for _, rule := range cfg.Pipeline.Publish.Outputs {
 			published[strings.TrimSpace(rule.Source)] = rule
 		}
 	}
 	staticSet := lockSourceSet(locks.Static)
 	for _, lock := range locks.All {
 		origin := "remote"
 		if _, ok := staticSet[lock.Source]; ok {
 			origin = "pipeline"
 		}
 		promo := "not-published"
 		if _, ok := published[lock.Source]; ok {
 			promo = "published"
 		}
 		reason := strings.TrimSpace(lock.Reason)
 		if reason == "" {
 			reason = "(no reason)"
 		}
 		fmt.Fprintf(out, "- %s origin=%s %s reason=%s\n", lock.Source, origin, promo, reason)
 	}
 }
 func lockMapValues(in map[string]config.PublishLockRule) []config.PublishLockRule {
 	keys := make([]string, 0, len(in))
 	for key := range in {
 		keys = append(keys, key)
 	}
 	sort.Strings(keys)
 	out := make([]config.PublishLockRule, 0, len(keys))
 	for _, key := range keys {
 		item := in[key]
 		item.Source = key
 		item.Reason = strings.TrimSpace(item.Reason)
 		out = append(out, item)
 	}
 	return out
 }
--- a/internal/app/operator_session_init.go
+++ b/internal/app/operator_session_init.go
@@ -0,0 +1,268 @@
 package app
 import (
 	"context"
 	"flag"
 	"fmt"
 	"io"
 	"os"
 	"path/filepath"
 	"regexp"
 	"sort"
 	"strings"
 	"gitea.maximumdirect.net/eric/narratio/internal/adapters/storage"
 	"gitea.maximumdirect.net/eric/narratio/internal/artifacts"
 	"gitea.maximumdirect.net/eric/narratio/internal/config"
 	"gopkg.in/yaml.v3"
 )
 // SessionInit creates a local or remote session.yml skeleton.
 func SessionInit(ctx context.Context, args []string, out io.Writer) error {
 	fs := flag.NewFlagSet("session init", flag.ContinueOnError)
 	fs.SetOutput(io.Discard)
 	var pipelinePath, campaignPath, campaignFilePath, sessionID, previousSessionID, date, title, output, audioS3Prefix, audioDir string
 	var remote, force bool
 	fs.StringVar(&pipelinePath, "config", "", "path to pipeline.yml (optional; defaults searched)")
 	fs.StringVar(&campaignPath, "campaign", "", "campaign ID")
 	fs.StringVar(&campaignFilePath, "campaign-file", "", "path to campaign.yml")
 	fs.StringVar(&sessionID, "session-id", "", "session identifier")
 	fs.StringVar(&previousSessionID, "previous-session-id", "", "previous session identifier")
 	fs.StringVar(&date, "date", "", "session date")
 	fs.StringVar(&title, "title", "", "session title")
 	fs.StringVar(&output, "output", "", "local output session.yml path")
 	fs.StringVar(&audioS3Prefix, "audio-s3-prefix", "", "session audio S3 prefix")
 	fs.StringVar(&audioDir, "audio-dir", "", "local audio directory")
 	fs.BoolVar(&remote, "remote", false, "write session.yml to S3 session prefix")
 	fs.BoolVar(&force, "force", false, "overwrite existing target")
 	if err := parseSessionAwareFlags("session init", fs, args, &sessionID); err != nil {
 		return err
 	}
 	if strings.TrimSpace(sessionID) == "" {
 		return fmt.Errorf("session init: session_id is required")
 	}
 	if (strings.TrimSpace(output) == "") == !remote {
 		return fmt.Errorf("session init: specify exactly one target: --output <path> or --remote")
 	}
 	if strings.TrimSpace(audioDir) != "" && strings.TrimSpace(audioS3Prefix) != "" {
 		return fmt.Errorf("session init: --audio-dir and --audio-s3-prefix are mutually exclusive")
 	}
 	base, err := loadPipelineCampaignConfig(pipelinePath, campaignPath, campaignFilePath)
 	if err != nil {
 		return fmt.Errorf("session init: %w", err)
 	}
 	input := sessionInitInput{
 		Campaign:          config.CampaignID(base.Campaign),
 		CampaignPath:      base.CampaignPath,
 		TemplateFile:      base.Campaign.SessionTemplateFile,
 		SessionID:         sessionID,
 		PreviousSessionID: previousSessionID,
 		Date:              date,
 		Title:             title,
 		AudioS3Prefix:     audioS3Prefix,
 		AudioDir:          audioDir,
 	}
 	data, err := buildSessionInitYAML(input)
 	if err != nil {
 		return fmt.Errorf("session init: %w", err)
 	}
 	label := strings.TrimSpace(output)
 	if label == "" {
 		label = "remote session.yml"
 	}
 	sessionCfg, err := config.LoadSessionBytesWithOptions(label, data, config.SessionLoadOptions{
 		SessionID:         sessionID,
 		PreviousSessionID: previousSessionID,
 	})
 	if err != nil {
 		return fmt.Errorf("session init: %w", err)
 	}
 	cfg, err := config.Resolve(base.PipelinePath, base.Pipeline, base.CampaignPath, base.Campaign, label, sessionCfg, config.SessionSource{Source: "session_config", LocalPath: label})
 	if err != nil {
 		return fmt.Errorf("session init: %w", err)
 	}
 	if err := config.Validate(cfg); err != nil {
 		return fmt.Errorf("session init: %w", err)
 	}
 	if !remote {
 		if err := writeLocalFile(output, data, force); err != nil {
 			return fmt.Errorf("session init: %w", err)
 		}
 		_, err := fmt.Fprintf(out, "narratio session init: wrote %s\n", filepath.Clean(output))
 		return err
 	}
 	store, err := newCommandObjectStore(ctx, cfg, nil)
 	if err != nil {
 		return fmt.Errorf("session init: %w", err)
 	}
 	sessionPrefix := artifacts.S3SessionPrefix(base.Pipeline.Storage.S3.RootPrefix, config.CampaignID(base.Campaign), sessionID)
 	key := artifacts.S3SessionConfigKey(sessionPrefix)
 	exists, err := store.Exists(ctx, key)
 	if err != nil {
 		return fmt.Errorf("session init: check remote session %q: %w", key, err)
 	}
 	if exists && !force {
 		return fmt.Errorf("session init: remote session %q already exists; pass --force to overwrite", key)
 	}
 	tmp, err := os.CreateTemp("", "narratio-session-init-*.yml")
 	if err != nil {
 		return fmt.Errorf("session init: create temp file: %w", err)
 	}
 	tmpPath := tmp.Name()
 	defer func() { _ = os.Remove(tmpPath) }()
 	if _, err := tmp.Write(data); err != nil {
 		_ = tmp.Close()
 		return fmt.Errorf("session init: write temp file: %w", err)
 	}
 	if err := tmp.Close(); err != nil {
 		return fmt.Errorf("session init: close temp file: %w", err)
 	}
 	if _, err := store.Upload(ctx, tmpPath, key, storage.UploadOptions{ContentType: "application/x-yaml; charset=utf-8"}); err != nil {
 		return fmt.Errorf("session init: upload remote session %q: %w", key, err)
 	}
 	_, err = fmt.Fprintf(out, "narratio session init: wrote s3://%s/%s\n", s3BucketName(base.Pipeline), key)
 	return err
 }
 func buildSessionYAML(campaign, sessionID, previousSessionID, date, title, audioS3Prefix, audioDir string) ([]byte, error) {
 	if strings.TrimSpace(date) == "" && regexp.MustCompile(`^\d{4}-\d{2}-\d{2}$`).MatchString(strings.TrimSpace(sessionID)) {
 		date = strings.TrimSpace(sessionID)
 	}
 	type audioS3 struct {
 		Prefix string `yaml:"prefix"`
 	}
 	type inputs struct {
 		AudioDir string   `yaml:"audio_dir,omitempty"`
 		AudioS3  *audioS3 `yaml:"audio_s3,omitempty"`
 	}
 	type sessionYAML struct {
 		Campaign          string `yaml:"campaign"`
 		SessionID         string `yaml:"session_id"`
 		PreviousSessionID string `yaml:"previous_session_id,omitempty"`
 		Date              string `yaml:"date,omitempty"`
 		Title             string `yaml:"title,omitempty"`
 		Inputs            inputs `yaml:"inputs"`
 	}
 	in := inputs{AudioDir: strings.TrimSpace(audioDir)}
 	if in.AudioDir == "" {
 		prefix := strings.TrimSpace(audioS3Prefix)
 		if prefix == "" {
 			prefix = "audio/"
 		}
 		in.AudioS3 = &audioS3{Prefix: prefix}
 	}
 	data, err := yaml.Marshal(sessionYAML{
 		Campaign:          strings.TrimSpace(campaign),
 		SessionID:         strings.TrimSpace(sessionID),
 		PreviousSessionID: strings.TrimSpace(previousSessionID),
 		Date:              strings.TrimSpace(date),
 		Title:             strings.TrimSpace(title),
 		Inputs:            in,
 	})
 	if err != nil {
 		return nil, err
 	}
 	return data, nil
 }
 type sessionInitInput struct {
 	Campaign          string
 	CampaignPath      string
 	TemplateFile      string
 	SessionID         string
 	PreviousSessionID string
 	Date              string
 	Title             string
 	AudioS3Prefix     string
 	AudioDir          string
 }
 func buildSessionInitYAML(in sessionInitInput) ([]byte, error) {
 	if strings.TrimSpace(in.TemplateFile) == "" {
 		return buildSessionYAML(in.Campaign, in.SessionID, in.PreviousSessionID, in.Date, in.Title, in.AudioS3Prefix, in.AudioDir)
 	}
 	templatePath := resolveSessionInitTemplatePath(in.CampaignPath, in.TemplateFile)
 	templateBytes, err := os.ReadFile(templatePath)
 	if err != nil {
 		return nil, fmt.Errorf("read session template %q: %w", templatePath, err)
 	}
 	rendered, err := renderSessionInitTemplate(string(templateBytes), in)
 	if err != nil {
 		return nil, fmt.Errorf("render session template %q: %w", templatePath, err)
 	}
 	return []byte(rendered), nil
 }
 func resolveSessionInitTemplatePath(campaignPath, templateFile string) string {
 	templateFile = strings.TrimSpace(templateFile)
 	if filepath.IsAbs(templateFile) {
 		return filepath.Clean(templateFile)
 	}
 	return filepath.Clean(filepath.Join(filepath.Dir(campaignPath), templateFile))
 }
 var sessionInitTemplatePattern = regexp.MustCompile(`\{\{\s*([a-zA-Z_][a-zA-Z0-9_]*)\s*\}\}`)
 func renderSessionInitTemplate(content string, in sessionInitInput) (string, error) {
 	values := map[string]string{
 		"session_id":          strings.TrimSpace(in.SessionID),
 		"previous_session_id": strings.TrimSpace(in.PreviousSessionID),
 		"date":                strings.TrimSpace(in.Date),
 		"title":               strings.TrimSpace(in.Title),
 		"audio_s3_prefix":     strings.TrimSpace(in.AudioS3Prefix),
 		"audio_dir":           strings.TrimSpace(in.AudioDir),
 	}
 	used := map[string]struct{}{}
 	unknown := map[string]struct{}{}
 	missing := map[string]struct{}{}
 	rendered := sessionInitTemplatePattern.ReplaceAllStringFunc(content, func(match string) string {
 		parts := sessionInitTemplatePattern.FindStringSubmatch(match)
 		if len(parts) < 2 {
 			return match
 		}
 		name := parts[1]
 		value, ok := values[name]
 		if !ok {
 			unknown[name] = struct{}{}
 			return match
 		}
 		used[name] = struct{}{}
 		if value == "" {
 			missing[name] = struct{}{}
 			return match
 		}
 		return value
 	})
 	if len(unknown) > 0 {
 		return "", fmt.Errorf("unsupported template variable(s): %s", sortedStringSet(unknown))
 	}
 	if len(missing) > 0 {
 		return "", fmt.Errorf("missing required template variable value(s): %s", sortedStringSet(missing))
 	}
 	unused := map[string]struct{}{}
 	for _, name := range []string{"previous_session_id", "date", "title", "audio_s3_prefix", "audio_dir"} {
 		if values[name] == "" {
 			continue
 		}
 		if _, ok := used[name]; !ok {
 			unused[name] = struct{}{}
 		}
 	}
 	if len(unused) > 0 {
 		return "", fmt.Errorf("unused template variable value(s): %s", sortedStringSet(unused))
 	}
 	return rendered, nil
 }
 func sortedStringSet(set map[string]struct{}) string {
 	items := make([]string, 0, len(set))
 	for item := range set {
 		items = append(items, item)
 	}
 	sort.Strings(items)
 	return strings.Join(items, ", ")
 }
--- a/internal/app/operator_session_validate.go
+++ b/internal/app/operator_session_validate.go
@@ -0,0 +1,81 @@
 package app
 import (
 	"context"
 	"flag"
 	"fmt"
 	"io"
 	"strings"
 	"gitea.maximumdirect.net/eric/narratio/internal/artifacts"
 	"gitea.maximumdirect.net/eric/narratio/internal/config"
 )
 // SessionValidate performs a read-only session preflight.
 func SessionValidate(ctx context.Context, args []string, out io.Writer) error {
 	fs := flag.NewFlagSet("session validate", flag.ContinueOnError)
 	fs.SetOutput(io.Discard)
 	var flags commonConfigFlags
 	addCommonConfigFlags(fs, &flags)
 	if err := parseSessionAwareFlags("session validate", fs, args, &flags.sessionID); err != nil {
 		return err
 	}
 	if strings.TrimSpace(flags.sessionID) == "" {
 		return fmt.Errorf("session validate: session_id is required")
 	}
 	findings := []finding{}
 	cfg, err := loadCommandConfig(ctx, flags.pipelinePath, flags.campaignPath, flags.campaignFilePath, flags.sessionPath, flags.sessionOptions())
 	if err != nil {
 		findings = append(findings, errorFinding("config", err.Error()))
 		return renderFindings(out, "", "", findings)
 	}
 	if err := config.Validate(cfg); err != nil {
 		findings = append(findings, errorFinding("config", err.Error()))
 	} else {
 		findings = append(findings, okFinding("config", "resolved pipeline, campaign, and session config"))
 	}
 	findings = append(findings, okFinding("session", fmt.Sprintf("session source: %s", sessionSourceSummary(cfg))))
 	paths := artifacts.NewLocalStore(cfg.Pipeline.Workspace.Root).SessionPathsFor(cfg.Session.Campaign, cfg.Session.SessionID)
 	findings = append(findings, validateStableInputFindings(cfg)...)
 	findings = append(findings, validateLocalAudioFindings(cfg)...)
 	store, storeErr := objectStoreIfConfigured(ctx, cfg)
 	if storeErr != nil {
 		findings = append(findings, errorFinding("storage", storeErr.Error()))
 	}
 	if cfg.Session.Inputs.AudioS3 != nil {
 		if storeErr != nil {
 			findings = append(findings, errorFinding("audio", "remote audio cannot be checked because storage is unavailable"))
 		} else {
 			findings = append(findings, validateRemoteAudioFinding(ctx, cfg, store))
 		}
 	}
 	requirements := artifacts.CollectPreviousArtifactRequirements(configuredScriptoriumArtifacts(cfg))
 	if len(requirements) == 0 {
 		findings = append(findings, okFinding("previous", "no previous-session artifacts required"))
 	} else if strings.TrimSpace(cfg.Session.PreviousSessionID) == "" {
 		findings = append(findings, errorFinding("previous", "previous_session_id is required by configured previous-session artifacts"))
 	} else if storeErr != nil {
 		findings = append(findings, errorFinding("previous", "previous-session artifacts cannot be checked because storage is unavailable"))
 	} else {
 		findings = append(findings, validatePreviousArtifactFindings(ctx, cfg, store, requirements)...)
 	}
 	locks, lockErr := loadEffectiveLocks(ctx, cfg, store)
 	if lockErr != nil {
 		findings = append(findings, errorFinding("locks", lockErr.Error()))
 	} else if len(locks.All) == 0 {
 		findings = append(findings, okFinding("locks", "no effective publish locks"))
 	} else {
 		for _, lock := range locks.All {
 			findings = append(findings, warnFinding("locks", fmt.Sprintf("%s locked: %s", lock.Source, strings.TrimSpace(lock.Reason))))
 		}
 	}
 	if paths.ManifestPath != "" {
 		findings = append(findings, infoFinding("workspace", "manifest path: "+paths.ManifestPath))
 	}
 	return renderFindings(out, cfg.Session.Campaign, cfg.Session.SessionID, findings)
 }
--- a/internal/app/operator_status.go
+++ b/internal/app/operator_status.go
@@ -0,0 +1,88 @@
 package app
 import (
 	"context"
 	"flag"
 	"fmt"
 	"io"
 	"strings"
 	"gitea.maximumdirect.net/eric/narratio/internal/artifacts"
 	"gitea.maximumdirect.net/eric/narratio/internal/config"
 )
 // Status reports effective local/remote session state.
 func Status(ctx context.Context, args []string, out io.Writer) error {
 	fs := flag.NewFlagSet("status", flag.ContinueOnError)
 	fs.SetOutput(io.Discard)
 	var flags commonConfigFlags
 	addCommonConfigFlags(fs, &flags)
 	if err := parseSessionAwareFlags("status", fs, args, &flags.sessionID); err != nil {
 		return err
 	}
 	if strings.TrimSpace(flags.sessionID) == "" {
 		return fmt.Errorf("status: session_id is required")
 	}
 	cfg, err := loadCommandConfig(ctx, flags.pipelinePath, flags.campaignPath, flags.campaignFilePath, flags.sessionPath, flags.sessionOptions())
 	if err != nil {
 		return fmt.Errorf("status: %w", err)
 	}
 	if err := config.Validate(cfg); err != nil {
 		return fmt.Errorf("status: %w", err)
 	}
 	paths := artifacts.NewLocalStore(cfg.Pipeline.Workspace.Root).SessionPathsFor(cfg.Session.Campaign, cfg.Session.SessionID)
 	fmt.Fprintf(out, "Session: %s\n", cfg.Session.SessionID)
 	fmt.Fprintf(out, "Campaign: %s\n", cfg.Session.Campaign)
 	fmt.Fprintf(out, "Workspace: %s\n", paths.Root)
 	fmt.Fprintf(out, "Session config: %s\n", sessionSourceSummary(cfg))
 	if m, err := loadLocalManifest(ctx, paths.ManifestPath); err != nil {
 		fmt.Fprintf(out, "Local manifest: error: %v\n", err)
 	} else if m == nil {
 		fmt.Fprintln(out, "Local manifest: missing")
 	} else {
 		fmt.Fprintf(out, "Local manifest: %s\n", paths.ManifestPath)
 		writeStageStatuses(out, m)
 	}
 	store, storeErr := objectStoreIfConfigured(ctx, cfg)
 	if storeErr != nil {
 		fmt.Fprintf(out, "Remote publish: unavailable: %v\n", storeErr)
 	} else if store != nil {
 		current, err := discoverRemoteCurrentStateFn(ctx, cfg, store)
 		if err != nil {
 			fmt.Fprintf(out, "Remote publish: missing or unavailable: %v\n", err)
 		} else {
 			fmt.Fprintf(out, "Remote publish: current run %s\n", current.RunID)
 			fmt.Fprintf(out, "Remote manifest: %s\n", current.CurrentManifestKey)
 		}
 	}
 	locks, err := loadEffectiveLocks(ctx, cfg, store)
 	if catalog, catalogErr := buildHelperArtifactCatalog(cfg); catalogErr != nil {
 		fmt.Fprintf(out, "Remote outputs: error: %v\n", catalogErr)
 	} else if storeErr == nil {
 		catalogLocks := locks
 		if err != nil {
 			catalogLocks = &effectiveLocks{
 				Static: staticPublishLocks(cfg),
 				All:    staticPublishLocks(cfg),
 			}
 		}
 		publishedRemoteState := map[string]string{}
 		if store != nil {
 			publishedRemoteState = remotePublishedOutputAvailability(ctx, cfg, store, catalog)
 		}
 		fmt.Fprintln(out, "Remote outputs:")
 		writeArtifactList(out, cfg, catalog, catalogLocks, publishedRemoteState)
 	}
 	if err != nil {
 		fmt.Fprintf(out, "Publish locks: error: %v\n", err)
 	} else {
 		writeLocks(out, cfg, locks)
 	}
 	fmt.Fprintln(out, "Next actions:")
 	fmt.Fprintf(out, "- narratio session validate %s\n", cfg.Session.SessionID)
 	fmt.Fprintf(out, "- narratio session restore %s --dry-run\n", cfg.Session.SessionID)
 	return nil
 }
--- a/internal/app/plan.go
+++ b/internal/app/plan.go
@@ -19,29 +19,18 @@ func Plan(ctx context.Context, args []string, out io.Writer) error {
 	fs := flag.NewFlagSet("plan", flag.ContinueOnError)
 	fs.SetOutput(io.Discard)
-	var pipelinePath string
+	var flags commonConfigFlags
 	var campaignPath string
 	var sessionPath string
 	var sessionID string
 	var previousSessionID string
 	var force bool
-	fs.StringVar(&pipelinePath, "config", "", "path to pipeline.yml (optional; defaults searched)")
+	addCommonConfigFlags(fs, &flags)
 	fs.StringVar(&campaignPath, "campaign", "", "path to campaign.yml (optional; defaults searched)")
 	fs.StringVar(&sessionPath, "session", "", "path to session.yml")
 	fs.StringVar(&sessionID, "session-id", "", "session identifier for session.yml templates")
 	fs.StringVar(&previousSessionID, "previous-session-id", "", "previous session identifier for session.yml templates")
 	fs.BoolVar(&force, "force", false, "force stage execution (reserved for future behavior)")
-	if err := fs.Parse(args); err != nil {
+	if err := parseSessionAwareFlags("plan", fs, args, &flags.sessionID); err != nil {
-		return fmt.Errorf("plan: invalid flags: %w", err)
+		return err
 	}
-	if fs.NArg() != 0 {
+	if flags.sessionID == "" {
-		return fmt.Errorf("plan: unexpected positional arguments")
+		return fmt.Errorf("plan: session_id is required")
 	}
-	cfg, err := loadCommandConfig(ctx, pipelinePath, campaignPath, sessionPath, config.SessionLoadOptions{
+	cfg, err := loadCommandConfig(ctx, flags.pipelinePath, flags.campaignPath, flags.campaignFilePath, flags.sessionPath, flags.sessionOptions())
 		SessionID:         sessionID,
 		PreviousSessionID: previousSessionID,
 	})
 	if err != nil {
 		return fmt.Errorf("plan: %w", err)
 	}
@@ -68,7 +57,7 @@ func Plan(ctx context.Context, args []string, out io.Writer) error {
 	runCount := 0
 	skipCount := 0
-	if _, err := fmt.Fprintf(out, "narratio plan: workdir prepared at %s\n", paths.Root); err != nil {
+	if _, err := fmt.Fprintf(out, "narratio session plan: workdir prepared at %s\n", paths.Root); err != nil {
 		return err
 	}
 	for _, d := range decisions {
--- a/internal/app/plan_test.go
+++ b/internal/app/plan_test.go
@@ -18,16 +18,16 @@ func TestPlanCreatesAndReusesWorkdir(t *testing.T) {
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 	var out bytes.Buffer
-	args := []string{"--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath}
+	args := []string{"2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath}
 	if err := Plan(context.Background(), args, &out); err != nil {
 		t.Fatalf("first Plan() error = %v", err)
 	}
 	got := out.String()
-	if !strings.Contains(got, "narratio plan: workdir prepared at") {
+	if !strings.Contains(got, "narratio session plan: workdir prepared at") {
 		t.Fatalf("first output = %q, want workdir prepared", got)
 	}
-	for _, name := range []string{"prepare", "transcribe", "merge", "polish", "normalize", "trim", "analyze", "archive", "notify"} {
+	for _, name := range []string{"prepare", "transcribe", "merge", "polish", "normalize", "trim", "analyze", "publish", "notify"} {
 		if !strings.Contains(got, name+": run") {
 			t.Fatalf("first output = %q, missing stage %q", got, name)
 		}
@@ -55,7 +55,7 @@ func TestPlanCreatesAndReusesWorkdir(t *testing.T) {
 	if err := Plan(context.Background(), args, &out); err != nil {
 		t.Fatalf("second Plan() error = %v", err)
 	}
-	if !strings.Contains(out.String(), "narratio plan: workdir prepared at") {
+	if !strings.Contains(out.String(), "narratio session plan: workdir prepared at") {
 		t.Fatalf("second output = %q, want workdir prepared", out.String())
 	}
 }
@@ -74,7 +74,7 @@ func TestPlanShowsRunAndSkipFromManifest(t *testing.T) {
 	}
 	var out bytes.Buffer
-	if err := Plan(context.Background(), []string{"--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath}, &out); err != nil {
+	if err := Plan(context.Background(), []string{"2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath}, &out); err != nil {
 		t.Fatalf("Plan() error = %v", err)
 	}
 	got := out.String()
@@ -108,8 +108,6 @@ seriatim:
  binary: seriatim
 audita:
  binary: audita
 analyzer:
  timeout: 20m
 notification:
  timeout: 10s
 `
@@ -129,7 +127,7 @@ inputs:
 	}
 	var out bytes.Buffer
-	err := Plan(context.Background(), []string{"--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath}, &out)
+	err := Plan(context.Background(), []string{"2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath}, &out)
 	if err == nil {
 		t.Fatal("expected error, got nil")
 	}
--- a/internal/app/planner_test.go
+++ b/internal/app/planner_test.go
@@ -4,7 +4,7 @@ import "testing"
 func TestBuildFullPlanOrder(t *testing.T) {
 	got := BuildFullPlan()
-	want := []string{"prepare", "transcribe", "merge", "polish", "normalize", "trim", "analyze", "archive", "notify"}
+	want := []string{"prepare", "transcribe", "merge", "polish", "normalize", "trim", "analyze", "publish", "notify"}
 	if len(got) != len(want) {
 		t.Fatalf("len(plan) = %d, want %d", len(got), len(want))
 	}
--- a/internal/app/post_publish_cleanup.go
+++ b/internal/app/post_publish_cleanup.go
@@ -12,18 +12,18 @@ import (
 	"gitea.maximumdirect.net/eric/narratio/internal/manifest"
 )
-func runPostArchiveCleanup(ctx context.Context, env *Env, manifestPath string, m *manifest.Manifest, executed []string) error {
+func runPostPublishCleanup(ctx context.Context, env *Env, manifestPath string, m *manifest.Manifest, executed []string) error {
 	if env == nil || env.Config == nil || env.Config.Pipeline == nil || m == nil {
 		return nil
 	}
-	spoolRequested := env.Config.Pipeline.Spool.DeleteAudioAfterArchive
+	spoolRequested := env.Config.Pipeline.Spool.DeleteAudioAfterPublish
-	workRequested := env.Config.Pipeline.Workspace.CleanupAfterArchive
+	workRequested := env.Config.Pipeline.Workspace.CleanupAfterPublish
 	if !spoolRequested && !workRequested {
 		return nil
 	}
-	sr := archiveStageRecordForCleanup(m, executed)
+	sr := publishStageRecordForCleanup(m, executed)
 	if sr == nil {
 		return nil
 	}
@@ -33,7 +33,7 @@ func runPostArchiveCleanup(ctx context.Context, env *Env, manifestPath string, m
 	sr.Metadata["spool_cleanup_requested"] = spoolRequested
 	sr.Metadata["workdir_cleanup_requested"] = workRequested
-	eligible, reason := archiveCleanupEligible(env.Config, sr)
+	eligible, reason := publishCleanupEligible(env.Config, sr)
 	if !eligible {
 		sr.Metadata["cleanup_skipped"] = true
 		sr.Metadata["cleanup_skipped_reason"] = reason
@@ -63,9 +63,9 @@ func runPostArchiveCleanup(ctx context.Context, env *Env, manifestPath string, m
 	}
 	if spoolRequested {
-		if err := removeRunScopedDir(strings.TrimSpace(env.Config.Pipeline.Spool.Root), spoolDir, "pipeline.spool.delete_audio_after_archive"); err != nil {
+		if err := removeRunScopedDir(strings.TrimSpace(env.Config.Pipeline.Spool.Root), spoolDir, "pipeline.spool.delete_audio_after_publish"); err != nil {
 			sr.Metadata["cleanup_failed"] = true
-			sr.Metadata["cleanup_failed_policy"] = "pipeline.spool.delete_audio_after_archive"
+			sr.Metadata["cleanup_failed_policy"] = "pipeline.spool.delete_audio_after_publish"
 			sr.Metadata["cleanup_failed_path"] = spoolDir
 			_ = env.ManifestStore.Save(ctx, manifestPath, m)
 			return err
@@ -82,9 +82,9 @@ func runPostArchiveCleanup(ctx context.Context, env *Env, manifestPath string, m
 		return nil
 	}
-	if err := removeRunScopedDir(strings.TrimSpace(env.Config.Pipeline.Workspace.Root), workDir, "pipeline.workspace.cleanup_after_archive"); err != nil {
+	if err := removeRunScopedDir(strings.TrimSpace(env.Config.Pipeline.Workspace.Root), workDir, "pipeline.workspace.cleanup_after_publish"); err != nil {
 		sr.Metadata["cleanup_failed"] = true
-		sr.Metadata["cleanup_failed_policy"] = "pipeline.workspace.cleanup_after_archive"
+		sr.Metadata["cleanup_failed_policy"] = "pipeline.workspace.cleanup_after_publish"
 		sr.Metadata["cleanup_failed_path"] = workDir
 		_ = env.ManifestStore.Save(ctx, manifestPath, m)
 		return err
@@ -96,59 +96,59 @@ func runPostArchiveCleanup(ctx context.Context, env *Env, manifestPath string, m
 	return nil
 }
-func archiveStageRecordForCleanup(m *manifest.Manifest, executed []string) *manifest.StageRecord {
+func publishStageRecordForCleanup(m *manifest.Manifest, executed []string) *manifest.StageRecord {
 	if m == nil {
 		return nil
 	}
-	archiveRan := false
+	publishRan := false
 	for _, name := range executed {
-		if name == "archive" {
+		if name == "publish" {
-			archiveRan = true
+			publishRan = true
 			break
 		}
 	}
-	if !archiveRan {
+	if !publishRan {
 		return nil
 	}
-	sr := m.Stages["archive"]
+	sr := m.Stages["publish"]
 	if sr == nil || sr.Status != manifest.StatusSucceeded {
 		return nil
 	}
 	return sr
 }
-func archiveCleanupEligible(cfg *config.Config, sr *manifest.StageRecord) (bool, string) {
+func publishCleanupEligible(cfg *config.Config, sr *manifest.StageRecord) (bool, string) {
-	if cfg == nil || cfg.Pipeline == nil || cfg.Pipeline.Archive == nil {
+	if cfg == nil || cfg.Pipeline == nil || cfg.Pipeline.Publish == nil {
-		return false, "archive configuration is missing"
+		return false, "publish configuration is missing"
 	}
 	enabled := true
-	if cfg.Pipeline.Archive.Enabled != nil {
+	if cfg.Pipeline.Publish.Enabled != nil {
-		enabled = *cfg.Pipeline.Archive.Enabled
+		enabled = *cfg.Pipeline.Publish.Enabled
 	}
 	if !enabled {
-		return false, "archive.enabled is false"
+		return false, "publish.enabled is false"
 	}
 	uploadRun := true
-	if cfg.Pipeline.Archive.UploadRun != nil {
+	if cfg.Pipeline.Publish.UploadRun != nil {
-		uploadRun = *cfg.Pipeline.Archive.UploadRun
+		uploadRun = *cfg.Pipeline.Publish.UploadRun
 	}
 	if !uploadRun {
-		return false, "archive.upload_run is false"
+		return false, "publish.upload_run is false"
 	}
 	if sr == nil || sr.Metadata == nil {
-		return false, "archive metadata is missing"
+		return false, "publish metadata is missing"
 	}
 	if skipped, _ := sr.Metadata["skipped"].(bool); skipped {
-		return false, "archive stage was skipped"
+		return false, "publish stage was skipped"
 	}
 	if uploaded, _ := sr.Metadata["uploaded"].(bool); !uploaded {
-		return false, "archive did not upload run record"
+		return false, "publish did not upload run record"
 	}
 	if pointer, _ := sr.Metadata["current_pointer_written"].(bool); !pointer {
-		return false, "archive did not write current pointer"
+		return false, "publish did not write current pointer"
 	}
 	if strings.TrimSpace(asString(sr.Metadata["current_run_id_key"])) == "" {
-		return false, "archive current run pointer key is missing"
+		return false, "publish current run pointer key is missing"
 	}
 	return true, ""
 }
@@ -174,49 +174,7 @@ func removeRunScopedDir(root, target, policy string) error {
 }
 func validateScopedDir(root, target, policy string) (scopedDir, error) {
-	cleanRoot := strings.TrimSpace(root)
+	return validateScopedTarget(root, target, policy, true)
 	cleanTarget := strings.TrimSpace(target)
 	if cleanRoot == "" {
 		return scopedDir{}, fmt.Errorf("cleanup policy %s: root path is required", policy)
 	}
 	if cleanTarget == "" {
 		return scopedDir{}, fmt.Errorf("cleanup policy %s: target path is required", policy)
 	}
 	rootAbs, err := filepath.Abs(cleanRoot)
 	if err != nil {
 		return scopedDir{}, fmt.Errorf("cleanup policy %s: resolve root %q: %w", policy, cleanRoot, err)
 	}
 	targetAbs, err := filepath.Abs(cleanTarget)
 	if err != nil {
 		return scopedDir{}, fmt.Errorf("cleanup policy %s: resolve target %q: %w", policy, cleanTarget, err)
 	}
 	rel, err := filepath.Rel(rootAbs, targetAbs)
 	if err != nil {
 		return scopedDir{}, fmt.Errorf("cleanup policy %s: relative path from %q to %q: %w", policy, rootAbs, targetAbs, err)
 	}
 	if rel == "." {
 		return scopedDir{}, fmt.Errorf("cleanup policy %s: refusing to delete root directory %q", policy, rootAbs)
 	}
 	if rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) {
 		return scopedDir{}, fmt.Errorf("cleanup policy %s: refusing to delete path outside root: root=%q target=%q", policy, rootAbs, targetAbs)
 	}
 	info, err := os.Lstat(targetAbs)
 	if err != nil {
 		if os.IsNotExist(err) {
 			return scopedDir{RootAbs: rootAbs, TargetAbs: targetAbs, Exists: false}, nil
 		}
 		return scopedDir{}, fmt.Errorf("cleanup policy %s: stat target %q: %w", policy, targetAbs, err)
 	}
 	if info.Mode()&os.ModeSymlink != 0 {
 		return scopedDir{}, fmt.Errorf("cleanup policy %s: refusing to delete symlink path %q", policy, targetAbs)
 	}
 	if !info.IsDir() {
 		return scopedDir{}, fmt.Errorf("cleanup policy %s: target %q is not a directory", policy, targetAbs)
 	}
 	return scopedDir{RootAbs: rootAbs, TargetAbs: targetAbs, Exists: true}, nil
 }
 func asString(v any) string {
--- a/internal/app/post_publish_cleanup_test.go
+++ b/internal/app/post_publish_cleanup_test.go
@@ -16,15 +16,15 @@ import (
 	"gitea.maximumdirect.net/eric/narratio/internal/stage"
 )
-type archiveSuccessStage struct {
+type publishSuccessStage struct {
 	metadata map[string]any
 }
-func (archiveSuccessStage) Name() string           { return "archive" }
+func (publishSuccessStage) Name() string           { return "publish" }
-func (archiveSuccessStage) Declares() stage.IODecl { return stage.IODecl{} }
+func (publishSuccessStage) Declares() stage.IODecl { return stage.IODecl{} }
-func (s archiveSuccessStage) Run(_ context.Context, _ *stage.Env, _ *manifest.Manifest) (*stage.StageResult, error) {
+func (s publishSuccessStage) Run(_ context.Context, _ *stage.Env, _ *manifest.Manifest) (*stage.StageResult, error) {
 	md := map[string]any{
-		"stage":                   "archive",
+		"stage":                   "publish",
 		"uploaded":                true,
 		"current_pointer_written": true,
 		"current_run_id_key":      "dnd/campaigns/sample-campaign/sessions/2026-05-03/current/run_id.txt",
@@ -43,12 +43,12 @@ func (notifyFailStage) Run(_ context.Context, _ *stage.Env, _ *manifest.Manifest
 	return nil, errors.New("notify failed")
 }
-func TestPostArchiveCleanupDisabledKeepsLocalDirs(t *testing.T) {
+func TestPostPublishCleanupDisabledKeepsLocalDirs(t *testing.T) {
 	cfg, seed := cleanupFixtureConfig(t)
-	cfg.Pipeline.Spool.DeleteAudioAfterArchive = false
+	cfg.Pipeline.Spool.DeleteAudioAfterPublish = false
-	cfg.Pipeline.Workspace.CleanupAfterArchive = false
+	cfg.Pipeline.Workspace.CleanupAfterPublish = false
-	if _, err := executeStages(context.Background(), cfg, []stage.Stage{archiveSuccessStage{}}, RunOptions{Env: &Env{ObjectStore: &storage.FakeBackend{}}}); err != nil {
+	if _, err := executeStages(context.Background(), cfg, []stage.Stage{publishSuccessStage{}}, RunOptions{Env: &Env{ObjectStore: &storage.FakeBackend{}}}); err != nil {
 		t.Fatalf("executeStages() error = %v", err)
 	}
@@ -57,12 +57,12 @@ func TestPostArchiveCleanupDisabledKeepsLocalDirs(t *testing.T) {
 	assertExists(t, seed.localSourceAudio)
 }
-func TestPostArchiveCleanupSpoolOnly(t *testing.T) {
+func TestPostPublishCleanupSpoolOnly(t *testing.T) {
 	cfg, seed := cleanupFixtureConfig(t)
-	cfg.Pipeline.Spool.DeleteAudioAfterArchive = true
+	cfg.Pipeline.Spool.DeleteAudioAfterPublish = true
-	cfg.Pipeline.Workspace.CleanupAfterArchive = false
+	cfg.Pipeline.Workspace.CleanupAfterPublish = false
-	if _, err := executeStages(context.Background(), cfg, []stage.Stage{archiveSuccessStage{}}, RunOptions{Env: &Env{ObjectStore: &storage.FakeBackend{}}}); err != nil {
+	if _, err := executeStages(context.Background(), cfg, []stage.Stage{publishSuccessStage{}}, RunOptions{Env: &Env{ObjectStore: &storage.FakeBackend{}}}); err != nil {
 		t.Fatalf("executeStages() error = %v", err)
 	}
@@ -71,12 +71,12 @@ func TestPostArchiveCleanupSpoolOnly(t *testing.T) {
 	assertExists(t, seed.localSourceAudio)
 }
-func TestPostArchiveCleanupWorkdirOnly(t *testing.T) {
+func TestPostPublishCleanupWorkdirOnly(t *testing.T) {
 	cfg, seed := cleanupFixtureConfig(t)
-	cfg.Pipeline.Spool.DeleteAudioAfterArchive = false
+	cfg.Pipeline.Spool.DeleteAudioAfterPublish = false
-	cfg.Pipeline.Workspace.CleanupAfterArchive = true
+	cfg.Pipeline.Workspace.CleanupAfterPublish = true
-	if _, err := executeStages(context.Background(), cfg, []stage.Stage{archiveSuccessStage{}}, RunOptions{Env: &Env{ObjectStore: &storage.FakeBackend{}}}); err != nil {
+	if _, err := executeStages(context.Background(), cfg, []stage.Stage{publishSuccessStage{}}, RunOptions{Env: &Env{ObjectStore: &storage.FakeBackend{}}}); err != nil {
 		t.Fatalf("executeStages() error = %v", err)
 	}
@@ -87,12 +87,12 @@ func TestPostArchiveCleanupWorkdirOnly(t *testing.T) {
 	assertExists(t, seed.spoolAudioDir)
 }
-func TestPostArchiveCleanupBothPolicies(t *testing.T) {
+func TestPostPublishCleanupBothPolicies(t *testing.T) {
 	cfg, seed := cleanupFixtureConfig(t)
-	cfg.Pipeline.Spool.DeleteAudioAfterArchive = true
+	cfg.Pipeline.Spool.DeleteAudioAfterPublish = true
-	cfg.Pipeline.Workspace.CleanupAfterArchive = true
+	cfg.Pipeline.Workspace.CleanupAfterPublish = true
-	if _, err := executeStages(context.Background(), cfg, []stage.Stage{archiveSuccessStage{}}, RunOptions{Env: &Env{ObjectStore: &storage.FakeBackend{}}}); err != nil {
+	if _, err := executeStages(context.Background(), cfg, []stage.Stage{publishSuccessStage{}}, RunOptions{Env: &Env{ObjectStore: &storage.FakeBackend{}}}); err != nil {
 		t.Fatalf("executeStages() error = %v", err)
 	}
@@ -102,26 +102,26 @@ func TestPostArchiveCleanupBothPolicies(t *testing.T) {
 	assertExists(t, seed.previousCachePath)
 }
-func TestPostArchiveCleanupNotRunWhenArchiveFails(t *testing.T) {
+func TestPostPublishCleanupNotRunWhenPublishFails(t *testing.T) {
 	cfg, seed := cleanupFixtureConfig(t)
-	cfg.Pipeline.Spool.DeleteAudioAfterArchive = true
+	cfg.Pipeline.Spool.DeleteAudioAfterPublish = true
-	cfg.Pipeline.Workspace.CleanupAfterArchive = true
+	cfg.Pipeline.Workspace.CleanupAfterPublish = true
-	_, err := executeStages(context.Background(), cfg, []stage.Stage{failingStage{name: "archive", err: errors.New("archive failed")}}, RunOptions{Env: &Env{ObjectStore: &storage.FakeBackend{}}})
+	_, err := executeStages(context.Background(), cfg, []stage.Stage{failingStage{name: "publish", err: errors.New("publish failed")}}, RunOptions{Env: &Env{ObjectStore: &storage.FakeBackend{}}})
-	if err == nil || !strings.Contains(err.Error(), "stage \"archive\" failed") {
+	if err == nil || !strings.Contains(err.Error(), "stage \"publish\" failed") {
-		t.Fatalf("executeStages() error = %v, want archive failure", err)
+		t.Fatalf("executeStages() error = %v, want publish failure", err)
 	}
 	assertExists(t, seed.spoolAudioDir)
 	assertExists(t, seed.runWorkDir)
 }
-func TestPostArchiveCleanupNotRunWhenArchiveSkipped(t *testing.T) {
+func TestPostPublishCleanupNotRunWhenPublishSkipped(t *testing.T) {
 	cfg, seed := cleanupFixtureConfig(t)
-	cfg.Pipeline.Spool.DeleteAudioAfterArchive = true
+	cfg.Pipeline.Spool.DeleteAudioAfterPublish = true
-	cfg.Pipeline.Workspace.CleanupAfterArchive = true
+	cfg.Pipeline.Workspace.CleanupAfterPublish = true
-	if _, err := executeStages(context.Background(), cfg, []stage.Stage{archiveSuccessStage{metadata: map[string]any{"skipped": true}}}, RunOptions{Env: &Env{ObjectStore: &storage.FakeBackend{}}}); err != nil {
+	if _, err := executeStages(context.Background(), cfg, []stage.Stage{publishSuccessStage{metadata: map[string]any{"skipped": true}}}, RunOptions{Env: &Env{ObjectStore: &storage.FakeBackend{}}}); err != nil {
 		t.Fatalf("executeStages() error = %v", err)
 	}
@@ -129,12 +129,12 @@ func TestPostArchiveCleanupNotRunWhenArchiveSkipped(t *testing.T) {
 	assertExists(t, seed.runWorkDir)
 }
-func TestPostArchiveCleanupNotRunWhenCurrentPointerMissing(t *testing.T) {
+func TestPostPublishCleanupNotRunWhenCurrentPointerMissing(t *testing.T) {
 	cfg, seed := cleanupFixtureConfig(t)
-	cfg.Pipeline.Spool.DeleteAudioAfterArchive = true
+	cfg.Pipeline.Spool.DeleteAudioAfterPublish = true
-	cfg.Pipeline.Workspace.CleanupAfterArchive = true
+	cfg.Pipeline.Workspace.CleanupAfterPublish = true
-	if _, err := executeStages(context.Background(), cfg, []stage.Stage{archiveSuccessStage{metadata: map[string]any{"current_pointer_written": false}}}, RunOptions{Env: &Env{ObjectStore: &storage.FakeBackend{}}}); err != nil {
+	if _, err := executeStages(context.Background(), cfg, []stage.Stage{publishSuccessStage{metadata: map[string]any{"current_pointer_written": false}}}, RunOptions{Env: &Env{ObjectStore: &storage.FakeBackend{}}}); err != nil {
 		t.Fatalf("executeStages() error = %v", err)
 	}
@@ -142,13 +142,13 @@ func TestPostArchiveCleanupNotRunWhenCurrentPointerMissing(t *testing.T) {
 	assertExists(t, seed.runWorkDir)
 }
-func TestPostArchiveCleanupNotRunWhenArchiveUploadDisabled(t *testing.T) {
+func TestPostPublishCleanupNotRunWhenPublishUploadDisabled(t *testing.T) {
 	cfg, seed := cleanupFixtureConfig(t)
-	cfg.Pipeline.Spool.DeleteAudioAfterArchive = true
+	cfg.Pipeline.Spool.DeleteAudioAfterPublish = true
-	cfg.Pipeline.Workspace.CleanupAfterArchive = true
+	cfg.Pipeline.Workspace.CleanupAfterPublish = true
-	cfg.Pipeline.Archive.UploadRun = boolPtr(false)
+	cfg.Pipeline.Publish.UploadRun = boolPtr(false)
-	if _, err := executeStages(context.Background(), cfg, []stage.Stage{archiveSuccessStage{}}, RunOptions{Env: &Env{ObjectStore: &storage.FakeBackend{}}}); err != nil {
+	if _, err := executeStages(context.Background(), cfg, []stage.Stage{publishSuccessStage{}}, RunOptions{Env: &Env{ObjectStore: &storage.FakeBackend{}}}); err != nil {
 		t.Fatalf("executeStages() error = %v", err)
 	}
@@ -156,12 +156,12 @@ func TestPostArchiveCleanupNotRunWhenArchiveUploadDisabled(t *testing.T) {
 	assertExists(t, seed.runWorkDir)
 }
-func TestPostArchiveCleanupWaitsUntilAllStagesSucceed(t *testing.T) {
+func TestPostPublishCleanupWaitsUntilAllStagesSucceed(t *testing.T) {
 	cfg, seed := cleanupFixtureConfig(t)
-	cfg.Pipeline.Spool.DeleteAudioAfterArchive = true
+	cfg.Pipeline.Spool.DeleteAudioAfterPublish = true
-	cfg.Pipeline.Workspace.CleanupAfterArchive = true
+	cfg.Pipeline.Workspace.CleanupAfterPublish = true
-	_, err := executeStages(context.Background(), cfg, []stage.Stage{archiveSuccessStage{}, notifyFailStage{}}, RunOptions{Env: &Env{ObjectStore: &storage.FakeBackend{}}})
+	_, err := executeStages(context.Background(), cfg, []stage.Stage{publishSuccessStage{}, notifyFailStage{}}, RunOptions{Env: &Env{ObjectStore: &storage.FakeBackend{}}})
 	if err == nil || !strings.Contains(err.Error(), "stage \"notify\" failed") {
 		t.Fatalf("executeStages() error = %v, want notify failure", err)
 	}
@@ -170,10 +170,10 @@ func TestPostArchiveCleanupWaitsUntilAllStagesSucceed(t *testing.T) {
 	assertExists(t, seed.runWorkDir)
 }
-func TestPostArchiveCleanupFailsOnUnsafePath(t *testing.T) {
+func TestPostPublishCleanupFailsOnUnsafePath(t *testing.T) {
 	cfg, _ := cleanupFixtureConfig(t)
-	cfg.Pipeline.Spool.DeleteAudioAfterArchive = true
+	cfg.Pipeline.Spool.DeleteAudioAfterPublish = true
-	cfg.Pipeline.Workspace.CleanupAfterArchive = false
+	cfg.Pipeline.Workspace.CleanupAfterPublish = false
 	manifestPath := manifestPathFor(cfg)
 	store := &manifest.LocalStore{}
@@ -186,27 +186,27 @@ func TestPostArchiveCleanupFailsOnUnsafePath(t *testing.T) {
 		t.Fatalf("Save() error = %v", err)
 	}
-	_, err = executeStages(context.Background(), cfg, []stage.Stage{archiveSuccessStage{}}, RunOptions{Env: &Env{ObjectStore: &storage.FakeBackend{}}})
+	_, err = executeStages(context.Background(), cfg, []stage.Stage{publishSuccessStage{}}, RunOptions{Env: &Env{ObjectStore: &storage.FakeBackend{}}})
 	if err == nil || !strings.Contains(err.Error(), "refusing to delete path outside root") {
 		t.Fatalf("executeStages() error = %v, want safe-path failure", err)
 	}
 }
-func TestPostArchiveCleanupNotRunWhenPromotionIsMissing(t *testing.T) {
+func TestPostPublishCleanupNotRunWhenOutputIsMissing(t *testing.T) {
-	cfg, seed, runID := archiveStageCleanupFixture(t)
+	cfg, seed, runID := publishStageCleanupFixture(t)
-	cfg.Pipeline.Spool.DeleteAudioAfterArchive = true
+	cfg.Pipeline.Spool.DeleteAudioAfterPublish = true
-	cfg.Pipeline.Workspace.CleanupAfterArchive = true
+	cfg.Pipeline.Workspace.CleanupAfterPublish = true
-	cfg.Pipeline.Archive.PromoteArtifacts = []config.ArchivePromotionRule{
+	cfg.Pipeline.Publish.Outputs = []config.PublishOutputRule{
-		{Source: "narratio.transcript.merged", Dest: "transcripts/merged.json", Required: boolPtr(true)},
+		{Source: "narratio.transcript.base", Dest: "transcripts/base.json", Required: boolPtr(true)},
 	}
-	archiveStageImpl, err := stage.Select("archive")
+	publishStageImpl, err := stage.Select("publish")
 	if err != nil {
-		t.Fatalf("Select(archive) error = %v", err)
+		t.Fatalf("Select(publish) error = %v", err)
 	}
-	_, err = executeStages(context.Background(), cfg, []stage.Stage{archiveStageImpl}, RunOptions{Env: &Env{ObjectStore: &storage.FakeBackend{}}})
+	_, err = executeStages(context.Background(), cfg, []stage.Stage{publishStageImpl}, RunOptions{Env: &Env{ObjectStore: &storage.FakeBackend{}}})
-	if err == nil || !strings.Contains(err.Error(), "required promotion source unavailable") {
+	if err == nil || !strings.Contains(err.Error(), "required output source unavailable") {
-		t.Fatalf("executeStages() error = %v, want promotion-missing failure", err)
+		t.Fatalf("executeStages() error = %v, want required output source unavailable failure", err)
 	}
 	assertExists(t, seed.spoolAudioDir)
@@ -215,17 +215,17 @@ func TestPostArchiveCleanupNotRunWhenPromotionIsMissing(t *testing.T) {
 	assertExists(t, artifacts.SessionRunRootForCampaign(cfg.Pipeline.Workspace.Root, cfg.Session.Campaign, cfg.Session.SessionID, runID))
 }
-func TestPostArchiveCleanupNotRunWhenCurrentManifestUploadFails(t *testing.T) {
+func TestPostPublishCleanupNotRunWhenCurrentManifestUploadFails(t *testing.T) {
-	cfg, seed, _ := archiveStageCleanupFixture(t)
+	cfg, seed, _ := publishStageCleanupFixture(t)
-	cfg.Pipeline.Spool.DeleteAudioAfterArchive = true
+	cfg.Pipeline.Spool.DeleteAudioAfterPublish = true
-	cfg.Pipeline.Workspace.CleanupAfterArchive = true
+	cfg.Pipeline.Workspace.CleanupAfterPublish = true
 	failKey := seed.sessionPrefix + "current/manifest.json"
-	archiveStageImpl, err := stage.Select("archive")
+	publishStageImpl, err := stage.Select("publish")
 	if err != nil {
-		t.Fatalf("Select(archive) error = %v", err)
+		t.Fatalf("Select(publish) error = %v", err)
 	}
-	_, err = executeStages(context.Background(), cfg, []stage.Stage{archiveStageImpl}, RunOptions{
+	_, err = executeStages(context.Background(), cfg, []stage.Stage{publishStageImpl}, RunOptions{
 		Env: &Env{ObjectStore: &failKeyStore{delegate: &storage.FakeBackend{}, failKey: failKey}},
 	})
 	if err == nil || !strings.Contains(err.Error(), "current manifest") {
@@ -236,17 +236,17 @@ func TestPostArchiveCleanupNotRunWhenCurrentManifestUploadFails(t *testing.T) {
 	assertExists(t, seed.runWorkDir)
 }
-func TestPostArchiveCleanupNotRunWhenCurrentPointerUploadFails(t *testing.T) {
+func TestPostPublishCleanupNotRunWhenCurrentPointerUploadFails(t *testing.T) {
-	cfg, seed, _ := archiveStageCleanupFixture(t)
+	cfg, seed, _ := publishStageCleanupFixture(t)
-	cfg.Pipeline.Spool.DeleteAudioAfterArchive = true
+	cfg.Pipeline.Spool.DeleteAudioAfterPublish = true
-	cfg.Pipeline.Workspace.CleanupAfterArchive = true
+	cfg.Pipeline.Workspace.CleanupAfterPublish = true
 	failKey := seed.sessionPrefix + "current/run_id.txt"
-	archiveStageImpl, err := stage.Select("archive")
+	publishStageImpl, err := stage.Select("publish")
 	if err != nil {
-		t.Fatalf("Select(archive) error = %v", err)
+		t.Fatalf("Select(publish) error = %v", err)
 	}
-	_, err = executeStages(context.Background(), cfg, []stage.Stage{archiveStageImpl}, RunOptions{
+	_, err = executeStages(context.Background(), cfg, []stage.Stage{publishStageImpl}, RunOptions{
 		Env: &Env{ObjectStore: &failKeyStore{delegate: &storage.FakeBackend{}, failKey: failKey}},
 	})
 	if err == nil || !strings.Contains(err.Error(), "current run pointer") {
@@ -270,7 +270,7 @@ func cleanupFixtureConfig(t *testing.T) (*config.Config, cleanupSeed) {
 	t.Helper()
 	cfg := testConfig(t)
-	cfg.Pipeline.Archive = &config.ArchiveConfig{Enabled: boolPtr(true), UploadRun: boolPtr(true)}
+	cfg.Pipeline.Publish = &config.PublishConfig{Enabled: boolPtr(true), UploadRun: boolPtr(true)}
 	cfg.Pipeline.Spool.Root = filepath.Join(t.TempDir(), "spool")
 	runID := "20260516T010203Z-1a2b3c4d"
@@ -320,7 +320,7 @@ func cleanupFixtureConfig(t *testing.T) (*config.Config, cleanupSeed) {
 	}
 }
-func archiveStageCleanupFixture(t *testing.T) (*config.Config, cleanupSeed, string) {
+func publishStageCleanupFixture(t *testing.T) (*config.Config, cleanupSeed, string) {
 	t.Helper()
 	cfg, seed := cleanupFixtureConfig(t)
@@ -329,11 +329,11 @@ func archiveStageCleanupFixture(t *testing.T) (*config.Config, cleanupSeed, stri
 		Bucket:     "my-dnd-archive",
 		RootPrefix: "dnd",
 	}
-	cfg.Pipeline.Archive = &config.ArchiveConfig{
+	cfg.Pipeline.Publish = &config.PublishConfig{
 		Enabled:   boolPtr(true),
 		UploadRun: boolPtr(true),
-		PromoteArtifacts: []config.ArchivePromotionRule{
+		Outputs: []config.PublishOutputRule{
-			{Source: "narratio.transcript.trimmed", Dest: "transcripts/trimmed.json", Required: boolPtr(true)},
+			{Source: "narratio.transcript.final_trimmed", Dest: "transcripts/final.trimmed.json", Required: boolPtr(true)},
 			{Source: "narratio.artifact.session_recap", Dest: "artifacts/session_recap.md", Required: boolPtr(true)},
 		},
 	}
@@ -344,7 +344,7 @@ func archiveStageCleanupFixture(t *testing.T) (*config.Config, cleanupSeed, stri
 			},
 		},
 	}
-	writeArchiveFixtureRunFiles(
+	writePublishFixtureRunFiles(
 		t,
 		seed.runWorkDir,
 		artifacts.SessionWorkDirForCampaign(cfg.Pipeline.Workspace.Root, cfg.Session.Campaign, cfg.Session.SessionID),
@@ -367,18 +367,18 @@ func archiveStageCleanupFixture(t *testing.T) (*config.Config, cleanupSeed, stri
 	return cfg, seed, runID
 }
-func writeArchiveFixtureRunFiles(t *testing.T, runWorkDir, sessionRoot string) {
+func writePublishFixtureRunFiles(t *testing.T, runWorkDir, sessionRoot string) {
 	t.Helper()
 	mustWriteFile(t, filepath.Join(runWorkDir, "prepare", "inputs", "session.yml"), "session_id: 2026-05-03\n")
 	mustWriteFile(t, filepath.Join(runWorkDir, "transcribe", "outputs", "transcripts", "raw", "speaker.json"), "{}\n")
-	mustWriteFile(t, filepath.Join(runWorkDir, "trim", "outputs", "transcripts", "trimmed.json"), "{\"segments\":[]}\n")
+	mustWriteFile(t, filepath.Join(runWorkDir, "trim", "outputs", "transcripts", "final.trimmed.json"), "{\"segments\":[]}\n")
 	mustWriteFile(t, filepath.Join(runWorkDir, "analyze", "outputs", "artifacts", "session_recap.md"), "# recap\n")
 	mustWriteFile(t, filepath.Join(runWorkDir, "polish", "reports", "audita.report.json"), "{}\n")
 	mustWriteFile(t, filepath.Join(runWorkDir, "merge", "config", "seriatim.generated.yml"), "key: value\n")
 	mustWriteFile(t, filepath.Join(runWorkDir, "logs", "audita.stderr.log"), "stderr\n")
 	mustWriteFile(t, filepath.Join(runWorkDir, "manifest.json"), "{}\n")
-	mustWriteFile(t, filepath.Join(sessionRoot, "transcripts", "trimmed.json"), "{\"segments\":[]}\n")
+	mustWriteFile(t, filepath.Join(sessionRoot, "transcripts", "final.trimmed.json"), "{\"segments\":[]}\n")
 	mustWriteFile(t, filepath.Join(sessionRoot, "artifacts", "session_recap.md"), "# recap\n")
 }
--- a/internal/app/remote_locks.go
+++ b/internal/app/remote_locks.go
@@ -13,9 +13,9 @@ import (
 )
 type effectiveLocks struct {
-	Static []config.ArchiveLockRule
+	Static []config.PublishLockRule
-	Remote []config.ArchiveLockRule
+	Remote []config.PublishLockRule
-	All    []config.ArchiveLockRule
+	All    []config.PublishLockRule
 	Key    string
 }
@@ -34,7 +34,7 @@ func remoteLocksKey(cfg *config.Config) (string, error) {
 	return artifacts.S3SessionLocksKey(sessionPrefix), nil
 }
-func loadRemoteLockStore(ctx context.Context, cfg *config.Config, store storage.ObjectStore) (*config.ArchiveLockStore, string, error) {
+func loadRemoteLockStore(ctx context.Context, cfg *config.Config, store storage.ObjectStore) (*config.PublishLockStore, string, error) {
 	key, err := remoteLocksKey(cfg)
 	if err != nil {
 		return nil, "", err
@@ -44,9 +44,9 @@ func loadRemoteLockStore(ctx context.Context, cfg *config.Config, store storage.
 		return nil, key, fmt.Errorf("check remote locks %q: %w", key, err)
 	}
 	if !exists {
-		return &config.ArchiveLockStore{}, key, nil
+		return &config.PublishLockStore{}, key, nil
 	}
-	tmp, err := downloadObjectToTemp(ctx, store, key, "narratio-locks-*.yml")
+	tmp, err := storage.DownloadObjectToTemp(ctx, store, key, "narratio-locks-*.yml")
 	if err != nil {
 		return nil, key, fmt.Errorf("download remote locks %q: %w", key, err)
 	}
@@ -55,7 +55,7 @@ func loadRemoteLockStore(ctx context.Context, cfg *config.Config, store storage.
 	if err != nil {
 		return nil, key, fmt.Errorf("read remote locks %q: %w", key, err)
 	}
-	lockStore, err := config.LoadArchiveLockStoreBytes("s3://"+s3BucketName(cfg.Pipeline)+"/"+key, data, cfg.Pipeline.Scriptorium)
+	lockStore, err := config.LoadPublishLockStoreBytes("s3://"+s3BucketName(cfg.Pipeline)+"/"+key, data, cfg.Pipeline.Scriptorium)
 	if err != nil {
 		return nil, key, err
 	}
@@ -63,45 +63,45 @@ func loadRemoteLockStore(ctx context.Context, cfg *config.Config, store storage.
 }
 func loadEffectiveLocks(ctx context.Context, cfg *config.Config, store storage.ObjectStore) (*effectiveLocks, error) {
-	staticLocks := staticArchiveLocks(cfg)
+	staticLocks := staticPublishLocks(cfg)
 	if store == nil {
 		return &effectiveLocks{
 			Static: staticLocks,
-			All:    append([]config.ArchiveLockRule(nil), staticLocks...),
+			All:    append([]config.PublishLockRule(nil), staticLocks...),
 		}, nil
 	}
 	lockStore, key, err := loadRemoteLockStore(ctx, cfg, store)
 	if err != nil {
 		return nil, err
 	}
-	remoteLocks := append([]config.ArchiveLockRule(nil), lockStore.Locks...)
+	remoteLocks := append([]config.PublishLockRule(nil), lockStore.Locks...)
 	return &effectiveLocks{
 		Static: staticLocks,
 		Remote: remoteLocks,
-		All:    config.MergeArchiveLockRules(staticLocks, remoteLocks),
+		All:    config.MergePublishLockRules(staticLocks, remoteLocks),
 		Key:    key,
 	}, nil
 }
-func staticArchiveLocks(cfg *config.Config) []config.ArchiveLockRule {
+func staticPublishLocks(cfg *config.Config) []config.PublishLockRule {
-	if cfg == nil || cfg.Pipeline == nil || cfg.Pipeline.Archive == nil {
+	if cfg == nil || cfg.Pipeline == nil || cfg.Pipeline.Publish == nil {
 		return nil
 	}
-	return append([]config.ArchiveLockRule(nil), cfg.Pipeline.Archive.Locks...)
+	return append([]config.PublishLockRule(nil), cfg.Pipeline.Publish.Locks...)
 }
-func applyEffectiveLocks(cfg *config.Config, locks []config.ArchiveLockRule) {
+func applyEffectiveLocks(cfg *config.Config, locks []config.PublishLockRule) {
 	if cfg == nil || cfg.Pipeline == nil {
 		return
 	}
-	if cfg.Pipeline.Archive == nil {
+	if cfg.Pipeline.Publish == nil {
-		cfg.Pipeline.Archive = &config.ArchiveConfig{}
+		cfg.Pipeline.Publish = &config.PublishConfig{}
 	}
-	cfg.Pipeline.Archive.Locks = append([]config.ArchiveLockRule(nil), locks...)
+	cfg.Pipeline.Publish.Locks = append([]config.PublishLockRule(nil), locks...)
 }
-func uploadRemoteLockStore(ctx context.Context, store storage.ObjectStore, key string, lockStore *config.ArchiveLockStore) error {
+func uploadRemoteLockStore(ctx context.Context, store storage.ObjectStore, key string, lockStore *config.PublishLockStore) error {
-	data, err := config.MarshalArchiveLockStore(lockStore)
+	data, err := config.MarshalPublishLockStore(lockStore)
 	if err != nil {
 		return err
 	}
@@ -124,8 +124,8 @@ func uploadRemoteLockStore(ctx context.Context, store storage.ObjectStore, key s
 	return nil
 }
-func lockSourceSet(locks []config.ArchiveLockRule) map[string]config.ArchiveLockRule {
+func lockSourceSet(locks []config.PublishLockRule) map[string]config.PublishLockRule {
-	out := make(map[string]config.ArchiveLockRule, len(locks))
+	out := make(map[string]config.PublishLockRule, len(locks))
 	for _, lock := range locks {
 		source := strings.TrimSpace(lock.Source)
 		if source == "" {
--- a/internal/app/remote_session_test.go
+++ b/internal/app/remote_session_test.go
@@ -19,7 +19,7 @@ func TestExecuteRemoteSessionFallbackLoadsFromObjectStore(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, _ := writeValidConfigFiles(t, workspaceRoot)
 	fake := &storage.FakeBackend{}
-	remoteKey := seedRemoteSessionConfig(t, fake, "2026-05-03", `session_id: "{{ session_id }}"
+	remoteKey := seedRemoteSessionConfig(t, fake, "2026-05-03", `session_id: 2026-05-03
 inputs:
  audio_s3:
    prefix: audio/
@@ -29,14 +29,14 @@ inputs:
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"plan", "--config", pipelinePath, "--campaign", campaignPath, "--session-id", "2026-05-03"}, &stdout, &stderr)
+	code := Execute([]string{"session", "plan", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
 	if storeInitCalls != 1 {
 		t.Fatalf("object store init calls = %d, want 1", storeInitCalls)
 	}
-	if !strings.Contains(stdout.String(), "narratio plan: workdir prepared") {
+	if !strings.Contains(stdout.String(), "narratio session plan: workdir prepared") {
 		t.Fatalf("stdout = %q, want plan output", stdout.String())
 	}
 	if _, ok := fake.Objects[remoteKey]; !ok {
@@ -56,7 +56,7 @@ func TestExecuteRemoteSessionFallbackLoadsSecretsBeforeObjectStoreInit(t *testin
 	addSecretsToPipelineConfig(t, pipelinePath, secretsDir, accessKeyEnv, secretKeyEnv)
 	fake := &storage.FakeBackend{}
-	seedRemoteSessionConfig(t, fake, "2026-05-03", `session_id: "{{ session_id }}"
+	seedRemoteSessionConfig(t, fake, "2026-05-03", `session_id: 2026-05-03
 inputs:
  audio_s3:
    prefix: audio/
@@ -77,7 +77,7 @@ inputs:
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"plan", "--config", pipelinePath, "--campaign", campaignPath, "--session-id", "2026-05-03"}, &stdout, &stderr)
+	code := Execute([]string{"session", "plan", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stdout=%q stderr=%q", code, stdout.String(), stderr.String())
 	}
@@ -92,7 +92,7 @@ func TestExecuteExplicitLocalSessionPrecedenceSkipsRemote(t *testing.T) {
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"plan", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "--session-id", "2026-05-03"}, &stdout, &stderr)
+	code := Execute([]string{"session", "plan", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
@@ -110,7 +110,7 @@ func TestExecuteLocalSessionDiscoveryPrecedenceSkipsRemote(t *testing.T) {
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"plan", "--config", pipelinePath, "--campaign", campaignPath, "--session-id", "2026-05-03"}, &stdout, &stderr)
+	code := Execute([]string{"session", "plan", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
@@ -129,7 +129,7 @@ func TestExecuteRemoteSessionMissingObjectFailsClearly(t *testing.T) {
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"plan", "--config", pipelinePath, "--campaign", campaignPath, "--session-id", "2026-05-03"}, &stdout, &stderr)
+	code := Execute([]string{"session", "plan", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath}, &stdout, &stderr)
 	if code == 0 {
 		t.Fatal("exit code = 0, want non-zero")
 	}
@@ -149,12 +149,12 @@ func TestExecuteRemoteSessionRequiresSessionID(t *testing.T) {
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"plan", "--config", pipelinePath, "--campaign", campaignPath}, &stdout, &stderr)
+	code := Execute([]string{"session", "plan", "--config", pipelinePath, "--campaign-file", campaignPath}, &stdout, &stderr)
 	if code == 0 {
 		t.Fatal("exit code = 0, want non-zero")
 	}
-	if !strings.Contains(stderr.String(), "remote session loading requires --session-id") {
+	if !strings.Contains(stderr.String(), "plan: session_id is required") {
-		t.Fatalf("stderr = %q, want session-id guidance", stderr.String())
+		t.Fatalf("stderr = %q, want session_id guidance", stderr.String())
 	}
 	if storeInitCalls != 0 {
 		t.Fatalf("object store init calls = %d, want 0", storeInitCalls)
@@ -177,7 +177,7 @@ func TestExecuteRemoteSessionStorageInitErrorFailsClearly(t *testing.T) {
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"plan", "--config", pipelinePath, "--campaign", campaignPath, "--session-id", "2026-05-03"}, &stdout, &stderr)
+	code := Execute([]string{"session", "plan", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath}, &stdout, &stderr)
 	if code == 0 {
 		t.Fatal("exit code = 0, want non-zero")
 	}
@@ -196,7 +196,7 @@ func TestExecuteRemoteSessionMalformedYAMLFailsStrictDecode(t *testing.T) {
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"plan", "--config", pipelinePath, "--campaign", campaignPath, "--session-id", "2026-05-03"}, &stdout, &stderr)
+	code := Execute([]string{"session", "plan", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath}, &stdout, &stderr)
 	if code == 0 {
 		t.Fatal("exit code = 0, want non-zero")
 	}
@@ -205,6 +205,48 @@ func TestExecuteRemoteSessionMalformedYAMLFailsStrictDecode(t *testing.T) {
 	}
 }
 func TestExecuteRemoteSessionTemplateFailsConcreteSessionCheck(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, _ := writeValidConfigFiles(t, workspaceRoot)
 	fake := &storage.FakeBackend{}
 	seedRemoteSessionConfig(t, fake, "2026-05-03", `session_id: "{{ session_id }}"
 inputs:
  audio_s3:
    prefix: audio/
 `)
 	var storeInitCalls int
 	restoreAppConfigTestGlobals(t, fake, &storeInitCalls, []string{filepath.Join(t.TempDir(), "session.yml")})
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute([]string{"session", "plan", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath}, &stdout, &stderr)
 	if code == 0 {
 		t.Fatal("exit code = 0, want non-zero")
 	}
 	if !strings.Contains(stderr.String(), "session.yml must be concrete") || !strings.Contains(stderr.String(), "run narratio session init") {
 		t.Fatalf("stderr = %q, want concrete session guidance", stderr.String())
 	}
 }
 func TestExecuteRemoteSessionMismatchFails(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, _ := writeValidConfigFiles(t, workspaceRoot)
 	fake := &storage.FakeBackend{}
 	seedRemoteSessionConfig(t, fake, "2026-05-03", "session_id: 2026-05-04\ninputs:\n  audio_s3:\n    prefix: audio/\n")
 	var storeInitCalls int
 	restoreAppConfigTestGlobals(t, fake, &storeInitCalls, []string{filepath.Join(t.TempDir(), "session.yml")})
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute([]string{"session", "plan", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath}, &stdout, &stderr)
 	if code == 0 {
 		t.Fatal("exit code = 0, want non-zero")
 	}
 	if !strings.Contains(stderr.String(), "session_id mismatch") {
 		t.Fatalf("stderr = %q, want session_id mismatch", stderr.String())
 	}
 }
 func restoreAppConfigTestGlobals(t *testing.T, fake *storage.FakeBackend, storeInitCalls *int, sessionDefaults []string) {
 	t.Helper()
 	origStoreFn := newObjectStoreFromConfigFn
--- a/internal/app/restore.go
+++ b/internal/app/restore.go
@@ -8,6 +8,7 @@ import (
 	"io"
 	"log/slog"
 	"os"
 	"strings"
 	"gitea.maximumdirect.net/eric/narratio/internal/adapters/storage"
 	"gitea.maximumdirect.net/eric/narratio/internal/artifacts"
@@ -22,27 +23,20 @@ var executeRestorePlanFn = executeRestorePlan
 // Restore validates restore CLI/config inputs and storage preflight for future restore phases.
 func Restore(ctx context.Context, args []string, out io.Writer) error {
 	positionalSessionID, args := pullLeadingSessionID(args)
 	fs := flag.NewFlagSet("restore", flag.ContinueOnError)
 	fs.SetOutput(out)
-	var pipelinePath string
+	var flags commonConfigFlags
 	var campaignPath string
 	var sessionPath string
 	var sessionID string
 	var previousSessionID string
 	var dryRun bool
 	var force bool
 	var includeAudio bool
-	fs.StringVar(&pipelinePath, "config", "", "path to pipeline.yml (optional; defaults searched)")
+	addCommonConfigFlags(fs, &flags)
 	fs.StringVar(&campaignPath, "campaign", "", "path to campaign.yml (optional; defaults searched)")
 	fs.StringVar(&sessionPath, "session", "", "path to session.yml")
 	fs.StringVar(&sessionID, "session-id", "", "session identifier for session.yml templates")
 	fs.StringVar(&previousSessionID, "previous-session-id", "", "previous session identifier for session.yml templates")
 	fs.BoolVar(&dryRun, "dry-run", false, "plan restore actions without writing local files")
 	fs.BoolVar(&force, "force", false, "overwrite local conflicts with remote state")
 	fs.BoolVar(&includeAudio, "include-audio", false, "include archived session-level audio objects")
 	fs.Usage = func() {
-		_, _ = fmt.Fprintln(out, "Usage: narratio restore [--config <path>] [--campaign <path>] [--session <path>] [--session-id <value>] [--previous-session-id <value>] [--dry-run] [--force] [--include-audio]")
+		_, _ = fmt.Fprintln(out, "Usage: narratio session restore <session_id> [--config <path>] [--campaign <id>] [--campaign-file <path>] [--session <path>] [--previous-session-id <value>] [--dry-run] [--force] [--include-audio]")
 		_, _ = fmt.Fprintln(out)
 		_, _ = fmt.Fprintln(out, "Flags:")
 		fs.PrintDefaults()
@@ -54,13 +48,13 @@ func Restore(ctx context.Context, args []string, out io.Writer) error {
 		}
 		return fmt.Errorf("restore: invalid flags: %w", err)
 	}
-	if fs.NArg() != 0 {
+	if err := resolveParsedSessionID("restore", positionalSessionID, fs, &flags.sessionID); err != nil {
-		return fmt.Errorf("restore: unexpected positional arguments")
+		return err
 	}
-	cfg, err := loadCommandConfig(ctx, pipelinePath, campaignPath, sessionPath, config.SessionLoadOptions{
+	if strings.TrimSpace(flags.sessionID) == "" {
-		SessionID:         sessionID,
+		return fmt.Errorf("restore: session_id is required")
-		PreviousSessionID: previousSessionID,
+	}
-	})
+	cfg, err := loadCommandConfig(ctx, flags.pipelinePath, flags.campaignPath, flags.campaignFilePath, flags.sessionPath, flags.sessionOptions())
 	if err != nil {
 		return fmt.Errorf("restore: %w", err)
 	}
--- a/internal/app/restore_discovery.go
+++ b/internal/app/restore_discovery.go
@@ -3,7 +3,6 @@ package app
 import (
 	"context"
 	"fmt"
 	"os"
 	"strings"
 	"gitea.maximumdirect.net/eric/narratio/internal/adapters/storage"
@@ -12,7 +11,7 @@ import (
 	"gitea.maximumdirect.net/eric/narratio/internal/manifest"
 )
-// RemoteCurrentState captures discovered committed remote archive state for one session.
+// RemoteCurrentState captures discovered committed remote published current state for one session.
 type RemoteCurrentState struct {
 	Bucket             string
 	SessionPrefix      string
@@ -32,80 +31,24 @@ func discoverRemoteCurrentState(ctx context.Context, cfg *config.Config, store s
 		return nil, fmt.Errorf("remote object store is required")
 	}
-	bucket := artifacts.ResolveArchiveBucket(cfg, nil)
+	bucket := artifacts.ResolvePublishBucket(cfg, nil)
 	if strings.TrimSpace(bucket) == "" {
-		return nil, fmt.Errorf("archive bucket is required")
+		return nil, fmt.Errorf("publish bucket is required")
 	}
-	sessionPrefix, err := artifacts.ResolveArchiveSessionPrefix(cfg, nil)
+	sessionPrefix, err := artifacts.ResolvePublishSessionPrefix(cfg, nil)
 	if err != nil {
-		return nil, fmt.Errorf("resolve archive session prefix: %w", err)
+		return nil, fmt.Errorf("resolve publish session prefix: %w", err)
 	}
 	currentManifestKey, currentRunIDKey := artifacts.ResolveArchiveCurrentStateKeys(sessionPrefix)
 	exists, err := store.Exists(ctx, currentRunIDKey)
 	if err != nil {
 		return nil, fmt.Errorf("check remote current run pointer %q: %w", currentRunIDKey, err)
 	}
 	if !exists {
 		return nil, fmt.Errorf("remote current run pointer missing: %q", currentRunIDKey)
 	}
 	runIDPath, err := downloadObjectToTemp(ctx, store, currentRunIDKey, "narratio-restore-current-run-id-*.txt")
 	if err != nil {
 		return nil, fmt.Errorf("download remote current run pointer %q: %w", currentRunIDKey, err)
 	}
 	defer func() { _ = os.Remove(runIDPath) }()
 	runIDData, err := os.ReadFile(runIDPath)
 	if err != nil {
 		return nil, fmt.Errorf("read downloaded run pointer %q: %w", currentRunIDKey, err)
 	}
 	runID := strings.TrimSpace(string(runIDData))
 	if runID == "" {
 		return nil, fmt.Errorf("remote current run pointer %q is empty", currentRunIDKey)
 	}
 	exists, err = store.Exists(ctx, currentManifestKey)
 	if err != nil {
 		return nil, fmt.Errorf("check remote current manifest %q: %w", currentManifestKey, err)
 	}
 	if !exists {
 		return nil, fmt.Errorf("remote current manifest missing: %q", currentManifestKey)
 	}
 	manifestPath, err := downloadObjectToTemp(ctx, store, currentManifestKey, "narratio-restore-current-manifest-*.json")
 	if err != nil {
 		return nil, fmt.Errorf("download remote current manifest %q: %w", currentManifestKey, err)
 	}
 	defer func() { _ = os.Remove(manifestPath) }()
 	manifestStore := &manifest.LocalStore{}
 	remoteManifest, err := manifestStore.Load(ctx, manifestPath)
 	if err != nil {
 		return nil, fmt.Errorf("remote current manifest decode failed: %w", err)
 	}
 	currentManifestKey, currentRunIDKey := artifacts.ResolveCurrentStateKeys(sessionPrefix)
 	requestedSession := strings.TrimSpace(cfg.Session.SessionID)
 	requestedCampaign := strings.TrimSpace(cfg.Session.Campaign)
-	manifestSession := strings.TrimSpace(remoteManifest.SessionID)
+	current, err := artifacts.LoadCurrentState(ctx, store, sessionPrefix, artifacts.CurrentStateValidation{
-	manifestCampaign := strings.TrimSpace(remoteManifest.Campaign)
+		ExpectedSessionID: requestedSession,
-
+		ExpectedCampaign:  requestedCampaign,
-	if manifestSession != requestedSession {
+	})
-		return nil, fmt.Errorf(
+	if err != nil {
-			"remote current manifest session_id %q does not match requested session_id %q",
+		return nil, fmt.Errorf("remote %w", err)
 			manifestSession,
 			requestedSession,
 		)
 	}
 	if manifestCampaign == "" {
 		return nil, fmt.Errorf("remote current manifest campaign is required")
 	}
 	if manifestCampaign != requestedCampaign {
 		return nil, fmt.Errorf(
 			"remote current manifest campaign %q does not match requested campaign %q",
 			manifestCampaign,
 			requestedCampaign,
 		)
 	}
 	return &RemoteCurrentState{
@@ -113,27 +56,9 @@ func discoverRemoteCurrentState(ctx context.Context, cfg *config.Config, store s
 		SessionPrefix:      sessionPrefix,
 		CurrentRunIDKey:    currentRunIDKey,
 		CurrentManifestKey: currentManifestKey,
-		RunID:              runID,
+		RunID:              current.RunID,
-		SessionID:          manifestSession,
+		SessionID:          strings.TrimSpace(current.Manifest.SessionID),
-		Campaign:           manifestCampaign,
+		Campaign:           strings.TrimSpace(current.Manifest.Campaign),
-		Manifest:           remoteManifest,
+		Manifest:           current.Manifest,
 	}, nil
 }
 func downloadObjectToTemp(ctx context.Context, store storage.ObjectStore, key, pattern string) (string, error) {
 	tmp, err := os.CreateTemp("", pattern)
 	if err != nil {
 		return "", fmt.Errorf("create temp file: %w", err)
 	}
 	path := tmp.Name()
 	if err := tmp.Close(); err != nil {
 		_ = os.Remove(path)
 		return "", fmt.Errorf("close temp file: %w", err)
 	}
 	if err := store.Download(ctx, key, path); err != nil {
 		_ = os.Remove(path)
 		return "", err
 	}
 	return path, nil
 }
--- a/internal/app/restore_discovery_test.go
+++ b/internal/app/restore_discovery_test.go
@@ -102,7 +102,7 @@ func TestDiscoverRemoteCurrentStateSessionMismatchFails(t *testing.T) {
 	store.SeedObject(storage.FakeObject{Key: manifestKey, Data: restoreManifestJSON(t, "wrong-session", cfg.Session.Campaign)})
 	_, err := discoverRemoteCurrentState(context.Background(), cfg, store)
-	if err == nil || !strings.Contains(err.Error(), "does not match requested session_id") {
+	if err == nil || !strings.Contains(err.Error(), "does not match expected session_id") {
 		t.Fatalf("error = %v, want session mismatch failure", err)
 	}
 }
@@ -116,7 +116,7 @@ func TestDiscoverRemoteCurrentStateCampaignMismatchFails(t *testing.T) {
 	store.SeedObject(storage.FakeObject{Key: manifestKey, Data: restoreManifestJSON(t, cfg.Session.SessionID, "wrong-campaign")})
 	_, err := discoverRemoteCurrentState(context.Background(), cfg, store)
-	if err == nil || !strings.Contains(err.Error(), "does not match requested campaign") {
+	if err == nil || !strings.Contains(err.Error(), "does not match expected campaign") {
 		t.Fatalf("error = %v, want campaign mismatch failure", err)
 	}
 }
@@ -208,7 +208,7 @@ func restoreDiscoveryConfig() *config.Config {
 func restoreDiscoveryKeys(cfg *config.Config) (sessionPrefix, manifestKey, runIDKey string) {
 	sessionPrefix = artifacts.S3SessionPrefix(cfg.Pipeline.Storage.S3.RootPrefix, cfg.Session.Campaign, cfg.Session.SessionID)
-	manifestKey, runIDKey = artifacts.ResolveArchiveCurrentStateKeys(sessionPrefix)
+	manifestKey, runIDKey = artifacts.ResolveCurrentStateKeys(sessionPrefix)
 	return sessionPrefix, manifestKey, runIDKey
 }
--- a/internal/app/restore_execution_test.go
+++ b/internal/app/restore_execution_test.go
@@ -32,7 +32,7 @@ func TestExecuteRestoreNonDryRunRestoresDurableFiles(t *testing.T) {
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"restore", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath}, &stdout, &stderr)
+	code := Execute([]string{"session", "restore", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
@@ -74,7 +74,7 @@ func TestExecuteRestoreIncludeAudioRestoresAudio(t *testing.T) {
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"restore", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "--include-audio"}, &stdout, &stderr)
+	code := Execute([]string{"session", "restore", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath, "--include-audio"}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
@@ -100,7 +100,7 @@ func TestExecuteRestoreIncludeAudioUsesCacheAfterWorkspaceDeletion(t *testing.T)
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"restore", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "--include-audio"}, &stdout, &stderr)
+	code := Execute([]string{"session", "restore", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath, "--include-audio"}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("first restore exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
@@ -115,7 +115,7 @@ func TestExecuteRestoreIncludeAudioUsesCacheAfterWorkspaceDeletion(t *testing.T)
 	}
 	stdout.Reset()
 	stderr.Reset()
-	code = Execute([]string{"restore", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "--include-audio"}, &stdout, &stderr)
+	code = Execute([]string{"session", "restore", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath, "--include-audio"}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("second restore exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
@@ -128,23 +128,29 @@ func TestExecuteRestoreIncludeAudioUsesCacheAfterWorkspaceDeletion(t *testing.T)
 func TestExecuteRestoreRestoresPreviousCacheWhenPresent(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 	appendRestoreWorkflowPreviousInputConfig(t, pipelinePath, sessionPath)
 	fake := &storage.FakeBackend{}
-	cfg, sessionPrefix, _, _ := seedRestoreCommittedState(t, fake, pipelinePath, campaignPath, sessionPath)
+	cfg, _, _, _ := seedRestoreCommittedState(t, fake, pipelinePath, campaignPath, sessionPath)
-	seedRestoreObject(fake, sessionPrefix+"previous/manifest.json", []byte(`{"session_id":"2026-04-26"}`))
+	seedRestorePreviousCurrent(t, fake, cfg, "# previous recap\n")
 	seedRestoreObject(fake, sessionPrefix+"previous/artifacts/session_recap.md", []byte("# previous recap\n"))
 	restoreWithStoreAndRealPhases(t, fake)
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"restore", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath}, &stdout, &stderr)
+	code := Execute([]string{"session", "restore", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
 	sessionRoot := artifacts.SessionWorkDirForCampaign(workspaceRoot, cfg.Session.Campaign, cfg.Session.SessionID)
-	mustReadEquals(t, filepath.Join(sessionRoot, "previous", "manifest.json"), `{"session_id":"2026-04-26"}`)
+	previousManifestBytes, err := os.ReadFile(filepath.Join(sessionRoot, "previous", "manifest.json"))
 	if err != nil {
 		t.Fatalf("read restored previous manifest: %v", err)
 	}
 	if !strings.Contains(string(previousManifestBytes), `"session_id":"2026-04-26"`) {
 		t.Fatalf("restored previous manifest = %q, want previous session id", string(previousManifestBytes))
 	}
 	mustReadEquals(t, filepath.Join(sessionRoot, "previous", "artifacts", "session_recap.md"), "# previous recap\n")
 	report := mustReadRestoreReport(t, filepath.Join(sessionRoot, "reports", "restore-latest.json"))
 	if report.Execution.Downloaded != 3 {
@@ -152,6 +158,33 @@ func TestExecuteRestoreRestoresPreviousCacheWhenPresent(t *testing.T) {
 	}
 }
 func TestExecuteRestoreDryRunReportsPreviousCacheWithoutWriting(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 	appendRestoreWorkflowPreviousInputConfig(t, pipelinePath, sessionPath)
 	fake := &storage.FakeBackend{}
 	cfg, _, _, _ := seedRestoreCommittedState(t, fake, pipelinePath, campaignPath, sessionPath)
 	seedRestorePreviousCurrent(t, fake, cfg, "# previous recap\n")
 	restoreWithStoreAndRealPhases(t, fake)
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute([]string{"session", "restore", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath, "--dry-run"}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
 	if !strings.Contains(stdout.String(), "previous/artifacts/session_recap.md") {
 		t.Fatalf("stdout = %q, want planned previous-cache artifact", stdout.String())
 	}
 	sessionRoot := artifacts.SessionWorkDirForCampaign(workspaceRoot, cfg.Session.Campaign, cfg.Session.SessionID)
 	if _, err := os.Stat(filepath.Join(sessionRoot, "previous", "artifacts", "session_recap.md")); !os.IsNotExist(err) {
 		t.Fatalf("previous artifact should not be written during dry-run; stat err=%v", err)
 	}
 }
 func TestExecuteRestoreConflictWithoutForceDoesNotOverwrite(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
@@ -167,7 +200,7 @@ func TestExecuteRestoreConflictWithoutForceDoesNotOverwrite(t *testing.T) {
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"restore", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath}, &stdout, &stderr)
+	code := Execute([]string{"session", "restore", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath}, &stdout, &stderr)
 	if code == 0 {
 		t.Fatal("exit code = 0, want non-zero")
 	}
@@ -199,7 +232,7 @@ func TestExecuteRestoreForceOverwritesDifferingFile(t *testing.T) {
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"restore", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "--force"}, &stdout, &stderr)
+	code := Execute([]string{"session", "restore", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath, "--force"}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
@@ -213,10 +246,11 @@ func TestExecuteRestoreForceOverwritesDifferingFile(t *testing.T) {
 func TestExecuteRestoreForceOverwritesDifferingPreviousCacheFile(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 	appendRestoreWorkflowPreviousInputConfig(t, pipelinePath, sessionPath)
 	fake := &storage.FakeBackend{}
-	cfg, sessionPrefix, _, _ := seedRestoreCommittedState(t, fake, pipelinePath, campaignPath, sessionPath)
+	cfg, _, _, _ := seedRestoreCommittedState(t, fake, pipelinePath, campaignPath, sessionPath)
-	seedRestoreObject(fake, sessionPrefix+"previous/artifacts/session_recap.md", []byte("# remote previous recap\n"))
+	seedRestorePreviousCurrent(t, fake, cfg, "# remote previous recap\n")
 	sessionRoot := artifacts.SessionWorkDirForCampaign(workspaceRoot, cfg.Session.Campaign, cfg.Session.SessionID)
 	mustWriteTestFile(t, filepath.Join(sessionRoot, "previous", "artifacts", "session_recap.md"), "# local previous recap\n")
@@ -225,7 +259,7 @@ func TestExecuteRestoreForceOverwritesDifferingPreviousCacheFile(t *testing.T) {
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"restore", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "--force"}, &stdout, &stderr)
+	code := Execute([]string{"session", "restore", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath, "--force"}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
@@ -251,7 +285,7 @@ func TestExecuteRestoreLockConflictFailsAndWritesNothing(t *testing.T) {
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"restore", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath}, &stdout, &stderr)
+	code := Execute([]string{"session", "restore", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath}, &stdout, &stderr)
 	if code == 0 {
 		t.Fatal("exit code = 0, want non-zero")
 	}
@@ -298,7 +332,7 @@ func TestExecuteRestoreInvalidManifestDoesNotCorruptExistingManifest(t *testing.
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"restore", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "--force"}, &stdout, &stderr)
+	code := Execute([]string{"session", "restore", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath, "--force"}, &stdout, &stderr)
 	if code == 0 {
 		t.Fatal("exit code = 0, want non-zero")
 	}
@@ -393,7 +427,7 @@ func seedRestoreCommittedState(t *testing.T, fake *storage.FakeBackend, pipeline
 	}
 	sessionPrefix := artifacts.S3SessionPrefix(cfg.Pipeline.Storage.S3.RootPrefix, cfg.Session.Campaign, cfg.Session.SessionID)
-	manifestKey, runIDKey := artifacts.ResolveArchiveCurrentStateKeys(sessionPrefix)
+	manifestKey, runIDKey := artifacts.ResolveCurrentStateKeys(sessionPrefix)
 	seedRestoreObject(fake, runIDKey, []byte("20260519T010203Z-a1b2c3d4\n"))
 	seedRestoreObject(fake, manifestKey, restoreManifestJSON(t, cfg.Session.SessionID, cfg.Session.Campaign))
@@ -401,6 +435,50 @@ func seedRestoreCommittedState(t *testing.T, fake *storage.FakeBackend, pipeline
 	return cfg, sessionPrefix, manifestKey, runIDKey
 }
 func appendRestoreWorkflowPreviousInputConfig(t *testing.T, pipelinePath, sessionPath string) {
 	t.Helper()
 	appendRestoreWorkflowScriptoriumConfig(t, pipelinePath, `
 scriptorium:
  binary: scriptorium
  artifacts:
    session_recap:
      enabled: true
      prompt_id: dnd.session_recap
      output_path: artifacts/session_recap.md
      inputs:
        previous_recap:
          source: narratio.previous_session.artifact.session_recap
          required: true
 `)
 	appendRestoreWorkflowScriptoriumConfig(t, sessionPath, `
 previous_session_id: 2026-04-26
 `)
 }
 func seedRestorePreviousCurrent(t *testing.T, fake *storage.FakeBackend, cfg *config.Config, artifactBody string) {
 	t.Helper()
 	seedRestorePreviousCurrentManifestOnly(t, fake, cfg)
 	previousPrefix := artifacts.S3SessionPrefix(cfg.Pipeline.Storage.S3.RootPrefix, cfg.Session.Campaign, cfg.Session.PreviousSessionID)
 	seedRestoreObject(fake, previousPrefix+"artifacts/session_recap.md", []byte(artifactBody))
 }
 func seedRestorePreviousCurrentManifestOnly(t *testing.T, fake *storage.FakeBackend, cfg *config.Config) {
 	t.Helper()
 	previousPrefix := artifacts.S3SessionPrefix(cfg.Pipeline.Storage.S3.RootPrefix, cfg.Session.Campaign, cfg.Session.PreviousSessionID)
 	manifestKey, runIDKey := artifacts.ResolveCurrentStateKeys(previousPrefix)
 	previousRunID := "20260426T010203Z-a1b2c3d4"
 	seedRestoreObject(fake, runIDKey, []byte(previousRunID+"\n"))
 	m := manifest.New(cfg.Session.PreviousSessionID, nowUTC())
 	m.Campaign = cfg.Session.Campaign
 	m.RunID = previousRunID
 	data, err := json.Marshal(m)
 	if err != nil {
 		t.Fatalf("marshal previous restore manifest: %v", err)
 	}
 	seedRestoreObject(fake, manifestKey, append(data, '\n'))
 }
 func mustReadEquals(t *testing.T, path, want string) {
 	t.Helper()
 	data, err := os.ReadFile(path)
--- a/internal/app/restore_plan.go
+++ b/internal/app/restore_plan.go
@@ -13,6 +13,7 @@ import (
 	"gitea.maximumdirect.net/eric/narratio/internal/adapters/storage"
 	"gitea.maximumdirect.net/eric/narratio/internal/artifacts"
 	"gitea.maximumdirect.net/eric/narratio/internal/config"
 	"gitea.maximumdirect.net/eric/narratio/internal/previouscache"
 )
 // RestoreActionKind identifies one restore planner action.
@@ -114,6 +115,12 @@ func buildRestorePlan(ctx context.Context, cfg *config.Config, current *RemoteCu
 		actions = append(actions, action)
 	}
 	previousActions, err := buildPreviousCacheRestoreActions(ctx, cfg, sessionPaths, store, opts.Force)
 	if err != nil {
 		return nil, err
 	}
 	actions = append(actions, previousActions...)
 	sort.Slice(actions, func(i, j int) bool {
 		if actions[i].LocalRelativePath == actions[j].LocalRelativePath {
 			return actions[i].RemoteKey < actions[j].RemoteKey
@@ -195,7 +202,7 @@ func restoreLocalRelativePathForKey(sessionPrefix, currentManifestKey, key strin
 		return cleanRel, true, nil
 	}
 	if cleanRel == config.PathPreviousDirSegment || strings.HasPrefix(cleanRel, config.PathPreviousDirSegment+"/") {
-		return cleanRel, true, nil
+		return "", false, nil
 	}
 	if includeAudio && (cleanRel == config.PathAudioDirSegment || strings.HasPrefix(cleanRel, config.PathAudioDirSegment+"/")) {
 		return cleanRel, true, nil
@@ -223,6 +230,35 @@ func joinWithinSessionRoot(sessionRoot, relative string) (string, error) {
 	return abs, nil
 }
 func buildPreviousCacheRestoreActions(
 	ctx context.Context,
 	cfg *config.Config,
 	sessionPaths artifacts.SessionPaths,
 	store storage.ObjectStore,
 	force bool,
 ) ([]RestoreAction, error) {
 	if cfg == nil || cfg.Pipeline == nil || cfg.Pipeline.Scriptorium == nil {
 		return nil, nil
 	}
 	requirements := artifacts.CollectPreviousArtifactRequirements(cfg.Pipeline.Scriptorium.Artifacts)
 	if len(requirements) == 0 {
 		return nil, nil
 	}
 	plan, err := previouscache.BuildPlan(ctx, cfg, sessionPaths, requirements, store)
 	if err != nil {
 		return nil, fmt.Errorf("plan previous-session cache restore: %w", err)
 	}
 	actions := make([]RestoreAction, 0, len(plan.Records))
 	for _, record := range plan.Records {
 		action, err := classifyRestoreAction(ctx, store, storage.ObjectInfo{Key: record.RemoteKey}, record.LocalRelativePath, record.LocalPath, force)
 		if err != nil {
 			return nil, fmt.Errorf("classify previous-session cache object %q: %w", record.RemoteKey, err)
 		}
 		actions = append(actions, action)
 	}
 	return actions, nil
 }
 func classifyRestoreAction(
 	ctx context.Context,
 	store storage.ObjectStore,
@@ -302,7 +338,7 @@ func classifyRestoreAction(
 	if err != nil {
 		return RestoreAction{}, fmt.Errorf("checksum local file: %w", err)
 	}
-	remotePath, err := downloadObjectToTemp(ctx, store, action.RemoteKey, "narratio-restore-plan-remote-*.tmp")
+	remotePath, err := storage.DownloadObjectToTemp(ctx, store, action.RemoteKey, "narratio-restore-plan-remote-*.tmp")
 	if err != nil {
 		return RestoreAction{}, fmt.Errorf("download remote object: %w", err)
 	}
--- a/internal/app/restore_plan_test.go
+++ b/internal/app/restore_plan_test.go
@@ -86,6 +86,27 @@ func TestRestorePlanExistingAudioUsesSizeWithoutRemoteChecksumDownload(t *testin
 }
 func TestRestorePlanIncludesPreviousCacheByDefault(t *testing.T) {
 	cfg := restorePlanConfig(t)
 	configureRestorePlanPreviousRequirement(cfg, true)
 	current := restorePlanCurrentState(t, cfg)
 	store := &storage.FakeBackend{}
 	seedRestoreObject(store, current.CurrentManifestKey, []byte(`{"session_id":"2026-05-03"}`))
 	seedRestorePreviousCurrent(t, store, cfg, "# previous recap\n")
 	plan, err := buildRestorePlan(context.Background(), cfg, current, store, RestorePlanOptions{})
 	if err != nil {
 		t.Fatalf("buildRestorePlan() error = %v", err)
 	}
 	got := actionRelPaths(plan.Actions)
 	want := []string{"manifest.json", "previous/artifacts/session_recap.md", "previous/manifest.json"}
 	if !reflect.DeepEqual(got, want) {
 		t.Fatalf("action local paths = %#v, want %#v", got, want)
 	}
 }
 func TestRestorePlanIgnoresCurrentSessionArchivedPreviousCache(t *testing.T) {
 	cfg := restorePlanConfig(t)
 	current := restorePlanCurrentState(t, cfg)
 	store := &storage.FakeBackend{}
@@ -100,12 +121,76 @@ func TestRestorePlanIncludesPreviousCacheByDefault(t *testing.T) {
 	}
 	got := actionRelPaths(plan.Actions)
-	want := []string{"manifest.json", "previous/artifacts/session_recap.md", "previous/manifest.json"}
+	want := []string{"manifest.json"}
 	if !reflect.DeepEqual(got, want) {
 		t.Fatalf("action local paths = %#v, want %#v", got, want)
 	}
 }
 func TestRestorePlanMissingOptionalPreviousCacheSkipsArtifact(t *testing.T) {
 	cfg := restorePlanConfig(t)
 	configureRestorePlanPreviousRequirement(cfg, false)
 	current := restorePlanCurrentState(t, cfg)
 	store := &storage.FakeBackend{}
 	seedRestoreObject(store, current.CurrentManifestKey, []byte(`{"session_id":"2026-05-03"}`))
 	seedRestorePreviousCurrentManifestOnly(t, store, cfg)
 	plan, err := buildRestorePlan(context.Background(), cfg, current, store, RestorePlanOptions{})
 	if err != nil {
 		t.Fatalf("buildRestorePlan() error = %v", err)
 	}
 	got := actionRelPaths(plan.Actions)
 	want := []string{"manifest.json", "previous/manifest.json"}
 	if !reflect.DeepEqual(got, want) {
 		t.Fatalf("action local paths = %#v, want %#v", got, want)
 	}
 }
 func TestRestorePlanMissingRequiredPreviousCacheFails(t *testing.T) {
 	cfg := restorePlanConfig(t)
 	configureRestorePlanPreviousRequirement(cfg, true)
 	current := restorePlanCurrentState(t, cfg)
 	store := &storage.FakeBackend{}
 	seedRestoreObject(store, current.CurrentManifestKey, []byte(`{"session_id":"2026-05-03"}`))
 	seedRestorePreviousCurrentManifestOnly(t, store, cfg)
 	_, err := buildRestorePlan(context.Background(), cfg, current, store, RestorePlanOptions{})
 	if err == nil || !strings.Contains(err.Error(), "required previous-session artifact") {
 		t.Fatalf("buildRestorePlan() error = %v, want required previous artifact failure", err)
 	}
 }
 func TestRestorePlanPreviousCacheConflictRequiresForce(t *testing.T) {
 	cfg := restorePlanConfig(t)
 	configureRestorePlanPreviousRequirement(cfg, true)
 	current := restorePlanCurrentState(t, cfg)
 	store := &storage.FakeBackend{}
 	seedRestoreObject(store, current.CurrentManifestKey, []byte(`{"session_id":"2026-05-03"}`))
 	seedRestorePreviousCurrent(t, store, cfg, "# remote previous recap\n")
 	sessionRoot := artifacts.SessionWorkDirForCampaign(cfg.Pipeline.Workspace.Root, cfg.Session.Campaign, cfg.Session.SessionID)
 	mustWriteTestFile(t, filepath.Join(sessionRoot, "previous", "artifacts", "session_recap.md"), "# local previous recap\n")
 	plan, err := buildRestorePlan(context.Background(), cfg, current, store, RestorePlanOptions{})
 	if err != nil {
 		t.Fatalf("buildRestorePlan() error = %v", err)
 	}
 	if plan.ConflictCount != 1 {
 		t.Fatalf("ConflictCount = %d, want 1", plan.ConflictCount)
 	}
 	plan, err = buildRestorePlan(context.Background(), cfg, current, store, RestorePlanOptions{Force: true})
 	if err != nil {
 		t.Fatalf("buildRestorePlan(force) error = %v", err)
 	}
 	if plan.ConflictCount != 0 {
 		t.Fatalf("force ConflictCount = %d, want 0", plan.ConflictCount)
 	}
 }
 func TestRestorePlanClassifiesSameAndConflict(t *testing.T) {
 	cfg := restorePlanConfig(t)
 	current := restorePlanCurrentState(t, cfg)
@@ -207,6 +292,10 @@ func restorePlanConfig(t *testing.T) *config.Config {
 	return &config.Config{
 		Pipeline: &config.PipelineConfig{
 			Workspace: config.WorkspaceConfig{Root: workspaceRoot},
 			Storage: config.StorageConfig{S3: &config.StorageS3Config{
 				Bucket:     "test-bucket",
 				RootPrefix: "dnd",
 			}},
 		},
 		Session: &config.SessionConfig{
 			SessionID: "2026-05-03",
@@ -215,10 +304,28 @@ func restorePlanConfig(t *testing.T) *config.Config {
 	}
 }
 func configureRestorePlanPreviousRequirement(cfg *config.Config, required bool) {
 	cfg.Session.PreviousSessionID = "2026-04-26"
 	cfg.Pipeline.Scriptorium = &config.ScriptoriumConfig{
 		Artifacts: map[string]config.ScriptoriumArtifactConfig{
 			"session_recap": {
 				Enabled:    true,
 				OutputPath: "artifacts/session_recap.md",
 				Inputs: map[string]config.ScriptoriumInputConfig{
 					"previous_recap": {
 						Source:   "narratio.previous_session.artifact.session_recap",
 						Required: required,
 					},
 				},
 			},
 		},
 	}
 }
 func restorePlanCurrentState(t *testing.T, cfg *config.Config) *RemoteCurrentState {
 	t.Helper()
 	sessionPrefix := artifacts.S3SessionPrefix("dnd", cfg.Session.Campaign, cfg.Session.SessionID)
-	manifestKey, runIDKey := artifacts.ResolveArchiveCurrentStateKeys(sessionPrefix)
+	manifestKey, runIDKey := artifacts.ResolveCurrentStateKeys(sessionPrefix)
 	return &RemoteCurrentState{
 		Bucket:             "test-bucket",
 		SessionPrefix:      sessionPrefix,
--- a/internal/app/restore_test.go
+++ b/internal/app/restore_test.go
@@ -18,7 +18,7 @@ func TestExecuteRestoreHelp(t *testing.T) {
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"restore", "--help"}, &stdout, &stderr)
+	code := Execute([]string{"session", "restore", "--help"}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0", code)
 	}
@@ -26,7 +26,7 @@ func TestExecuteRestoreHelp(t *testing.T) {
 		t.Fatalf("stderr = %q, want empty", stderr.String())
 	}
 	out := stdout.String()
-	if !strings.Contains(out, "Usage: narratio restore") {
+	if !strings.Contains(out, "Usage: narratio session restore <session_id>") {
 		t.Fatalf("stdout = %q, want restore usage", out)
 	}
 	if !strings.Contains(out, "--include-audio") {
@@ -79,11 +79,10 @@ func TestExecuteRestoreRecognizedAndReturnsNYI(t *testing.T) {
 	var stderr bytes.Buffer
 	code := Execute(
 		[]string{
-			"restore",
+			"session", "restore", "2026-05-03",
 			"--config", pipelinePath,
-			"--campaign", campaignPath,
+			"--campaign-file", campaignPath,
 			"--session", sessionPath,
 			"--session-id", "2026-05-03",
 			"--dry-run",
 			"--force",
 			"--include-audio",
@@ -124,7 +123,7 @@ func TestExecuteRestoreRejectsUnexpectedPositionalArguments(t *testing.T) {
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"restore", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "extra"}, &stdout, &stderr)
+	code := Execute([]string{"session", "restore", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath, "extra"}, &stdout, &stderr)
 	if code == 0 {
 		t.Fatal("exit code = 0, want non-zero")
 	}
@@ -146,7 +145,7 @@ func TestExecuteRestoreFailsWhenStorageBackendNotConfigured(t *testing.T) {
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"restore", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath}, &stdout, &stderr)
+	code := Execute([]string{"session", "restore", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath}, &stdout, &stderr)
 	if code == 0 {
 		t.Fatal("exit code = 0, want non-zero")
 	}
@@ -174,7 +173,7 @@ func TestExecuteRestoreDiscoveryErrorSurfaced(t *testing.T) {
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"restore", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath}, &stdout, &stderr)
+	code := Execute([]string{"session", "restore", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath}, &stdout, &stderr)
 	if code == 0 {
 		t.Fatal("exit code = 0, want non-zero")
 	}
@@ -263,11 +262,10 @@ func TestExecuteRestoreLoadsSecretsBeforeObjectStoreInit(t *testing.T) {
 	var stderr bytes.Buffer
 	code := Execute(
 		[]string{
-			"restore",
+			"session", "restore", "2026-05-03",
 			"--config", pipelinePath,
-			"--campaign", campaignPath,
+			"--campaign-file", campaignPath,
 			"--session", sessionPath,
 			"--session-id", "2026-05-03",
 			"--dry-run",
 		},
 		&stdout,
@@ -315,7 +313,7 @@ func TestExecuteRestoreNonDryRunConflictFailsBeforeNYI(t *testing.T) {
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"restore", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath}, &stdout, &stderr)
+	code := Execute([]string{"session", "restore", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath}, &stdout, &stderr)
 	if code == 0 {
 		t.Fatal("exit code = 0, want non-zero")
 	}
@@ -367,7 +365,7 @@ func TestExecuteRestoreNonDryRunForceExecutesPlan(t *testing.T) {
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"restore", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "--force"}, &stdout, &stderr)
+	code := Execute([]string{"session", "restore", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath, "--force"}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
--- a/internal/app/restore_workflow_test.go
+++ b/internal/app/restore_workflow_test.go
@@ -46,11 +46,10 @@ func TestRestoreThenRunStageForceAnalyzeUsesRestoredDurableState(t *testing.T) {
 	var stderr bytes.Buffer
 	restoreCode := Execute(
 		[]string{
-			"restore",
+			"session", "restore", cfg.Session.SessionID,
 			"--config", pipelinePath,
-			"--campaign", campaignPath,
+			"--campaign-file", campaignPath,
 			"--session", sessionPath,
 			"--session-id", cfg.Session.SessionID,
 		},
 		&stdout,
 		&stderr,
@@ -85,14 +84,12 @@ func TestRestoreThenRunStageForceAnalyzeUsesRestoredDurableState(t *testing.T) {
 	stderr.Reset()
 	runStageCode := Execute(
 		[]string{
-			"run-stage",
+			"run-stage", "analyze", cfg.Session.SessionID,
 			"--config", pipelinePath,
-			"--campaign", campaignPath,
+			"--campaign-file", campaignPath,
 			"--session", sessionPath,
 			"--session-id", cfg.Session.SessionID,
 			"--force",
 			"--artifacts", "player_handout",
 			"analyze",
 		},
 		&stdout,
 		&stderr,
@@ -170,20 +167,22 @@ scriptorium:
      output_path: artifacts/session_recap.md
      inputs:
        transcript:
-          source: narratio.transcript.trimmed
+          source: narratio.transcript.final_trimmed
          required: true
        previous_recap:
          source: narratio.previous_session.artifact.session_recap
          required: true
 `)
 	appendRestoreWorkflowScriptoriumConfig(t, sessionPath, `
 previous_session_id: 2026-04-26
 `)
 	fakeStore := &storage.FakeBackend{}
 	cfg, sessionPrefix, manifestKey, runIDKey := seedRestoreCommittedState(t, fakeStore, pipelinePath, campaignPath, sessionPath)
 	seedRestoreObject(fakeStore, runIDKey, []byte("20260519T010203Z-a1b2c3d4\n"))
 	seedRestoreObject(fakeStore, manifestKey, restoreWorkflowManifestJSON(t, cfg.Session.SessionID, cfg.Session.Campaign))
-	seedRestoreObject(fakeStore, sessionPrefix+"transcripts/trimmed.json", []byte(`{"segments":[]}`+"\n"))
+	seedRestoreObject(fakeStore, sessionPrefix+"transcripts/final.trimmed.json", []byte(`{"segments":[]}`+"\n"))
-	seedRestoreObject(fakeStore, sessionPrefix+"previous/manifest.json", []byte(`{"session_id":"2026-04-26"}`))
+	seedRestorePreviousCurrent(t, fakeStore, cfg, "# previous recap\n")
 	seedRestoreObject(fakeStore, sessionPrefix+"previous/artifacts/session_recap.md", []byte("# previous recap\n"))
 	restoreWithStoreAndRealPhases(t, fakeStore)
@@ -191,11 +190,10 @@ scriptorium:
 	var stderr bytes.Buffer
 	restoreCode := Execute(
 		[]string{
-			"restore",
+			"session", "restore", cfg.Session.SessionID,
 			"--config", pipelinePath,
-			"--campaign", campaignPath,
+			"--campaign-file", campaignPath,
 			"--session", sessionPath,
 			"--session-id", cfg.Session.SessionID,
 		},
 		&stdout,
 		&stderr,
@@ -208,8 +206,14 @@ scriptorium:
 	}
 	sessionRoot := artifacts.SessionWorkDirForCampaign(workspaceRoot, cfg.Session.Campaign, cfg.Session.SessionID)
-	mustReadEquals(t, filepath.Join(sessionRoot, "transcripts", "trimmed.json"), `{"segments":[]}`+"\n")
+	mustReadEquals(t, filepath.Join(sessionRoot, "transcripts", "final.trimmed.json"), `{"segments":[]}`+"\n")
-	mustReadEquals(t, filepath.Join(sessionRoot, "previous", "manifest.json"), `{"session_id":"2026-04-26"}`)
+	previousManifestBytes, err := os.ReadFile(filepath.Join(sessionRoot, "previous", "manifest.json"))
 	if err != nil {
 		t.Fatalf("read restored previous manifest: %v", err)
 	}
 	if !strings.Contains(string(previousManifestBytes), `"session_id":"2026-04-26"`) {
 		t.Fatalf("restored previous manifest = %q, want previous session id", string(previousManifestBytes))
 	}
 	mustReadEquals(t, filepath.Join(sessionRoot, "previous", "artifacts", "session_recap.md"), "# previous recap\n")
 	scriptoriumFake := &scriptorium.FakeRunner{}
@@ -236,14 +240,12 @@ scriptorium:
 	stderr.Reset()
 	runStageCode := Execute(
 		[]string{
-			"run-stage",
+			"run-stage", "analyze", cfg.Session.SessionID,
 			"--config", pipelinePath,
-			"--campaign", campaignPath,
+			"--campaign-file", campaignPath,
 			"--session", sessionPath,
 			"--session-id", cfg.Session.SessionID,
 			"--force",
 			"--artifacts", "session_recap",
 			"analyze",
 		},
 		&stdout,
 		&stderr,
@@ -261,7 +263,7 @@ scriptorium:
 		t.Fatalf("scriptorium run requests = %d, want 1", len(scriptoriumFake.RunRequests))
 	}
 	req := scriptoriumFake.RunRequests[0]
-	if got := req.InputPaths["transcript"]; got != filepath.Join(sessionRoot, "transcripts", "trimmed.json") {
+	if got := req.InputPaths["transcript"]; got != filepath.Join(sessionRoot, "transcripts", "final.trimmed.json") {
 		t.Fatalf("transcript input = %q, want trimmed transcript path", got)
 	}
 	if got := req.InputPaths["previous_recap"]; got != filepath.Join(sessionRoot, "previous", "artifacts", "session_recap.md") {
--- a/internal/app/resume.go
+++ b/internal/app/resume.go
@@ -16,31 +16,20 @@ func Resume(ctx context.Context, args []string, out io.Writer) error {
 	fs := flag.NewFlagSet("resume", flag.ContinueOnError)
 	fs.SetOutput(io.Discard)
-	var pipelinePath string
+	var flags commonConfigFlags
 	var campaignPath string
 	var sessionPath string
 	var sessionID string
 	var previousSessionID string
 	var force bool
 	var selectedArtifacts artifactSelectionFlag
-	fs.StringVar(&pipelinePath, "config", "", "path to pipeline.yml (optional; defaults searched)")
+	addCommonConfigFlags(fs, &flags)
 	fs.StringVar(&campaignPath, "campaign", "", "path to campaign.yml (optional; defaults searched)")
 	fs.StringVar(&sessionPath, "session", "", "path to session.yml")
 	fs.StringVar(&sessionID, "session-id", "", "session identifier for session.yml templates")
 	fs.StringVar(&previousSessionID, "previous-session-id", "", "previous session identifier for session.yml templates")
 	fs.BoolVar(&force, "force", false, "force stage execution")
-	fs.Var(&selectedArtifacts, "artifacts", "artifact names to execute during analyze (comma-separated or repeatable)")
+	fs.Var(&selectedArtifacts, "artifacts", "configured artifact names to execute and publish (comma-separated or repeatable)")
-	if err := fs.Parse(args); err != nil {
+	if err := parseSessionAwareFlags("resume", fs, args, &flags.sessionID); err != nil {
-		return fmt.Errorf("resume: invalid flags: %w", err)
+		return err
 	}
-	if fs.NArg() != 0 {
+	if flags.sessionID == "" {
-		return fmt.Errorf("resume: unexpected positional arguments")
+		return fmt.Errorf("resume: session_id is required")
 	}
-	cfg, err := loadCommandConfig(ctx, pipelinePath, campaignPath, sessionPath, config.SessionLoadOptions{
+	cfg, err := loadCommandConfig(ctx, flags.pipelinePath, flags.campaignPath, flags.campaignFilePath, flags.sessionPath, flags.sessionOptions())
 		SessionID:         sessionID,
 		PreviousSessionID: previousSessionID,
 	})
 	if err != nil {
 		return fmt.Errorf("resume: %w", err)
 	}
@@ -51,7 +40,7 @@ func Resume(ctx context.Context, args []string, out io.Writer) error {
 	if err != nil {
 		return fmt.Errorf("resume: invalid --artifacts: %w", err)
 	}
-	if err := validateSelectedAnalyzeArtifacts(cfg, normalizedArtifacts); err != nil {
+	if err := validateSelectedArtifacts(cfg, normalizedArtifacts); err != nil {
 		return fmt.Errorf("resume: %w", err)
 	}
--- a/internal/app/resume_run_stage_test.go
+++ b/internal/app/resume_run_stage_test.go
@@ -32,7 +32,7 @@ func TestResumeStartsAfterCompletedStages(t *testing.T) {
 	mustWriteTestFile(t, filepath.Join(workRoot, "inputs", "glossary.yml"), "terms: []\n")
 	var out bytes.Buffer
-	err := Resume(context.Background(), []string{"--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath}, &out)
+	err := Resume(context.Background(), []string{"2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath}, &out)
 	if err != nil {
 		t.Fatalf("Resume() error = %v", err)
 	}
@@ -56,7 +56,7 @@ func TestResumeNoRemainingStages(t *testing.T) {
 	store := &manifest.LocalStore{}
 	m := manifest.New("2026-05-03", time.Date(2026, 5, 3, 10, 0, 0, 0, time.UTC))
-	for _, name := range []string{"prepare", "transcribe", "merge", "polish", "normalize", "trim", "analyze", "archive", "notify"} {
+	for _, name := range []string{"prepare", "transcribe", "merge", "polish", "normalize", "trim", "analyze", "publish", "notify"} {
 		m.MarkStageSucceeded(name, time.Date(2026, 5, 3, 10, 1, 0, 0, time.UTC), nil)
 	}
 	if err := store.Save(context.Background(), manifestPath, m); err != nil {
@@ -64,7 +64,7 @@ func TestResumeNoRemainingStages(t *testing.T) {
 	}
 	var out bytes.Buffer
-	err := Resume(context.Background(), []string{"--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath}, &out)
+	err := Resume(context.Background(), []string{"2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath}, &out)
 	if err != nil {
 		t.Fatalf("Resume() error = %v", err)
 	}
@@ -85,7 +85,7 @@ func TestResumeForceRerunsSucceeded(t *testing.T) {
 	store := &manifest.LocalStore{}
 	m := manifest.New("2026-05-03", time.Date(2026, 5, 3, 10, 0, 0, 0, time.UTC))
-	for _, name := range []string{"prepare", "transcribe", "merge", "polish", "normalize", "trim", "analyze", "archive", "notify"} {
+	for _, name := range []string{"prepare", "transcribe", "merge", "polish", "normalize", "trim", "analyze", "publish", "notify"} {
 		m.MarkStageSucceeded(name, time.Date(2026, 5, 3, 10, 1, 0, 0, time.UTC), nil)
 	}
 	if err := store.Save(context.Background(), manifestPath, m); err != nil {
@@ -93,7 +93,7 @@ func TestResumeForceRerunsSucceeded(t *testing.T) {
 	}
 	var out bytes.Buffer
-	err := Resume(context.Background(), []string{"--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "--force"}, &out)
+	err := Resume(context.Background(), []string{"2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath, "--force"}, &out)
 	if err != nil {
 		t.Fatalf("Resume() error = %v", err)
 	}
@@ -107,11 +107,11 @@ func TestRunStageExecutesOnlySelectedStage(t *testing.T) {
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 	manifestPath := filepath.Join(workspaceRoot, "work", "sample-campaign", "2026-05-03", "manifest.json")
 	workRoot := filepath.Join(workspaceRoot, "work", "sample-campaign", "2026-05-03")
-	mustWriteTestFile(t, filepath.Join(workRoot, "transcripts", "merged.json"), `{"segments":[]}`)
+	mustWriteTestFile(t, filepath.Join(workRoot, "transcripts", "base.json"), `{"segments":[]}`)
 	mustWriteTestFile(t, filepath.Join(workRoot, "inputs", "glossary.yml"), "terms: []\n")
 	var out bytes.Buffer
-	err := RunStage(context.Background(), []string{"--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "polish"}, &out)
+	err := RunStage(context.Background(), []string{"polish", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath}, &out)
 	if err != nil {
 		t.Fatalf("RunStage() error = %v", err)
 	}
@@ -137,7 +137,7 @@ func TestRunStageSkipAndForce(t *testing.T) {
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 	manifestPath := filepath.Join(workspaceRoot, "work", "sample-campaign", "2026-05-03", "manifest.json")
 	workRoot := filepath.Join(workspaceRoot, "work", "sample-campaign", "2026-05-03")
-	mustWriteTestFile(t, filepath.Join(workRoot, "transcripts", "merged.json"), `{"segments":[]}`)
+	mustWriteTestFile(t, filepath.Join(workRoot, "transcripts", "base.json"), `{"segments":[]}`)
 	mustWriteTestFile(t, filepath.Join(workRoot, "inputs", "glossary.yml"), "terms: []\n")
 	store := &manifest.LocalStore{}
@@ -148,7 +148,7 @@ func TestRunStageSkipAndForce(t *testing.T) {
 	}
 	var out bytes.Buffer
-	err := RunStage(context.Background(), []string{"--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "polish"}, &out)
+	err := RunStage(context.Background(), []string{"polish", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath}, &out)
 	if err != nil {
 		t.Fatalf("RunStage() error = %v", err)
 	}
@@ -157,7 +157,7 @@ func TestRunStageSkipAndForce(t *testing.T) {
 	}
 	out.Reset()
-	err = RunStage(context.Background(), []string{"--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "--force", "polish"}, &out)
+	err = RunStage(context.Background(), []string{"polish", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath, "--force"}, &out)
 	if err != nil {
 		t.Fatalf("RunStage(force) error = %v", err)
 	}
@@ -171,12 +171,12 @@ func TestRunStageForceMarksDownstreamStaleAndResumeContinuesFromStale(t *testing
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 	manifestPath := filepath.Join(workspaceRoot, "work", "sample-campaign", "2026-05-03", "manifest.json")
 	workRoot := filepath.Join(workspaceRoot, "work", "sample-campaign", "2026-05-03")
-	mustWriteTestFile(t, filepath.Join(workRoot, "transcripts", "merged.json"), `{"segments":[]}`)
+	mustWriteTestFile(t, filepath.Join(workRoot, "transcripts", "base.json"), `{"segments":[]}`)
 	mustWriteTestFile(t, filepath.Join(workRoot, "inputs", "glossary.yml"), "terms: []\n")
 	store := &manifest.LocalStore{}
 	seed := manifest.New("2026-05-03", time.Date(2026, 5, 3, 10, 0, 0, 0, time.UTC))
-	for _, name := range []string{"prepare", "transcribe", "merge", "polish", "normalize", "trim", "analyze", "archive", "notify"} {
+	for _, name := range []string{"prepare", "transcribe", "merge", "polish", "normalize", "trim", "analyze", "publish", "notify"} {
 		seed.MarkStageSucceeded(name, time.Date(2026, 5, 3, 10, 1, 0, 0, time.UTC), nil)
 	}
 	if err := store.Save(context.Background(), manifestPath, seed); err != nil {
@@ -184,7 +184,7 @@ func TestRunStageForceMarksDownstreamStaleAndResumeContinuesFromStale(t *testing
 	}
 	var out bytes.Buffer
-	err := RunStage(context.Background(), []string{"--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "--force", "polish"}, &out)
+	err := RunStage(context.Background(), []string{"polish", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath, "--force"}, &out)
 	if err != nil {
 		t.Fatalf("RunStage(force) error = %v", err)
 	}
@@ -196,14 +196,14 @@ func TestRunStageForceMarksDownstreamStaleAndResumeContinuesFromStale(t *testing
 	if err != nil {
 		t.Fatalf("load manifest after force: %v", err)
 	}
-	for _, name := range []string{"normalize", "trim", "analyze", "archive", "notify"} {
+	for _, name := range []string{"normalize", "trim", "analyze", "publish", "notify"} {
 		if afterForce.Stages[name] == nil || afterForce.Stages[name].Status != manifest.StatusStale {
 			t.Fatalf("stage %q = %#v, want stale", name, afterForce.Stages[name])
 		}
 	}
 	out.Reset()
-	err = Resume(context.Background(), []string{"--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath}, &out)
+	err = Resume(context.Background(), []string{"2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath}, &out)
 	if err != nil {
 		t.Fatalf("Resume() error = %v", err)
 	}
@@ -217,10 +217,10 @@ func TestRunStageTrimExecutes(t *testing.T) {
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 	manifestPath := filepath.Join(workspaceRoot, "work", "sample-campaign", "2026-05-03", "manifest.json")
 	workRoot := filepath.Join(workspaceRoot, "work", "sample-campaign", "2026-05-03")
-	mustWriteTestFile(t, filepath.Join(workRoot, "transcripts", "normalized.json"), `{"segments":[{"id":1},{"id":2}]}`)
+	mustWriteTestFile(t, filepath.Join(workRoot, "transcripts", "final.json"), `{"segments":[{"id":1},{"id":2}]}`)
 	var out bytes.Buffer
-	err := RunStage(context.Background(), []string{"--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "trim"}, &out)
+	err := RunStage(context.Background(), []string{"trim", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath}, &out)
 	if err != nil {
 		t.Fatalf("RunStage(trim) error = %v", err)
 	}
@@ -246,10 +246,10 @@ func TestRunStageNormalizeExecutes(t *testing.T) {
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 	manifestPath := filepath.Join(workspaceRoot, "work", "sample-campaign", "2026-05-03", "manifest.json")
 	workRoot := filepath.Join(workspaceRoot, "work", "sample-campaign", "2026-05-03")
-	mustWriteTestFile(t, filepath.Join(workRoot, "transcripts", "processed.json"), `{"segments":[{"id":1},{"id":2}]}`)
+	mustWriteTestFile(t, filepath.Join(workRoot, "transcripts", "polished.json"), `{"segments":[{"id":1},{"id":2}]}`)
 	var out bytes.Buffer
-	err := RunStage(context.Background(), []string{"--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "normalize"}, &out)
+	err := RunStage(context.Background(), []string{"normalize", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath}, &out)
 	if err != nil {
 		t.Fatalf("RunStage(normalize) error = %v", err)
 	}
--- a/internal/app/run.go
+++ b/internal/app/run.go
@@ -14,31 +14,20 @@ func Run(ctx context.Context, args []string, out io.Writer) error {
 	fs := flag.NewFlagSet("run", flag.ContinueOnError)
 	fs.SetOutput(io.Discard)
-	var pipelinePath string
+	var flags commonConfigFlags
 	var campaignPath string
 	var sessionPath string
 	var sessionID string
 	var previousSessionID string
 	var force bool
 	var selectedArtifacts artifactSelectionFlag
-	fs.StringVar(&pipelinePath, "config", "", "path to pipeline.yml (optional; defaults searched)")
+	addCommonConfigFlags(fs, &flags)
 	fs.StringVar(&campaignPath, "campaign", "", "path to campaign.yml (optional; defaults searched)")
 	fs.StringVar(&sessionPath, "session", "", "path to session.yml")
 	fs.StringVar(&sessionID, "session-id", "", "session identifier for session.yml templates")
 	fs.StringVar(&previousSessionID, "previous-session-id", "", "previous session identifier for session.yml templates")
 	fs.BoolVar(&force, "force", false, "force stage execution (reserved for future behavior)")
-	fs.Var(&selectedArtifacts, "artifacts", "artifact names to execute during analyze (comma-separated or repeatable)")
+	fs.Var(&selectedArtifacts, "artifacts", "configured artifact names to execute and publish (comma-separated or repeatable)")
-	if err := fs.Parse(args); err != nil {
+	if err := parseSessionAwareFlags("run", fs, args, &flags.sessionID); err != nil {
-		return fmt.Errorf("run: invalid flags: %w", err)
+		return err
 	}
-	if fs.NArg() != 0 {
+	if flags.sessionID == "" {
-		return fmt.Errorf("run: unexpected positional arguments")
+		return fmt.Errorf("run: session_id is required")
 	}
-	cfg, err := loadCommandConfig(ctx, pipelinePath, campaignPath, sessionPath, config.SessionLoadOptions{
+	cfg, err := loadCommandConfig(ctx, flags.pipelinePath, flags.campaignPath, flags.campaignFilePath, flags.sessionPath, flags.sessionOptions())
 		SessionID:         sessionID,
 		PreviousSessionID: previousSessionID,
 	})
 	if err != nil {
 		return fmt.Errorf("run: %w", err)
 	}
@@ -49,7 +38,7 @@ func Run(ctx context.Context, args []string, out io.Writer) error {
 	if err != nil {
 		return fmt.Errorf("run: invalid --artifacts: %w", err)
 	}
-	if err := validateSelectedAnalyzeArtifacts(cfg, normalizedArtifacts); err != nil {
+	if err := validateSelectedArtifacts(cfg, normalizedArtifacts); err != nil {
 		return fmt.Errorf("run: %w", err)
 	}
--- a/internal/app/run_control_test.go
+++ b/internal/app/run_control_test.go
@@ -44,7 +44,7 @@ func TestDecideStageActions(t *testing.T) {
 func TestDownstreamStageNames(t *testing.T) {
 	got := downstreamStageNames("polish")
-	want := []string{"normalize", "trim", "analyze", "archive", "notify"}
+	want := []string{"normalize", "trim", "analyze", "publish", "notify"}
 	if !reflect.DeepEqual(got, want) {
 		t.Fatalf("downstreamStageNames(polish) = %#v, want %#v", got, want)
 	}
@@ -65,11 +65,11 @@ func TestInvalidateDownstreamSucceededStages(t *testing.T) {
 	m.MarkStageSucceeded("normalize", now, nil)
 	m.MarkStageSucceeded("trim", now, nil)
 	m.MarkStageFailed("analyze", now, "analysis failed")
-	m.MarkStageSucceeded("archive", now, nil)
+	m.MarkStageSucceeded("publish", now, nil)
 	m.MarkStageSucceeded("notify", now, nil)
 	got := invalidateDownstreamSucceededStages(m, "polish", now.Add(1*time.Second))
-	want := []string{"normalize", "trim", "archive", "notify"}
+	want := []string{"normalize", "trim", "publish", "notify"}
 	if !reflect.DeepEqual(got, want) {
 		t.Fatalf("invalidateDownstreamSucceededStages() = %#v, want %#v", got, want)
 	}
--- a/internal/app/run_stage.go
+++ b/internal/app/run_stage.go
@@ -5,53 +5,73 @@ import (
 	"flag"
 	"fmt"
 	"io"
 	"strings"
 	"gitea.maximumdirect.net/eric/narratio/internal/config"
 )
 // RunStage executes exactly one selected stage.
 func RunStage(ctx context.Context, args []string, out io.Writer) error {
 	var stageName string
 	var positionalSessionID string
 	if len(args) >= 2 && !isCLIFlagToken(args[0]) && !isCLIFlagToken(args[1]) {
 		stageName = strings.TrimSpace(args[0])
 		positionalSessionID = strings.TrimSpace(args[1])
 		args = append([]string(nil), args[2:]...)
 	}
 	fs := flag.NewFlagSet("run-stage", flag.ContinueOnError)
 	fs.SetOutput(io.Discard)
-	var pipelinePath string
+	var flags commonConfigFlags
 	var campaignPath string
 	var sessionPath string
 	var sessionID string
 	var previousSessionID string
 	var force bool
 	var selectedArtifacts artifactSelectionFlag
-	fs.StringVar(&pipelinePath, "config", "", "path to pipeline.yml (optional; defaults searched)")
+	addCommonConfigFlags(fs, &flags)
 	fs.StringVar(&campaignPath, "campaign", "", "path to campaign.yml (optional; defaults searched)")
 	fs.StringVar(&sessionPath, "session", "", "path to session.yml")
 	fs.StringVar(&sessionID, "session-id", "", "session identifier for session.yml templates")
 	fs.StringVar(&previousSessionID, "previous-session-id", "", "previous session identifier for session.yml templates")
 	fs.BoolVar(&force, "force", false, "force stage execution (reserved for future behavior)")
-	fs.Var(&selectedArtifacts, "artifacts", "artifact names to execute during analyze (comma-separated or repeatable)")
+	fs.Var(&selectedArtifacts, "artifacts", "configured artifact names to execute or publish (comma-separated or repeatable)")
 	if err := fs.Parse(args); err != nil {
 		return fmt.Errorf("run-stage: invalid flags: %w", err)
 	}
-	if fs.NArg() != 1 {
+	if stageName == "" {
-		return fmt.Errorf("run-stage: expected exactly one stage name")
+		switch fs.NArg() {
 		case 2:
 			stageName = strings.TrimSpace(fs.Arg(0))
 			positionalSessionID = strings.TrimSpace(fs.Arg(1))
 		case 1:
 			if strings.TrimSpace(flags.sessionID) == "" {
 				return fmt.Errorf("run-stage: expected stage name and session_id")
 			}
 			stageName = strings.TrimSpace(fs.Arg(0))
 		default:
 			return fmt.Errorf("run-stage: expected stage name and session_id")
 		}
 	} else if fs.NArg() != 0 {
 		return fmt.Errorf("run-stage: unexpected positional arguments")
 	}
 	if err := applyPositionalSessionID("run-stage", positionalSessionID, &flags.sessionID); err != nil {
 		return err
 	}
 	if strings.TrimSpace(flags.sessionID) == "" {
 		return fmt.Errorf("run-stage: session_id is required")
 	}
 	normalizedArtifacts, err := selectedArtifacts.Normalize()
 	if err != nil {
 		return fmt.Errorf("run-stage: invalid --artifacts: %w", err)
 	}
-	stageName := fs.Arg(0)
+	if len(normalizedArtifacts) > 0 && stageName != "analyze" && stageName != "publish" {
-	if len(normalizedArtifacts) > 0 && stageName != "analyze" {
+		return fmt.Errorf("run-stage: --artifacts is only supported for stages \"analyze\" and \"publish\"")
 		return fmt.Errorf("run-stage: --artifacts is only supported for stage \"analyze\"")
 	}
 	summary, err := runSingleStageCommand(ctx, singleStageCommand{
 		CommandName:       "run-stage",
 		StageName:         stageName,
-		PipelinePath:      pipelinePath,
+		PipelinePath:      flags.pipelinePath,
-		CampaignPath:      campaignPath,
+		CampaignPath:      flags.campaignPath,
-		SessionPath:       sessionPath,
+		CampaignFilePath:  flags.campaignFilePath,
-		SessionID:         sessionID,
+		SessionPath:       flags.sessionPath,
-		PreviousSessionID: previousSessionID,
+		SessionID:         flags.sessionID,
 		PreviousSessionID: flags.previousSessionID,
 		Force:             force,
 		SelectedArtifacts: normalizedArtifacts,
 	})
@@ -76,24 +96,16 @@ func Analyze(ctx context.Context, args []string, out io.Writer) error {
 	fs := flag.NewFlagSet("analyze", flag.ContinueOnError)
 	fs.SetOutput(io.Discard)
-	var pipelinePath string
+	var flags commonConfigFlags
 	var campaignPath string
 	var sessionPath string
 	var sessionID string
 	var previousSessionID string
 	var selectedArtifacts artifactSelectionFlag
-	fs.StringVar(&pipelinePath, "config", "", "path to pipeline.yml (optional; defaults searched)")
+	addCommonConfigFlags(fs, &flags)
-	fs.StringVar(&campaignPath, "campaign", "", "path to campaign.yml (optional; defaults searched)")
+	fs.Var(&selectedArtifacts, "artifacts", "configured artifact names to execute during analyze (comma-separated or repeatable)")
 	fs.StringVar(&sessionPath, "session", "", "path to session.yml")
 	fs.StringVar(&sessionID, "session-id", "", "session identifier for session.yml templates")
 	fs.StringVar(&previousSessionID, "previous-session-id", "", "previous session identifier for session.yml templates")
 	fs.Var(&selectedArtifacts, "artifacts", "artifact names to execute during analyze (comma-separated or repeatable)")
-	if err := fs.Parse(args); err != nil {
+	if err := parseSessionAwareFlags("analyze", fs, args, &flags.sessionID); err != nil {
-		return fmt.Errorf("analyze: invalid flags: %w", err)
+		return err
 	}
-	if fs.NArg() != 0 {
+	if strings.TrimSpace(flags.sessionID) == "" {
-		return fmt.Errorf("analyze: unexpected positional arguments")
+		return fmt.Errorf("analyze: session_id is required")
 	}
 	normalizedArtifacts, err := selectedArtifacts.Normalize()
 	if err != nil {
@@ -103,11 +115,12 @@ func Analyze(ctx context.Context, args []string, out io.Writer) error {
 	summary, err := runSingleStageCommand(ctx, singleStageCommand{
 		CommandName:       "analyze",
 		StageName:         "analyze",
-		PipelinePath:      pipelinePath,
+		PipelinePath:      flags.pipelinePath,
-		CampaignPath:      campaignPath,
+		CampaignPath:      flags.campaignPath,
-		SessionPath:       sessionPath,
+		CampaignFilePath:  flags.campaignFilePath,
-		SessionID:         sessionID,
+		SessionPath:       flags.sessionPath,
-		PreviousSessionID: previousSessionID,
+		SessionID:         flags.sessionID,
 		PreviousSessionID: flags.previousSessionID,
 		Force:             true,
 		SelectedArtifacts: normalizedArtifacts,
 	})
@@ -125,11 +138,59 @@ func Analyze(ctx context.Context, args []string, out io.Writer) error {
 	return err
 }
 // Publish force-runs the publish stage.
 func Publish(ctx context.Context, args []string, out io.Writer) error {
 	fs := flag.NewFlagSet("publish", flag.ContinueOnError)
 	fs.SetOutput(io.Discard)
 	var flags commonConfigFlags
 	var selectedArtifacts artifactSelectionFlag
 	addCommonConfigFlags(fs, &flags)
 	fs.Var(&selectedArtifacts, "artifacts", "configured artifact names to publish (comma-separated or repeatable)")
 	if err := parseSessionAwareFlags("publish", fs, args, &flags.sessionID); err != nil {
 		return err
 	}
 	if strings.TrimSpace(flags.sessionID) == "" {
 		return fmt.Errorf("publish: session_id is required")
 	}
 	normalizedArtifacts, err := selectedArtifacts.Normalize()
 	if err != nil {
 		return fmt.Errorf("publish: invalid --artifacts: %w", err)
 	}
 	summary, err := runSingleStageCommand(ctx, singleStageCommand{
 		CommandName:       "publish",
 		StageName:         "publish",
 		PipelinePath:      flags.pipelinePath,
 		CampaignPath:      flags.campaignPath,
 		CampaignFilePath:  flags.campaignFilePath,
 		SessionPath:       flags.sessionPath,
 		SessionID:         flags.sessionID,
 		PreviousSessionID: flags.previousSessionID,
 		Force:             true,
 		SelectedArtifacts: normalizedArtifacts,
 	})
 	if err != nil {
 		return err
 	}
 	_, err = fmt.Fprintf(
 		out,
 		"narratio publish: executed=%d skipped=%d force=true; manifest=%s\n",
 		len(summary.Executed),
 		len(summary.Skipped),
 		summary.ManifestPath,
 	)
 	return err
 }
 type singleStageCommand struct {
 	CommandName       string
 	StageName         string
 	PipelinePath      string
 	CampaignPath      string
 	CampaignFilePath  string
 	SessionPath       string
 	SessionID         string
 	PreviousSessionID string
@@ -143,7 +204,7 @@ func runSingleStageCommand(ctx context.Context, req singleStageCommand) (*RunSum
 		return nil, fmt.Errorf("%s: %w", req.CommandName, err)
 	}
-	cfg, err := loadCommandConfig(ctx, req.PipelinePath, req.CampaignPath, req.SessionPath, config.SessionLoadOptions{
+	cfg, err := loadCommandConfig(ctx, req.PipelinePath, req.CampaignPath, req.CampaignFilePath, req.SessionPath, config.SessionLoadOptions{
 		SessionID:         req.SessionID,
 		PreviousSessionID: req.PreviousSessionID,
 	})
@@ -153,7 +214,7 @@ func runSingleStageCommand(ctx context.Context, req singleStageCommand) (*RunSum
 	if err := config.Validate(cfg); err != nil {
 		return nil, fmt.Errorf("%s: %w", req.CommandName, err)
 	}
-	if err := validateSelectedAnalyzeArtifacts(cfg, req.SelectedArtifacts); err != nil {
+	if err := validateSelectedArtifacts(cfg, req.SelectedArtifacts); err != nil {
 		return nil, fmt.Errorf("%s: %w", req.CommandName, err)
 	}
--- a/internal/app/runner.go
+++ b/internal/app/runner.go
@@ -46,7 +46,7 @@ func executeStages(ctx context.Context, cfg *config.Config, stages []stage.Stage
 	if env.Config == nil {
 		env.Config = cfg
 	}
-	env.SelectedAnalyzeArtifacts = append([]string(nil), opts.SelectedArtifacts...)
+	env.SelectedArtifactKeys = append([]string(nil), opts.SelectedArtifacts...)
 	if env.ArtifactStore == nil {
 		env.ArtifactStore = artifacts.NewLocalStore(cfg.Pipeline.Workspace.Root)
 	}
@@ -96,7 +96,7 @@ func executeStages(ctx context.Context, cfg *config.Config, stages []stage.Stage
 	if needsRemoteLocksForRun(env.Config, stages) {
 		locks, err := loadEffectiveLocks(ctx, env.Config, env.ObjectStore)
 		if err != nil {
-			return nil, fmt.Errorf("load remote archive locks: %w", err)
+			return nil, fmt.Errorf("load remote publish locks: %w", err)
 		}
 		applyEffectiveLocks(env.Config, locks.All)
 	}
@@ -234,14 +234,14 @@ func executeStages(ctx context.Context, cfg *config.Config, stages []stage.Stage
 		env.Logger.Info("stage succeeded", "stage", s.Name())
 	}
-	if err := runPostArchiveCleanup(ctx, env, manifestPath, m, executed); err != nil {
+	if err := runPostPublishCleanup(ctx, env, manifestPath, m, executed); err != nil {
 		failedAt := nowUTC()
 		runManifest.MarkFailed(failedAt, err.Error())
 		syncRunManifestIdentityFromSession(m, runManifest)
 		if saveErr := runManifestStore.SaveRun(ctx, runManifestPath, runManifest); saveErr != nil {
-			return nil, fmt.Errorf("post-archive cleanup failed (%v) and run-manifest save failed (%v)", err, saveErr)
+			return nil, fmt.Errorf("post-publish cleanup failed (%v) and run-manifest save failed (%v)", err, saveErr)
 		}
-		return nil, fmt.Errorf("post-archive cleanup: %w", err)
+		return nil, fmt.Errorf("post-publish cleanup: %w", err)
 	}
 	completedAt := nowUTC()
 	runManifest.MarkSucceeded(completedAt)
@@ -568,16 +568,16 @@ func needsObjectStoreForRun(cfg *config.Config, stages []stage.Stage) bool {
 			return true
 		}
 	}
-	if !stageRequested("archive") {
+	if !stageRequested("publish") {
 		return false
 	}
-	if cfg.Pipeline.Archive == nil {
+	if cfg.Pipeline.Publish == nil {
 		return false
 	}
-	if cfg.Pipeline.Archive.Enabled != nil && !*cfg.Pipeline.Archive.Enabled {
+	if cfg.Pipeline.Publish.Enabled != nil && !*cfg.Pipeline.Publish.Enabled {
 		return false
 	}
-	if cfg.Pipeline.Archive.UploadRun != nil && !*cfg.Pipeline.Archive.UploadRun {
+	if cfg.Pipeline.Publish.UploadRun != nil && !*cfg.Pipeline.Publish.UploadRun {
 		return false
 	}
 	return true
@@ -587,23 +587,23 @@ func needsRemoteLocksForRun(cfg *config.Config, stages []stage.Stage) bool {
 	if cfg == nil || cfg.Pipeline == nil || cfg.Session == nil {
 		return false
 	}
-	archiveRequested := false
+	publishRequested := false
 	for _, s := range stages {
-		if s != nil && s.Name() == "archive" {
+		if s != nil && s.Name() == "publish" {
-			archiveRequested = true
+			publishRequested = true
 			break
 		}
 	}
-	if !archiveRequested {
+	if !publishRequested {
 		return false
 	}
-	if cfg.Pipeline.Archive == nil {
+	if cfg.Pipeline.Publish == nil {
 		return false
 	}
-	if cfg.Pipeline.Archive.Enabled != nil && !*cfg.Pipeline.Archive.Enabled {
+	if cfg.Pipeline.Publish.Enabled != nil && !*cfg.Pipeline.Publish.Enabled {
 		return false
 	}
-	if cfg.Pipeline.Archive.UploadRun != nil && !*cfg.Pipeline.Archive.UploadRun {
+	if cfg.Pipeline.Publish.UploadRun != nil && !*cfg.Pipeline.Publish.UploadRun {
 		return false
 	}
 	return cfg.Pipeline.Storage.S3 != nil
--- a/internal/app/runner_test.go
+++ b/internal/app/runner_test.go
@@ -54,7 +54,7 @@ func (s captureSelectedArtifactsStage) Name() string           { return s.name }
 func (s captureSelectedArtifactsStage) Declares() stage.IODecl { return stage.IODecl{} }
 func (s captureSelectedArtifactsStage) Run(_ context.Context, env *stage.Env, _ *manifest.Manifest) (*stage.StageResult, error) {
 	if s.captured != nil {
-		*s.captured = append((*s.captured)[:0], env.SelectedAnalyzeArtifacts...)
+		*s.captured = append((*s.captured)[:0], env.SelectedArtifactKeys...)
 	}
 	return &stage.StageResult{Metadata: map[string]any{"captured": true}}, nil
 }
@@ -78,12 +78,12 @@ type selectedAnalyzeArtifactStage struct {
 func (s selectedAnalyzeArtifactStage) Name() string           { return "analyze" }
 func (s selectedAnalyzeArtifactStage) Declares() stage.IODecl { return stage.IODecl{} }
 func (s selectedAnalyzeArtifactStage) Run(_ context.Context, env *stage.Env, m *manifest.Manifest) (*stage.StageResult, error) {
-	if len(env.SelectedAnalyzeArtifacts) != len(s.expected) {
+	if len(env.SelectedArtifactKeys) != len(s.expected) {
-		return nil, fmt.Errorf("selected artifacts len = %d, want %d", len(env.SelectedAnalyzeArtifacts), len(s.expected))
+		return nil, fmt.Errorf("selected artifacts len = %d, want %d", len(env.SelectedArtifactKeys), len(s.expected))
 	}
 	for i := range s.expected {
-		if env.SelectedAnalyzeArtifacts[i] != s.expected[i] {
+		if env.SelectedArtifactKeys[i] != s.expected[i] {
-			return nil, fmt.Errorf("selected artifacts[%d] = %q, want %q", i, env.SelectedAnalyzeArtifacts[i], s.expected[i])
+			return nil, fmt.Errorf("selected artifacts[%d] = %q, want %q", i, env.SelectedArtifactKeys[i], s.expected[i])
 		}
 	}
@@ -248,16 +248,16 @@ func TestNeedsObjectStoreForRunPrepareWithPreviousRequirements(t *testing.T) {
 	}
 }
-func TestExecuteStagesArchiveFailsWhenRequiredRecapPromotionMissingForSelectedArtifacts(t *testing.T) {
+func TestExecuteStagesPublishSkipsRequiredUnselectedConfiguredOutput(t *testing.T) {
 	cfg := testConfig(t)
 	cfg.Pipeline.Storage.S3 = &config.StorageS3Config{
 		Bucket:     "my-dnd-archive",
 		RootPrefix: "dnd",
 	}
-	cfg.Pipeline.Archive = &config.ArchiveConfig{
+	cfg.Pipeline.Publish = &config.PublishConfig{
 		Enabled:   boolPtr(true),
 		UploadRun: boolPtr(true),
-		PromoteArtifacts: []config.ArchivePromotionRule{
+		Outputs: []config.PublishOutputRule{
 			{Source: "narratio.artifact.session_recap", Dest: "artifacts/session_recap.md", Required: boolPtr(true)},
 		},
 	}
@@ -283,28 +283,45 @@ func TestExecuteStagesArchiveFailsWhenRequiredRecapPromotionMissingForSelectedAr
 		t.Fatalf("Save manifest error = %v", err)
 	}
-	archiveStageImpl, err := stage.Select("archive")
+	publishStageImpl, err := stage.Select("publish")
 	if err != nil {
-		t.Fatalf("Select(archive) error = %v", err)
+		t.Fatalf("Select(publish) error = %v", err)
 	}
-	_, err = executeStages(
+	summary, err := executeStages(
 		context.Background(),
 		cfg,
 		[]stage.Stage{
 			selectedAnalyzeArtifactStage{expected: []string{"player_handout"}},
-			archiveStageImpl,
+			publishStageImpl,
 		},
 		RunOptions{
 			SelectedArtifacts: []string{"player_handout"},
 			Env:               &Env{ObjectStore: &storage.FakeBackend{}},
 		},
 	)
-	if err == nil {
+	if err != nil {
-		t.Fatal("expected archive promotion failure, got nil")
+		t.Fatalf("executeStages() error = %v", err)
 	}
-	if !strings.Contains(err.Error(), "required promotion source unavailable") {
+	if len(summary.Executed) != 2 || summary.Executed[0] != "analyze" || summary.Executed[1] != "publish" {
-		t.Fatalf("error = %q, want required promotion source unavailable", err.Error())
+		t.Fatalf("executed = %#v, want analyze and publish", summary.Executed)
 	}
 	loadedManifest, err := store.Load(context.Background(), summary.ManifestPath)
 	if err != nil {
 		t.Fatalf("Load manifest error = %v", err)
 	}
 	meta := loadedManifest.Stages["publish"].Metadata
 	skipped, ok := meta["skipped_unselected_outputs"].([]any)
 	if !ok || len(skipped) != 1 {
 		t.Fatalf("skipped_unselected_outputs = %#v, want one item", meta["skipped_unselected_outputs"])
 	}
 	item, ok := skipped[0].(map[string]any)
 	if !ok {
 		t.Fatalf("skipped item = %#v, want object", skipped[0])
 	}
 	if item["source"] != "narratio.artifact.session_recap" || item["dest"] != "artifacts/session_recap.md" || item["required"] != true {
 		t.Fatalf("skipped item = %#v, want required session_recap published output", item)
 	}
 }
@@ -325,7 +342,7 @@ func TestExecuteStagesPlaceholderSuccessUpdatesManifest(t *testing.T) {
 		t.Fatalf("Load manifest error = %v", err)
 	}
-	for _, name := range []string{"prepare", "transcribe", "merge", "polish", "normalize", "trim", "analyze", "archive", "notify"} {
+	for _, name := range []string{"prepare", "transcribe", "merge", "polish", "normalize", "trim", "analyze", "publish", "notify"} {
 		sr := m.Stages[name]
 		if sr == nil {
 			t.Fatalf("missing stage record %q", name)
@@ -408,12 +425,12 @@ func TestExecuteStagesPlaceholderSuccessUpdatesManifest(t *testing.T) {
 			}
 			continue
 		}
-		if name == "archive" {
+		if name == "publish" {
-			if sr.Metadata == nil || sr.Metadata["stage"] != "archive" {
+			if sr.Metadata == nil || sr.Metadata["stage"] != "publish" {
-				t.Fatalf("archive metadata missing stage=archive: %#v", sr.Metadata)
+				t.Fatalf("publish metadata missing stage=publish: %#v", sr.Metadata)
 			}
 			if sr.Metadata["skipped"] != true {
-				t.Fatalf("archive metadata missing skipped=true for test config without archive section: %#v", sr.Metadata)
+				t.Fatalf("publish metadata missing skipped=true for test config without publish section: %#v", sr.Metadata)
 			}
 			continue
 		}
@@ -505,7 +522,7 @@ func TestExecuteStagesForceSuccessInvalidatesDownstreamSucceededStages(t *testin
 	store := &manifest.LocalStore{}
 	existing := manifest.New(cfg.Session.SessionID, time.Date(2026, 5, 3, 1, 0, 0, 0, time.UTC))
-	for _, stageName := range []string{"prepare", "transcribe", "merge", "polish", "normalize", "trim", "archive", "notify"} {
+	for _, stageName := range []string{"prepare", "transcribe", "merge", "polish", "normalize", "trim", "publish", "notify"} {
 		existing.MarkStageSucceeded(stageName, time.Date(2026, 5, 3, 1, 1, 0, 0, time.UTC), nil)
 	}
 	existing.MarkStageFailed("analyze", time.Date(2026, 5, 3, 1, 1, 0, 0, time.UTC), "previous analyze failure")
@@ -536,7 +553,7 @@ func TestExecuteStagesForceSuccessInvalidatesDownstreamSucceededStages(t *testin
 	if loaded.Stages["polish"] == nil || loaded.Stages["polish"].Status != manifest.StatusSucceeded {
 		t.Fatalf("polish status = %#v, want succeeded", loaded.Stages["polish"])
 	}
-	for _, stageName := range []string{"normalize", "trim", "archive", "notify"} {
+	for _, stageName := range []string{"normalize", "trim", "publish", "notify"} {
 		if loaded.Stages[stageName] == nil || loaded.Stages[stageName].Status != manifest.StatusStale {
 			t.Fatalf("%s status = %#v, want stale", stageName, loaded.Stages[stageName])
 		}
@@ -712,7 +729,7 @@ func TestExecuteStagesRunManifestRecordsSkippedStage(t *testing.T) {
 	}
 }
-func TestExecuteStagesRunLocalArtifactsAndCanonicalPromotion(t *testing.T) {
+func TestExecuteStagesRunLocalArtifactsAndCanonicalSync(t *testing.T) {
 	cfg := testConfig(t)
 	stages := []stage.Stage{
 		BuildFullPlan()[0], // prepare
@@ -744,7 +761,7 @@ func TestExecuteStagesRunLocalArtifactsAndCanonicalPromotion(t *testing.T) {
 		filepath.Join(runRoot, "merge", "logs", "seriatim.stdout.log"),
 		filepath.Join(runRoot, "polish", "config", "audita.generated.yml"),
 		filepath.Join(runRoot, "normalize", "logs", "seriatim.normalize.stdout.log"),
-		filepath.Join(runRoot, "trim", "outputs", "transcripts", "trimmed.json"),
+		filepath.Join(runRoot, "trim", "outputs", "transcripts", "final.trimmed.json"),
 	}
 	for _, p := range runLocalChecks {
 		if _, statErr := os.Stat(p); statErr != nil {
@@ -754,14 +771,14 @@ func TestExecuteStagesRunLocalArtifactsAndCanonicalPromotion(t *testing.T) {
 	canonicalChecks := []string{
 		filepath.Join(paths.TranscriptsRawDir, "alice.json"),
-		filepath.Join(paths.TranscriptsDir, "merged.json"),
+		filepath.Join(paths.TranscriptsDir, "base.json"),
-		filepath.Join(paths.TranscriptsDir, "processed.json"),
+		filepath.Join(paths.TranscriptsDir, "polished.json"),
-		filepath.Join(paths.TranscriptsDir, "normalized.json"),
+		filepath.Join(paths.TranscriptsDir, "final.json"),
-		filepath.Join(paths.TranscriptsDir, "trimmed.json"),
+		filepath.Join(paths.TranscriptsDir, "final.trimmed.json"),
 	}
 	for _, p := range canonicalChecks {
 		if _, statErr := os.Stat(p); statErr != nil {
-			t.Fatalf("canonical promoted artifact missing at %q: %v", p, statErr)
+			t.Fatalf("canonical published artifact missing at %q: %v", p, statErr)
 		}
 	}
@@ -847,7 +864,7 @@ func TestAdapterBackedStageFailureMarksManifestFailed(t *testing.T) {
 		{name: "merge", env: &Env{Seriatim: &seriatim.FakeRunner{Err: errors.New("merge fail")}}},
 		{name: "polish", env: &Env{Audita: &audita.FakeRunner{Err: errors.New("polish fail")}}},
 		{name: "analyze", env: &Env{Scriptorium: &scriptorium.FakeRunner{RunErr: errors.New("analyze fail")}}},
-		{name: "archive", env: &Env{ObjectStore: &storage.FakeBackend{UploadErr: errors.New("archive fail")}}},
+		{name: "publish", env: &Env{ObjectStore: &storage.FakeBackend{UploadErr: errors.New("publish fail")}}},
 		{name: "notify", env: &Env{Notifier: &notify.FakeSender{Err: errors.New("notify fail")}}},
 	}
@@ -902,7 +919,7 @@ func TestAdapterBackedStageFailureMarksManifestFailed(t *testing.T) {
 				if ensureErr != nil {
 					t.Fatalf("EnsureLayout() error = %v", ensureErr)
 				}
-				if err := os.WriteFile(filepath.Join(paths.TranscriptsDir, "merged.json"), []byte(`{"segments":[]}`), 0o644); err != nil {
+				if err := os.WriteFile(filepath.Join(paths.TranscriptsDir, "base.json"), []byte(`{"segments":[]}`), 0o644); err != nil {
 					t.Fatalf("write merged transcript: %v", err)
 				}
 				if err := os.WriteFile(filepath.Join(paths.InputsDir, "glossary.yml"), []byte("terms: []\n"), 0o644); err != nil {
@@ -914,7 +931,7 @@ func TestAdapterBackedStageFailureMarksManifestFailed(t *testing.T) {
 				if ensureErr != nil {
 					t.Fatalf("EnsureLayout() error = %v", ensureErr)
 				}
-				if err := os.WriteFile(filepath.Join(paths.TranscriptsDir, "processed.json"), []byte(`{"segments":[]}`), 0o644); err != nil {
+				if err := os.WriteFile(filepath.Join(paths.TranscriptsDir, "polished.json"), []byte(`{"segments":[]}`), 0o644); err != nil {
 					t.Fatalf("write processed transcript: %v", err)
 				}
 				cfg.Pipeline.Scriptorium = &config.ScriptoriumConfig{
@@ -932,8 +949,8 @@ func TestAdapterBackedStageFailureMarksManifestFailed(t *testing.T) {
 					},
 				}
 			}
-			if tc.name == "archive" {
+			if tc.name == "publish" {
-				cfg.Pipeline.Archive = &config.ArchiveConfig{
+				cfg.Pipeline.Publish = &config.PublishConfig{
 					Enabled:   boolPtr(true),
 					UploadRun: boolPtr(true),
 				}
@@ -944,13 +961,13 @@ func TestAdapterBackedStageFailureMarksManifestFailed(t *testing.T) {
 				runID := "20260516T010203Z-0a1b2c3d"
 				runWorkDir := filepath.Join(cfg.Pipeline.Workspace.Root, "work", cfg.Session.Campaign, cfg.Session.SessionID, runID)
 				if err := os.MkdirAll(filepath.Join(runWorkDir, "inputs"), 0o755); err != nil {
-					t.Fatalf("mkdir archive inputs dir: %v", err)
+					t.Fatalf("mkdir publish inputs dir: %v", err)
 				}
 				if err := os.WriteFile(filepath.Join(runWorkDir, "inputs", "session.yml"), []byte("session_id: 2026-05-03\n"), 0o644); err != nil {
-					t.Fatalf("write archive fixture session.yml: %v", err)
+					t.Fatalf("write publish fixture session.yml: %v", err)
 				}
 				if err := os.WriteFile(filepath.Join(runWorkDir, "manifest.json"), []byte("{}\n"), 0o644); err != nil {
-					t.Fatalf("write archive fixture manifest.json: %v", err)
+					t.Fatalf("write publish fixture manifest.json: %v", err)
 				}
 				seed := manifest.New(cfg.Session.SessionID, time.Now().UTC())
@@ -964,7 +981,7 @@ func TestAdapterBackedStageFailureMarksManifestFailed(t *testing.T) {
 					seed.MarkStageSucceeded(name, time.Now().UTC(), nil)
 				}
 				if err := tc.env.ManifestStore.Save(context.Background(), manifestPathFor(cfg), seed); err != nil {
-					t.Fatalf("seed archive manifest: %v", err)
+					t.Fatalf("seed publish manifest: %v", err)
 				}
 			}
@@ -998,7 +1015,7 @@ func testConfig(t *testing.T) *config.Config {
 	pipelinePath := filepath.Join(cfgDir, "pipeline.yml")
 	mustWriteFile(t, pipelinePath, "workspace:\n  root: "+workspace+"\n")
-	mustWriteFile(t, campaignPath, "campaign: sample-campaign\ninputs:\n  speakers_file: ./speakers.yml\n  autocorrect_file: ./autocorrect.yml\n  glossary_file: ./glossary.yml\n")
+	mustWriteFile(t, campaignPath, "campaign_id: sample-campaign\ninputs:\n  speakers_file: ./speakers.yml\n  autocorrect_file: ./autocorrect.yml\n  glossary_file: ./glossary.yml\n")
 	mustWriteFile(t, sessionPath, "session_id: 2026-05-03\ncampaign: sample-campaign\ninputs:\n  audio_dir: ./audio\n")
 	mustWriteFile(t, filepath.Join(cfgDir, "speakers.yml"), "alice: alice.flac\n")
 	mustWriteFile(t, filepath.Join(cfgDir, "autocorrect.yml"), "[]\n")
@@ -1007,7 +1024,7 @@ func testConfig(t *testing.T) *config.Config {
 	return &config.Config{
 		Pipeline:     &config.PipelineConfig{Workspace: config.WorkspaceConfig{Root: workspace}},
-		Campaign:     &config.CampaignConfig{Campaign: "sample-campaign"},
+		Campaign:     &config.CampaignConfig{CampaignID: "sample-campaign"},
 		PipelinePath: pipelinePath,
 		CampaignPath: campaignPath,
 		SessionPath:  sessionPath,
@@ -1050,12 +1067,10 @@ func TestBuildDefaultRunnersWithOmittedToolSections(t *testing.T) {
  root: ` + t.TempDir() + `
 whisperx:
  transcribe_url: https://example.com/transcribe
 analyzer:
  timeout: 20m
 notification:
  timeout: 10s
 `
-	campaignYAML := `campaign: sample-campaign
+	campaignYAML := `campaign_id: sample-campaign
 inputs:
  speakers_file: ./speakers.yml
  autocorrect_file: ./autocorrect.yml
--- a/internal/app/session_args.go
+++ b/internal/app/session_args.go
@@ -0,0 +1,61 @@
 package app
 import (
 	"flag"
 	"fmt"
 	"strings"
 )
 func isCLIFlagToken(arg string) bool {
 	return strings.HasPrefix(arg, "-") && arg != "-"
 }
 func pullLeadingSessionID(args []string) (string, []string) {
 	if len(args) == 0 || isCLIFlagToken(args[0]) {
 		return "", args
 	}
 	rest := append([]string(nil), args[1:]...)
 	return strings.TrimSpace(args[0]), rest
 }
 func applyPositionalSessionID(command, positional string, sessionID *string) error {
 	positional = strings.TrimSpace(positional)
 	if positional == "" {
 		return nil
 	}
 	existing := strings.TrimSpace(*sessionID)
 	if existing != "" && existing != positional {
 		return fmt.Errorf("%s: positional session id %q does not match expected session id %q", command, positional, existing)
 	}
 	*sessionID = positional
 	return nil
 }
 func applyParsedSessionIDArg(command string, fs *flag.FlagSet, sessionID *string) error {
 	switch fs.NArg() {
 	case 0:
 		return nil
 	case 1:
 		return applyPositionalSessionID(command, fs.Arg(0), sessionID)
 	default:
 		return fmt.Errorf("%s: unexpected positional arguments", command)
 	}
 }
 func resolveParsedSessionID(command, positionalSessionID string, fs *flag.FlagSet, sessionID *string) error {
 	if strings.TrimSpace(positionalSessionID) == "" {
 		return applyParsedSessionIDArg(command, fs, sessionID)
 	}
 	if fs.NArg() != 0 {
 		return fmt.Errorf("%s: unexpected positional arguments", command)
 	}
 	return applyPositionalSessionID(command, positionalSessionID, sessionID)
 }
 func parseSessionAwareFlags(command string, fs *flag.FlagSet, args []string, sessionID *string) error {
 	positionalSessionID, args := pullLeadingSessionID(args)
 	if err := fs.Parse(args); err != nil {
 		return fmt.Errorf("%s: invalid flags: %w", command, err)
 	}
 	return resolveParsedSessionID(command, positionalSessionID, fs, sessionID)
 }
--- a/internal/app/session_cli_test.go
+++ b/internal/app/session_cli_test.go
@@ -10,7 +10,7 @@ import (
 	"gitea.maximumdirect.net/eric/narratio/internal/config"
 )
-func TestPlanUsesDiscoveredSessionTemplateWithSessionIDs(t *testing.T) {
+func TestPlanRejectsDiscoveredSessionTemplate(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
@@ -32,16 +32,20 @@ inputs:
 	t.Cleanup(func() { config.DefaultSessionConfigSearchPaths = origSessionDefaults })
 	var out bytes.Buffer
-	if err := Plan(context.Background(), []string{
+	err := Plan(context.Background(), []string{
 		"2026-04-04",
 		"--config", pipelinePath,
-		"--campaign", campaignPath,
+		"--campaign-file", campaignPath,
 		"--session-id", "2026-04-04",
 		"--previous-session-id", "2026-03-28",
-	}, &out); err != nil {
+	}, &out)
-		t.Fatalf("Plan() error = %v", err)
+	if err == nil {
 		t.Fatal("expected error, got nil")
 	}
-	if !strings.Contains(out.String(), "narratio plan: workdir prepared") {
+	if !strings.Contains(err.Error(), "session.yml must be concrete") {
-		t.Fatalf("output = %q, want plan output", out.String())
+		t.Fatalf("error = %q, want concrete session guidance", err.Error())
 	}
 	if !strings.Contains(err.Error(), "run narratio session init") {
 		t.Fatalf("error = %q, want session init guidance", err.Error())
 	}
 }
@@ -50,7 +54,7 @@ func TestPlanFailsWhenSessionIDMismatchesConcreteSession(t *testing.T) {
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 	var out bytes.Buffer
-	err := Plan(context.Background(), []string{"--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "--session-id", "2026-04-04"}, &out)
+	err := Plan(context.Background(), []string{"2026-04-04", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath}, &out)
 	if err == nil {
 		t.Fatal("expected error, got nil")
 	}
@@ -78,10 +82,10 @@ inputs:
 	var out bytes.Buffer
 	err := Plan(context.Background(), []string{
 		"2026-05-03",
 		"--config", pipelinePath,
-		"--campaign", campaignPath,
+		"--campaign-file", campaignPath,
 		"--session", sessionPath,
 		"--session-id", "2026-05-03",
 		"--previous-session-id", "2026-04-25",
 	}, &out)
 	if err == nil {
@@ -92,12 +96,12 @@ inputs:
 	}
 }
-func TestRunStageAcceptsSessionIDFlagAndParsesStageName(t *testing.T) {
+func TestRunStageAcceptsPositionalSessionIDAndParsesStageName(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 	var out bytes.Buffer
-	err := RunStage(context.Background(), []string{"--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "--session-id", "2026-05-03", "prepare"}, &out)
+	err := RunStage(context.Background(), []string{"prepare", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath}, &out)
 	if err != nil {
 		t.Fatalf("RunStage() error = %v", err)
 	}
--- a/internal/app/session_oriented_cli_test.go
+++ b/internal/app/session_oriented_cli_test.go
@@ -0,0 +1,374 @@
 package app
 import (
 	"bytes"
 	"context"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 	"gitea.maximumdirect.net/eric/narratio/internal/adapters/storage"
 	"gitea.maximumdirect.net/eric/narratio/internal/artifacts"
 	"gitea.maximumdirect.net/eric/narratio/internal/config"
 	"gitea.maximumdirect.net/eric/narratio/internal/stage"
 )
 func TestExecuteRunAcceptsPositionalSessionID(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 	var capturedSessionID string
 	origExecuteStagesFn := executeStagesFn
 	t.Cleanup(func() { executeStagesFn = origExecuteStagesFn })
 	executeStagesFn = func(_ context.Context, cfg *config.Config, _ []stage.Stage, _ RunOptions) (*RunSummary, error) {
 		capturedSessionID = cfg.Session.SessionID
 		return &RunSummary{
 			SessionID:    cfg.Session.SessionID,
 			ManifestPath: filepath.Join(workspaceRoot, "manifest.json"),
 			Executed:     []string{"prepare"},
 		}, nil
 	}
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute([]string{
 		"run",
 		"2026-05-03",
 		"--config", pipelinePath,
 		"--campaign-file", campaignPath,
 		"--session", sessionPath,
 	}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
 	if !strings.Contains(stdout.String(), "narratio run: session 2026-05-03") {
 		t.Fatalf("stdout = %q, want run summary", stdout.String())
 	}
 	if capturedSessionID != "2026-05-03" {
 		t.Fatalf("captured session = %q, want positional session id", capturedSessionID)
 	}
 }
 func TestExecutePositionalSessionIDMismatchFails(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute([]string{
 		"run",
 		"2026-05-04",
 		"--config", pipelinePath,
 		"--campaign-file", campaignPath,
 		"--session", sessionPath,
 	}, &stdout, &stderr)
 	if code == 0 {
 		t.Fatal("exit code = 0, want non-zero")
 	}
 	if !strings.Contains(stderr.String(), "session_id mismatch") {
 		t.Fatalf("stderr = %q, want session mismatch", stderr.String())
 	}
 }
 func TestExecuteSessionIDFlagMismatchFails(t *testing.T) {
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute([]string{"session", "status", "2026-05-03", "--session-id", "2026-05-04"}, &stdout, &stderr)
 	if code == 0 {
 		t.Fatal("exit code = 0, want non-zero")
 	}
 	if !strings.Contains(stderr.String(), "does not match expected session id") {
 		t.Fatalf("stderr = %q, want positional/flag mismatch", stderr.String())
 	}
 }
 func TestExecuteSessionIDFlagAcceptedWithoutPositional(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute([]string{
 		"session", "status",
 		"--session-id", "2026-05-03",
 		"--config", pipelinePath,
 		"--campaign-file", campaignPath,
 		"--session", sessionPath,
 	}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
 	if !strings.Contains(stdout.String(), "Session: 2026-05-03") {
 		t.Fatalf("stdout = %q, want status output", stdout.String())
 	}
 }
 func TestExecuteRemoteSessionFallbackUsesPositionalSessionID(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, _ := writeValidConfigFiles(t, workspaceRoot)
 	fake := &storage.FakeBackend{}
 	var storeInitCalls int
 	restoreAppConfigTestGlobals(t, fake, &storeInitCalls, []string{filepath.Join(t.TempDir(), "session.yml")})
 	remoteKey := seedRemoteSessionConfig(t, fake, "2026-06-07", `session_id: 2026-06-07
 inputs:
  audio_s3:
    prefix: audio/
 `)
 	origExecuteStagesFn := executeStagesFn
 	t.Cleanup(func() { executeStagesFn = origExecuteStagesFn })
 	executeStagesFn = func(_ context.Context, cfg *config.Config, _ []stage.Stage, _ RunOptions) (*RunSummary, error) {
 		return &RunSummary{
 			SessionID:    cfg.Session.SessionID,
 			ManifestPath: filepath.Join(workspaceRoot, "manifest.json"),
 			Executed:     []string{"prepare"},
 		}, nil
 	}
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute([]string{
 		"run",
 		"2026-06-07",
 		"--config", pipelinePath,
 		"--campaign-file", campaignPath,
 	}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
 	downloaded := false
 	for _, call := range fake.Downloads {
 		if call.Key == remoteKey {
 			downloaded = true
 			break
 		}
 	}
 	if !downloaded {
 		t.Fatalf("remote session %q was not downloaded; downloads=%v", remoteKey, fake.Downloads)
 	}
 	if storeInitCalls == 0 {
 		t.Fatal("object store was not initialized")
 	}
 }
 func TestExecuteWorkflowCommandsAcceptPositionalSessionID(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFilesWithScriptoriumArtifacts(t, workspaceRoot)
 	tests := []struct {
 		name      string
 		args      []string
 		wantStage string
 		wantForce bool
 	}{
 		{
 			name:      "resume",
 			args:      []string{"resume", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath},
 			wantStage: "prepare",
 			wantForce: false,
 		},
 		{
 			name:      "analyze",
 			args:      []string{"analyze", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath, "--artifacts", "session_recap"},
 			wantStage: "analyze",
 			wantForce: true,
 		},
 		{
 			name:      "publish",
 			args:      []string{"publish", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath, "--artifacts", "session_recap"},
 			wantStage: "publish",
 			wantForce: true,
 		},
 		{
 			name:      "run-stage",
 			args:      []string{"run-stage", "publish", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath, "--artifacts", "session_recap"},
 			wantStage: "publish",
 			wantForce: false,
 		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			var capturedStages []string
 			var capturedForce bool
 			var capturedArtifacts []string
 			origExecuteStagesFn := executeStagesFn
 			t.Cleanup(func() { executeStagesFn = origExecuteStagesFn })
 			executeStagesFn = func(_ context.Context, _ *config.Config, stages []stage.Stage, opts RunOptions) (*RunSummary, error) {
 				for _, s := range stages {
 					capturedStages = append(capturedStages, s.Name())
 				}
 				capturedForce = opts.Force
 				capturedArtifacts = append([]string(nil), opts.SelectedArtifacts...)
 				return &RunSummary{
 					SessionID:    "2026-05-03",
 					ManifestPath: filepath.Join(workspaceRoot, "manifest.json"),
 					Executed:     []string{tt.wantStage},
 				}, nil
 			}
 			var stdout bytes.Buffer
 			var stderr bytes.Buffer
 			code := Execute(tt.args, &stdout, &stderr)
 			if code != 0 {
 				t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 			}
 			if len(capturedStages) == 0 || capturedStages[0] != tt.wantStage {
 				t.Fatalf("captured stages = %#v, want first %q", capturedStages, tt.wantStage)
 			}
 			if capturedForce != tt.wantForce {
 				t.Fatalf("captured force = %t, want %t", capturedForce, tt.wantForce)
 			}
 			if tt.name == "analyze" || tt.name == "publish" || tt.name == "run-stage" {
 				if strings.Join(capturedArtifacts, ",") != "session_recap" {
 					t.Fatalf("captured artifacts = %#v, want [session_recap]", capturedArtifacts)
 				}
 			}
 		})
 	}
 }
 func TestExecuteSessionSubcommandsAcceptPositionalSessionID(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 	fake := &storage.FakeBackend{}
 	sessionPrefix := artifacts.S3SessionPrefix("dnd", "sample-campaign", "2026-05-03")
 	manifestKey, runIDKey := artifacts.ResolveCurrentStateKeys(sessionPrefix)
 	fake.SeedObject(storage.FakeObject{Key: runIDKey, Data: []byte("20260519T010203Z-a1b2c3d4\n")})
 	fake.SeedObject(storage.FakeObject{Key: manifestKey, Data: restoreManifestJSON(t, "2026-05-03", "sample-campaign")})
 	var storeInitCalls int
 	restoreAppConfigTestGlobals(t, fake, &storeInitCalls, []string{sessionPath})
 	tests := []struct {
 		name string
 		args []string
 		want string
 	}{
 		{
 			name: "validate",
 			args: []string{"session", "validate", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath},
 			want: "OK    config",
 		},
 		{
 			name: "status",
 			args: []string{"session", "status", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath},
 			want: "Session: 2026-05-03",
 		},
 		{
 			name: "plan",
 			args: []string{"session", "plan", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath},
 			want: "narratio session plan: workdir prepared",
 		},
 		{
 			name: "artifacts",
 			args: []string{"session", "artifacts", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath},
 			want: "Built-in:",
 		},
 		{
 			name: "locks",
 			args: []string{"session", "locks", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath},
 			want: "Publish locks:",
 		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			var stdout bytes.Buffer
 			var stderr bytes.Buffer
 			code := Execute(tt.args, &stdout, &stderr)
 			if code != 0 {
 				t.Fatalf("exit code = %d, want 0; stdout=%q stderr=%q", code, stdout.String(), stderr.String())
 			}
 			if !strings.Contains(stdout.String(), tt.want) {
 				t.Fatalf("stdout = %q, want %q", stdout.String(), tt.want)
 			}
 		})
 	}
 }
 func TestExecuteSessionInitAcceptsPositionalSessionID(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, _ := writeValidConfigFiles(t, workspaceRoot)
 	outputPath := filepath.Join(t.TempDir(), "session.yml")
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute([]string{
 		"session", "init", "2026-06-07",
 		"--config", pipelinePath,
 		"--campaign-file", campaignPath,
 		"--output", outputPath,
 	}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
 	data, err := os.ReadFile(outputPath)
 	if err != nil {
 		t.Fatalf("read generated session: %v", err)
 	}
 	if !strings.Contains(string(data), `session_id: "2026-06-07"`) {
 		t.Fatalf("generated session = %q, want positional session id", string(data))
 	}
 }
 func TestExecuteSessionLocksMutationAcceptsPositionalSessionID(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 	fake := &storage.FakeBackend{}
 	var storeInitCalls int
 	restoreAppConfigTestGlobals(t, fake, &storeInitCalls, []string{sessionPath})
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute([]string{
 		"session", "locks", "add", "2026-05-03", "narratio.transcript.final_trimmed",
 		"--config", pipelinePath,
 		"--campaign-file", campaignPath,
 		"--session", sessionPath,
 		"--reason", "review",
 	}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("locks add exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
 	key := artifacts.S3SessionLocksKey(artifacts.S3SessionPrefix("dnd", "sample-campaign", "2026-05-03"))
 	if !strings.Contains(string(fake.Objects[key].Data), "reason: review") {
 		t.Fatalf("lock store data = %q, want reason", string(fake.Objects[key].Data))
 	}
 	stdout.Reset()
 	stderr.Reset()
 	code = Execute([]string{
 		"session", "locks", "remove", "2026-05-03", "narratio.transcript.final_trimmed",
 		"--config", pipelinePath,
 		"--campaign-file", campaignPath,
 		"--session", sessionPath,
 	}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("locks remove exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
 	store, err := config.LoadPublishLockStoreBytes("locks.yml", fake.Objects[key].Data, nil)
 	if err != nil {
 		t.Fatalf("LoadPublishLockStoreBytes() error = %v", err)
 	}
 	if len(store.Locks) != 0 {
 		t.Fatalf("locks after remove = %#v, want empty", store.Locks)
 	}
 }
 func TestExecuteCleanAcceptsPositionalSessionID(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 	workDir := artifacts.SessionWorkDirForCampaign(workspaceRoot, "sample-campaign", "2026-05-03")
 	spoolDir := artifacts.SessionSpoolDir(filepath.Join(workspaceRoot, "spool"), "sample-campaign", "2026-05-03")
 	mustWriteTestFile(t, filepath.Join(workDir, "manifest.json"), "{}")
 	mustWriteTestFile(t, filepath.Join(spoolDir, "run-1", "audio", "alice.flac"), "audio")
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute([]string{"clean", "2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
 	cleanAssertMissing(t, workDir)
 	cleanAssertMissing(t, spoolDir)
 }
--- a/internal/app/status_test.go
+++ b/internal/app/status_test.go
@@ -3,71 +3,28 @@ package app
 import (
 	"bytes"
 	"context"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 	"time"
 	"gitea.maximumdirect.net/eric/narratio/internal/manifest"
 )
-func TestStatusCommandReadsManifest(t *testing.T) {
+func TestStatusCommandRequiresSessionID(t *testing.T) {
 	manifestPath := writeManifestForStatus(t)
 	var out bytes.Buffer
 	err := Status(context.Background(), []string{"--manifest", manifestPath}, &out)
 	if err != nil {
 		t.Fatalf("Status() error = %v", err)
 	}
 	s := out.String()
 	if !strings.Contains(s, "session_id: 2026-05-03") {
 		t.Fatalf("output = %q, want session_id", s)
 	}
 	if !strings.Contains(s, "- merge: succeeded") {
 		t.Fatalf("output = %q, want stage status", s)
 	}
 }
 func TestStatusCommandMissingManifestFlag(t *testing.T) {
 	var out bytes.Buffer
 	err := Status(context.Background(), nil, &out)
 	if err == nil {
 		t.Fatal("expected error, got nil")
 	}
-	if !strings.Contains(err.Error(), "--manifest is required") {
+	if !strings.Contains(err.Error(), "status: session_id is required") {
-		t.Fatalf("error = %q, want missing manifest flag", err.Error())
+		t.Fatalf("error = %q, want missing session_id error", err.Error())
 	}
 }
-func TestStatusCommandBadManifest(t *testing.T) {
+func TestStatusCommandRejectsManifestFlag(t *testing.T) {
 	dir := t.TempDir()
 	path := filepath.Join(dir, "manifest.json")
 	if err := os.WriteFile(path, []byte("{not-json"), 0o644); err != nil {
 		t.Fatalf("WriteFile() error = %v", err)
 	}
 	var out bytes.Buffer
-	err := Status(context.Background(), []string{"--manifest", path}, &out)
+	err := Status(context.Background(), []string{"2026-05-03", "--manifest", "manifest.json"}, &out)
 	if err == nil {
 		t.Fatal("expected error, got nil")
 	}
-	if !strings.Contains(err.Error(), "decode manifest") {
+	if !strings.Contains(err.Error(), "status: invalid flags: flag provided but not defined: -manifest") {
-		t.Fatalf("error = %q, want decode error", err.Error())
+		t.Fatalf("error = %q, want invalid manifest flag", err.Error())
 	}
 }
 func writeManifestForStatus(t *testing.T) string {
 	t.Helper()
 	store := &manifest.LocalStore{}
 	m := manifest.New("2026-05-03", time.Date(2026, 5, 3, 10, 0, 0, 0, time.UTC))
 	m.MarkStageSucceeded("merge", time.Date(2026, 5, 3, 10, 5, 0, 0, time.UTC), nil)
 	path := filepath.Join(t.TempDir(), "manifest.json")
 	if err := store.Save(context.Background(), path, m); err != nil {
 		t.Fatalf("Save() error = %v", err)
 	}
 	return path
 }
--- a/internal/artifactmodel/transcripts.go
+++ b/internal/artifactmodel/transcripts.go
@@ -0,0 +1,84 @@
 package artifactmodel
 import "strings"
 const (
 	SourceTranscriptBase         = "narratio.transcript.base"
 	SourceTranscriptPolished     = "narratio.transcript.polished"
 	SourceTranscriptFinal        = "narratio.transcript.final"
 	SourceTranscriptFinalTrimmed = "narratio.transcript.final_trimmed"
 )
 const (
 	TranscriptPathBase         = "transcripts/base.json"
 	TranscriptPathPolished     = "transcripts/polished.json"
 	TranscriptPathFinal        = "transcripts/final.json"
 	TranscriptPathFinalTrimmed = "transcripts/final.trimmed.json"
 )
 const (
 	TranscriptOutputKindBase         = "transcript_base"
 	TranscriptOutputKindPolished     = "transcript_polished"
 	TranscriptOutputKindFinal        = "transcript_final"
 	TranscriptOutputKindFinalTrimmed = "transcript_final_trimmed"
 )
 // TranscriptArtifactSpec describes one built-in transcript artifact mapping.
 type TranscriptArtifactSpec struct {
 	SourceID         string
 	CanonicalRelPath string
 	ProducerStage    string
 	OutputKind       string
 }
 var runtimeTranscriptArtifacts = []TranscriptArtifactSpec{
 	{
 		SourceID:         SourceTranscriptBase,
 		CanonicalRelPath: TranscriptPathBase,
 		ProducerStage:    "merge",
 		OutputKind:       TranscriptOutputKindBase,
 	},
 	{
 		SourceID:         SourceTranscriptPolished,
 		CanonicalRelPath: TranscriptPathPolished,
 		ProducerStage:    "polish",
 		OutputKind:       TranscriptOutputKindPolished,
 	},
 	{
 		SourceID:         SourceTranscriptFinal,
 		CanonicalRelPath: TranscriptPathFinal,
 		ProducerStage:    "normalize",
 		OutputKind:       TranscriptOutputKindFinal,
 	},
 	{
 		SourceID:         SourceTranscriptFinalTrimmed,
 		CanonicalRelPath: TranscriptPathFinalTrimmed,
 		ProducerStage:    "trim",
 		OutputKind:       TranscriptOutputKindFinalTrimmed,
 	},
 }
 // RuntimeTranscriptArtifacts returns transcript mappings in pipeline order.
 func RuntimeTranscriptArtifacts() []TranscriptArtifactSpec {
 	return cloneTranscriptSpecs(runtimeTranscriptArtifacts)
 }
 // LookupRuntimeTranscriptArtifact returns runtime transcript metadata by source ID.
 func LookupRuntimeTranscriptArtifact(sourceID string) (TranscriptArtifactSpec, bool) {
 	trimmed := strings.TrimSpace(sourceID)
 	for _, spec := range runtimeTranscriptArtifacts {
 		if spec.SourceID == trimmed {
 			return spec, true
 		}
 	}
 	return TranscriptArtifactSpec{}, false
 }
 func cloneTranscriptSpecs(specs []TranscriptArtifactSpec) []TranscriptArtifactSpec {
 	if len(specs) == 0 {
 		return nil
 	}
 	out := make([]TranscriptArtifactSpec, len(specs))
 	copy(out, specs)
 	return out
 }
--- a/internal/artifactpolicy/policy.go
+++ b/internal/artifactpolicy/policy.go
@@ -0,0 +1,145 @@
 package artifactpolicy
 import (
 	"fmt"
 	"regexp"
 	"strings"
 	"gitea.maximumdirect.net/eric/narratio/internal/artifactmodel"
 	"gitea.maximumdirect.net/eric/narratio/internal/pathsafe"
 )
 const (
 	SourceBoundsSession = "narratio.bounds.session"
 	configuredSourcePrefix      = "narratio.artifact."
 	previousConfiguredSrcPrefix = "narratio.previous_session.artifact."
 )
 var configuredSourceRE = regexp.MustCompile(`^narratio\.artifact\.([a-z][a-z0-9_]*)$`)
 var previousSourceRE = regexp.MustCompile(`^narratio\.previous_session\.artifact\.([a-z][a-z0-9_]*)$`)
 type SourceKind string
 const (
 	SourceKindBuiltIn            SourceKind = "built_in"
 	SourceKindConfiguredArtifact SourceKind = "configured_artifact"
 	SourceKindPreviousArtifact   SourceKind = "previous_session_configured_artifact"
 )
 // Source describes one normalized artifact source identifier.
 type Source struct {
 	ID            string
 	Kind          SourceKind
 	ConfiguredKey string
 }
 // ConfiguredSourceID converts a configured artifact key into source id form.
 func ConfiguredSourceID(key string) string {
 	return configuredSourcePrefix + strings.TrimSpace(key)
 }
 // PreviousSessionSourceID converts a configured artifact key into previous-session source id form.
 func PreviousSessionSourceID(key string) string {
 	return previousConfiguredSrcPrefix + strings.TrimSpace(key)
 }
 // ParseConfiguredSource extracts configured key from narratio.artifact.<key>.
 func ParseConfiguredSource(source string) (string, bool) {
 	matches := configuredSourceRE.FindStringSubmatch(strings.TrimSpace(source))
 	if len(matches) != 2 {
 		return "", false
 	}
 	return matches[1], true
 }
 // ParsePreviousSessionSource extracts configured key from narratio.previous_session.artifact.<key>.
 func ParsePreviousSessionSource(source string) (string, bool) {
 	matches := previousSourceRE.FindStringSubmatch(strings.TrimSpace(source))
 	if len(matches) != 2 {
 		return "", false
 	}
 	return matches[1], true
 }
 // ClassifySource classifies a source id as built-in, configured, or previous-session configured.
 func ClassifySource(source string) (Source, error) {
 	trimmed := strings.TrimSpace(source)
 	if trimmed == "" {
 		return Source{}, fmt.Errorf("artifact source is required")
 	}
 	if _, ok := artifactmodel.LookupRuntimeTranscriptArtifact(trimmed); ok {
 		return Source{ID: trimmed, Kind: SourceKindBuiltIn}, nil
 	}
 	if trimmed == SourceBoundsSession {
 		return Source{ID: trimmed, Kind: SourceKindBuiltIn}, nil
 	}
 	if key, ok := ParseConfiguredSource(trimmed); ok {
 		return Source{ID: trimmed, Kind: SourceKindConfiguredArtifact, ConfiguredKey: key}, nil
 	}
 	if key, ok := ParsePreviousSessionSource(trimmed); ok {
 		return Source{ID: trimmed, Kind: SourceKindPreviousArtifact, ConfiguredKey: key}, nil
 	}
 	return Source{}, fmt.Errorf("unsupported artifact source %q", source)
 }
 // ValidatePublishSource validates that a source is publish-compatible and references a known configured artifact.
 func ValidatePublishSource(source string, configured map[string]string) (Source, error) {
 	classified, err := ClassifySource(source)
 	if err != nil {
 		return Source{}, fmt.Errorf("must be a built-in source id or narratio.artifact.<name>")
 	}
 	if classified.Kind == SourceKindPreviousArtifact {
 		return Source{}, fmt.Errorf("must be a built-in source id or narratio.artifact.<name>")
 	}
 	if classified.Kind == SourceKindConfiguredArtifact {
 		if configured == nil {
 			return Source{}, fmt.Errorf("configured artifact %q is not defined in pipeline.scriptorium.artifacts", classified.ConfiguredKey)
 		}
 		if _, ok := configured[classified.ConfiguredKey]; !ok {
 			return Source{}, fmt.Errorf("configured artifact %q is not defined in pipeline.scriptorium.artifacts", classified.ConfiguredKey)
 		}
 	}
 	return classified, nil
 }
 // DeriveDefaultPublishedDestination returns the default publish destination for one source.
 func DeriveDefaultPublishedDestination(source Source, configured map[string]string) (string, error) {
 	switch source.Kind {
 	case SourceKindBuiltIn:
 		if spec, ok := artifactmodel.LookupRuntimeTranscriptArtifact(source.ID); ok {
 			return pathsafe.NormalizeRelativeDestination(spec.CanonicalRelPath)
 		}
 		if source.ID == SourceBoundsSession {
 			return pathsafe.NormalizeRelativeDestination("artifacts/session_bounds.json")
 		}
 		return "", fmt.Errorf("unsupported built-in source %q", source.ID)
 	case SourceKindConfiguredArtifact:
 		if configured == nil {
 			return "", fmt.Errorf("configured artifact %q is not defined in pipeline.scriptorium.artifacts", source.ConfiguredKey)
 		}
 		outputPath, ok := configured[source.ConfiguredKey]
 		if !ok {
 			return "", fmt.Errorf("configured artifact %q is not defined in pipeline.scriptorium.artifacts", source.ConfiguredKey)
 		}
 		if strings.TrimSpace(outputPath) == "" {
 			return "", fmt.Errorf("pipeline.scriptorium.artifacts.%s.output_path is empty", source.ConfiguredKey)
 		}
 		return pathsafe.NormalizeRelativeDestination(outputPath)
 	default:
 		return "", fmt.Errorf("publish destination cannot be derived from source %q", source.ID)
 	}
 }
 // ResolvePublishedDestination validates and normalizes an explicit destination,
 // or derives one when omitted.
 func ResolvePublishedDestination(sourceID, explicitDest string, configured map[string]string) (string, error) {
 	source, err := ValidatePublishSource(sourceID, configured)
 	if err != nil {
 		return "", err
 	}
 	if strings.TrimSpace(explicitDest) != "" {
 		return pathsafe.NormalizeRelativeDestination(explicitDest)
 	}
 	return DeriveDefaultPublishedDestination(source, configured)
 }
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Eric Rakestraw	5620fc5bcf	Refresh CLI and internal restore documentation for current behavior	2026-05-23 14:07:11 +00:00
Eric Rakestraw	be57e675e0	Split operator helper implementations by command responsibility	2026-05-23 14:03:31 +00:00
Eric Rakestraw	3971443831	Centralize remote current-state loading and preserve caller policy	2026-05-23 13:56:53 +00:00
Eric Rakestraw	a6b0c33e9f	Unify session-aware CLI parsing and add session-id compatibility	2026-05-23 13:47:39 +00:00
Eric Rakestraw	96b886e711	Align internal publish terminology across stage, app, and artifacts	2026-05-23 13:39:15 +00:00
Eric Rakestraw	7d584ee6cd	Centralize artifact source and publish destination policy	2026-05-23 13:28:25 +00:00
Eric Rakestraw	572a112c31	Consolidate path safety, temp downloads, and cleanup validation helpers	2026-05-23 13:20:28 +00:00
Eric Rakestraw	ea87c335d6	Add a roadmap to implement the high-priority items revealed by the code quality audit	2026-05-23 08:10:00 -05:00
Eric Rakestraw	7169ff04df	Audit code quality and deduplication opportunities	2026-05-23 08:08:24 -05:00
Eric Rakestraw	ef1f650bc0	Mark documentation roadmap complete after final validation sweep	2026-05-23 13:04:16 +00:00
Eric Rakestraw	0d02cb9fa0	Rewrite integration documentation and verify maintained examples	2026-05-23 13:01:17 +00:00
Eric Rakestraw	0299b128cf	Rewrite internal documentation for current stage and state contracts	2026-05-23 12:57:59 +00:00
Eric Rakestraw	d723384888	Rewrite user and operator documentation for current CLI and config behavior	2026-05-23 12:50:46 +00:00
Eric Rakestraw	54228055c8	Audit Stage 1 documentation scope and fix broken references	2026-05-23 12:43:50 +00:00
Eric Rakestraw	23ed716450	Added a documentation update roadmap	2026-05-23 07:38:17 -05:00
Eric Rakestraw	ab59bab044	Initial documentation cleanup pass	2026-05-23 07:11:17 -05:00
Eric Rakestraw	71395bb076	Rewrite docs for the publish stage contract and current behavior	2026-05-23 04:51:16 +00:00
Eric Rakestraw	79737edf79	Rename publish runtime terminology to published outputs	2026-05-23 04:42:08 +00:00
Eric Rakestraw	df2c765b7f	Rename archive config and stage contract to publish	2026-05-23 04:30:45 +00:00
Eric Rakestraw	f050b9dd54	Added roadmap documentation for the upcoming refactoring of the publish stage	2026-05-22 23:19:44 -05:00
Eric Rakestraw	9c9cb54339	Implemented multiple campaign support via a campaign directory registry with explicit campaign IDs	2026-05-22 23:01:27 -05:00
Eric Rakestraw	7657ec3ad6	CLI cleanup to consolidate session-related subcommands	2026-05-22 22:09:17 -05:00
Eric Rakestraw	cee52aa092	Updated transcript artifact names and canonical paths to use a consistent, role-based nomenclature	2026-05-22 19:05:23 -05:00
Eric Rakestraw	e920f3a8d5	Cleaned up and removed legacy configuration surfaces	2026-05-22 18:32:14 -05:00
Eric Rakestraw	591c529a09	Updated the analyze stage to accept --artifacts as a CLI flag	2026-05-22 18:01:05 -05:00
Eric Rakestraw	7324c5a686	Session configuration templates are now proceeded by narratio session init; all other commands require concrete configuration	2026-05-22 17:38:23 -05:00
Eric Rakestraw	d0936fb022	Implemented default config/campaign discovery for narratio session init	2026-05-22 11:36:57 -05:00
Eric Rakestraw	2aa074c5cf	Implemented narratio publish as a shortcut to run the archive stage only	2026-05-22 11:28:38 -05:00
Eric Rakestraw	782d0cf3b9	Upgraded the restore command to download previous session artifcats when configured as inputs for the current session analyze stage	2026-05-21 23:31:01 -05:00