Document the v1.7.0 release

.woodpecker/release.yml

@@ -2,39 +2,26 @@ when:
   - event: tag
 
 steps:
-  - name: build-release-assets
-    image: golang:1.25
+  validate-release:
+    image: golang:1.26.7
+    commands:
+      - ./scripts/check-release-candidate.sh "$CI_COMMIT_TAG"
+
+  build-release-assets:
+    image: golang:1.26.7
+    depends_on:
+      - validate-release
     commands:
       - |
         set -eu
+        case "$PWD" in
+          /*) ;;
+          *) echo "release workspace must have an absolute path" >&2; exit 1 ;;
+        esac
+        ./scripts/build-release-assets.sh "$CI_COMMIT_TAG" "$PWD/dist"
 
-        version="$CI_COMMIT_TAG"
-        dist="dist"
-        pkg="gitea.maximumdirect.net/eric/narratio/cmd/narratio"
-
-        rm -rf "$dist"
-        mkdir -p "$dist"
-
-        build_binary() {
-          goos="$1"
-          goarch="$2"
-          suffix="$3"
-          output="$dist/narratio-$version-$goos-$goarch$suffix"
-
-          CGO_ENABLED=0 GOOS="$goos" GOARCH="$goarch" \
-            go build -trimpath -ldflags "-s -w -X gitea.maximumdirect.net/eric/narratio/internal/buildinfo.Version=$version" \
-            -o "$output" "$pkg"
-        }
-
-        build_binary linux amd64 ""
-        build_binary linux arm64 ""
-        build_binary darwin amd64 ""
-        build_binary darwin arm64 ""
-        build_binary windows amd64 ".exe"
-        build_binary windows arm64 ".exe"
-
-  - name: publish-release
-    image: woodpeckerci/plugin-release
+  publish-release:
+    image: woodpeckerci/plugin-release:0.3.1
     depends_on:
       - build-release-assets
     settings:
@@ -42,6 +29,8 @@ steps:
         from_secret: GITEA_RELEASE_TOKEN
       files:
         - dist/narratio-*
+      title: Narratio ${CI_COMMIT_TAG}
+      note: docs/releases/${CI_COMMIT_TAG}.md
       checksum: sha256
       checksum-file: SHA256SUMS
       checksum-flatten: true

.woodpecker/shuffle.yml

@@ -0,0 +1,8 @@
+when:
+  - event: cron
+
+steps:
+  shuffled-race-tests:
+    image: golang:1.26
+    commands:
+      - go test -race -shuffle=on -count=3 ./...

.woodpecker/verify.yml

@@ -0,0 +1,47 @@
+when:
+  - event: [push, pull_request]
+
+steps:
+  tests:
+    image: golang:1.26
+    commands:
+      - go test ./...
+
+  race-tests:
+    image: golang:1.26
+    depends_on: tests
+    commands:
+      - go test -race ./...
+
+  static-analysis:
+    image: golang:1.26
+    depends_on: tests
+    commands:
+      - go vet ./...
+
+  build:
+    image: golang:1.26
+    depends_on: tests
+    commands:
+      - go build ./...
+
+  documentation-and-examples:
+    image: golang:1.26
+    depends_on: tests
+    commands:
+      - go test ./internal/doccheck
+      - go test ./internal/config -run '^TestExamplesLoadAndValidate$'
+
+  cross-build:
+    image: golang:1.26
+    depends_on: [race-tests, static-analysis, build, documentation-and-examples]
+    commands:
+      - |
+        set -eu
+        output_dir="$(mktemp -d)"
+        trap 'rm -rf "$output_dir"' EXIT
+        for target in linux/amd64 linux/arm64 darwin/amd64 darwin/arm64 windows/amd64 windows/arm64; do
+          goos="${target%/*}"
+          goarch="${target#*/}"
+          CGO_ENABLED=0 GOOS="$goos" GOARCH="$goarch" go build -o "$output_dir/narratio-$goos-$goarch" ./cmd/narratio
+        done

README.md

@@ -27,7 +27,7 @@ This requires resolvable `pipeline.yml`, `campaign.yml`, and concrete
 - [Integration contracts](docs/integrations/) — external tools, formats, and
   compatibility expectations.
 - [Maintained examples](examples/README.md) — complete copyable configuration
-  and input files.
+  and input files, including the production/testing split bundle.
 
 ## Maintainer Documentation
 

docs/cli.md

@@ -12,12 +12,15 @@ This runs the canonical full pipeline for session `2026-04-04`.
 
 Top-level commands:
 
-- `run <session_id>`: run full stage order.
+- `version`: print the Narratio build version.
+- `run <session_id>`: run all or one contiguous range of the canonical stage order.
+- `regenerate-artifacts <session_id>`: force-run extraction through analysis.
 - `run-stage <stage> <session_id>`: run one stage.
 - `analyze <session_id>`: force-run analyze.
 - `publish <session_id>`: force-run publish.
 - `clean <session_id>` or `clean --all`: remove local work/spool state.
 - `session <subcommand>`: session helper commands.
+- `config <subcommand>`: validate, display, source-trace, or compare resolved pipeline configuration.
 
 Session subcommands:
 
@@ -41,13 +44,22 @@ Most session-aware commands accept:
 - `--session <session.yml>`
 - `--session-id <session_id>`
 - `--previous-session-id <session_id>`
+- `--profile <name>`
 
 Rules:
 
 - `--campaign` and `--campaign-file` are mutually exclusive.
 - `--session` is not used by `session init`.
 - if both positional `<session_id>` and `--session-id` are provided, values must match.
+- `--previous-session-id` is a strict expectation: the selected session file
+  must contain the same `previous_session_id`.
+- `--profile` selects a declared pipeline profile. It may be supplied once;
+  an explicit empty or unknown value fails configuration resolution. When it is
+  omitted, a declared `default_profile` is used. The same selection applies to
+  all common-flag commands, including `regenerate-artifacts`.
 - `clean --all` cannot be combined with campaign/session selectors.
+- notification delivery is currently limited to the configured `noop` mode; see
+  the [configuration reference](./config.md#notifications).
 
 ## Session ID Input Rules
 
@@ -66,21 +78,121 @@ Commands with additional positionals keep their command-specific order:
 
 ## Command Reference
 
+### `config validate`, `config show`, `config sources`, and `config diff`
+
+```bash
+narratio config validate [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--profile <name>]
+narratio config show [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--profile <name>]
+narratio config sources [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--profile <name>]
+narratio config diff <left-profile> <right-profile> [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>]
+```
+
+These commands resolve the selected profile, defaults, ordinary paths, and—if
+a campaign is selected—the campaign-owned party. They neither discover or load
+a session nor create a workspace, manifest, run, lock, adapter, remote
+connection, or credential environment.
+
+Campaign selection is optional for a pipeline without party-driven artifact
+families. A pipeline with `scriptorium.artifact_families` needs a selected or
+configured default campaign so Narratio can expand its concrete artifacts and
+publish rules. `--campaign` and `--campaign-file` remain mutually exclusive.
+Session, range, force, and artifact-execution flags are not accepted.
+
+`config validate` writes a concise root-path, selected-profile (or `none`), and
+effective-digest summary after successful complete validation. `config show`
+writes one deterministic, secret-free YAML document containing defaulted and
+expanded concrete configuration. It omits composition declarations, artifact
+family declarations, and runtime provenance.
+
+`config sources` reports the same fully validated resolution without printing
+effective values. Its header identifies the root, ordered imports, selected
+profile and overlay, selected campaign, party source, and digest. The
+remaining tab-separated records are sorted as `path`, `role`, and `source`.
+Roles distinguish root, import, profile, centralized default, campaign, party,
+and generated family ownership. A generated party member has
+one family record and one party record at the same logical path. The output
+never reads or prints secret values.
+
+`config diff` resolves both supplied profile names from one parsed root source
+set and compares their fully resolved, secret-free effective mappings. It does
+not accept `--profile`; the two positional names must be distinct, declared
+profiles. When party-driven families are present, both profiles must resolve to
+the same selected campaign and party. Use `--campaign-file` if profile-specific
+campaign configuration would otherwise select different files.
+
+Equal profiles print `no differences`. Otherwise, sorted tab-separated records
+use one of these forms, with compact JSON values:
+
+```text
+added    <path>    <right-value>
+removed  <path>    <left-value>
+changed  <path>    <left-value>    <right-value>
+```
+
+Mappings are flattened to their logical field paths; lists remain one atomic
+value. The command compares defaulted concrete artifacts and publish rules, not
+profile names, source-file layout, or formatting. It succeeds when differences
+are found, making it suitable for review and migration checks.
+
+### `version`
+
+```bash
+narratio version
+```
+
+Official release binaries report their exact Git tag. Binaries built directly
+from source without release linker metadata report `dev`.
+
 ### `run`
 
 ```bash
-narratio run <session_id> [--force] [--artifacts <name[,name...]>] [...common config flags]
+narratio run <session_id> [--from <stage>] [--through <stage>] [--force] [--artifacts <name[,name...]>] [...common config flags]
 ```
 
 Behavior:
 
-- evaluates full stage order;
-- runs `extract` between `trim` and `render`; an omitted or disabled Notarius
+- evaluates one inclusive contiguous range of the canonical stage order;
+- defaults an omitted `--from` to `prepare` and an omitted `--through` to
+  `cleanup`, so omitting both retains full-pipeline behavior;
+- rejects unknown endpoints and a `--from` endpoint after `--through`;
+- runs `render` before `extract`; an omitted or disabled Notarius
   configuration records an explicit `notarius_disabled` self-skip;
 - skips already-succeeded stages unless `--force` is set or a stage-specific
   resume check finds its durable result obsolete;
+- applies `--force` only to stages in the selected range;
+- rejects repeated `--from`, `--through`, or `--force` options, including
+  `--name=value` spellings;
 - continues interrupted or partially completed sessions by running non-succeeded stages;
-- writes session and run manifests.
+- writes the session manifest as the sole durable progress ledger. Each
+  invocation also creates its run-local directory and returns an immediate
+  command summary; neither creates another durable progress record.
+- reports the resolved profile (or `none`) and effective configuration digest.
+
+When `--artifacts` is present, the selected range must contain `analyze` or
+`publish`. Either consumer is sufficient, including a one-stage range.
+
+### `regenerate-artifacts`
+
+```bash
+narratio regenerate-artifacts <session_id> [--artifacts <name[,name...]>] [...common config flags]
+```
+
+Exactly equivalent to:
+
+```bash
+narratio run <session_id> --force --from extract --through analyze [caller options]
+```
+
+The command always reruns extraction. Analysis rebuilds the selected configured
+artifacts and any prerequisites required by those targets; without
+`--artifacts`, it uses the normal default analysis selection. Publish and notify
+never run. Common session/configuration options and repeatable artifact values
+pass through unchanged.
+
+Because the expansion owns `--force`, `--from`, and `--through`, callers cannot
+supply those options. The shared `run` parser reports them as duplicate
+singleton flags. The alias has no private execution options or behavior, and
+runtime diagnostics may identify the operation as `run`.
 
 ### `run-stage`
 
@@ -96,11 +208,12 @@ Valid stage names:
 - `polish`
 - `normalize`
 - `trim`
-- `extract`
 - `render`
+- `extract`
 - `analyze`
 - `publish`
 - `notify`
+- `cleanup`
 
 Rules:
 
@@ -130,6 +243,10 @@ Equivalent to:
 narratio run-stage publish <session_id> --force [...common config flags]
 ```
 
+This command selects only `publish`; it does not invoke cleanup. Use a normal
+full run to include configured cleanup, or `run-stage cleanup` to retry cleanup
+from valid publication evidence.
+
 ### `clean`
 
 ```bash
@@ -143,16 +260,25 @@ Behavior:
 - `--all` removes all local session work and spool state;
 - cache remains unless `--clear-cache` is provided.
 
-See [Operations: Cleanup](./operations.md#cleanup) for deletion scope and
-post-publish cleanup behavior.
+See [Operations: Cleanup](./operations.md#cleanup) for manual and pipeline-stage
+deletion scope.
 
 ### `session plan`
 
 ```bash
-narratio session plan <session_id> [--force] [...common config flags]
+narratio session plan <session_id> [--from <stage>] [--through <stage>] [--force] [--artifacts <name[,name...]>] [...common config flags]
 ```
 
-Validates config, prepares local workdir layout, and prints run/skip decisions for each stage.
+Uses the same inclusive bounds, endpoint validation, force scope, and artifact
+selection contract as `run`. It validates config and prints run/skip decisions
+for selected stages only without creating the local workdir or changing the
+manifest. Resume-capable selected stages are checked against durable evidence.
+The output includes the resolved profile (or `none`) and effective configuration
+digest without writing provenance or any manifest state.
+For `analyze`, the preview also lists explicit targets, prerequisite-only work,
+execution order, and reusable current artifacts with concise reasons. These
+artifact decisions come from the same reconciliation and work planner used by
+execution; the preview does not predict output identities.
 
 ### `session validate`
 
@@ -160,7 +286,8 @@ Validates config, prepares local workdir layout, and prints run/skip decisions f
 narratio session validate <session_id> [...common config flags]
 ```
 
-Read-only preflight checks for config validity, required inputs, audio mode, previous-session requirements, publish outputs, and effective locks.
+Read-only preflight checks for config validity, required inputs, audio mode,
+previous-session requirements, publish outputs, and independent remote locks.
 
 ### `session status`
 
@@ -168,7 +295,13 @@ Read-only preflight checks for config validity, required inputs, audio mode, pre
 narratio session status <session_id> [...common config flags]
 ```
 
-Prints local manifest state and, when storage is available, remote current-state and published-output status.
+Prints local manifest state and, when storage is available, status for the
+pointer-selected remote commit and its declared published outputs. Current
+publish metadata reports `published`, `carried_locked`, `locked_unpublished`,
+`optional_missing`, and `unselected`; carried output lines include the run
+derived from their exact declared key, the key itself, and its declared
+destination. A separately displayed `dest` is the destination requested by the
+current configuration and may differ while an older declaration is locked.
 
 ### `session init`
 
@@ -211,7 +344,8 @@ Behavior:
 - discovers committed remote current state;
 - plans local restores;
 - writes an execution report;
-- blocks conflicting overwrites unless `--force` is set.
+- blocks unresolved conflicts. `--force` permits replacement only of eligible
+  regular files.
 
 See [Operations: Restore Workflow](./operations.md#restore-workflow) for the
 default restore scope, report location, and conflict-handling workflow.
@@ -225,7 +359,8 @@ narratio session artifacts <session_id> [--remote] [...common config flags]
 Lists effective built-in, configured Scriptorium, and configured extraction
 sources; reports planned, available, unavailable, and published state without
 reading payload bodies; and includes publish rules, lock state, and optional
-remote published-state availability.
+remote published-state availability. Remote inspection uses exact commit
+declarations and displays the five current publish outcomes when recorded.
 
 ### `session locks`
 
@@ -237,23 +372,34 @@ narratio session locks remove <session_id> <source> [...common config flags]
 
 Behavior:
 
-- list mode reports the effective merge of static and remote locks;
-- add/remove mutate only remote locks;
-- static locks from pipeline config cannot be removed by CLI commands.
+- list mode validates and reports independent remote locks sorted by source;
+- add creates one lock and reports an existing lock unless `--force` is used;
+- `--force` performs one generation-matched replacement and reports a
+  concurrent change for operator retry; and
+- remove is idempotent and reports when the source was not locked.
 
 See [Operations: Publish Locks](./operations.md#publish-locks) for lock storage
-and precedence.
+and publication behavior.
 
 ## `--artifacts` Selection Rules
 
-- accepted on `run`, `run-stage`, `analyze`, and `publish`;
+An artifact-family key selects all of its concrete character members. A
+concrete generated key selects only that member; mixed family and concrete
+selection is deduplicated and executed as concrete keys. The resulting plan
+and command output identify both the concrete key and, where applicable, its
+family and character ID.
+
+- accepted on `run`, `session plan`, `run-stage`, `analyze`, and `publish`;
+- repeatable and comma-separated values are combined, surrounding whitespace
+  is removed, and duplicate names are collapsed;
 - names must exist in `pipeline.scriptorium.artifacts`;
 - empty entries are invalid;
-- repeated names are deduplicated.
+- on `run-stage`, only `analyze` and `publish` accept the option.
 
 Effects:
 
-- filters analyze execution to selected configured artifacts;
+- selects explicit analyze targets; required configured prerequisites may be
+  reused or rebuilt before them;
 - filters publish rules that source `narratio.artifact.<name>`;
 - does not filter built-in transcript/bounds or explicitly configured
   `narratio.extraction.<name>` publish sources; and
@@ -285,6 +431,12 @@ Force publish only:
 narratio publish 2026-04-04
 ```
 
+Regenerate post-transcript artifacts without publishing:
+
+```bash
+narratio regenerate-artifacts 2026-04-04 --artifacts session_recap,player_handout
+```
+
 ## Output And Exit Behavior
 
 - Successful commands write their result or summary to standard output and

docs/config.md

@@ -38,17 +38,158 @@ If local session discovery fails and a `session_id` is known, Narratio attempts
 
 using configured object storage.
 
+The downloaded remote session file is command-scoped: Narratio removes it after
+the command finishes and records only the remote object provenance alongside
+the durable copied session input.
+
+### Read-only effective pipeline inspection
+
+`narratio config validate`, `narratio config show`, and `narratio config
+sources` use the same `--config`, `--campaign`, `--campaign-file`, and
+`--profile` selection rules as pipeline commands, but do not select, discover,
+or load a session. They do not read credential values or create runtime state.
+`narratio config diff <left-profile> <right-profile>` uses the same pipeline and
+campaign selectors, resolves each named profile independently from one parsed
+root source set, and does not accept a separate `--profile` flag.
+
+Campaign selection is optional only when the resolved pipeline has no
+`scriptorium.artifact_families`. When families are declared, Narratio selects a
+campaign through an explicit flag or `pipeline.campaigns.default_campaign_id`,
+then parses the campaign-owned party and expands concrete artifacts and any
+family publish rules before validation. `config validate` prints the resulting
+root, profile, and effective digest. `config show` emits the normalized
+effective pipeline YAML, with defaults and concrete expansion included but
+composition and family declarations omitted. `config sources` prints a stable
+source projection instead of effective values: root/import/profile/default
+ownership plus campaign/party and generated-family records. Canonical derived
+players trace to the party. The [CLI reference](cli.md#config-validate-config-show-config-sources-and-config-diff)
+owns command syntax and output conventions.
+
+`config diff` compares normalized field values rather than YAML text or source
+ownership. It emits sorted `added`, `removed`, and `changed` records, uses
+compact deterministic JSON values, treats lists atomically, and reports `no
+differences` when the complete effective configurations are equal. Concrete
+family members and generated publish rules participate after expansion; moving
+an equal value between eligible root/import sources does not create a
+difference.
+
+### Migrating to the maintained bundle
+
+Use the [production/testing bundle](../examples/production-testing/pipeline.yml)
+as the complete copyable migration reference. Split stable pipeline settings
+into explicit additive imports, place production/testing differences in one
+selected overlay, and retain a production `default_profile`. Convert campaign
+rosters to [canonical party input](integrations/party.md), then express
+character work as families. Inspect the result
+with `config validate`, `config show`, and `config sources`; use `config diff`
+to review profiles before running a session. Unversioned party documents are
+rejected.
+
+### Identity segments
+
+Campaign IDs (`campaign_id` and `default_campaign_id`), session IDs, previous
+session IDs, and Narratio run IDs are opaque portable segments. They must use
+only ASCII letters, digits, `.`, `_`, and `-`; empty values, `.`/`..`, path
+separators, drive forms, whitespace, control characters, and non-ASCII text are
+rejected. Narratio does not trim or rewrite these values. Existing manifests or
+remote state with an unsafe legacy identity must be migrated before use.
+
 ## Validation and Merge Rules
 
-- YAML decode is strict (`KnownFields(true)`): unknown fields fail load.
+- YAML decode is strict (`KnownFields(true)`) and accepts exactly one document:
+  unknown fields or trailing documents fail load.
+- A pipeline file may explicitly import additive YAML fragments through the
+  root-only `composition.imports` list. Imported files contribute fields to one
+  logical pipeline document; they do not override fields supplied by the root
+  or another import.
+- A root pipeline may declare named profiles. Exactly one profile is selected
+  by an option-aware caller or by `composition.default_profile`; a caller's
+  explicit selection takes precedence. Declaring profiles without either form
+  of selection is an error.
+- Configured timeout and retry-delay durations must be positive. An omitted
+  artifact timeout continues to inherit its configured Scriptorium timeout.
 - Session files must be concrete; unresolved `{{ ... }}` placeholders fail load.
 - Pipeline defaults are applied before validation.
 - Campaign and session identities must agree.
-- Stable files (`speakers_file`, `autocorrect_file`, `glossary_file`, `players_file`, `party_file`) resolve from session overrides when provided, otherwise from campaign defaults.
+- Required stable files (`speakers_file`, `autocorrect_file`, `glossary_file`,
+  `party_file`) are campaign-owned; the first three may be overridden by the
+  session. The optional `spell_catalog_file` also inherits a campaign value
+  when omitted by the session.
+- `party_file` is parsed when pipeline and campaign configuration are combined.
+  It must be a versioned [canonical party](integrations/party.md), is
+  campaign-owned and derives the players input internally. `players_file` and
+  session `party_file` are unsupported configuration keys.
 - Exactly one audio mode must be configured in session input:
   - local (`audio_dir` or `audio_files`), or
   - S3 (`audio_s3.prefix`).
 
+### Pipeline composition
+
+Large pipeline configurations may be split into explicitly named fragments and
+may declare one overlay per selectable profile:
+
+```yaml
+composition:
+  imports:
+    - config/storage.yml
+    - config/integrations.yaml
+  default_profile: production
+  profiles:
+    production:
+      overlay: profiles/production.yml
+    testing:
+      overlay: profiles/testing.yml
+
+campaigns:
+  root: /usr/local/share/narratio/campaigns
+```
+
+The maintained [production/testing bundle](../examples/production-testing/pipeline.yml)
+is a complete copyable example of this structure, including canonical-party
+artifact families.
+
+Imports are resolved relative to the directory containing the root pipeline
+file and are loaded in declaration order. Narratio does not scan directories or
+infer fragments. Each import must be a confined regular `.yml` or `.yaml` file:
+absolute paths, traversal, symlinks, directories, duplicate files, and an
+import of the root pipeline itself are rejected. Only the root pipeline may
+contain `composition`; nested composition is rejected.
+
+Composition is additive. A map may be extended by multiple files when every
+leaf is distinct, but a scalar, list, or map/list/scalar kind cannot be claimed
+more than once, even when the repeated values are identical. Conflict errors
+name the full field path and every source that claimed it. The assembled YAML is
+then decoded against the normal strict pipeline schema and defaults are applied
+once.
+
+Profile names are case-sensitive, non-empty, trimmed, and cannot contain
+control characters. If `profiles` is present, it must contain at least one
+entry and every entry must contain only an `overlay` path. An explicit profile
+selection overrides `default_profile`; unknown and explicitly empty selections
+fail. Narratio never selects the first profile implicitly and does not read a
+profile selection from the environment.
+
+Every declared overlay is resolved relative to the root pipeline directory and
+must satisfy the same confined regular-YAML-file rules as an import. Narratio
+parses every declared overlay even when it is not selected, then applies only
+the selected one. Maps merge recursively, overlay scalars replace base scalars,
+and overlay lists replace base lists completely. Explicit `false`, zero, empty
+lists, and empty maps remain meaningful. YAML null cannot delete a value, and
+kind changes are rejected. Profiles cannot inherit from or stack with other
+profiles, and overlays cannot import files or declare profiles.
+
+After composition, Narratio strictly decodes the result, applies centralized
+defaults once, resolves ordinary paths, and computes a deterministic effective
+configuration digest. The digest represents the normalized, secret-free
+runtime pipeline mapping; it excludes composition declarations, source
+provenance, profile identity, and raw environment secret values. Equivalent
+effective mappings therefore have the same digest regardless of how fields are
+split among the root and imports.
+
+An imported field has the same meaning it would have in a monolithic root
+pipeline. In particular, ordinary relative pipeline paths continue to resolve
+from the root pipeline directory, not from the importing fragment's directory.
+
 ## Minimal Working Configuration
 
 `pipeline.yml`
@@ -69,7 +210,6 @@ inputs:
   speakers_file: ./speakers.yml
   autocorrect_file: ./autocorrect.yml
   glossary_file: ./glossary.yml
-  players_file: ./players.yml
   party_file: ./party.yml
 ```
 
@@ -85,7 +225,13 @@ inputs:
 
 - Do not place raw secrets in YAML.
 - Use env var names in config (for example `pipeline.audita.llm_api_key_env`).
-- Optionally load env files from `pipeline.secrets.env_dir`.
+- Optionally load credential files from `pipeline.secrets.env_dir`. Each valid
+  environment-variable filename supplies one value; trailing CR/LF is removed.
+- An existing process environment value takes precedence over a credential file.
+- Credential directories and files must not be symlinks and must be regular,
+  bounded files (at most 8 KiB per value). On POSIX, provision the directory
+  with no group/other access (normally `0700`) and files with no group/other
+  access (normally `0600`).
 - Commands that need storage/auth load filesystem secrets before constructing adapters.
 
 ## Publish Configuration Summary
@@ -109,9 +255,6 @@ publish:
     - source: narratio.artifact.session_recap
       dest: artifacts/session_recap.md
       required: true
-  locks:
-    - source: narratio.artifact.session_recap
-      reason: manual post-publish edits
 ```
 
 Rules:
@@ -122,7 +265,8 @@ Rules:
   a rule names that source; the Notarius index and complete bundle are not
   publish sources.
 - `outputs[].required` defaults to `true`.
-- static locks (`pipeline.publish.locks`) merge with remote locks (`{session_prefix}/locks.yml`), with static locks taking precedence on duplicates.
+- publish locks are independent remote session objects managed with
+  `narratio session locks`; they are not pipeline configuration fields.
 
 ## Full Schema
 
@@ -130,13 +274,16 @@ Rules:
 
 | Field | Type | Required | Default / Rule |
 | --- | --- | --- | --- |
+| `composition.imports[]` | list of strings | No | explicit additive pipeline fragments relative to the root pipeline directory; `.yml` or `.yaml` regular files only |
+| `composition.default_profile` | string | Conditional | selected when profiles exist and no caller explicitly selects one; must name a declared profile |
+| `composition.profiles.<name>.overlay` | string | Conditional | required for every declared profile; one confined `.yml` or `.yaml` overlay relative to the root pipeline directory |
 | `pipeline.workspace.root` | string | No | `/var/lib/narratio` |
-| `pipeline.workspace.cleanup_after_publish` | bool | No | `false` |
+| `pipeline.workspace.cleanup_after_publish` | bool | No | `false`; selects the published run's workspace target for final cleanup and requires effective `pipeline.publish.enabled=true` and `pipeline.publish.upload_run=true` |
 | `pipeline.campaigns.root` | string | No | `/usr/local/share/narratio/campaigns` |
 | `pipeline.campaigns.default_campaign_id` | string | No | empty |
 | `pipeline.secrets.env_dir` | string | No | empty |
-| `pipeline.storage.backend` | string | No | empty |
-| `pipeline.storage.s3.bucket` | string | Conditional | required for S3 session-audio and for publish upload when backend is `s3` |
+| `pipeline.storage.backend` | string | No | `local`; supported values are `local` and `s3` (case-insensitive) |
+| `pipeline.storage.s3.bucket` | string | Conditional | required when backend is `s3` and S3 session-audio or publish upload is enabled |
 | `pipeline.storage.s3.root_prefix` | string | No | `dnd` |
 | `pipeline.storage.s3.region` | string | No | empty |
 | `pipeline.storage.s3.endpoint` | string | No | empty |
@@ -144,7 +291,7 @@ Rules:
 | `pipeline.storage.s3.access_key_id_env` | string | No | `OBJECT_STORAGE_KEY_ID` |
 | `pipeline.storage.s3.secret_access_key_env` | string | No | `OBJECT_STORAGE_KEY` |
 | `pipeline.spool.root` | string | No | `/var/spool/narratio` |
-| `pipeline.spool.delete_audio_after_publish` | bool | No | `false` |
+| `pipeline.spool.delete_audio_after_publish` | bool | No | `false`; selects the published run's spool-audio target for final cleanup and requires effective `pipeline.publish.enabled=true` and `pipeline.publish.upload_run=true` |
 | `pipeline.cache.root` | string | No | `/var/cache/narratio` |
 | `pipeline.cache.s3_audio` | bool | No | `true` |
 | `pipeline.publish.enabled` | bool | No | `true` |
@@ -153,10 +300,7 @@ Rules:
 | `pipeline.publish.outputs[].source` | string | Yes (per rule) | must reference built-in or configured artifact source |
 | `pipeline.publish.outputs[].dest` | string | Conditional | derived if omitted and source supports derivation |
 | `pipeline.publish.outputs[].required` | bool | No | `true` |
-| `pipeline.publish.locks[]` | list | No | empty |
-| `pipeline.publish.locks[].source` | string | Yes (per lock) | must reference supported publish source |
-| `pipeline.publish.locks[].reason` | string | No | empty |
-| `pipeline.whisperx.transcribe_url` | string | Yes | valid URL |
+| `pipeline.whisperx.transcribe_url` | string | Yes | absolute `http` or `https` URL |
 | `pipeline.whisperx.language` | string | No | `en` |
 | `pipeline.whisperx.timeout` | duration | No | `30m` |
 | `pipeline.whisperx.retries` | int | No | `3` |
@@ -205,6 +349,7 @@ Rules:
 | `pipeline.notarius.pipeline_id` | string | Conditional | required when enabled |
 | `pipeline.notarius.timeout` | duration | No | `3h`; must be positive |
 | `pipeline.notarius.working_directory` | string | No | directory containing resolved `config_path`; relative paths resolve from the pipeline file directory |
+| `pipeline.notarius.references` | map[string]string | No | empty; maps normalized Notarius selectors to supported prepared Narratio source IDs; maximum 256 entries |
 | `pipeline.notarius.outputs` | map | Conditional | at least one entry when enabled |
 | `pipeline.render.enabled` | bool | No | `true` |
 | `pipeline.render.format` | string | No | `markdown` (only supported value) |
@@ -217,9 +362,46 @@ Rules:
 | `pipeline.scriptorium.timeout` | duration | No | `10m` |
 | `pipeline.scriptorium.render_debug` | bool | No | `false` |
 | `pipeline.scriptorium.artifacts` | map | No | empty |
-| `pipeline.notification.backend` | string | No | empty |
-| `pipeline.notification.recipient` | string | No | empty |
-| `pipeline.notification.timeout` | duration | No | empty |
+| `pipeline.scriptorium.artifact_families` | map | No | empty; expands one ordinary artifact per canonical party character |
+| `pipeline.notification.mode` | string | No | `noop`; the only supported notification mode until a provider is implemented |
+
+### Notarius Reference Bindings
+
+`pipeline.notarius.references` maps a Notarius CLI selector to a prepared
+Narratio source, not to a filesystem path:
+
+```yaml
+notarius:
+  references:
+    glossary: narratio.input.glossary
+    party: narratio.input.party
+    players: narratio.input.players
+    spell_catalog: narratio.input.spell_catalog
+```
+
+Supported sources are `narratio.input.party`, `narratio.input.players`,
+`narratio.input.glossary`, and `narratio.input.spell_catalog`. Each map entry is
+required by its presence: omit a binding when the selected Notarius pipeline
+does not need it. A spell-catalog binding additionally requires an effective
+campaign or session `spell_catalog_file`.
+
+Selectors accept Notarius's `slot`, `chunk.slot`, `lane.slot`,
+`lane.extract.slot`, `lane.merge.slot`, and `lane.normalize.slot` forms.
+Narratio trims whitespace around
+selectors and their dot-separated components, rejects empty components and
+`=`, rejects duplicate normalized selectors, and limits the map to 256 entries.
+It validates only selector structure and the prepared source vocabulary;
+Notarius owns target-slot declarations and media compatibility.
+
+Before extraction, Narratio resolves every binding from the current prepared
+session manifest and streams it into a verified invocation-local snapshot whose
+absolute path is passed to Notarius. Missing, unsafe, empty,
+changed-during-copy, or checksum-inconsistent prepared evidence fails with
+guidance to force `prepare`. Bindings are sorted by normalized selector and are
+part of extraction fingerprint and resume identity. See the
+[Notarius integration contract](./integrations/notarius.md) for the subprocess
+boundary and the [complete example](../examples/pipeline.full.annotated.yml)
+for a copyable configuration.
 
 ### Notarius Output Entries
 
@@ -248,7 +430,7 @@ For each `pipeline.scriptorium.artifacts.<name>`:
 | Field | Type | Required | Rule |
 | --- | --- | --- | --- |
 | `enabled` | bool | No | `false` if omitted |
-| `depends_on[]` | list[string] | No | must reference configured artifact keys; no self-reference; enabled graph must be acyclic |
+| `depends_on[]` | list[string] | No | must reference configured artifact keys; no self-reference; configured graph must be acyclic |
 | `render_debug` | bool | No | per-artifact override |
 | `prompt_id` | string | Conditional | required when artifact is enabled |
 | `profile_id` | string | No | empty |
@@ -259,41 +441,97 @@ For each `pipeline.scriptorium.artifacts.<name>`:
 
 Narratio adds `session_id=narratio-session-<session_id>` to every Scriptorium request for sticky upstream LLM routing. If an artifact config sets `vars.session_id`, Narratio replaces that value before invoking Scriptorium. Use a different variable name if a prompt needs the raw Narratio session ID as content.
 
+Without `--artifacts`, analyze executes enabled configured artifacts. With an
+explicit `--artifacts` list, the exact named configured artifacts are the
+one-invocation targets even if their `enabled` values are false. Analyze closes
+those targets over `depends_on`: a current prerequisite is reused, while a
+stale, missing, or failed prerequisite is rebuilt before its dependent.
+Unrelated artifacts are not executed. Named targets and any prerequisite that
+may require rebuilding must therefore have valid executable fields. This
+override affects analyze planning only; publish uses the list only to filter
+configured `narratio.artifact.<name>` output rules.
+
 For each artifact input `pipeline.scriptorium.artifacts.<name>.inputs.<input_name>`:
 
 | Field | Type | Required | Rule |
 | --- | --- | --- | --- |
 | `source` | string | Yes | built-in runtime source, prepared input source, `narratio.extraction.<name>`, `narratio.artifact.<name>`, or `narratio.previous_session.artifact.<name>` |
-| `artifact` | string | No | optional passthrough adapter field |
-| `path` | string | No | optional passthrough adapter field |
 | `required` | bool | No | optional input requirement |
 
+`artifact` and `path` are obsolete and rejected by strict configuration
+loading. Use the canonical `source` identifier to select the input; Narratio
+does not provide adapter-specific input passthrough fields.
+
+### Scriptorium Artifact Families
+
+`pipeline.scriptorium.artifact_families` declares a shared artifact template
+for every canonical campaign character. Configuration resolution expands each
+family into ordinary `pipeline.scriptorium.artifacts` entries before analyze
+planning or Scriptorium invocation. Party parsing rejects unsupported document
+schemas before family expansion.
+
+For each `pipeline.scriptorium.artifact_families.<name>`:
+
+| Field | Type | Required | Rule |
+| --- | --- | --- | --- |
+| `enabled`, `prompt_id`, `profile_id`, `timeout`, `render_debug`, `depends_on`, `inputs`, `vars` | ordinary artifact fields | No | copied to each generated artifact under the corresponding ordinary rules |
+| `for_each` | string | Yes | exactly `party.characters` |
+| `output_path_pattern` | string | Yes | safe path beneath `artifacts/` with exactly one `{character_id}` token and no other brace syntax |
+| `member_vars` | map | No | maps an ordinary Scriptorium variable name to a supported canonical character selector |
+| `member_dependencies` | list | No | unique family keys; each generated member depends on the corresponding generated member of each listed family |
+| `publish` | map | No | typed family publish policy (`enabled`, `required`, `dest_pattern`) expanded into concrete publish outputs when enabled |
+
+Generated keys are `<family>_<character_id>` and generated output paths must
+not collide with explicit artifacts or another generated artifact. Families
+expand even when disabled; normal analyze selection still omits disabled
+artifacts unless they are explicitly selected by their concrete key.
+
+Supported `member_vars` selectors are `character_id`, `player.name`,
+`character.name`, `character.class_summary`, and `character.alias_summary`.
+Their resolved values are strings. A member variable may not reuse a static
+`vars` name; `session_id` remains owned and overwritten by Narratio as for any
+other Scriptorium artifact.
+
+Within a family only, an input source may use
+`narratio.member_artifact.<family>`. The referenced family must be named in
+that family's `member_dependencies`; resolution rewrites the source to the
+corresponding ordinary `narratio.artifact.<family>_<character_id>` source.
+This syntax is rejected in explicit artifacts and never reaches runtime stages
+or Scriptorium.
+
+### Notifications
+
+Narratio currently supports only `notification.mode: noop`, which is also the
+default when the section is omitted. The notify stage performs no delivery in
+this mode. Backend, recipient, timeout, and other provider settings are
+rejected by strict configuration loading until Narratio has a provider
+integration.
+
 ### Campaign
 
 | Field | Type | Required | Notes |
 | --- | --- | --- | --- |
-| `campaign_id` | string | Yes | canonical campaign identity |
+| `campaign_id` | string | Yes | canonical opaque campaign identity |
 | `session_template_file` | string | No | used by `session init` when set |
 | `inputs.speakers_file` | string | Yes | stable input default |
 | `inputs.autocorrect_file` | string | Yes | stable input default |
 | `inputs.glossary_file` | string | Yes | stable input default |
-| `inputs.players_file` | string | Yes | stable input default |
-| `inputs.party_file` | string | Yes | stable input default |
+| `inputs.party_file` | string | Yes | stable campaign party source; relative paths resolve from `campaign.yml` |
+| `inputs.spell_catalog_file` | string | No | optional spell-catalog overlay default; required when a Notarius reference selects `narratio.input.spell_catalog` |
 
 ### Session
 
 | Field | Type | Required in session file | Notes |
 | --- | --- | --- | --- |
-| `session_id` | string | Yes | must match CLI session target when provided |
-| `previous_session_id` | string | No | must not equal `session_id` |
-| `campaign` | string | No | filled from `campaign_id` during resolve if omitted |
+| `session_id` | string | Yes | opaque identity; must match CLI session target when provided |
+| `previous_session_id` | string | No | opaque identity; must not equal `session_id` |
+| `campaign` | string | No | opaque identity; filled from `campaign_id` during resolve if omitted |
 | `date` | string | No | metadata |
 | `title` | string | No | metadata |
 | `inputs.speakers_file` | string | No | overrides campaign stable input |
 | `inputs.autocorrect_file` | string | No | overrides campaign stable input |
 | `inputs.glossary_file` | string | No | overrides campaign stable input |
-| `inputs.players_file` | string | No | overrides campaign stable input |
-| `inputs.party_file` | string | No | overrides campaign stable input |
+| `inputs.spell_catalog_file` | string | No | overrides the optional campaign spell catalog; empty or omitted inherits the campaign value |
 | `inputs.audio_dir` | string | Conditional | local audio mode |
 | `inputs.audio_files[]` | list[string] | Conditional | local audio mode |
 | `inputs.audio_s3.prefix` | string | Conditional | S3 audio mode |
@@ -301,6 +539,20 @@ For each artifact input `pipeline.scriptorium.artifacts.<name>.inputs.<input_nam
 Audio rules:
 
 - configure local mode (`audio_dir` or `audio_files`) or S3 mode (`audio_s3.prefix`), not both.
+- `audio_s3` requires `pipeline.storage.backend: s3` and a configured S3 bucket.
+
+### Storage backend selection
+
+`local` is the default and disables remote object-store operations. Configure
+`s3` explicitly before supplying `storage.s3`; a populated S3 block does not
+select a backend on its own. Unknown backend names and an S3 block paired with
+`local` are rejected during configuration validation.
+
+### Previous-session expectation
+
+`previous_session_id` is optional in a session file. When a command supplies
+`--previous-session-id`, however, the session file must contain the same value;
+an omitted or different value is rejected before the command performs work.
 
 ## Maintained Examples
 

docs/development.md

@@ -10,6 +10,11 @@ polished transcripts and generated artifacts. Start with the
 [Architecture](policy/architecture.md) for normative system boundaries, and the
 [Internal Overview](internal/overview.md) for implemented component ownership.
 
+## Go Prerequisite
+
+Maintained development and verification require Go 1.26. Use the official Go
+1.26 toolchain before running repository commands.
+
 ## What To Read
 
 | When working on | Read | Why |
@@ -25,19 +30,35 @@ polished transcripts and generated artifacts. Start with the
 | Adapters or external tool contracts | [Adapter Internals](internal/adapters.md) and [Integration Contracts](integrations/README.md) | The internal guide owns adapter composition and mechanics; integration documents own external formats and protocols. |
 | Manifests, artifacts, workspace paths, or publish behavior | [Manifest Internals](internal/manifest.md), [Artifact Internals](internal/artifacts.md), [Workspace Internals](internal/workspace.md), [Publish Internals](internal/stage-publish.md), and [Operations](operations.md) | These separate implementation state and resolution from operator-visible layout and lifecycle. |
 | Maintained configuration or input examples | [Configuration](config.md) and [Examples](../examples/README.md) | The reference owns field meanings; the examples directory owns complete copyable files. |
-| Proposed or unimplemented behavior | [Roadmap](roadmap/) | Future work belongs only in roadmap documentation until implemented. |
+| Preparing, validating, or publishing a release | [Release Procedure](release.md) | The maintainer procedure owns version selection, candidate validation, guarded tag publication, and optional later CI inspection. |
+| Proposed or unimplemented behavior | `docs/roadmap/` | Future work belongs only in roadmap documentation until implemented. |
 
 For an existing subsystem, also inspect its focused tests and package-level
 contracts before changing behavior.
 
 ## Validation
 
-Use focused package tests while iterating. Run the repository-wide checks when a
-change affects shared contracts, application behavior, or maintained
-documentation examples:
+Use focused package tests while iterating. Every pull request and push runs the
+following repository-wide checks before it can be accepted:
 
 ```sh
 go test ./...
+go test -race ./...
 go vet ./...
-go build ./cmd/narratio
+go build ./...
+go test ./internal/doccheck
+go test ./internal/config -run '^TestExamplesLoadAndValidate$'
 ```
+
+The documentation check verifies local Markdown links and the dependency graph
+of the Woodpecker workflows. The configuration check loads every maintained
+pipeline and session example. Tag CI reuses this validation path before its
+asynchronous asset publication; the maintainer release boundary is documented
+in the [Release Procedure](release.md).
+
+Woodpecker also runs `go test -race -shuffle=on -count=3 ./...` on its scheduled
+job to expose ordering and repeatability defects. Current runners cross-compile
+for macOS and Windows, but do not provide native macOS or Windows execution.
+Those cross-builds establish compilation only, not platform-equivalent runtime
+evidence. Add native checks only when official runner labels and successful
+native-run evidence are available.

docs/integrations/README.md

@@ -21,6 +21,7 @@ focused stage documents.
 - [Audita](./audita.md): transcript polishing (`audita process`).
 - [Notarius](./notarius.md): complete pipeline execution and safe JSON bundle
   discovery (`notarius run`).
+- [Party](./party.md): canonical campaign roster input.
 - [Seriatim](./seriatim.md): merge, normalize, trim, and render operations.
 - [Scriptorium](./scriptorium.md): artifact generation and debug rendering
   (`scriptorium run|render`).

docs/integrations/audita.md

@@ -15,7 +15,12 @@ runner composition is documented in
 - required transcript/glossary/output/work-dir paths;
 - optional report path (required when report mode is enabled);
 - generated config and stdout/stderr log paths;
-- optional module/model/base-url/config/output-schema/concurrency settings.
+- optional per-invocation module override.
+
+The constructed runner owns static Audita settings: binary, timeout,
+credentials, default modules, model and endpoint settings, validation and output
+settings, report mode, and concurrency. The `polish` stage supplies only
+invocation-specific paths and may override modules for that invocation.
 
 ## Result Contract
 `PolishResult` returns:
@@ -41,6 +46,9 @@ Run fails for:
 - invalid processed transcript JSON (`segments` array required);
 - invalid report JSON when reporting is enabled.
 
+Processed transcript JSON is limited to 64 MiB and optional report JSON to 16
+MiB. Both must be regular files without symlinked path components.
+
 Failure results still include output/log/config/exit metadata for diagnostics.
 
 ## Deterministic Behavior

docs/integrations/notarius.md

@@ -7,12 +7,14 @@ lanes from the final trimmed Seriatim transcript. Narratio owns invocation,
 safe bundle discovery, lane selection, and its own artifact metadata. Notarius
 owns pipeline definitions, lane schemas, the receipt, and bundle formats.
 
-Canonical Notarius references:
+Canonical Notarius v0.6.0 references:
 
-- [Subprocess consumer contract](https://gitea.maximumdirect.net/eric/notarius/src/branch/main/docs/consumers/subprocess.md)
-- [D&D pipeline and lane contracts](https://gitea.maximumdirect.net/eric/notarius/src/branch/main/docs/consumers/dnd-pipeline.md)
-- [Run-result receipt](https://gitea.maximumdirect.net/eric/notarius/src/branch/main/docs/integrations/run-result.md)
-- [JSON output bundle](https://gitea.maximumdirect.net/eric/notarius/src/branch/main/docs/integrations/json-output.md)
+- [CLI reference](https://gitea.maximumdirect.net/eric/notarius/src/tag/v0.6.0/docs/cli.md)
+- [Subprocess consumer contract](https://gitea.maximumdirect.net/eric/notarius/src/tag/v0.6.0/docs/consumers/subprocess.md)
+- [D&D pipeline and lane contracts](https://gitea.maximumdirect.net/eric/notarius/src/tag/v0.6.0/docs/consumers/dnd-pipeline.md)
+- [Run-result receipt](https://gitea.maximumdirect.net/eric/notarius/src/tag/v0.6.0/docs/integrations/run-result.md)
+- [JSON output bundle](https://gitea.maximumdirect.net/eric/notarius/src/tag/v0.6.0/docs/integrations/json-output.md)
+- [D&D spell-catalog overlay](https://gitea.maximumdirect.net/eric/notarius/src/tag/v0.6.0/docs/integrations/dnd-spell-catalog-overlays.md)
 
 The [complete Narratio example](../../examples/pipeline.full.annotated.yml)
 records the exact current constraints for all ten D&D lanes. Treat the linked
@@ -23,39 +25,83 @@ duplicate the complete schemas.
 
 When `pipeline.notarius.enabled` is true, Narratio resolves the executable,
 configuration path, input path, output directory, and working directory to
-absolute paths and invokes:
+absolute paths. Narratio requires the Notarius v0.6.0 CLI contract when
+references are configured and invokes each binding as a separate argument
+before `--json`:
 
 ```text
-notarius run <pipeline_id> --config <config_path> --input <trimmed_json> --output-dir <staging_dir> --json
+notarius run <pipeline_id> --config <config_path> --input <trimmed_json> --output-dir <staging_dir> [--reference <selector>=<verified_snapshot_path>]... --json
 ```
 
+Reference paths are absolute invocation-local snapshots streamed from the
+manifest-verified canonical files prepared inside the current Narratio session
+workspace. Narratio verifies snapshot checksum and size before and after the
+subprocess, and passes only configured bindings, ordered lexically by normalized
+selector, as direct argument-vector entries without shell interpretation. A CLI
+binding takes precedence over a matching external path in Notarius
+configuration. Narratio never emits `--without-reference`.
+
+For canonical party configuration, the `party` binding is the unchanged,
+validated authored roster and the `players` binding is its generated
+projection. Both retain their established `narratio.input.party` and
+`narratio.input.players` source IDs, and both are resolved from the prepared
+manifest rather than from campaign configuration at extraction time.
+
+The maintained D&D boundary binds only the four campaign-owned external slots:
+
+```text
+notarius run dnd-session \
+  --config <absolute config path> \
+  --input <absolute trimmed transcript path> \
+  --output-dir <absolute staging directory> \
+  --reference glossary=<absolute verified glossary snapshot> \
+  --reference party=<absolute verified party snapshot> \
+  --reference players=<absolute verified players snapshot> \
+  --reference spell_catalog=<absolute verified spell catalog snapshot> \
+  --json
+```
+
+The spell-catalog binding is omitted when the campaign does not maintain that
+optional overlay. Registry, scene-description, combat-turn, and occurrence
+handoffs generated during the same Notarius run remain in Notarius pipeline
+composition and must not be emitted as CLI references. The linked CLI and D&D
+consumer documents own selector targeting, declared slots, media compatibility,
+and generated-handoff collision rules.
+
 Standard output is reserved for the JSON receipt. Standard error is captured
 separately as diagnostic output. Narratio applies the configured timeout and
 does not interpret stdout as a receipt unless the subprocess exits successfully.
 It does not pass a Narratio session ID or run `notarius config validate`
-automatically; the configured working directory and inherited environment
-apply to the subprocess.
+automatically; the configured working directory and Narratio's minimal child
+environment apply to the subprocess.
 
 ## Accepted Result
 
-Narratio currently accepts receipt schema `notarius.run-result.v1`. The receipt
+Narratio's supported invocation baseline is Notarius v0.6.0. The accepted
+receipt remains `notarius.run-result.v2`; reference flags do not change the
+receipt or ten-lane output contract. The receipt
 must identify the configured pipeline, and its `index_file` must be exactly
 `index.json` beneath the reported bundle root. The production index must name
-the management files exactly as `manifest.json`, `rejected.json`, and
-`warnings.json`. All receipt, index, and lane paths must stay inside that
-bundle; symlinks and non-regular lane payloads are rejected.
+the management files exactly as `manifest.json`, `rejected.json`,
+`warnings.json`, and `diagnostics.json`. All receipt, index, and lane paths must
+stay inside that bundle; symlinks and non-regular lane payloads are rejected.
 
 Supported receipt and index shapes tolerate unknown fields for forward
 compatibility, while required identity, validation, count, manifest,
-rejection, warning, and lane-list fields remain mandatory. Narratio applies
-bounded reads to the receipt, index, rejection, and warning documents. Optional
-chunk-map and evidence-context descriptors must carry their complete generic
-contract metadata when present.
+rejection, warning, diagnostic, and lane-list fields remain mandatory.
+Narratio applies bounded reads to the receipt, index, rejection, warning, and
+diagnostic documents. Warning and diagnostic envelopes, group counts,
+occurrence counts, truncation state, framework-owned origins, and
+receipt-to-bundle counts must be internally consistent. Optional chunk-map and
+evidence-context descriptors must carry their complete generic contract
+metadata when present.
 
 For every entry in `pipeline.notarius.outputs`, Narratio requires exactly one
 index descriptor with the configured lane ID, media type, schema ID, schema
 version, and, when configured, module key. Missing, duplicate, rejected, or
-incompatible required lanes fail extraction even if Notarius exited zero.
+incompatible required lanes fail extraction even if Notarius exited zero. A
+configured lane whose v2 validation summary is `rejected` or `incomplete` also
+fails extraction.
 Unconfigured lanes may remain in the preserved bundle but do not become
 selectable Narratio sources.
 
@@ -72,10 +118,13 @@ only explicitly named lane sources; `--artifacts` never selects Notarius lanes.
   staged bundle is promoted to durable storage.
 - Contract and external provenance metadata are preserved on lane artifact
   records and through explicit publication.
+- Undeclared selectors, incompatible reference files, and external/generated
+  reference collisions are Notarius errors and fail extraction normally.
 
-Rejection and warning summaries retain structured stage, scope, lane, and
-reason-code fields for diagnostics without exposing free-form external messages
-or reading lane payload bodies.
+Rejection, validation, warning, and diagnostic summaries retain bounded stable
+identity, category, origin, reason-code, status, and occurrence fields without
+copying free-form external messages into Narratio manifest metadata or reading
+lane payload bodies.
 
 Configuration fields and defaults are in [Configuration](../config.md).
 Operator paths, rerun procedures, and bundle retention are in

docs/integrations/party.md

@@ -0,0 +1,71 @@
+# Canonical Party Input
+
+`party.yml` is a campaign-owned roster input. It must be a single, versioned
+`narratio.party.v1` document when Narratio resolves a pipeline, campaign, and
+session together.
+
+```yaml
+schema_version: narratio.party.v1
+
+characters:
+  arannis:
+    player:
+      name: Eric
+    character:
+      name: Arannis
+      alias:
+        - Ari
+        - The Grey Owl
+      classes:
+        - name: wizard
+          level: 8
+```
+
+`characters` is a non-empty mapping. Each key is a stable character ID using
+the configured-artifact key grammar: a lowercase ASCII letter followed by zero
+or more lowercase ASCII letters, digits, or underscores. Character order is
+preserved where roster order matters.
+
+Every entry has `player.name`, `character.name`, and a non-empty
+`character.classes` list. Class entries require a non-empty `name` and may
+include a positive integer `level`. The optional, intentionally singular
+`character.alias` field is a list. Names, aliases, and class names must be
+non-empty, trimmed display strings without control characters. Character names
+and aliases must be unique across the full roster under Unicode-aware
+case-insensitive comparison; player names may repeat.
+
+The document has exactly one YAML document and accepts no unknown fields.
+`schema_version` is required: a missing, wrong, or malformed value is an error.
+
+## Migration
+
+Unversioned party inputs are rejected. Replace each legacy party document with
+the versioned structure above, move each roster entry under `characters`, and
+remove separate player and session-party settings: those keys are unsupported.
+
+The configuration rules and source-relative path behavior are defined in the
+[Configuration Reference](../config.md).
+
+## Derived players document
+
+During `prepare`, Narratio copies the canonical party source bytes unchanged
+to `inputs/party.yml` and writes this deterministic players-only projection to
+`inputs/players.yml`:
+
+```yaml
+schema_version: narratio.players.v1
+players:
+    - name: Eric
+      character:
+        id: arannis
+        name: Arannis
+        alias:
+            - Ari
+            - The Grey Owl
+```
+
+There is one entry per character, sorted by stable character ID. Repeated
+player names remain separate entries. The optional `alias` list retains its
+declared order and is omitted when empty. The projection carries no class
+data. Its prepared manifest record is marked `derived_from_party`; it is not a
+separate user-provided `players_file`.

docs/integrations/scriptorium.md

@@ -46,6 +46,9 @@ Run behavior:
 - `run` exit code `2` is mapped to `ValidationFailed=true`;
 - successful subprocess still fails if output file is missing or empty.
 
+Each artifact result is limited to 64 MiB and must be a regular file without
+symlinked path components.
+
 Render behavior:
 - subprocess errors propagate;
 - output file must exist and be non-empty.

docs/integrations/seriatim.md

@@ -41,6 +41,8 @@ Invocation fails on:
 - empty render output files.
 
 When report paths are provided/enabled, report files must parse as JSON.
+Each Seriatim JSON or rendered-text result is limited to 64 MiB and must be a
+regular file without symlinked path components.
 
 ## Deterministic Behavior
 - argument ordering is deterministic per command construction.

docs/integrations/whisperx.md

@@ -17,6 +17,11 @@ Narratio sends an HTTP `POST` to the configured transcription URL using
 The server must return a `2xx` response whose body is valid JSON. Narratio does
 not currently require a more specific response schema at this boundary.
 
+The transcription URL must be an absolute `http` or `https` URL. The audio body
+is streamed through a fresh multipart writer for every attempt, so its memory
+use is bounded by the transport buffer rather than by the complete audio file.
+WhisperX response acquisition is capped at 10 MiB.
+
 ## Request And Result Contract
 
 Each adapter request identifies a speaker, a readable audio file, and the
@@ -40,7 +45,7 @@ transcript output.
 
 ## Validation And Failure Semantics
 
-Client construction rejects a missing or invalid absolute transcription URL,
+Client construction rejects a missing or non-HTTP(S) absolute transcription URL,
 a missing language, a non-positive timeout, negative retries, or a negative
 retry delay. A request fails before transmission when its audio or output path
 is missing.

docs/internal/adapters.md

@@ -35,31 +35,66 @@ Adapters do not own:
 
 ## Default Wiring
 
-`internal/app/runner.go` initializes default adapters when not injected:
+The application composes default adapters per invocation when they were not
+injected through the stage environment, and only when the selected execution
+plan needs them:
 
-- WhisperX HTTP client from pipeline config.
-- Seriatim subprocess runner.
-- Audita subprocess runner.
-- Scriptorium subprocess runner.
-- Notarius subprocess runner when extraction is enabled.
-- Noop notifier (`notify.NoopSender`).
+- WhisperX HTTP client for `transcribe`.
+- Seriatim subprocess runner for `merge`, `normalize`, `trim`, or `render`.
+- Audita subprocess runner for `polish`.
+- Scriptorium subprocess runner for `trim` or `analyze`.
+- Notarius subprocess runner for `extract` when extraction is enabled.
+- Noop notifier (`notify.NoopSender`) for `notify`.
 - Object store only when required by selected stages/config.
 
-Notarius is composed only when extraction is enabled; the extract stage owns
-receipt, bundle, and configured-lane policy rather than the adapter.
+Remote publish locks are loaded only for a selected, enabled publish that
+uploads a run. Shared session lifecycle setup still applies to every selected
+range, but an unselected integration is neither initialized nor validated by
+application-owned composition. Constructor, clock, randomness, remote-lock,
+and post-publish deletion boundaries are scoped to the invocation; stages still
+receive their collaborators through the stage environment. Each selected stage
+retains its own fail-fast configuration and input validation.
 
-Object-store construction goes through `newCommandObjectStore`, which loads
-configured filesystem secrets before adapter initialization.
+`session plan` is outside production adapter composition. It performs
+resume validation and models selected transitions against cloned manifest
+state without constructing or invoking stage-execution adapters. The shared
+command configuration loader may still use object storage to retrieve a missing
+remote session file before planning begins.
+
+Notarius is composed only when extraction is enabled; the extract stage owns
+prepared reference resolution, receipt, bundle, and configured-lane policy.
+The adapter validates the ordered selector/absolute-path pairs and is the sole
+owner of serializing them as repeated `--reference` arguments before `--json`.
+
+Application-owned object-store construction loads configured filesystem
+secrets before invoking the invocation's storage factory. Production commands
+use the concrete storage adapter constructor; focused tests can supply an
+in-memory backend without changing package state.
 
 ## Failure Semantics
 
 - Constructor errors fail stage execution setup early.
 - Runtime adapter errors propagate to stage code and then manifest failure handling.
 - Subprocess adapters persist stage logs/generated configs through stage-managed paths.
+- Shared subprocess execution keeps private lifecycle mechanics separate from
+  Narratio's environment, diagnostics, redaction, and error policy. It starts
+  an owned process group on Linux/macOS or a
+  kill-on-close job object on Windows. Every terminal path disposes of that
+  owned tree before returning. After a natural leader exit, Unix checks for
+  remaining group members and uses bounded graceful then forceful termination;
+  Windows closes the job so kill-on-close applies. Cancellation, deadlines, and
+  diagnostic limits use the same terminal disposal path without losing their
+  original result classification. Child environments contain only the execution
+  baseline and adapter-specified values; configured credentials are explicit
+  sensitive values. Stdout and stderr are redacted while streaming into separate
+  8 MiB diagnostic captures; a bounded wait closes a stream retained by a
+  departed leader's descendant. Unsupported platforms reject owned command
+  execution.
 
 ## Implementation And Tests
 
-- Composition: `internal/app/runner.go`, `internal/app/object_store.go`
+- Composition: `internal/app/runner_composition.go`,
+  `internal/app/runner_dependencies.go`, `internal/app/object_store.go`
 - Shared subprocess mechanics: `internal/adapters/subprocess`
 - Focused adapters: `internal/adapters/{whisperx,seriatim,audita,scriptorium,notarius,storage,notify}`
 - `internal/adapters/whisperx/http_test.go`

docs/internal/artifacts.md

@@ -20,8 +20,8 @@ The internal registry recognizes these stable built-in source IDs:
 - `narratio.transcript.final_trimmed_markdown`
 - `narratio.bounds.session`
 
-Registry entries bind each ID to its producer, output kind, canonical fallback,
-and content validator. The focused stage documents own their input/output flow;
+Registry entries bind each ID to its producer, output kind, and content
+validator. The focused stage documents own their input/output flow;
 [Configuration](../config.md) owns where operators may select these IDs.
 
 ## Configured, Extraction, And Previous-Session Sources
@@ -30,23 +30,61 @@ and content validator. The focused stage documents own their input/output flow;
 - extraction source ID format: `narratio.extraction.<output_key>`
 - previous-session source ID format: `narratio.previous_session.artifact.<artifact_key>`
 
-All formats are validated by strict source-policy rules. Extraction sources are
-registered only from `pipeline.notarius.outputs`; the Notarius index has no
-selectable source ID.
+All formats are validated by strict source-policy rules. Configured artifact and
+extraction keys use `^[a-z][a-z0-9_]*$`; source parsers never normalize an
+unrecognized token into a valid source. Extraction sources are registered only
+from `pipeline.notarius.outputs`; the Notarius index has no selectable source
+ID.
+
+Prepared stable source IDs are `narratio.input.players`,
+`narratio.input.party`, `narratio.input.glossary`, and
+`narratio.input.spell_catalog`. Artifact policy owns their canonical manifest
+kind and prepared filename vocabulary. Canonical party mode preserves the
+party source bytes in the party record and supplies the players record from the
+deterministic `derived_from_party` projection; both remain ordinary prepared
+source IDs for consumers.
 
 ## Runtime Catalog
 
 `ArtifactCatalog` tracks:
 
 - `planned`: source registered for run context;
-- `executable`: selected and enabled for analyze execution;
-- `available`: local file exists and validates;
+- `executable`: included in the effective analyze artifact set;
+- `available`: the source's canonical evidence owner validates its current
+  manifest record and durable bytes;
 - `provenance`: availability source.
 
+Configured definitions are always registered. Without an explicit selection,
+the effective analyze set contains enabled definitions. With `--artifacts`, the
+exact named configured definitions become the effective set for that invocation,
+regardless of their `enabled` value. The effective-set resolver itself does not
+expand dependencies; the analyze work planner closes those targets over their
+configured prerequisite graph. Availability is separate from executability.
+Configuration may normalize a family selection into its concrete generated
+members before this resolver runs. The effective set retains optional family
+and character origin metadata, but its keys, catalog sources, and runtime
+lookups remain concrete configured-artifact identities.
+Family publish policies are likewise expanded into ordinary configured-source
+publish rules during configuration resolution.
+Configured outputs, including non-executable prerequisites, become available
+only when the versioned analyze state identifies a current result whose source,
+contract, canonical configured path, size, and checksum match a confined
+no-follow regular file. An incidental canonical file is unavailable, and a
+manifest with an unsupported aggregate-only representation is rejected before
+catalog construction.
+Extraction entries are registered from configuration and become available only
+after compatible extraction evidence is hydrated.
+
+During an analyze invocation, a newly validated and atomically materialized
+configured output is marked available with its producer run ID, contract,
+checksum, and size. Later scheduled dependents therefore observe the same
+semantic identity whether their prerequisite was reused from current manifest
+evidence or produced earlier in the invocation.
+
 Current provenance values:
 
 - `generated.current_analyze_run`
-- `filesystem.disabled_artifact_output`
+- `manifest.current_analyze_artifact`
 - `manifest.inputs.previous_cache`
 - `current_session.previous_cache`
 
@@ -54,27 +92,65 @@ Current provenance values:
 
 Built-ins:
 
-1. manifest producer outputs (when present)
-2. canonical session-path fallback
+- resolve only from the current manifest's succeeded registered producer;
+- require exactly one output with the registered source ID and output kind, a
+  safe session-rooted path, producer run ID, canonical checksum, and valid
+  content; and
+- verify the registered checksum against the durable bytes. Incidental files,
+  canonical filenames, duplicate outputs, failed/stale producer records, and
+  malformed evidence are unavailable.
 
 Configured sources (`narratio.artifact.*`):
 
-- resolve only through runtime catalog availability.
+- resolve only through runtime catalog availability;
+- use the shared typed analyze-evidence inspection in
+  `analyze_evidence.go` for prior current-session results;
+- require the supported analyze-state and fingerprint versions, a `current`
+  record for the exact configured key and source ID, a complete contract, the
+  configured canonical relative path, positive stored size, and stored
+  checksum matching bytes read from a confined no-follow regular file; and
+- treat non-current statuses, malformed records, removed keys,
+  unsafe or missing files, and size/checksum mismatches as unavailable without
+  rewriting manifest state. Catalog construction iterates current
+  configuration, so removed or renamed records are not advertised.
+
+`narratio.member_artifact.*` is not a runtime source family. Configuration
+resolution accepts it only in an artifact-family declaration and rewrites it
+to the corresponding configured source before this catalog is built.
+
+Prepared stable sources (`narratio.input.*`):
+
+- resolve only from the current manifest's exact prepared-input record;
+- require the policy-owned canonical path below the session root, a confined
+  non-symlink regular file, a non-empty payload, and a matching SHA-256
+  checksum; and
+- return an immutable source/path/checksum/size identity shared by extract and
+  analyze rather than falling back to campaign/session source paths.
 
 Extraction sources (`narratio.extraction.*`):
 
-- use the shared registration and manifest hydration path in
-  `extraction_catalog.go`;
+- use the shared typed bundle evidence inspection in `extraction_evidence.go`;
 - require a current successful extract record with the exact configured source,
   compatible contract and Notarius provenance, a confined regular durable
-  payload, and matching checksum; and
+  payload, matching checksum, and the current resolved trimmed-transcript
+  identity;
+- remain unavailable unless catalog hydration receives valid evidence. Resume
+  treats absent or obsolete evidence as a rerun decision and unsafe evidence as
+  an error; and
 - are never inferred by scanning the Notarius bundle directory.
 
 Previous-session sources (`narratio.previous_session.artifact.*`):
 
-- resolve only from local `previous/` cache state;
-- prefer manifest-backed previous-input paths;
-- fallback to existing previous-cache filesystem paths.
+- resolve only from one matching `previous_artifact` input record in the
+  current manifest, including its exact source ID and checksum;
+- are hydrated only from the unique `published_output` declaration for their
+  canonical source in the selected remote commit; and
+- never infer a path from a previous manifest, current configuration, basename,
+  or existing cache file.
+
+Source absence is evaluated by the consuming artifact input. An optional input
+is omitted from that invocation; a required input fails resolution. This is
+separate from a stage's lifecycle outcome.
 
 Validation by content type:
 
@@ -87,7 +163,7 @@ Validation by content type:
 
 `CollectPreviousArtifactRequirements`:
 
-- scans enabled configured artifacts only;
+- scans the effective configured artifact set;
 - extracts only canonical previous-session sources;
 - deduplicates by artifact key;
 - merges required and optional references (required wins);
@@ -98,17 +174,44 @@ Validation by content type:
 Artifacts package owns shared remote current-state loading mechanics used by
 restore, status and validation checks, and previous-cache planning.
 
+The selected session manifest is accepted only with
+`schema_version: narratio.session-manifest.v1` and complete stage identity.
+An unsupported local or downloaded manifest must be replaced by regeneration,
+verified restore, or republication; artifact resolution never fills in missing
+authority markers.
+
+For a new-protocol current state, the pointer-selected immutable commit is the
+complete restore authority. Callers receive its declared object identities and
+must not supplement them by listing mutable session prefixes.
+
+A `published_output` declaration must use a canonical publish-compatible source
+ID and an exact `runs/{run_id}/published/{destination}` key in the same session.
+Only this declaration type may refer to an earlier run; other declared objects
+remain confined to the selected commit's run.
+
+The reader opens each small control object directly and enforces owner-specific
+limits before decoding: 64 KiB for the mutable commit pointer, 4 MiB for the
+immutable commit manifest, and 8 MiB for the selected session manifest. These
+are exposed as `MaxCurrentCommitPointerBytes`,
+`MaxRemoteCommitManifestBytes`, and `MaxRemoteSessionManifestBytes`.
+
+Each read uses the generation and size metadata returned with its opened body.
+Actual bytes remain subject to a limit-plus-one read even if size metadata is
+absent or inaccurate. Immutable selections then retain their declared-size,
+checksum, generation, and identity checks. No current-state control object is
+downloaded through a temporary file. Artifact and previous-session downloads
+validate their complete sibling temporary file against available committed
+identity before replacing a canonical local path.
+
 Core helpers:
 
-- `LoadCurrentRunPointer`
-- `LoadCurrentManifest`
 - `LoadCurrentState`
 - `ValidateCurrentStateIdentity`
+- `RemoteCommitManifest` and `CurrentCommitPointer`
 
-Typed missing-state errors:
+Typed missing-state error:
 
-- `CurrentRunPointerMissingError` (`ErrCurrentRunPointerMissing`)
-- `CurrentManifestMissingError` (`ErrCurrentManifestMissing`)
+- `CurrentCommitPointerMissingError` (`ErrCurrentCommitPointerMissing`)
 
 Identity validation supports caller-provided expectations:
 
@@ -122,6 +225,21 @@ Caller policy is intentionally outside artifacts helpers:
 - some callers downgrade missing state to status/findings;
 - some callers skip optional behavior when state is missing.
 
+## Remote Lock Objects
+
+The artifacts package defines the independent remote-lock payload and identity
+contract. Each canonical publish source maps to one object below the validated
+session `locks/` prefix; its filename is the lowercase SHA-256 digest of the
+exact source followed by `.lock`.
+
+Lock payloads are strict versioned JSON containing the canonical source, an
+optional reason, and a UTC creation time. Reads are bounded to
+`MaxRemoteLockObjectBytes` (64 KiB), reject unknown fields and trailing values,
+and verify that the payload source matches the key digest. Exact lookup reports
+presence explicitly, prefix listing validates every object and sorts by source,
+creation uses an absence precondition, forced replacement uses one observed
+generation, and removal is idempotent.
+
 ## Key Path Helpers
 
 `internal/artifacts/paths.go` and S3-key helpers define canonical helpers for:
@@ -131,6 +249,23 @@ Caller policy is intentionally outside artifacts helpers:
 - spool/cache paths;
 - S3 session/run/current-state key layout.
 
+New publication creates run-scoped immutable objects, including
+`runs/{run_id}/commit.json` and `runs/{run_id}/session-manifest.json`. The sole
+mutable selector is `current/commit-pointer.json`; readers verify its selected
+commit and declared object generations/checksums.
+
+A `published_output` declaration may identify its commit's run or an earlier
+immutable run in the same campaign/session namespace. The key parser validates
+that namespace, rejects mutable and malformed keys, and derives the originating
+run from the exact declaration. All other commit artifacts remain confined to
+the commit's own run prefix.
+
+Campaign, session, and Narratio run IDs are validated as portable opaque
+segments at configuration and artifact boundaries before they can be used in a
+workspace or S3 namespace. Previous-artifact destinations remain typed,
+multi-segment relative paths and are confined beneath `previous/artifacts`; they
+are not treated as opaque identifiers.
+
 See [Workspace Internals](workspace.md) for how callers consume local helpers
 and [Operations](../operations.md#local-state-layout) for the authoritative
 physical layout.
@@ -148,8 +283,12 @@ physical layout.
 
 - Registry and resolution: `internal/artifacts/artifact_resolver.go`,
   `internal/artifacts/catalog.go`, `internal/artifacts/transcripts.go`,
-  `internal/artifacts/extraction_catalog.go`
-- Current state: `internal/artifacts/current_state.go`
+  `internal/artifacts/extraction_catalog.go`,
+  `internal/artifacts/extraction_evidence.go`,
+  `internal/artifacts/extraction_input.go`,
+  `internal/artifacts/prepared_input.go`
+- Current state: `internal/artifacts/current_state.go`,
+  `internal/artifacts/current_state_commit.go`,
 - Paths and keys: `internal/artifacts/paths.go`,
   `internal/artifacts/s3_keys.go`
 - Previous requirements: `internal/artifacts/previous_requirements.go`

docs/internal/command-restore.md

@@ -8,8 +8,13 @@ reporting flow in `internal/app`. User invocation belongs in
 physical restore scope belong in
 [Operations](../operations.md#restore-workflow).
 
-Restore is split into explicit phases so remote authority, local conflict
-policy, and filesystem mutation can be tested independently.
+Restore separates remote authority, local conflict policy, and filesystem
+mutation so each remains testable independently.
+
+The public command supplies production defaults to one private,
+invocation-scoped dependency value. Discovery, planning, and execution use that
+same value, so focused sequencing tests can replace one boundary without
+mutable package hooks.
 
 ## Discovery Contract
 
@@ -18,6 +23,7 @@ Discovery delegates current-state pointer and manifest loading to
 
 - campaign must match;
 - session ID must match.
+- run ID must match the pointer-selected committed run.
 
 Restore treats any missing or invalid remote current state as a command error.
 
@@ -31,13 +37,27 @@ Restore planner action kinds:
 
 Planner behavior:
 
-- remote list scope is the resolved session prefix;
+- a new-protocol restore uses only the selected commit's declared artifact set;
+  each action carries that artifact's immutable key, checksum, size, and
+  generation;
 - remote-to-local mapping is traversal-safe;
 - actions are sorted by local relative path and then remote key;
-- force converts differing local targets from conflicts to downloads.
+- planning opens the selected session root and inspects every target by its
+  normalized session-relative path. Missing ancestors produce a missing target;
+  an ancestor or leaf symlink is a non-regular conflict and is never opened for
+  hashing;
+- force converts differing eligible regular files from conflicts to downloads;
+  directories, symlinks, and other non-regular targets remain conflicts.
 
-Previous-cache files are planned separately through `previouscache.BuildPlan`
-when configured previous-session requirements exist.
+For a non-dry-run restore, planning/classification happens only after acquiring
+the session lock. Runner manifest/reuse checks acquire that same lock first.
+
+Previous-cache readiness is resolved through `previouscache.Resolve` for restore,
+prepare, status, and validation. Each requirement selects the unique
+`published_output` for its canonical source in the pointer-selected commit,
+then strips only that run's immutable `published/` prefix for its safe local
+cache path. It never probes candidate objects or derives paths from manifests,
+configuration, or basenames.
 
 ## Execution Contract
 
@@ -45,19 +65,40 @@ Execution order and safety:
 
 - non-manifest downloads happen before manifest install;
 - `manifest.json` installs last;
-- downloads use sibling temp files plus atomic rename;
+- downloads use sibling temp files, validate the complete object, then use an
+  atomic rename;
 - manifest replacement is validated before rename;
+- each committed object is verified against its declared checksum, size, and
+  generation before installation;
+- installation reopens the selected session root, creates only validated
+  missing directory components with workspace modes, and rejects symlinked or
+  non-regular ancestors and leaves before replacement;
+- a committed manifest already verified during discovery is retained for the
+  matching restore action and revalidated before installation, avoiding a
+  second body transfer;
 - failed installs do not roll back files already written in the same execution.
+- a durable `.restore-incomplete.json` marker is written before installation.
+  It blocks runners until a restore retry completes all verified installs and
+  the local manifest replacement, at which point it is removed.
+- restored manifest local references are rebased beneath the selected local
+  session root. Unsafe relative references and producer-machine absolute paths
+  outside the manifest's producer session root are rejected; producer-local
+  spool paths and run-local diagnostic references are not restored as
+  authority. Cleanup remains ordinary restored stage state and is not reset or
+  synthesized by restore.
 
 Audio restore path:
 
 - uses `audio.MaterializeS3Audio`;
 - integrates spool and S3 audio cache paths;
-- supports cache-hit reuse without object redownload.
+- reuses cached audio only when its opened regular file, content digest, and
+  identity sidecar all match the selected remote object version; otherwise it
+  refreshes through the validated download path.
 
 ## Reporting Contract
 
-- dry-run mode prints a summary and performs no local writes;
+- dry-run mode prints a summary, performs no durable session writes, and may
+  read remote current-state or object-identity data to produce that summary;
 - execution mode persists the canonical restore report described in
   [Operations](../operations.md#restore-workflow);
 - report includes plan counts, per-action status, and execution failures.
@@ -65,7 +106,11 @@ Audio restore path:
 ## Invariants
 
 - restore uses committed remote current state as authority;
-- `current/run_id.txt` is the remote publish commit marker;
+- one restore or status inspection observes the single pointer-selected commit
+  loaded at discovery; later pointer changes cannot add objects or substitute a
+  different run into its plan;
+- a verified `current/commit-pointer.json` and its selected immutable commit
+  establish remote commitment; when absent, republish the session;
 - restore does not execute pipeline stages.
 
 ## Implementation And Tests
@@ -78,4 +123,5 @@ Audio restore path:
 - Tests: `internal/app/restore_discovery_test.go`,
   `internal/app/restore_plan_test.go`,
   `internal/app/restore_execution_test.go`,
+  `internal/app/restore_recovery_test.go`,
   `internal/app/restore_workflow_test.go`

docs/internal/configuration.md

@@ -0,0 +1,196 @@
+# Configuration Internals
+
+User-visible fields, defaults, and selection behavior belong in the
+[Configuration Reference](../config.md). This document describes the internal
+pipeline-loading boundary implemented by `internal/config`.
+
+## Pipeline Loading
+
+`LoadPipeline` assembles and validates a pipeline in this order:
+
+1. Parse the root YAML into a presence-aware composition tree. The tree retains
+   source names, full field paths, node kinds, declaration order, and explicit
+   zero, false, empty-map, and empty-list values.
+2. Decode the root-only `composition` envelope, validate its declaration shapes
+   and cross-field profile semantics, then clone the root without that envelope
+   as the ordinary pipeline body. The parsed source document is not mutated. A
+   load option retains the difference between omitted and explicitly empty
+   profile selection.
+3. Open each import relative to the root pipeline directory through the
+   confined regular-file boundary. Imports must use a `.yml` or `.yaml`
+   extension and cannot traverse, use symlinks, repeat a file, import the root,
+   or contain another composition envelope.
+4. Resolve and structurally parse every declared profile overlay through the
+   same confined regular-file boundary. Missing or malformed unselected
+   overlays fail the load. Overlays cannot contain a composition envelope.
+5. Additively merge the root body and imports. Distinct map leaves compose;
+   repeated scalar or list paths and node-kind disagreements are conflicts.
+6. Select exactly one declared profile from an explicit option or the default,
+   then recursively merge its overlay. Overlay leaves replace base leaves,
+   lists are atomic replacements, and null or kind changes fail.
+7. Emit deterministic canonical YAML and strictly decode it into
+   `PipelineConfig`.
+8. Apply pipeline defaults once, resolve ordinary relative pipeline paths from
+   the root pipeline file, and digest the normalized effective mapping.
+
+This ordering preserves monolithic configuration behavior. Moving a field to
+an imported fragment changes its source ownership, not its path base, default,
+or schema semantics.
+
+## Loaded Context Resolution
+
+`LoadedPipelineCampaign` carries one already composed pipeline and its selected
+campaign into session resolution. `LoadSessionWithPipelineCampaignOptions`
+loads a local session against that context, while
+`ResolveLoadedPipelineCampaign` also accepts an already loaded remote session
+or no session while a caller retrieves one. Compatibility loaders route through
+these functions after their initial pipeline and campaign reads.
+
+Application commands own pipeline and campaign discovery, campaign-file versus
+registry selection, and the corresponding mutual-exclusion rules. Once they
+have a `LoadedPipelineCampaign`, local session discovery and remote-session
+download retain that exact pipeline object and its private provenance. Removing
+a temporary downloaded session file therefore cannot invalidate the resolved
+pipeline or campaign context.
+
+The application also has a separate read-only inspection resolver for `config
+validate`, `config show`, and `config sources`. It uses the same production root/profile and
+campaign selection functions, but never routes through session discovery,
+remote-session download, secret loading, adapter composition, workspace
+initialization, manifest access, or cleanup. A pipeline with retained artifact
+family declarations must resolve its selected campaign before ordinary pipeline
+validation, which expands its canonical-party members and generated publish
+rules. A pipeline without those declarations may be validated by itself.
+
+`MarshalEffectivePipeline` is the configuration-owned projection for `config
+show`. It serializes the typed, defaulted effective mapping through the
+deterministic composition renderer, then removes resolution-only artifact
+family declarations. The result contains no composition envelope or private
+provenance fields and has one trailing newline; commands do not marshal runtime
+objects directly.
+
+`EffectivePipelineSources` and `EffectiveCampaignSources` provide the separate
+safe provenance projection for `config sources`. Pipeline ownership begins with
+the complete logical field paths retained during composition and classifies
+each contributor as root, import, profile, or centralized default. The
+projection replaces generated concrete member paths with paired family and
+canonical-party records, and does the same for generated publish rules.
+Campaign records identify campaign-owned fields and party inputs; canonical
+derived players point to the party source. The application command only joins these sorted
+records with selection metadata and never reparses configuration files.
+
+`config diff` uses a paired profile loader that parses the root, imports, and
+declared overlays once, then clones the additive base before independently
+selecting, decoding, defaulting, and finalizing each profile. When campaign
+resolution is needed, the command loads one selected campaign and party and
+expands both effective pipelines from that same party value. The configuration
+owner projects each normalized effective mapping into sorted logical paths;
+mapping leaves are compared individually while sequence values remain atomic.
+Values are compact deterministic JSON representations for command output, not
+raw YAML fragments, ownership records, or secret material. A differing digest
+with no projected difference is treated as an internal consistency error.
+
+Campaign context construction reads the campaign-owned party source through
+`ParseParty`. The required canonical party retains its raw bytes and normalized
+roster in runtime-only `ResolvedParty` provenance. Canonical resolution creates
+a deterministic `derived_from_party` players projection. The party is the only
+configured roster authority; player and session-party fields are unsupported.
+
+## Canonical Party Domain
+
+`ParseParty` is the package-owned boundary for parsing a party source. It
+requires a top-level `schema_version` and strictly validates the
+`narratio.party.v1` contract into ordered character domain values. The
+canonical value retains a separate exact byte copy of its source so consumers
+can materialize the authored party document without reserializing it. Its
+`PlayersYAML` method deterministically derives the versioned players-only
+projection.
+
+An unversioned source is rejected before resolution, family expansion, or
+prepare-stage materialization.
+
+## Validation Ownership
+
+Configuration validation remains within `internal/config`, with the public
+entry points and pipeline-domain sequencing separated from the private owners
+for core pipeline/session rules, external adapters, publish/storage, Notarius,
+Scriptorium, and shared scalar/path checks. These are package-local ownership
+boundaries rather than extension points or a general validation framework.
+
+Validation fails fast and does not define which of several independent invalid
+fields is reported first. Map-backed declarations are nevertheless traversed
+deterministically. Notarius validates scalar policy, builds normalized reference
+bindings and output lanes independently, and installs all candidate values only
+after every check succeeds. Scriptorium validates artifact declarations and
+outputs, dependencies and inputs, variables, referenced outputs, and the final
+dependency graph in deterministic artifact order.
+
+Diagnostics identify the relevant semantic field. Composition conflicts also
+retain every claiming source needed to correct an additive ownership conflict.
+Complete prose, punctuation, formatting, and private validation choreography are
+not compatibility contracts.
+
+## Diagnostics And Runtime Metadata
+
+Syntax, duplicate-key, composition, conflict, and schema failures include the
+relevant source name and full field path. Additive conflicts report every
+claiming source so operators can repair the split without repeatedly
+rediscovering additional conflicts.
+
+The loaded pipeline retains private runtime metadata for the absolute root
+path, ordered imports, selected profile name and selection source, selected
+overlay, contributing sources, effective digest, and leaf ownership. Base
+leaves retain their root/import owners, replaced leaves belong to the selected
+overlay, and centrally supplied values use the synthetic `default` owner. This
+metadata does not participate in YAML decoding or alter the public
+configuration model.
+
+The effective digest is SHA-256 over deterministic canonical YAML produced from
+the defaulted `PipelineConfig`. Runtime Notarius paths remain absolute for
+execution, but the digest substitutes their normalized logical values captured
+before root-relative resolution, so relocating an equivalent configuration
+bundle does not change provenance. Because composition and resolution metadata
+are private, the digest excludes source layout, profile name, and ownership.
+Configuration stores environment variable names rather than resolving raw
+credentials, so raw secret values are neither loaded nor hashed.
+`recomputePipelineEffectiveDigest` is the single package-owned refresh point
+for later runtime expansion.
+
+## Test Surfaces
+
+`composition_test.go` protects the presence and merge algebra independently of
+the public schema. `pipeline_composition_test.go` exercises explicit imports,
+confinement, conflicts, strict decoding, metadata, and root-relative path
+behavior through `LoadPipeline`. `pipeline_profiles_test.go` covers selection,
+all-overlay validation, overlay behavior, provenance, option propagation, and
+effective-digest stability. Application configuration-loader tests protect the
+single-read boundary by changing the pipeline file after its initial load and
+confirming local session resolution retains the original pipeline. Other
+configuration tests continue to protect defaults and validation after assembly.
+`party_test.go` protects the versioned party schema, domain invariants, and
+deterministic players projection without involving campaign or runtime wiring.
+`party_resolution_test.go` protects campaign-owned party loading, canonical
+input restrictions, source provenance, and virtual players input selection.
+
+## Artifact Family Resolution
+
+Pipeline loading retains `scriptorium.artifact_families` as a resolution-only
+declaration. Once campaign party resolution establishes a canonical roster,
+configuration expands families in sorted family-key and character-ID order
+into ordinary `ScriptoriumArtifactConfig` values. The expansion owns the narrow
+`{character_id}` output substitution, closed member-variable selectors, key and
+output collision checks, and the runtime-only family-origin catalog. It then
+removes family declarations from `ScriptoriumConfig`, runs ordinary Scriptorium
+validation, and refreshes the effective pipeline digest. Stages and adapters
+therefore receive only concrete artifact maps.
+
+The catalog retains sorted family member keys plus family/character/source
+origins and the typed dependency/publish declarations for their later owners.
+`member_dependencies` add corresponding ordinary concrete dependencies, while
+the family-only `narratio.member_artifact.<family>` input form is rewritten to
+the matching ordinary configured-artifact source. The catalog records those
+resolved dependency and input identities with their declaring family and party
+member. No member-artifact source is registered as a runtime policy source.
+An enabled family publish declaration expands to ordinary configured-artifact
+publish rules before the existing publish and lock validators run. Runtime
+publication consequently receives no family wildcard or special matcher.

docs/internal/fileops.md

@@ -0,0 +1,55 @@
+# Internal: File Operations
+
+`internal/fileops` owns the narrow mechanics for atomically visible replacement of one
+byte file. Callers keep ownership of serialization, validation, cancellation,
+and destination-directory policy.
+
+## Destination Paths
+
+Ordinary workspace replacement uses standard operating-system path semantics.
+Callers with a root-scoped safety contract own that validation at their boundary.
+
+Remote object acquisition is owned by its domain caller. The caller writes a
+sibling temporary file, validates the complete result, and passes that file to
+`InstallSiblingTempFile` only when it is ready to become canonical. Callers own
+remote object selection, validation, conflict handling, and temporary-file
+cleanup.
+
+Directory bundles are not promoted by `internal/fileops`; extraction owns its
+validated Notarius bundle rename.
+
+## Cleanup Contract
+
+`RemoveAllUnderRoot` accepts an explicit root and a proper descendant, opens
+that root with `os.OpenRoot`, and removes the normalized root-relative target
+with `Root.RemoveAll`. It rejects root, traversal, and out-of-root targets; a
+missing target is successful. `RemoveFileUnderRoot` additionally requires an
+existing leaf to be regular. Command and post-publish policy remains owned by
+`internal/app`.
+
+## Bounded Reads
+
+`ReadFileBounded` opens a normal path and reads at most its caller-supplied
+limit. Credential mode policy and environment precedence remain owned by
+`internal/app`.
+
+## Replacement Contract
+
+`ReplaceFileAtomic` requires an existing destination directory. It creates a
+sibling temporary file, writes the complete byte sequence, applies the
+caller-supplied mode, closes the file, runs an optional pre-rename check, and
+replaces the destination with a rename.
+
+The pre-rename check is the last point at which a caller can cancel without
+installing a new destination. A failure before the rename leaves the old
+destination unchanged and removes the temporary file. Successful replacement
+provides atomic visibility; it makes no crash- or power-loss durability claim.
+
+Replacement follows the operating system's same-filesystem rename semantics.
+If a platform cannot replace an existing destination, the operation returns an
+error and never removes the old file as an emulation step.
+
+`WriteFileAtomic` and the copy helpers create the destination parent with the
+repository's workspace permissions. `InstallSiblingTempFile` requires the
+caller to provide an existing temporary file in the existing destination
+directory.

docs/internal/manifest.md

@@ -2,20 +2,43 @@
 
 ## Purpose
 
-Explain the session-progress and invocation-audit models implemented by
-`internal/manifest`. Physical manifest placement belongs in
+Explain the session-progress model implemented by `internal/manifest`. Physical
+manifest placement belongs in
 [Operations](../operations.md#local-state-layout).
 
 ## Session Manifest
 
 `manifest.Manifest` records:
 
+- required `schema_version: narratio.session-manifest.v1`
 - identity (`session_id`, `campaign`, `run_id`)
 - local path metadata (`local_workdir`, `local_spool_dir`)
 - remote identity metadata (`s3_bucket`, `s3_session_prefix`, `s3_run_prefix`)
 - `inputs` records
 - durable `artifacts` records
-- per-stage `stages` map
+- per-stage `stages` map, including the ordinary cleanup stage record
+
+Session, campaign, and run identities in local and downloaded manifests must be
+portable opaque segments. Unsafe legacy identities are rejected with migration
+guidance rather than being normalized into a different workspace or remote
+namespace.
+
+Decoding is strict at every typed manifest field. Unknown fields are rejected;
+the schema version remains `narratio.session-manifest.v1` and there is no
+compatibility reader that silently drops retired state. Cleanup progress uses
+only the cleanup entry in `stages`.
+
+Every persisted session manifest has a non-nil `stages` map. Each entry is
+non-nil and its embedded `name` exactly matches its map key; loading never
+invents either marker. A missing or unsupported schema version, or incomplete
+stage identity, is unsupported local state: move it aside and regenerate it,
+or restore a verified current committed snapshot when that is authoritative.
+
+Prepare records independent `party` and `players` input checksums. In canonical
+party mode, the party record retains its campaign source identity while the
+players record uses `derived_from_party`; raw roster content is never embedded
+in manifest metadata. Both records remain the durable authority for consumers
+of their prepared input source IDs.
 
 The model admits these stage states:
 
@@ -27,73 +50,265 @@ The model admits these stage states:
 - `stale`
 - `interrupted`
 
-## Run Manifest
+### Analyze-owned artifact state
 
-`manifest.RunManifest` is created for each invocation and records:
+Every `analyze` stage record carries `analyze_state_version: 1` and an
+`analyze_artifacts` map keyed by normalized configured artifact key. The
+version is the authority marker: version 1 with no entries is a valid evaluated
+empty set. An absent or unsupported version is unsupported local state and is
+rejected rather than being treated as aggregate-only authority.
 
-- invocation identity and `force` flag
-- requested stages
-- per-stage action (`run` or `skip`)
-- per-stage status
-- overall run status (`running`, `succeeded`, `failed`)
+Each analyze artifact record has one disposition:
+
+- `current`: the configured artifact is available and carries a versioned
+  fingerprint plus a complete output record and separate output size;
+- `stale`: the recorded semantic identity is no longer current;
+- `missing`: no validated current result exists;
+- `failed`: the attempted work failed and carries a bounded diagnostic; or
+- `unselected`: the artifact was intentionally outside the evaluated set.
+
+Records bind their normalized key and dependencies, fingerprint contract when
+evaluated, canonical session-relative output identity when current, producing
+Narratio run, update time, and bounded non-secret Scriptorium provenance and
+diagnostic paths. A current output includes its configured source ID, contract,
+checksum, and positive byte size. Non-current records cannot carry an output,
+so an older file is not advertised through stale, missing, failed, or
+unselected state.
+
+Family-produced records additionally retain optional `family` and
+`character_id` provenance supplied by configuration resolution. These fields
+do not replace the concrete configured key or infer family membership from a
+name, so older records without them remain valid.
+
+The session-stage collection is the reconciled authority across invocations.
+These records remain analyze-owned data inside the fixed stage; they are not
+dynamic stages or generic subtasks.
+
+Analyze checkpoints one complete validated candidate collection after each
+successful artifact and before exposing that artifact to later work. It saves a
+detached manifest candidate and installs its version, collection, and updated
+timestamp into live state only after the store reports success. Aggregate stage
+outputs are ordinary result outputs rebuilt in configured-key order from current
+session records only.
+
+Successful incremental execution replaces only evaluated artifact records and
+preserves valid unrelated current records. Rebuilt outputs are compared by
+bytes and contract: an unchanged identity permits an unselected dependent with
+the same recomputed fingerprint to remain current, while a changed identity
+removes output authority from every unselected transitive dependent by marking
+it stale. A partial analyze invocation can therefore succeed while unrelated
+configured records remain stale. Existing canonical files never create current
+records without validated execution and a successful checkpoint.
+
+Aggregate analyze status is deliberately coarser than this collection. Resume
+validation may skip a succeeded aggregate record when the selected artifact
+closure is current even if unrelated records are stale. Conversely, a stale
+aggregate record may cross the ordinary runner boundary and perform zero
+Scriptorium calls when reconciliation proves every selected artifact current;
+ordinary successful stage completion then restores the aggregate status.
+
+On an artifact error, analyze installs a complete retry collection on the live
+manifest before returning. The active record is failed without output, current
+transitive dependents are stale, unrelated current records survive, and only
+earlier checkpointed completions remain current. The runner's ordinary failure
+path marks aggregate analyze failed, clears aggregate outputs, invalidates
+delivery dependents, and saves that collection. A terminal session-save failure
+is joined with the original adapter, validation, filesystem, cancellation, or
+checkpoint cause.
+
+If an artifact checkpoint fails, analyze rolls its working collection back to
+the last committed collection before constructing the active failed record.
+Newly materialized canonical bytes therefore remain incidental and cannot
+become current authority. A later ordinary run reconciles the durable records,
+reuses earlier current artifacts, and resumes with the failed or stale work.
+The same recovery applies after process interruption: the aggregate record may
+be non-successful, but every completed artifact checkpoint remains reusable.
+
+## Remote Commit Manifest
+
+`artifacts.RemoteCommitManifest` is a separate, versioned remote snapshot
+contract. It is not a serialized session manifest and contains no local
+post-publication assertion such as `current_pointer_written`. A remote commit
+identifies one campaign, session, and run and declares its immutable artifact
+set. Each artifact has a typed source, immutable destination key, SHA-256
+checksum, size, and storage generation.
+
+`current/commit-pointer.json` is the sole mutable selector for the new
+contract. It identifies exactly one run-scoped `runs/{run_id}/commit.json` and
+binds that object by checksum, size, and generation. Readers strictly reject
+unknown fields, version mismatches, pointer/commit identity mismatches, and
+objects that do not match their declaration.
+
+An absent commit pointer means no remote state is published. Republish to
+establish a current immutable snapshot.
 
 ## Persistence Semantics
 
 `manifest.LocalStore`:
 
-- validates loaded documents;
-- normalizes missing maps/stage records;
-- writes atomically via temp file + rename;
+- accepts only the exact supported session-manifest schema version;
+- rejects unknown fields and multiple JSON values;
+- validates stage-map identity without synthesizing missing maps, records, or
+  names;
+- retains only representation-preserving collection normalization;
+- writes through a sibling temporary file and atomic replacement visibility;
 - updates `updated_at` on save.
 
+Manifest replacement provides atomic visibility, not a crash- or power-loss
+durability guarantee. Callers reload after a returned save error before retrying.
+An analyze checkpoint error leaves the prior manifest as per-artifact authority.
+The runner then attempts to persist the bounded failed/stale retry collection;
+if that terminal save also fails, its error is joined with the originating
+failure and the next invocation must reconcile from the last readable manifest.
+
 ## Execution Semantics
 
-The application runner marks an executing stage running and then succeeded or
-failed in both manifests, persisting each transition. On success it records
-outputs, logs, generated configuration references, and metadata. Artifact
+Planning and execution share one pure pre-execution decision over the recorded
+stage status, force selection, and normalized resume-validation result. That
+decision identifies run versus reuse and any required stale and dependent
+invalidation transition. Planning applies it only to a cloned manifest.
+Execution remains the sole owner of observed stage results and persistence.
+
+For each selected stage, the application runner computes semantic evidence,
+performs any eligible resume validation, applies the pre-execution decision,
+and persists required invalidation before either reusing the existing success
+or beginning an attempt. The same one-stage execution owner marks the attempt
+running before invoking the stage and then records and persists its failed,
+skipped, or successful terminal state before a later stage may start. On
+success it records outputs, logs, generated configuration references, metadata,
+and—when the stage implements the optional contract—a versioned
+semantic-configuration fingerprint. Artifact
 records may include optional contract and external provenance objects; old
 manifests remain compatible when those fields are absent. A successful forced
-rerun marks only succeeded downstream session-stage records stale.
+rerun marks only succeeded transitive dependent session-stage records stale.
+The application owns a fixed dependency relation distinct from execution order;
+dependents are returned in canonical order. Render and extract therefore never
+stale one another, while either can stale analyze, publish, notify, and cleanup.
 
 Starting an execution clears the current session-stage record's prior outputs,
-logs, generated configuration references, and metadata. Failed and skipped
+logs, generated configuration references, metadata, and semantic fingerprint.
+Failed and skipped
 transitions enforce the same clearing rule directly, while success repopulates
 only fields returned by the new result. Marking a record stale does not clear
 those details because resume validation and diagnosis may still require them
-before execution begins. Invocation run manifests remain immutable audit
-records of their own outcomes.
+before execution begins.
+
+Aggregate lifecycle clearing deliberately preserves the analyze-owned
+per-artifact collection. This lets later reconciliation replace only evaluated
+entries without erasing unrelated current results. Other stages retain their
+existing aggregate-only lifecycle behavior and are forbidden from carrying the
+analyze-specific fields.
 
 A stage may explicitly return a skipped disposition and stable reason. The
-runner persists that outcome in both manifests, clears older outputs for the
-session-stage record along with older logs, generated configuration references,
-and metadata, then applies any bounded details from the current skip and
-continues. This self-skip is distinct from deciding not to execute an
+runner persists that outcome in the session manifest, clears older outputs,
+logs, generated configuration references, and metadata, then applies any
+bounded details from the current skip and continues. This self-skip is distinct from deciding not to execute an
 already-succeeded stage and is reconsidered on later runs. Skipped results
-cannot contain outputs.
+cannot contain outputs. An intentional self-skip records the current semantic
+fingerprint because it is a completed, reusable stage result; failed or
+interrupted work never promotes one.
 
-When an already-succeeded stage is skipped, the invocation run manifest records
-the `skip` action and reason. The session manifest deliberately retains its
-existing succeeded record because it remains the cross-invocation progress
-authority. Stages with a resume validator, currently extraction, may reject an
-otherwise eligible skip when the recorded durable result is obsolete; the
-runner marks it stale and executes it.
+When an already-succeeded stage is skipped, the session manifest deliberately
+retains its existing succeeded record because it remains the cross-invocation
+progress authority. If a stage supplies semantic configuration evidence, reuse first
+requires the persisted positive schema version and lowercase SHA-256 digest to
+match the current resolved stage semantics. Missing semantic evidence, malformed
+evidence, or a mismatch makes the stage and its fixed transitive dependents
+stale. The existing stage-specific resume
+validator runs only after this semantic check succeeds; both checks are
+required. Extraction, analyze, and cleanup have resume validators and may
+reject an otherwise eligible skip when their selected durable evidence is
+obsolete; the runner marks the aggregate record stale and executes it.
+Analyze's validator can still accept a partial selection when only unrelated
+artifact records are stale.
 
-Session manifest is the authoritative stage-progress ledger across invocations.
-Run manifest is invocation-scoped audit state.
+Implemented reuse coverage is deliberately split between aggregate semantic
+evidence and focused durable validators:
+
+| Work | Reuse authority | Focused owners |
+| --- | --- | --- |
+| prepare | aggregate semantic fingerprint | [prepare](stage-prepare.md) |
+| transcribe | aggregate semantic fingerprint | [transcribe](stage-transcribe.md), [WhisperX](../integrations/whisperx.md) |
+| merge | aggregate semantic fingerprint | [merge](stage-merge.md), [Seriatim](../integrations/seriatim.md) |
+| polish | aggregate semantic fingerprint | [polish](stage-polish.md), [Audita](../integrations/audita.md) |
+| normalize | aggregate semantic fingerprint | [normalize](stage-normalize.md), [Seriatim](../integrations/seriatim.md) |
+| trim | aggregate semantic fingerprint | [trim](stage-trim.md), [Scriptorium](../integrations/scriptorium.md), [Seriatim](../integrations/seriatim.md) |
+| render | aggregate semantic fingerprint | [render](stage-render.md), [Seriatim](../integrations/seriatim.md) |
+| extract | aggregate semantic fingerprint plus reference/output validator | [extract](stage-extract.md), [Notarius](../integrations/notarius.md) |
+| analyze artifacts | per-artifact fingerprint, reconciliation, and output validator | [analyze](stage-analyze.md), [Scriptorium](../integrations/scriptorium.md) |
+| publish | aggregate semantic fingerprint plus immediate lock/commit checks | [publish](stage-publish.md), [storage adapter](adapters.md) |
+| notify | aggregate delivery-mode fingerprint | [pipeline overview](overview.md), [configuration](../config.md#notifications) |
+| cleanup | aggregate semantic fingerprint plus publish-evidence and target-absence validator | [cleanup](stage-cleanup.md), [workspace](workspace.md) |
+
+These contracts record resolved choices Narratio can observe, not operational
+runner tuning. External model, module, prompt, profile, and configuration-file
+contents that a tool privately loads remain outside the contract when their
+configured identifier is unchanged; operators must force the affected work
+after such a private content change.
+
+The session manifest is the authoritative stage-progress ledger across
+invocations. It retains the most recently resolved invocation's bounded
+configuration provenance. It identifies the selected profile name and source
+(`default` or `cli`) plus the effective configuration digest, but never a raw
+secret or profile content. This provenance is informational: it does not
+participate in stage resume or cache decisions. A profile change therefore
+invalidates only stages whose semantic configuration changed. When a private
+external-tool model, module, prompt, or profile changes behind an unchanged
+configured identifier, use `--force` for the affected work.
+
+`session plan` computes the same current fingerprint and applies the shared
+decision and invalidation rules to a cloned manifest. It predicts the runner
+decision without persisting session state. The semantic fingerprint owner
+hashes deterministic JSON from stage-owned typed structs; stage providers must
+exclude secrets, complete effective-configuration dumps, and operational
+values that cannot affect canonical results. Concrete coverage is owned by the
+focused stage and integration documents linked above.
+
+Before an explicitly bounded execution starts after `prepare`, the application
+reads the session manifest and accepts only `succeeded` or `skipped` for every
+excluded canonical prefix stage. The first other status or absent record fails
+the request before layout mutation, adapter initialization, session-manifest
+writes, or run-directory creation. Excluded prefix records are not passed to
+resume validators. Records after the selected end are not prerequisites and
+may be made stale by selected work without being scheduled.
+
+After a publish commits remotely, any configured local cleanup is first recorded
+as a session-manifest obligation before deletion begins. Each target becomes
+complete only after its confined deletion (or safe absence check) and a
+successful manifest save. An incomplete obligation is retried when publish
+executes again and retains the committed run and remote identity that authorized
+it; an invocation that does not execute publish does not perform cleanup.
+
+Each invocation derives campaign, session, run, local-path, and remote-prefix
+metadata from the validated resolved configuration as one projection. A persisted
+session manifest must agree on campaign and session identity before execution;
+the current projection is refreshed for every invocation while stage progress,
+inputs, and durable artifacts remain session history.
+
+For handled failures after the session identity transition, the runner records
+the failure on the session ledger and atomically attempts its save while
+preserving the originating error. Abrupt process death remains an accepted case
+where the last session transition can require operator interpretation.
 
 ## Invariants
 
 - stage resume/skip decisions are session-manifest driven.
+- semantic fingerprint comparison precedes stage-specific resume validation.
+- only successful and intentional-skipped results promote current semantic
+  evidence.
 - running, failed, and self-skipped stages do not retain result payloads from
   an earlier success.
 - stale stages retain prior details until replacement execution starts.
-- force reruns stale downstream succeeded stages.
-- run manifest does not replace session manifest as progress authority.
+- force reruns stale succeeded stages in the fixed dependency relation.
+- the session manifest is the only durable local progress ledger.
+- remote commitment is established by a verified current pointer and remote
+  commit relationship, never by a mutable session-manifest boolean.
 
 ## Implementation And Tests
 
-- Models and transitions: `internal/manifest/manifest.go`,
-  `internal/manifest/run_manifest.go`
+- Models and transitions: `internal/manifest/manifest.go`
+- Remote commit model and readers: `internal/artifacts/remote_commit.go`,
+  `internal/artifacts/current_state_commit.go`,
 - Persistence and validation: `internal/manifest/store.go`
 - Package tests: `internal/manifest/*_test.go`
 - Assembled execution behavior: `internal/app/runner_test.go`,

docs/internal/overview.md

@@ -22,20 +22,29 @@ session safety controls, and runs commands. Pipeline commands execute the
 canonical stage sequence through adapter interfaces, while manifests record
 progress and artifact services resolve durable inputs and outputs.
 
+The pipeline runner follows one explicit invocation lifecycle: inspect bounded
+prerequisites without mutation, prepare the workspace layout, acquire one
+session lock, load or create the authoritative session manifest, compose only
+the collaborators needed by the selected range, execute each selected stage in
+order, and then return the summary. Cleanup, when selected, is the ordinary
+final stage rather than runner finalization work.
+The lock remains held from manifest initialization through finalization, and a
+failed stage or required manifest save prevents later stages from starting.
+
 ## Components
 
 | Area | Implemented owners | Responsibility |
 | --- | --- | --- |
 | Executable | `cmd/narratio` | Process entry, standard stream wiring, argument handoff, and exit status. |
-| Application orchestration | `internal/app` | Command dispatch, configuration selection, secret-file environment loading, production composition, session locking, planning, execution, restore, cleanup gates, and user-facing reporting. |
-| Configuration | `internal/config` | Strict YAML loading, discovery, defaults, normalization, session templating, and validation. |
+| Application orchestration | `internal/app` | Command dispatch, configuration selection, secret-file environment loading, production composition, session locking, planning, execution, restore, and user-facing reporting. |
+| Configuration | [`internal/config`](configuration.md) | Presence-aware root/import/profile composition, canonical party and family expansion, strict YAML loading, defaults, normalization, session templating, and validation. |
 | Pipeline stages | `internal/stage` | Canonical stage registry, shared stage contract, execution dependencies, and implemented stage behavior. |
 | External boundaries | `internal/adapters`, `internal/audio` | WhisperX HTTP, downstream subprocesses, notification, object storage, and S3 audio materialization behind Narratio contracts. |
-| Manifests | `internal/manifest` | Durable session progress, invocation audit state, stage transitions, validation, and atomic persistence. |
+| Manifests | `internal/manifest` | Durable session progress, stage transitions, validation, and atomic persistence. |
 | Artifacts and paths | `internal/artifacts`, `internal/pathsafe` | Artifact identities and resolution, local and remote path/key models, current-state discovery, and confined relative destinations. |
 | Previous-session cache | `internal/previouscache` | Deterministic planning and materialization requirements for configured previous-session inputs. |
 | Artifact policy | `internal/artifactpolicy` | Source and destination policy, configured artifact identity validation, and publish destination safety. |
-| Shared models and file operations | `internal/artifactmodel`, `internal/contracts`, `internal/fileops` | Transcript and artifact data contracts plus narrow atomic filesystem helpers. |
+| Shared models and file operations | `internal/artifactmodel`, `internal/contracts`, [`internal/fileops`](fileops.md) | Transcript and artifact data contracts plus atomic single-file replacement, bounded reads, workspace modes, and root-scoped cleanup helpers. |
 | Logging | `internal/logging` | Application logger construction and shared structured logging behavior. |
 
 The application boundary composes concrete implementations. Stages depend on
@@ -43,6 +52,25 @@ Narratio-level contracts; external transport and SDK details remain in
 adapters. The normative rules for these relationships remain in
 [Architecture](../policy/architecture.md).
 
+Command execution normalizes one private dependency value per invocation.
+Configuration reads, secret-directory reads, remote downloads, object-store
+construction, and restore phase functions use that value throughout the
+command. Public command entry points supply production defaults, while focused
+tests replace only the external or sequencing boundary they exercise without
+mutating package state.
+
+Pipeline execution and `session plan` share the same inclusive contiguous-range
+model and the same pure pre-execution decision over recorded status, force, and
+normalized resume validation. Planning applies that decision and modeled
+selected-stage transitions to cloned session state; it does not persist, create
+invocation state, initialize stage-execution adapters, or claim to observe an
+execution result. Command configuration loading can still retrieve a
+missing session file through configured remote storage. It retains the initially
+composed pipeline and selected campaign while resolving either a local or
+downloaded remote session, so one invocation cannot mix pipeline revisions.
+Analyze planning additionally exposes the artifact closure's targets,
+prerequisite rebuilds, execution order, and current reuse.
+
 ## Pipeline Stage Set
 
 The implemented canonical order is:
@@ -53,26 +81,38 @@ The implemented canonical order is:
 4. [`polish`](stage-polish.md)
 5. [`normalize`](stage-normalize.md)
 6. [`trim`](stage-trim.md)
-7. [`extract`](stage-extract.md)
-8. [`render`](stage-render.md)
+7. [`render`](stage-render.md)
+8. [`extract`](stage-extract.md)
 9. [`analyze`](stage-analyze.md)
 10. [`publish`](stage-publish.md)
-11. `notify` (placeholder)
+11. `notify` (no-op)
+12. [`cleanup`](stage-cleanup.md)
 
-`notify` currently has optional notifier call behavior and no persisted pipeline
-outputs; its default collaborator is a no-op sender. The focused stage
+`notify` currently has no persisted pipeline outputs and uses the explicit
+`noop` notification mode. Its versioned semantic evidence records that delivery
+mode and excludes adapter credentials and response data. The focused stage
 documents own implementation mechanics. The
 [CLI](../cli.md) and [Operations](../operations.md) own user-visible invocation
 and execution semantics.
 
+Execution order and invalidation are separate application contracts. The stage
+registry owns the flat execution sequence. The application orchestration owner
+uses a fixed, validated dependency relation to find transitive dependents in
+canonical order. In particular, `render` and `extract` are sibling consumers of
+trimmed transcript state: neither invalidates the other, while either can stale
+`analyze`, `publish`, `notify`, and `cleanup`. Cleanup is a dependent of notify,
+so any earlier replacement can stale a prior cleanup result.
+
 ## Focused Documentation
 
+- [Configuration Internals](configuration.md): pipeline composition, import
+  confinement, field ownership, decoding, and root-relative path semantics.
 - [Adapter Internals](adapters.md): external adapter boundaries, composition,
   failure behavior, and test surfaces.
 - [Artifact Internals](artifacts.md): source identities, runtime catalog,
   resolution, previous requirements, and current-state helpers.
-- [Manifest Internals](manifest.md): session and run records, persistence, and
-  execution transitions.
+- [Manifest Internals](manifest.md): session records, persistence, and execution
+  transitions.
 - [Storage Internals](storage.md): object-store interface and S3 behavior.
 - [Workspace Internals](workspace.md): local layout, locking, and cleanup
   guardrails.
@@ -84,10 +124,11 @@ and execution semantics.
 - [`polish`](stage-polish.md)
 - [`normalize`](stage-normalize.md)
 - [`trim`](stage-trim.md)
-- [`extract`](stage-extract.md)
 - [`render`](stage-render.md)
+- [`extract`](stage-extract.md)
 - [`analyze`](stage-analyze.md)
 - [`publish`](stage-publish.md)
+- [`cleanup`](stage-cleanup.md)
 
 Use this map to find an owner, then read its focused documentation and tests
 before changing behavior.

docs/internal/stage-analyze.md

@@ -2,34 +2,133 @@
 
 ## Purpose
 
-Execute selected configured Scriptorium artifacts in dependency order and materialize outputs.
+Reconcile configured Scriptorium artifacts, execute only required work in
+dependency order, and safely materialize validated outputs.
 
 ## Inputs
 
-- configured artifacts from `pipeline.scriptorium.artifacts`
+- ordinary configured artifacts from `pipeline.scriptorium.artifacts`; canonical
+  party artifact families have already expanded into this map during
+  configuration resolution, including corresponding member dependencies and
+  rewritten member-artifact input sources
 - optional selected artifact keys supplied through the stage environment
-- built-in/configured/previous-session source references in artifact inputs
+- built-in, configured, extraction, and previous-session source references in
+  artifact inputs
 
 Supported source families:
 - built-ins: `narratio.transcript.*`, `narratio.bounds.session`
 - prepared stable inputs: `narratio.input.players`, `narratio.input.party`,
-  `narratio.input.glossary`
+  `narratio.input.glossary`, `narratio.input.spell_catalog`
 - configured artifacts: `narratio.artifact.<key>`
+- extraction lanes: `narratio.extraction.<key>`
 - previous-session cache: `narratio.previous_session.artifact.<key>`
 
 ## Outputs
 
-- one materialized output per executed configured artifact (`output_path`)
+- one current per-artifact manifest record per validated materialized output
 - stage metadata describing selected/generated/reused artifacts
 
 ## Key Behavior
 
-- skips with metadata when Scriptorium config is missing or no executable artifacts remain.
-- builds runtime artifact catalog (built-ins + configured artifacts).
-- marks non-executable configured artifacts as reusable when output files already exist.
+- when `pipeline.scriptorium` is absent or no configured artifact is
+  executable, completes successfully and records explanatory metadata. Before
+  returning, it reconciles and checkpoints the complete session collection:
+  records removed from configuration are dropped, while valid records for
+  configured but unselected artifacts remain authoritative. This is not an
+  explicit self-skip: the session manifest records success, satisfies publish's
+  prerequisite, and an ordinary later run reuses the result while the effective
+  set remains empty. Enabling or selecting an artifact later makes missing
+  versioned evidence non-resumable and schedules it without requiring force.
+- builds a runtime artifact catalog containing built-ins, configured artifacts,
+  and configured extraction lanes. Extraction availability is hydrated only
+  from compatible successful extraction evidence.
+- uses enabled configured artifacts by default. An explicit `--artifacts`
+  selection is a one-invocation override that makes exactly the named
+  configured artifacts explicit targets even when disabled. The work planner
+  adds required configured prerequisites, reuses current ones, and schedules
+  stale, missing, or otherwise non-current prerequisites before dependents.
+- makes a non-executable configured artifact reusable only when its current
+  manifest record and durable output pass the configured-artifact evidence
+  contract; an incidental or stale canonical file is unavailable.
 - validates selected artifact dependency order (cycle-safe topo ordering).
-- resolves required/optional inputs per artifact source definition.
-- resolves prepared stable input sources from `inputs/*.yml` materialized by `prepare`.
+- resolves required/optional inputs per artifact source definition into an
+  ordered semantic identity. Each identity records the configured input name,
+  canonical source ID, required policy, explicit presence, source contract,
+  checksum, size, and a source-based logical identity. Workspace paths and
+  producer run IDs are excluded.
+- orders input identities by configured input name independently of Go map
+  iteration. Runtime adapter paths remain a separate execution-only map.
+- omits an unavailable optional input from the adapter request while retaining
+  explicit absence in its semantic identity; an unavailable required input
+  fails.
+- resolves prepared stable input sources through the shared manifest-authoritative
+  identity resolver; it does not accept incidental files or fall back to
+  campaign/session source paths.
+- reuses checksums and sizes from validated prepared, extraction, and current
+  configured-artifact evidence. Other resolved inputs are hashed as confined
+  regular files with streaming reads and the central resolved-artifact size
+  limit.
+- owns a versioned SHA-256 fingerprint contract with one fixed-field canonical
+  JSON payload and no map serialization. Configured artifacts are fingerprinted
+  in deterministic dependency order.
+- fingerprints the normalized artifact key, prompt and profile identifiers,
+  effective render-debug behavior, session-relative output identity, sorted
+  dependency keys, ordered input declarations and semantic identities,
+  validated current dependency-output identities, and sorted effective
+  Scriptorium variables (including Narratio's sticky session variable).
+- provides read-only reconciliation that classifies each configured record as
+  current, stale, missing, failed, or otherwise non-resumable, and
+  separately identifies manifest records removed from current configuration.
+  A record is current only when its fingerprint version and value match and its
+  configured output still passes manifest-authoritative evidence validation.
+- owns a read-only typed work planner. Its explicit targets are enabled
+  artifacts by default or the exact normalized `--artifacts` selection when
+  supplied. It closes targets over configured prerequisites, orders the closure
+  topologically, reuses current members, and schedules every non-current member
+  before its dependents.
+- force applies only to explicit targets. A current prerequisite is reused
+  unless it is itself an explicit forced target; disabled prerequisites may be
+  rebuilt when required, while unrelated disabled artifacts are excluded.
+- the work plan carries explicit targets, prerequisite-only work, deterministic
+  execution and reuse lists, invalidated and removed records, and a cloned
+  reconciled starting collection. Valid unrelated configured records survive
+  reconciliation, removed records are omitted, and incidental files never
+  become current without manifest-backed regeneration.
+- implements aggregate resume validation by running the same read-only catalog,
+  fingerprint reconciliation, and work planner used by execution. A succeeded
+  aggregate record is reusable exactly when the selected closure schedules no
+  artifact work and no removed configuration records require a checkpoint;
+  stale unrelated records do not block a partial selection.
+- exposes the typed artifact decision to `session plan`. Planning applies it to
+  a cloned manifest after modeling earlier selected stage transitions, so
+  aggregate run/skip and artifact execute/reuse decisions match the ordinary
+  runner without creating durable state or invoking Scriptorium.
+- executes only the work plan's scheduled entries. Manifest-validated current
+  prerequisites remain available through the runtime catalog without invoking
+  Scriptorium; newly produced prerequisites enter that catalog with the same
+  contract, checksum, and size identity used for persisted current evidence.
+- before the first adapter call, checkpoints the reconciled starting collection
+  when it removed configuration records or cleared obsolete authority. After
+  each successful artifact, checkpoints the complete collection before making
+  that artifact available to the next scheduled dependent.
+- keeps adapter output in the invocation's run-local analyze directory until
+  it is a safe, non-empty, bounded regular file with a calculated checksum and
+  complete output contract. Canonical replacement uses the shared atomic file
+  operation boundary and verifies that the installed checksum matches the
+  validated run-local bytes.
+- records each successful artifact's freshly computed fingerprint, canonical
+  relative output path, contract, checksum, size, producer run ID, bounded
+  Scriptorium provenance, logs, and generated configuration references in the
+  analyze-owned manifest collection.
+- preserves valid unrelated current records during partial execution. If a
+  rebuilt output's bytes and contract are unchanged, unselected dependents may
+  remain current. If that semantic identity changes, unselected transitive
+  dependents become stale without being executed; dependents included in the
+  invocation are evaluated in dependency order instead.
+- returns aggregate outputs from every current session record in normalized-key
+  order after the complete reconciled collection has been checkpointed;
+  unrelated stale records do not make an otherwise successful partial
+  invocation fail.
 - resolves previous-session sources from local `previous/` cache only.
 - runs optional render-debug, then artifact execution.
 - validates non-empty output files and materializes canonical outputs.
@@ -44,17 +143,63 @@ Supported source families:
   guidance.
 - dependency cycles or unavailable required dependencies fail.
 - adapter validation failures fail stage.
+- a scheduled artifact failure installs a retry collection on the live manifest
+  with the active artifact marked `failed`, a bounded error, and no output
+  authority. Current transitive dependents become stale without execution.
+- earlier artifacts remain current only after their run-local output passed
+  validation, canonical materialization, and a successful complete-collection
+  manifest checkpoint; unattempted later artifacts retain their reconciled
+  session state.
+- unrelated current records survive a partial failure. Old canonical bytes for
+  the failed artifact and newly materialized bytes whose checkpoint fails are
+  incidental, not current evidence.
+- a checkpoint failure stops the queue immediately. The in-memory retry
+  collection starts from the last successful checkpoint, marks the active
+  artifact failed without output authority, and stales its current transitive
+  dependents.
+- the runner's ordinary error path marks aggregate analyze failed, clears its
+  aggregate outputs, invalidates publish, notify, and cleanup through the
+  application dependency relation, and persists the live retry collection.
+  Terminal-save errors are joined with the original artifact or checkpoint
+  failure.
 
 ## Invariants
 
 - `analyze` performs no remote storage calls for previous-session source resolution.
+- input-identity resolution is read-only: it does not invoke adapters,
+  materialize outputs, update status, or create run-local files.
+- fingerprints exclude timeouts, retries, timestamps, producer and Narratio run
+  IDs, executable and config paths, workspace roots, diagnostic locations, and
+  executable or private transitive configuration contents. A change that is
+  visible only inside Scriptorium—such as a file privately loaded by its config
+  path—requires an explicit forced regeneration.
 - output provenance and metadata are deterministic per execution.
+- a canonical file without current per-artifact manifest evidence is never
+  promoted to current state.
+- an ordinary retry after interruption or partial failure reuses every valid
+  earlier checkpoint and schedules only failed, stale, missing, or otherwise
+  non-current work in dependency order.
 
 ## Related Contracts And Tests
 
 - [Configuration](../config.md#scriptorium-artifact-entries) owns artifact
-  fields and source-selection rules.
+  fields and source-selection rules, including
+  [artifact families](../config.md#scriptorium-artifact-families).
 - [CLI](../cli.md) owns user-visible artifact selection.
 - [Scriptorium](../integrations/scriptorium.md) owns the subprocess contract.
 - Implementation and tests: `internal/stage/analyze.go`,
-  `internal/stage/analyze_test.go`
+  `internal/stage/analyze_artifact_execution.go`,
+  `internal/stage/analyze_execution_state.go`,
+  `internal/stage/analyze_input_identity.go`,
+  `internal/stage/analyze_fingerprint.go`,
+  `internal/stage/analyze_reconciliation.go`, `internal/stage/analyze_plan.go`,
+  `internal/stage/analyze_resume.go`, `internal/stage/analyze_test.go`,
+  `internal/stage/analyze_checkpoint_test.go`,
+  `internal/stage/analyze_input_identity_test.go`,
+  `internal/stage/analyze_fingerprint_test.go`,
+  `internal/stage/analyze_reconciliation_test.go`,
+  `internal/stage/analyze_plan_test.go`,
+  `internal/stage/analyze_incremental_execution_test.go`,
+  `internal/stage/analyze_failure_test.go`,
+  `internal/stage/analyze_resume_test.go`, and
+  `internal/app/analyze_checkpoint_recovery_test.go`.

docs/internal/stage-cleanup.md

@@ -0,0 +1,54 @@
+# Stage: cleanup
+
+## Purpose
+
+Remove explicitly configured local data for the run selected by a successful
+publish commit. Cleanup is the twelfth and final canonical stage, after
+`notify`.
+
+## Authorization And Targets
+
+Cleanup is disabled unless at least one of these policies is true:
+
+- `pipeline.spool.delete_audio_after_publish`
+- `pipeline.workspace.cleanup_after_publish`
+
+An enabled cleanup requires the manifest's publish stage to be succeeded with
+`uploaded=true`, a canonical `published_run_id`, and the exact remote commit and
+current commit-pointer keys for the manifest campaign/session prefix. The
+configured campaign and session must match the manifest. Cleanup derives its
+only possible targets through the canonical artifact path helpers:
+
+- the published run's session spool-audio directory; and
+- the published run's workspace run directory.
+
+It does not scan parent directories, infer the newest run, or read object
+storage. Every deletion uses the root-confined file operation, which rejects a
+root itself, traversal, symlink escape, and out-of-root targets.
+
+## Execution And Resume
+
+Disabled cleanup records an explicit skipped result. Enabled cleanup removes
+targets in deterministic policy order and treats an already-missing target as
+success. A successful record contains the published run ID and completed policy
+names.
+
+A previous cleanup success is reusable only while its semantic configuration
+matches and every selected target remains absent. A recreated target makes the
+stage non-resumable. A failure is recorded against cleanup; publish remains
+succeeded and remote current state is unchanged. On a later normal full run,
+valid upstream stages are skipped and cleanup is retried without republishing.
+
+`narratio publish` selects publish only and never invokes cleanup. A bounded run
+through `notify` or any earlier endpoint also excludes it. Operators may run
+`narratio run-stage cleanup <session_id>` directly; missing, failed, malformed,
+or identity-mismatched publication evidence fails before deletion.
+
+## Implementation And Tests
+
+- Planning and evidence validation: `internal/stage/cleanup_plan.go`
+- Execution and resume: `internal/stage/cleanup.go`
+- Root-confined deletion: `internal/fileops/cleanup.go`
+- Focused tests: `internal/stage/cleanup_plan_test.go`,
+  `internal/stage/cleanup_test.go`, and
+  `internal/app/cleanup_orchestration_test.go`

docs/internal/stage-extract.md

@@ -2,7 +2,7 @@
 
 ## Responsibility
 
-`extract` runs after `trim` and before `render`. It converts the canonical
+`extract` runs after `render` and before `analyze`. It converts the canonical
 `narratio.transcript.final_trimmed` JSON into configured Notarius lane artifacts.
 An omitted or disabled Notarius section makes the stage explicitly self-skip
 with reason `notarius_disabled`, no outputs, and no Notarius runner.
@@ -17,33 +17,63 @@ procedures belong in [Operations](../operations.md).
 `internal/stage/extract.go`:
 
 1. resolves the final trimmed transcript from the shared artifact catalog;
-2. resolves and fingerprints the Notarius invocation contract;
-3. creates a run-local staging directory and invokes the injected
+2. resolves every configured prepared reference through the shared
+   manifest-authoritative identity resolver before creating run-local output;
+3. streams each verified reference into an invocation-local snapshot and
+   rejects any source change observed while copying;
+4. fingerprints the byte- and provenance-bearing Notarius invocation evidence,
+   including sorted reference identities;
+5. creates a run-local staging directory and invokes the injected
    `notarius.Runner`;
-4. validates the successful receipt, confined index, configured required lane
-   descriptors, and regular payload files;
-5. atomically promotes the complete bundle to its immutable durable location;
-6. records one non-selectable `notarius_index` output and one selectable
+6. revalidates the reference snapshots, then validates the v2 successful
+   receipt, confined index, management documents, configured required lane
+   descriptors, validation summaries, and regular payload files;
+7. atomically promotes the complete bundle to its immutable durable location;
+8. records one non-selectable `notarius_index` output and one selectable
    `notarius_lane` output per configured lane; and
-7. registers each lane as `narratio.extraction.<output_key>` for downstream
+9. registers each lane as `narratio.extraction.<output_key>` for downstream
    Scriptorium and publish resolution.
 
 Lane records retain checksum, contract, producer run ID, and Notarius system,
 run, pipeline, and lane provenance. Stage metadata retains the durable bundle
 root, receipt, diagnostic paths, rejection/warning summaries, producing
-Narratio run ID, and invocation fingerprint. Validation completes before
-promotion, so a rejected result cannot expose a partial durable bundle.
+Narratio run ID, the resolved trimmed-input identity, and invocation
+fingerprint. The input identity binds the exact transcript bytes, canonical
+source ID, producer stage/output/run identity, and resolution provenance.
+Reference metadata contains only selector, source ID, canonical session-relative
+path, checksum, and size; adapter requests receive selector and absolute
+invocation-local snapshot path, never payload contents. Snapshot bytes must
+match the prepared identity both before and after Notarius runs, so a concurrent
+prepared-file replacement cannot make recorded provenance describe different
+bytes from those supplied to Notarius.
+Validation completes before the single durable rename, so a rejected result
+cannot expose a partial durable bundle.
 
 Any executed extraction outcome that replaces a different effective outcome
-marks succeeded downstream stages stale. Repeating the same disabled self-skip
-with no outputs is stable and does not repeatedly invalidate downstream stages.
+marks succeeded analysis and delivery dependents stale. Render is an independent
+sibling and remains current. Repeating the same disabled self-skip with no
+outputs is stable and does not repeatedly invalidate dependent stages.
 
 ## Resume Validation
 
-`internal/stage/extract_resume.go` permits a skip only when the existing stage
-record succeeded and still matches the current invocation fingerprint. The
-fingerprint covers the resolved executable and config paths, pipeline ID,
-timeout, working directory, and sorted configured output contracts.
+Before the focused validator runs, the application compares extract's versioned
+semantic fingerprint. It covers enablement, Notarius pipeline identity, sorted
+reference selector/source mappings, sorted declared output contracts, and each
+canonical `narratio.extraction.<key>` output identity. It excludes executable,
+timeout, working directory, config path, and private Notarius config contents.
+
+`internal/stage/extract_resume.go` then permits a skip only when the existing
+stage record still matches the current byte- and provenance-bearing invocation
+evidence. That evidence covers the current direct trimmed-transcript identity,
+sorted prepared-reference identities, pipeline identity, and configured output
+contracts. The same reference helper and transcript identity are resolved again
+for artifact evidence, so changing current transcript bytes, reference bytes,
+or producer identity makes the prior extraction obsolete. Operational runner
+settings do not invalidate otherwise current durable evidence.
+
+A valid prepared-reference change makes extraction non-resumable. Missing,
+unsafe, or checksum-inconsistent prepared evidence is a hard validation error
+with prepare-force guidance because an immediate extract rerun cannot succeed.
 
 The validator then checks the producing run identity, canonical immutable
 bundle root, path confinement and absence of symlink components, receipt
@@ -52,30 +82,34 @@ contracts and provenance, regular-file status, and stored checksums. Missing or
 obsolete results are non-resumable and run again; unsafe filesystem conditions
 return an error rather than silently accepting or replacing data.
 
-The fingerprint cannot observe files imported by Notarius configuration,
-profile contents, prompt/module definitions, or other transitive inputs.
-Operators must force extraction after changing any such input.
+Neither contract can observe files imported by Notarius configuration, profile
+contents, prompt/module definitions, or other transitive inputs. Operators must
+force extraction after changing any such private input behind a stable
+identifier.
 
 ## Failure Behavior
 
 Adapter startup, timeout, nonzero exit, receipt decoding, path confinement,
-index compatibility, required-lane rejection, payload inspection, checksum, or
-promotion errors fail the stage through ordinary manifest transition handling.
+index compatibility, inconsistent warning or diagnostic envelopes,
+required-lane rejection or incomplete validation, payload inspection,
+checksum, or installation errors fail the stage through ordinary manifest
+transition handling.
 Stdout receipt and stderr diagnostics remain separate. Downstream stages are
 not given selectable extraction sources unless the complete configured result
-has passed validation and promotion.
+has passed validation and installation.
 
 When a replacement attempt begins, the current session-stage record no longer
 advertises payload from the previous success. A failed replacement therefore
 has no current outputs, logs, generated configuration references, or metadata,
-while the earlier invocation manifest and immutable promoted bundle remain
-available for audit and recovery.
+while the earlier immutable promoted bundle remains available for audit and
+recovery.
 
 ## Implementation And Focused Tests
 
 - Stage execution, selection, and resume validation: `internal/stage/extract.go`,
   `internal/stage/extract_resume.go`,
-  `internal/stage/extract_test.go`
+  `internal/stage/extract_test.go`,
+  `internal/stage/semantic_contracts_delivery.go`
 - Subprocess boundary: `internal/adapters/notarius/subprocess.go`,
   `internal/adapters/notarius/subprocess_test.go`
 - Catalog hydration: `internal/artifacts/extraction_catalog.go`,

docs/internal/stage-merge.md

@@ -29,9 +29,23 @@ Normalize raw transcript inputs and merge into base transcript via Seriatim.
 - base transcript must validate before stage success.
 - report output is config-gated.
 
+## Resume Evidence
+
+Merge records a versioned semantic-configuration fingerprint for the Seriatim
+merge operation, output schema, coalesce gap, and every configured advanced
+merge transformation. A change reruns merge and stales only its fixed
+descendants; prepare and transcribe remain reusable. Binary path, timeout,
+report emission, logs, and diagnostic retention are operational exclusions.
+
+Configuration or resources loaded privately inside Seriatim are outside
+Narratio's observable contract and require `--force` when changed. An existing
+successful merge record without evidence reruns once when selected.
+
 ## Related Contracts And Tests
 
 - [Seriatim](../integrations/seriatim.md) owns subprocess and output semantics.
 - [Configuration](../config.md#pipeline) owns operator-selected Seriatim values.
 - Implementation and tests: `internal/stage/merge.go`,
-  `internal/stage/merge_test.go`
+  `internal/stage/merge_test.go`,
+  `internal/stage/semantic_contracts_initial.go`, and
+  `internal/stage/semantic_contracts_initial_test.go`

docs/internal/stage-normalize.md

@@ -15,7 +15,7 @@ Normalize polished transcript into final transcript using Seriatim.
 
 ## Key Behavior
 
-- resolves polished transcript from manifest outputs/canonical fallback.
+- resolves polished transcript only from verified manifest output evidence.
 - applies `pipeline.normalize` config or default normalize config.
 - runs Seriatim normalize with configured timeout/binary.
 - validates normalized transcript and optional report.
@@ -26,9 +26,17 @@ Normalize polished transcript into final transcript using Seriatim.
 - final transcript must validate as processed transcript JSON (`segments` array).
 - normalize defaults are applied when `pipeline.normalize` is unset.
 
+## Resume Semantics
+
+The versioned semantic fingerprint covers the Seriatim normalize operation,
+output schema and canonical output identity, plus the configured transcript
+transformations. Seriatim's executable and timeout and optional report
+generation are operational and do not invalidate the normalized transcript.
+
 ## Related Contracts And Tests
 
 - [Seriatim](../integrations/seriatim.md) owns subprocess and output semantics.
 - [Configuration](../config.md#pipeline) owns normalize fields and defaults.
 - Implementation and tests: `internal/stage/normalize.go`,
-  `internal/stage/normalize_test.go`
+  `internal/stage/normalize_test.go`,
+  `internal/stage/semantic_contracts_refinement.go`

docs/internal/stage-polish.md

@@ -16,8 +16,9 @@ Run Audita polishing on base transcript and produce polished transcript.
 
 ## Key Behavior
 
-- resolves base transcript from merge outputs/canonical fallback.
-- invokes Audita with configured model/module/runtime options.
+- resolves base transcript only from verified merge manifest output evidence.
+- invokes an Audita runner configured with static model/runtime options; the
+  invocation supplies paths and modules.
 - validates processed transcript structure (`segments` array required).
 - validates optional report JSON.
 - materializes canonical outputs; records logs/generated config and adapter metadata.
@@ -27,10 +28,26 @@ Run Audita polishing on base transcript and produce polished transcript.
 - polished transcript schema validation is mandatory.
 - report output is config-gated.
 
+## Resume Semantics
+
+The versioned semantic fingerprint covers the Audita service endpoint, model,
+validation model, module set, transcript description, output schema, selected
+external configuration path, and canonical polished-transcript identity. Module
+ordering is normalized because the configured modules form a set. Audita's
+executable, timeouts, concurrency, report and debug behavior, work retention,
+and credential environment name are operational and do not invalidate a
+successful result.
+
+Narratio can fingerprint a selected model, module, or configuration identifier,
+but it cannot inspect content that Audita privately resolves behind that stable
+identifier. Force `polish` after changing such private content without changing
+its identifier.
+
 ## Related Contracts And Tests
 
 - [Audita](../integrations/audita.md) owns subprocess, validation, and failure
   semantics.
 - [Configuration](../config.md#pipeline) owns operator-selected Audita values.
 - Implementation and tests: `internal/stage/polish.go`,
-  `internal/stage/polish_test.go`
+  `internal/stage/polish_test.go`,
+  `internal/stage/semantic_contracts_refinement.go`

docs/internal/stage-prepare.md

@@ -8,6 +8,7 @@ Materialize canonical current-session inputs before processing stages.
 
 - resolved campaign, session, and pipeline configuration
 - stable input files (`speakers`, `autocorrect`, `glossary`, `players`, `party`)
+- optional spell-catalog overlay
 - one resolved local or S3 audio source
 - enabled configured artifact input requirements for previous-session sources
 
@@ -21,6 +22,7 @@ Materialize canonical current-session inputs before processing stages.
 - `inputs/glossary.yml`
 - `inputs/players.yml`
 - `inputs/party.yml`
+- optional `inputs/spell_catalog.json`
 - `audio/*.flac`
 - optional `previous/manifest.json`
 - optional `previous/artifacts/**`
@@ -30,23 +32,55 @@ Materialize canonical current-session inputs before processing stages.
 
 - validates required config/store state.
 - enforces local audio vs S3 audio mutual exclusivity.
+- rejects duplicate explicit local audio sources after resolution.
+- gives distinct local source paths with the same basename deterministic unique
+  prepared filenames so neither source is overwritten.
 - materializes S3 audio through spool/cache-aware logic.
+- materializes a configured spell catalog with checksum and provenance, or
+  safely removes an obsolete canonical spell catalog and its manifest record
+  when the effective input is omitted.
+- copies the validated canonical party bytes unchanged and deterministically
+  generates the prepared players projection.
 - scans enabled configured artifact inputs for `narratio.previous_session.artifact.*` requirements.
-- when previous requirements exist:
-  - clears managed `previous/` state;
-  - builds previous-cache remote plan;
+- clears managed `previous/` state on every invocation, then, when requirements exist:
+  - resolves the pointer-selected previous source through the shared resolver;
   - downloads previous manifest/artifacts;
   - records previous inputs in `manifest.inputs`.
 
-Required previous-session inputs fail when unavailable; optional missing inputs are skipped.
+Required previous-session inputs fail when unavailable; optional missing inputs
+are typed skipped results. Each requirement resolves only from its unique
+`published_output` declaration in the pointer-selected remote commit. Prepare
+strips that selected run's immutable `published/` prefix to derive the local
+cache path, then validates the committed checksum, size, and generation.
 
 ## Invariants
 
 - only `prepare` hydrates canonical `previous/` cache state.
 - managed previous artifacts are stored under `previous/artifacts/**` without
   duplicate `artifacts/artifacts/` nesting.
+- managed `previous/` state represents only the current requirement set.
 - `manifest.inputs` ordering is deterministic (`kind`, `path`).
 
+## Resume Evidence
+
+Prepare records a versioned semantic-configuration fingerprint for the
+resolved campaign/session selection, local-versus-S3 audio mode and canonical
+audio names, stable-input ownership/presence, previous-session identity, and
+the party mode plus canonical players projection version, and the effective
+previous-artifact requirement set. A change reruns prepare and
+stales its fixed descendants. Existing successful records without this
+evidence rerun once when selected.
+
+Workspace, spool, and cache placement and absolute source relocation are not
+semantic when logical selection, canonical names, and bytes are equivalent.
+The fingerprint deliberately does not read or rehash large audio. Prepared
+input checksums remain the content provenance. Before reusing success, prepare
+validates every durable prepared copy and compares current stable-input bytes,
+canonical party and derived-player bytes, local audio membership/checksums, or
+S3 key/size/entity-tag identity with that provenance. Source relocation with
+equivalent names and bytes remains reusable; changed or unavailable evidence
+causes a normal prepare rerun.
+
 ## Related Contracts And Tests
 
 - [Configuration](../config.md) owns audio selection, stable input fields, and
@@ -56,5 +90,10 @@ Required previous-session inputs fail when unavailable; optional missing inputs
 - [Storage Internals](storage.md) and [Artifact Internals](artifacts.md) explain
   the internal collaborators.
 - Implementation and tests: `internal/stage/prepare.go`,
-  `internal/stage/prepare_test.go`, `internal/audio/s3_audio_test.go`,
+  `internal/stage/prepare_test.go`,
+  `internal/stage/prepare_resume.go`,
+  `internal/stage/prepare_resume_test.go`,
+  `internal/stage/semantic_contracts_initial.go`,
+  `internal/stage/semantic_contracts_initial_test.go`,
+  `internal/audio/s3_audio_test.go`,
   `internal/previouscache/*_test.go`

docs/internal/stage-publish.md

@@ -7,36 +7,82 @@ Upload run/session outputs to object storage and atomically advance remote curre
 ## Inputs
 
 - successful preceding stages from the [canonical stage set](overview.md#pipeline-stage-set)
-- invocation-scoped run files
+- declared run-local diagnostic files
 - resolved publish output rules
-- effective publish locks (static + remote merged lock set)
+- independent per-source remote lock objects read at planning start
+- the validated prior current commit when an initially locked source may carry
 - durable previous-session cache files when present
 
 ## Outputs
 
-- uploaded invocation record and selected publish outputs;
+- uploaded session manifest, declared run-local diagnostics, and selected
+  publish outputs;
 - uploaded durable previous-session cache files when present;
-- updated remote current manifest; and
-- remote current-run commit marker, written last.
+- immutable run-scoped commit manifest; and
+- current commit pointer, written last.
 
 Exact remote placement and the operator workflow belong in
 [Operations](../operations.md#publish-workflow).
 
 ## Key Behavior
 
-- stage can self-skip when publish disabled or run upload disabled.
+`publish.go` retains the transaction-owning `Run` path. Source discovery,
+manifest-derived archive metadata, confined opening, and checksum validation
+live in `publish_sources.go`; artifact-catalog matching, selection, required
+and optional rules, destination resolution, and collision inputs live in
+`publish_outputs.go`. Copying, hashing, immutable upload, reuse checks, and
+remote verification live in `publish_transfer.go`; committed-manifest,
+immutable-commit, and current-pointer encoding and writes live in
+`publish_commit.go`. `publish_output_plan.go` owns the deterministic, I/O-free
+five-outcome model and its secret-free metadata projection.
+
+- when publishing or run upload is disabled, completes successfully with no
+  outputs and records explanatory metadata. This is not an explicit self-skip:
+  the session manifest records success. Enablement and upload policy are
+  fingerprinted, so changing either automatically makes the prior result
+  non-resumable.
 - validates prerequisite stage success and object-store availability.
-- collects a deterministic run file list plus run `manifest.json`, excluding
-  `audio/**` and the run-local `extract/notarius-output/**` staging bundle.
-- keeps run-local Notarius receipt and stderr diagnostics eligible for the run
-  archive.
-- resolves publish output sources through runtime artifact catalog and manifest-aware resolution.
+- derives a deterministic run-archive allowlist from the session manifest's
+  declared current-run outputs, logs, and generated configurations. References
+  outside the current run root, including canonical session files and prior-run
+  diagnostics, are not archive candidates. No distinguished diagnostic file is
+  read or uploaded.
+- opens each archive candidate beneath its archive root without following
+  symlinked ancestors or leaf entries, verifies that it is a regular file and
+  checks a declared checksum when present, then streams the opened descriptor.
+- derives the durable previous-cache archive from its validated manifest using
+  the same confinement and regular-file checks.
+- resolves publish output sources through runtime artifact catalog and
+  manifest-aware resolution. Configured Scriptorium outputs are publishable
+  only from validated `current` per-artifact analyze evidence; an incidental
+  canonical file, aggregate output, stale/failed/unselected record, or
+  mismatched path, size, or checksum remains unavailable. Built-in and
+  extraction sources likewise require their own current manifest evidence.
 - publishes extraction lanes only through explicit configured output rules;
   neither run-local nor durable Notarius bundles are scanned or uploaded wholesale.
 - selected artifact filter applies to configured artifact sources only.
-- locked outputs are skipped intentionally (including required ones).
-- optional missing outputs are skipped; required missing unlocked outputs fail.
-- writes remote current manifest before current run pointer.
+- plans every configured output into exactly one source-sorted outcome:
+  `published`, `carried_locked`, `locked_unpublished`, `optional_missing`, or
+  `unselected`.
+- an initially locked selected output carries its exact prior
+  `published_output` declaration when one exists. The declaration may point to
+  an earlier run in the same session and retains its source, key, checksum,
+  size, and generation; the bytes are not copied.
+- verifies a carried object's exact key, size, and generation through object
+  metadata without downloading or opening the local output source.
+- an initially locked source with no prior declaration remains absent even
+  when the output rule is required. Optional missing unlocked outputs remain
+  absent; required missing unlocked outputs fail.
+- creates one complete immutable source-to-destination mapping before upload;
+- uploads and verifies every declared immutable object and the commit manifest;
+- writes the immutable commit from the combined new and exact carried
+  declarations.
+- rereads every initially unlocked participating source after the immutable
+  commit. A newly present lock aborts selection, leaving the uploaded immutable
+  attempt unselected. Removing an initial lock may conservatively produce one
+  carry because the initial snapshot controls the plan.
+- updates `current/commit-pointer.json` exactly once, last, and writes no other
+  mutable publication control record.
 
 ## Metadata Signals
 
@@ -44,31 +90,58 @@ Includes counts/lists for:
 - run uploads
 - published output uploads
 - previous uploads
-- skipped optional outputs
-- skipped unselected outputs
-- locked outputs
-- current-state key paths
-- `current_pointer_written`
+- one `publish_output_outcomes` collection containing all five output states,
+  exact declared keys, and key-derived origin runs where applicable
+- remote commit and current-pointer key paths
+- the run identifier selected by the commit
 
 ## Invariants
 
-- `current/run_id.txt` is the remote commit marker and is written last.
-- run upload excludes `audio/**` and `extract/notarius-output/**`.
-- `extract/notarius.receipt.json` and `extract/notarius.stderr.log` remain
-  eligible run-record diagnostics.
-- publish locks are not overridden by `--force`.
+- `current/commit-pointer.json` is the remote commit marker and is written last.
+- run files, selected outputs, previous-cache files, and the committed session
+  manifest are all declared by an immutable commit under the run prefix.
+- run and previous uploads contain only manifest-declared regular files opened
+  from verified descriptors; symlinks, special files, replacement races, and
+  undeclared entries are rejected or ignored before uploads begin.
+- run-local diagnostics, including Notarius receipt and stderr files, are
+  archived only when recorded by the session manifest. A run with no declared
+  current-run diagnostics legitimately uploads none.
+- independent publish locks are not overridden by `--force`; every initially
+  unlocked relevant source is reread immediately before current-state
+  selection.
+- successful uploaded publication records the exact run ID, remote commit key,
+  and current-pointer key consumed by the later cleanup stage.
 
-The commit boundary and cleanup gate are normative architecture invariants; see
+## Resume Semantics
+
+The versioned semantic fingerprint covers enabled behavior, run-upload policy,
+normalized source/destination/required output rules, and the remote backend,
+bucket, region, endpoint, and root-prefix identity. Rule ordering is
+canonicalized. Credential
+environment names, path-addressing transport mode, local workspace placement,
+and run identifiers are excluded. Independent remote locks remain mutable state
+and are read directly by publish at planning and commit boundaries; semantic
+evidence does not replace those safety checks.
+
+The commit boundary and cleanup authorization are normative architecture invariants; see
 [Architecture](../policy/architecture.md#publish-commit-boundary).
 
+Publish never deletes local state. The standalone `publish` command selects
+only this stage; a full run selects notify and cleanup afterward.
+
 ## Related Contracts And Tests
 
-- [Configuration](../config.md#publish-configuration-summary) owns output and
-  static-lock fields.
+- [Configuration](../config.md#publish-configuration-summary) owns output
+  rules.
 - [Operations](../operations.md#publish-locks) owns remote lock lifecycle and
   physical remote state.
 - [Artifact Internals](artifacts.md) explains source resolution and current-state
   helpers.
 - Implementation and tests: `internal/stage/publish.go`,
-  `internal/stage/publish_test.go`, `internal/app/operator_helpers_test.go`,
-  `internal/app/post_publish_cleanup_test.go`
+  `internal/stage/publish_sources.go`, `internal/stage/publish_outputs.go`,
+  `internal/stage/publish_output_plan.go`,
+  `internal/stage/publish_transfer.go`, `internal/stage/publish_commit.go`,
+  `internal/stage/publish_test.go`,
+  `internal/stage/semantic_contracts_delivery.go`,
+  `internal/app/operator_helpers_test.go`, and
+  `internal/app/cleanup_orchestration_test.go`

docs/internal/stage-render.md

@@ -3,6 +3,10 @@
 ## Purpose
 
 Render Markdown transcript artifacts from normalized JSON transcripts via Seriatim.
+It runs after `trim` and before `extract` in the canonical sequence. Render and
+extract are independent sibling consumers: replacing render output does not
+invalidate extraction, but it does invalidate succeeded analysis and delivery
+records that may consume rendered transcripts.
 
 ## Inputs
 
@@ -17,10 +21,13 @@ Render Markdown transcript artifacts from normalized JSON transcripts via Seriat
 ## Key Behavior
 
 - uses `pipeline.render` settings (enabled/format/title/booleans).
-- resolves inputs manifest-first, then canonical fallback.
+- resolves inputs only from verified manifest output evidence.
 - writes run-local outputs first, then materializes canonical session outputs.
 - records input provenance, output paths, adapter metadata, logs, and generated config refs.
-- skips with stage metadata when `pipeline.render.enabled=false`.
+- when `pipeline.render.enabled=false`, completes successfully with no outputs
+  and records explanatory metadata. This is not an explicit self-skip: both
+  manifests record success. Because enablement is fingerprinted, enabling
+  render later automatically makes the prior result non-resumable.
 
 ## Failure Semantics
 
@@ -34,9 +41,20 @@ Render Markdown transcript artifacts from normalized JSON transcripts via Seriat
 - only `format: markdown` is supported.
 - render stage owns production of built-in Markdown transcript sources.
 
+## Resume Semantics
+
+The versioned semantic fingerprint covers enablement, final format, resolved
+title (including the session-title fallback), timestamp, segment-ID and
+metadata inclusion, both canonical input identities, and both Markdown output
+identities. Seriatim's executable, timeout, and report behavior are operational
+and do not invalidate rendered transcripts. A render-only change leaves the
+independent `extract` sibling reusable while invalidating their shared
+downstream consumers.
+
 ## Related Contracts And Tests
 
 - [Seriatim](../integrations/seriatim.md) owns render subprocess behavior.
 - [Configuration](../config.md#pipeline) owns render fields and defaults.
 - Implementation and tests: `internal/stage/render.go`,
-  `internal/stage/render_test.go`
+  `internal/stage/render_test.go`,
+  `internal/stage/semantic_contracts_refinement.go`

docs/internal/stage-transcribe.md

@@ -15,16 +15,34 @@ Generate raw per-speaker transcripts from prepared audio using WhisperX.
 ## Key Behavior
 
 - discovers prepared audio from manifest inputs or canonical audio directory.
-- derives speaker ID from `.flac` basename.
-- dispatches WhisperX requests through a bounded worker pool.
+- derives the transcript identity from the prepared `.flac` filename.
+- dispatches one WhisperX request per prepared file through a bounded errgroup.
 - validates each output as JSON.
-- writes run-local outputs then materializes canonical transcript outputs.
+- writes run-local outputs then materializes canonical transcript outputs only
+  after every planned request succeeds.
 
 ## Invariants
 
-- speaker basenames must be unique.
+- prepared audio identities must be unique; prepare disambiguates distinct
+  source paths that share a basename.
 - output path returned by adapter must match requested output path.
-- each successful output is validated before stage success.
+- an empty adapter result path means the requested path; adapters cannot select
+  an alternate destination.
+- each successful output is validated before stage success, and cancellation or
+  incomplete dispatch cannot be reported as a successful result.
+
+## Resume Evidence
+
+Transcribe records a versioned semantic-configuration fingerprint containing
+the Narratio-visible WhisperX service URL and recognition language. Changes to
+either rerun transcription and stale its fixed descendants while leaving
+prepare reusable. Retry count/delay, concurrency, timeout, credentials, and
+diagnostic locations are operational and do not change this evidence.
+
+WhisperX models or private service configuration not exposed by Narratio's
+adapter contract cannot be fingerprinted; use `--force` after changing them.
+An existing successful transcribe record without evidence reruns once when
+selected.
 
 ## Related Contracts And Tests
 
@@ -33,4 +51,6 @@ Generate raw per-speaker transcripts from prepared audio using WhisperX.
 - [Configuration](../config.md#pipeline) owns concurrency and other
   operator-selected values.
 - Implementation and tests: `internal/stage/transcribe.go`,
-  `internal/stage/transcribe_test.go`
+  `internal/stage/transcribe_test.go`,
+  `internal/stage/semantic_contracts_initial.go`, and
+  `internal/stage/semantic_contracts_initial_test.go`

docs/internal/stage-trim.md

@@ -33,6 +33,19 @@ When `trim.enabled=false`:
 - bounds output exists only in enabled trim path.
 - render-debug output is diagnostic and not a declared stage output.
 
+## Resume Semantics
+
+The versioned semantic fingerprint covers enablement, the bounds prompt and
+profile identifiers, the Scriptorium configuration identity, transcript input
+name, sticky session variable, bounds and trimmed output identities, and the
+Seriatim trim operation. Diagnostic bounds rendering, diagnostic output paths,
+timeouts, executable paths, and optional reports are operational and do not
+invalidate the canonical trimmed transcript.
+
+Narratio cannot inspect prompt, profile, or configuration content that
+Scriptorium or Seriatim privately resolves behind a stable identifier. Force
+`trim` after changing such private content without changing its identifier.
+
 ## Related Contracts And Tests
 
 - [Scriptorium](../integrations/scriptorium.md) owns bounds generation and
@@ -40,4 +53,5 @@ When `trim.enabled=false`:
 - [Seriatim](../integrations/seriatim.md) owns transcript trimming behavior.
 - [Configuration](../config.md#pipeline) owns trim fields and defaults.
 - Implementation and tests: `internal/stage/trim.go`,
-  `internal/stage/trim_test.go`
+  `internal/stage/trim_test.go`,
+  `internal/stage/semantic_contracts_refinement.go`

docs/internal/storage.md

@@ -12,14 +12,24 @@ operator-selected storage fields and credential mechanisms belong in
 `storage.ObjectStore` interface:
 
 - `List(ctx, prefix)`
+- `Read(ctx, key)` returns an object body and the generation observed with it
 - `Download(ctx, key, localPath)`
 - `Upload(ctx, localPath, key, opts)`
+- `UploadConditional(ctx, source, key, opts, condition)`
+- `Delete(ctx, key)` removes one object and succeeds when it is already absent
 - `Exists(ctx, key)`
 
 Key invariant:
 - callers pass full bucket-relative keys;
 - storage implementations do not infer campaign/session/run prefixes.
 
+`ReadObjectBounded` is the shared mechanism for small control objects. It opens
+one object version, returns the metadata observed with that body, rejects an
+oversized known size before transfer, and still performs a context-aware
+limit-plus-one read. It closes the body on every exit. Callers own the policy
+limit and add the control-object category to errors; this helper is not used for
+large artifact payloads.
+
 ## Composition
 
 `NewObjectStoreFromConfig` constructs the S3-backed implementation from
@@ -31,14 +41,28 @@ not own discovery, defaults, or configuration validation.
 
 - normalizes object keys.
 - `List` paginates and returns normalized `ObjectInfo`.
+- A truncated S3 listing must supply a new, non-empty continuation token;
+  otherwise listing fails with bucket and prefix context instead of looping.
 - `Download` writes local files with parent directory creation.
 - `Upload` streams local file and returns remote metadata.
+- `Read` binds a returned body to its S3 ETag. `UploadConditional` maps an ETag
+  match or absence precondition directly to the provider request and reports a
+  failed precondition without performing a local check-then-write replacement.
+- `Delete` maps one normalized key to the provider delete-object operation and
+  treats an absent object as success.
 - `Exists` maps not-found responses to `false`.
 
 ## Invariants
 
 - storage layer is stateless regarding manifest/stage progression.
+- bounded reads never retain more than the caller's limit plus one byte and do
+  not replace owner-specific size policy.
 - publish ordering semantics are owned by stage/app code, not storage adapters.
+- A caller that installs remote content into a canonical workspace path first
+  writes a sibling temporary file, validates the complete object against its
+  owner-specific contract, and only then replaces the destination. Temporary
+  files used solely for remote comparisons are removed by their callers and do
+  not represent installed workspace state.
 
 ## Implementation And Tests
 

docs/internal/workspace.md

@@ -13,8 +13,16 @@ previous-cache path construction. `SessionPathsFor` provides the session-scoped
 path model, and layout creation goes through `EnsureLayoutFor`. Callers should
 consume those helpers instead of rebuilding relative paths.
 
-`internal/pathsafe` and application cleanup helpers enforce confinement for
-relative destinations and deletion targets.
+`internal/pathsafe` validates relative destinations. `internal/fileops` opens
+explicit cleanup roots and removes only normalized proper descendants through
+the resulting root handle.
+
+`internal/fileops` owns the ordinary workspace mode contract. On POSIX,
+`WorkspaceDirectoryMode` is setgid `02775` and `WorkspaceFileMode` is `0664`.
+`EnsureWorkspaceDirectory` reapplies the directory mode after creation so a
+restrictive umask cannot remove group access, while retaining existing ownership
+and group. Credential paths are outside this contract; the platform-specific
+operational requirements are in [Operations](../operations.md#workspace-permissions).
 
 ## Run-Local Stage Layout
 
@@ -25,32 +33,40 @@ previous-session cache paths remain session-durable and are never redirected
 into run-local output space.
 
 Extraction uses run-local receipt, stderr, and output-root helpers, then
-promotes the validated external bundle to the unique immutable Notarius bundle
-path supplied by `internal/artifacts`. `internal/fileops.PromoteDirectory`
-copies only regular files and directories to a same-filesystem temporary
-sibling. Source traversal uses confined directory handles and identity checks
-so replacing an inspected root, directory, or file is rejected rather than
-followed. The completed tree is atomically renamed without replacing an
-existing destination. Exact physical paths belong in
+validates and renames the external bundle to the unique immutable Notarius
+bundle path supplied by `internal/artifacts`. Exact physical paths belong in
 [Operations](../operations.md#extraction-workflow).
 
 ## Locking
 
-`artifacts.LocalStore` enforces the single-writer session lock via `.lock`
-(`ErrLockConflict` on contention).
+`artifacts.LocalStore` enforces the single-writer session lock via an
+operating-system lock held on `.lock` (`ErrLockConflict` on contention). The
+file retains owner metadata after release or process death; its existence is
+not evidence that a lock is active. Command and restore flows wait for this
+lock only while their context remains active, and report a release failure.
+
+The runner assigns every invocation a run-workspace identity but creates the
+physical directory only before an executing stage that requires it. Fully
+reused invocations and cleanup-only invocations therefore do not accumulate
+empty run directories.
 
 ## Cleanup Semantics
 
-Automatic post-publish cleanup:
+The canonical cleanup stage:
 
-- only runs when publish actually executed and succeeded;
-- requires `uploaded=true` and `current_pointer_written=true` metadata;
+- runs after notify only when selected by the invocation range;
+- requires a succeeded publish record with `uploaded=true`, the published run
+  ID, remote commit key, and current commit-pointer key;
 - consumes the resolved cleanup policy described in
   [Configuration](../config.md);
-- refuses unsafe deletes (root delete, out-of-root delete, symlink paths).
+- refuses unsafe deletes (root delete, traversal, and out-of-root targets);
+- treats missing targets as successful, idempotent deletion; and
+- uses its ordinary failed/succeeded manifest stage record for retry. A later
+  full run can skip reusable upstream stages and retry cleanup without
+  republishing.
 
-Manual cleanup uses the same scoped-target checks. Invocation syntax and exact
-deletion scope belong in [CLI](../cli.md#clean) and
+Manual cleanup uses the same root-confined deletion mechanism. Invocation
+syntax and exact deletion scope belong in [CLI](../cli.md#clean) and
 [Operations](../operations.md#cleanup).
 
 ## Invariants
@@ -58,17 +74,24 @@ deletion scope belong in [CLI](../cli.md#clean) and
 - campaign-aware session root is mandatory.
 - manifest-driven stage state is durable across runs.
 - cleanup guardrails prevent destructive root/out-of-scope deletion.
+- restore installation is confined to validated relative paths beneath the
+  selected session root.
+- ordinary workspace paths retain group-writable directory and file modes across
+  nested creation, replacement, and Notarius promotion.
 
 ## Implementation And Tests
 
 - Path model and local store: `internal/artifacts/paths.go`,
   `internal/artifacts/local.go`
 - Run-local materialization: `internal/stage/run_local.go`
-- Immutable bundle promotion: `internal/fileops/directory.go`
-- Cleanup confinement: `internal/app/cleanup_targets.go`,
-  `internal/app/post_publish_cleanup.go`
+- Immutable bundle installation: `internal/stage/extract.go`
+- Workspace modes: `internal/fileops/modes.go`
+- Cleanup confinement: `internal/fileops/cleanup.go`,
+  `internal/stage/cleanup.go`, `internal/stage/cleanup_plan.go`, and
+  `internal/app/cleanup_targets.go`
 - Tests: `internal/artifacts/paths_model_test.go`,
   `internal/artifacts/local_test.go`, `internal/stage/run_local_test.go`,
-  `internal/fileops/directory_test.go`,
-  `internal/app/cleanup_targets_test.go`,
-  `internal/app/post_publish_cleanup_test.go`
+  `internal/fileops/modes_posix_test.go`,
+  `internal/fileops/cleanup_test.go`, `internal/app/cleanup_targets_test.go`,
+  `internal/stage/cleanup_test.go`, and
+  `internal/app/cleanup_orchestration_test.go`

docs/operations.md

@@ -36,7 +36,12 @@ narratio session init 2026-04-04 --remote --force
 
 If `campaign.yml` sets `session_template_file`, `session init` renders it. Template variables must resolve to concrete values.
 
-Campaigns must provide stable input files for speakers, autocorrect, glossary, players, and party. Session files may override those paths for one session. The `prepare` stage materializes them under `inputs/`; configured Scriptorium artifacts can reference prepared `players`, `party`, and `glossary` files with `narratio.input.players`, `narratio.input.party`, and `narratio.input.glossary`.
+Campaigns must provide stable input files for speakers, autocorrect, glossary,
+players, and party, and may provide an optional spell-catalog overlay. Session
+files may override those paths for one session. The `prepare` stage
+materializes them under `inputs/`; configured consumers use the prepared files,
+never the original campaign or session source paths. Field definitions and
+source IDs are in [Configuration](./config.md#notarius-reference-bindings).
 
 ## Standard Session Workflow
 
@@ -65,6 +70,19 @@ narratio run 2026-04-04
 narratio session status 2026-04-04
 ```
 
+Run, plan, and status output identify the resolved pipeline profile (or `none`)
+and effective configuration digest. Status distinguishes the current resolved
+value from the last value persisted in the session manifest, which helps
+diagnose profile switches without changing resume authority.
+
+Before switching an operational profile, compare its effective meaning with the
+current selection through `narratio config diff <left-profile> <right-profile>`.
+The command is read-only and succeeds whether it finds differences or not. Its
+sorted records describe defaulted, expanded concrete configuration—not source
+file layout—so it can be used to review model, artifact, and publish changes
+without creating a session or run. Select the same campaign explicitly when
+profiles could resolve different campaign paths; see the [CLI reference](cli.md#config-validate-config-show-config-sources-and-config-diff) for syntax and record format.
+
 ## Stage Execution and Continuation Behavior
 
 Canonical stage order:
@@ -75,22 +93,53 @@ Canonical stage order:
 4. `polish`
 5. `normalize`
 6. `trim`
-7. `extract`
-8. `render`
+7. `render`
+8. `extract`
 9. `analyze`
 10. `publish`
 11. `notify`
+12. `cleanup`
 
 Execution rules:
 
-- succeeded stages are skipped unless `--force` is set;
+- succeeded stages are skipped unless `--force` is set; stages with semantic
+  configuration contracts additionally require matching versioned evidence;
 - `run` continues interrupted or partially completed sessions by running non-succeeded stages;
-- forcing an upstream stage marks succeeded downstream stages as `stale` before
-  the replacement runs; and
+- forcing a stage marks succeeded transitive dependents as `stale` before the
+  replacement runs; render and extract are independent siblings; and
 - an executed failure, changed self-skip, or success that replaces a different
-  effective upstream outcome also marks succeeded downstream stages stale. A
+  effective outcome uses the same fixed dependency relation. A
   repeated self-skip with the same reason and no outputs is stable and does not
-  perpetually rerun downstream work.
+  perpetually rerun dependent work.
+
+Every aggregate stage except analyze currently provides semantic-configuration
+evidence; analyze retains its more precise per-artifact fingerprints and
+validator.
+Prepare additionally validates current stable/local/S3 source identity and the
+checksums of its durable prepared copies before reuse. Changed bytes, audio
+membership, S3 object identity, or missing/tampered copies rerun prepare and
+its fixed descendants without requiring `--force`. Changing prepare selection
+semantics likewise reruns all fixed descendants; changing
+WhisperX language/service identity reuses prepare; changing a Seriatim merge
+transformation reuses prepare and transcribe; and changing an Audita model
+reuses prepare, transcribe, and merge while rebuilding transcript refinement.
+A trim change invalidates both render and extract through the fixed dependency
+relation, while a render-only change preserves the extract sibling.
+
+Operational timeouts, retry/concurrency tuning, executable paths,
+workspace/cache/spool placement, reports, diagnostics, and secret values are
+excluded. Configuration, models, prompts, modules, or resources loaded
+privately inside external tools remain unobservable to Narratio. If their
+contents change behind the same configured identifier, explicitly force the
+affected stage.
+
+An explicit self-skip is a durable `skipped` stage outcome that later runs
+reconsider. It differs from successful no-output execution: disabled `render`
+and `publish`, and absent or no-executable `analyze`, record `succeeded` with
+metadata and no outputs. Ordinary later runs reuse those successful results;
+force the affected stage after enabling or configuring it. Optional artifact
+inputs are omitted only from the consuming artifact invocation and do not make
+the stage self-skip.
 
 Single-stage execution:
 
@@ -98,14 +147,92 @@ Single-stage execution:
 narratio run-stage normalize 2026-04-04 --force
 ```
 
+Contiguous bounded execution uses inclusive canonical endpoints:
+
+```bash
+narratio session plan 2026-04-04 --from extract --through analyze --force
+narratio run 2026-04-04 --from extract --through analyze --force
+```
+
+Omitting `--from` selects from `prepare`; omitting `--through` selects through
+`cleanup`. Force applies only within the selected range. Repeating `--from`,
+`--through`, or `--force` is rejected instead of resolving by argument order.
+The plan command uses the same selection contract and prints only the selected
+range. Planning is read-only: it clones the loaded manifest, models selected
+stage transitions and invalidation in memory, and invokes resume validation
+without writing the manifest, creating run directories, materializing files,
+or invoking pipeline adapters. Analyze detail separates explicit targets,
+prerequisite rebuilds, scheduled execution, and current reuse. This lets a
+coarsely stale aggregate analyze stage show zero artifact executions when its
+selected artifact evidence is still semantically current.
+
+Before a bounded run or plan whose range starts after `prepare`, every excluded
+prefix stage must already have a session-manifest status of `succeeded` or
+`skipped`. Narratio reports the first absent, pending, running, failed, stale,
+or interrupted prerequisite without creating a run-local directory or changing
+session state. Widen `--from` to include that stage, or recover it explicitly
+before retrying. Excluded prefix stages are not resume-validated or repaired as
+part of the bounded invocation; selected stages still reject missing, unsafe,
+or manifest-inconsistent inputs at their owning boundary.
+
+Stages after `--through` are not prerequisites and are never scheduled by the
+bounded invocation. A selected forced stage can mark one of those succeeded
+dependents stale through the fixed invalidation relation, but the dependent
+does not execute until a later invocation selects it. Production composition
+likewise initializes only collaborators needed by the selected range and
+shared session lifecycle. In particular, render does not require Notarius or
+Scriptorium, extract does not require Scriptorium, and analyze does not require
+the transcription, Seriatim, Audita, or Notarius adapters.
+
+For the common post-transcript development loop, use:
+
+```bash
+narratio regenerate-artifacts 2026-04-04
+narratio regenerate-artifacts 2026-04-04 --artifacts session_recap,player_handout
+```
+
+This command is a transparent expansion to a forced bounded `run` from
+`extract` through `analyze`. Extraction always rebuilds its complete configured
+bundle. Analysis rebuilds the selected targets and their required analysis
+prerequisites, or uses the normal default selection when no artifact names are
+given. The command does not run publish, notify, or cleanup; delivery and
+retention remain separate operator actions.
+
+Inspect current artifact evidence, then publish explicitly when the regenerated
+set is ready:
+
+```bash
+narratio session artifacts 2026-04-04
+narratio publish 2026-04-04
+```
+
+If planning or execution reports stale, missing, failed, or tampered
+analysis evidence, regenerate the affected target instead of copying an older
+canonical file into place or editing the manifest. See
+[Troubleshooting: Analysis artifact evidence is not current](./troubleshooting.md#analysis-artifact-evidence-is-not-current).
+
+Analyze checkpoints each completed configured artifact before starting later
+artifact work. After a partial failure or interruption, retry normally: valid
+earlier checkpoints are reused and execution resumes with failed, stale, or
+missing work in dependency order. `--force` is unnecessary unless the operator
+intends to replace otherwise-current artifacts.
+
 ## Artifact Selection
 
-`--artifacts` can be used on `run`, `run-stage`, `analyze`, and `publish`.
+For a configured artifact family, selecting its family key expands to every
+concrete character artifact. Select a concrete generated key to operate on one
+member only. Manifests and plan output retain the concrete key as the durable
+identity and include the family and character ID as optional provenance.
+
+`--artifacts` can be used on `run`, `session plan`, `run-stage`, `analyze`, and
+`publish`. For a bounded run or plan, the selected range must contain `analyze`
+or `publish`.
 
 Selection behavior:
 
 - validates names against `pipeline.scriptorium.artifacts`;
-- filters analyze execution to selected configured artifacts;
+- selects explicit analyze targets and permits their required configured
+  prerequisites to be reused or rebuilt first;
 - filters publish rules for `narratio.artifact.<name>` sources only;
 - does not suppress built-in transcript, bounds, or explicitly configured
   `narratio.extraction.<name>` publish sources; and
@@ -127,17 +254,60 @@ The directory is immutable once promoted. Configured lanes become
 the bundle and `index.json` are retained for audit and resume validation but
 are not selectable or published implicitly.
 
+Configured Notarius references resolve only from the current manifest-backed
+prepared inputs. Their canonical locations are `inputs/party.yml`,
+`inputs/players.yml`, `inputs/glossary.yml`, and, when configured,
+`inputs/spell_catalog.json`. Extraction supplies Notarius with verified copies
+under `runs/<run_id>/extract/references/` so a concurrent refresh of canonical
+prepared files cannot change the bytes consumed by an in-flight invocation.
+For a canonical party, preparation retains the validated authored party bytes
+at `inputs/party.yml` and generates `inputs/players.yml` from that roster.
+The manifest records their checksums separately, with the players input marked
+as derived from the party; refresh preparation after changing the roster rather
+than editing either prepared file.
+Inspect the effective stable-input inventory and
+prepared-file readiness with:
+
+```bash
+narratio session status 2026-04-04
+narratio session validate 2026-04-04
+```
+
+Reference metadata records selector, source ID, session-relative path,
+checksum, and byte size, but never payload contents. Changing a prepared
+reference changes extraction identity: ordinary continuation rejects the old
+result, reruns Notarius, and marks successful downstream stages stale. If the
+prepared file is missing or inconsistent with its manifest checksum, repair
+the source configuration and refresh prepared state first:
+
+```bash
+narratio run-stage prepare 2026-04-04 --force
+```
+
 Starting a replacement clears the previous extraction payload from the current
 session-stage record. If that replacement fails or self-skips, the current
-record does not fall back to the earlier outputs. The earlier run manifest and
-immutable bundle remain available for inspection, but downstream resolution
-requires a new current successful extraction record.
+record does not fall back to the earlier outputs. The earlier immutable bundle
+remains available for inspection, but downstream resolution requires a new
+current successful extraction record.
 
-Atomic Notarius bundle promotion is supported on Linux, macOS, and Windows.
-On other operating systems, extraction fails before copying the bundle into a
-temporary promotion tree because Narratio has no verified atomic no-replace
-directory primitive there. This is an extraction limitation, not a broader
-platform-support guarantee for every Narratio workflow.
+Notarius extraction validates its run-local bundle and moves it once to the
+unique durable bundle path. A pre-existing durable destination is a collision;
+no duplicate promotion tree is created.
+
+## External Command Lifecycle
+
+When an external command is cancelled or times out, Narratio terminates its
+owned descendants as well as the command itself. Cancellation first requests
+termination where the platform supports it, then force terminates after a
+bounded wait. A command is not considered finished until its leader has been
+reaped, and descendants that keep standard output or error open cannot keep
+the invocation blocked. Other operating systems fail closed rather than launch
+a command without tree ownership.
+
+Subprocess stdout and stderr diagnostics are separately redacted and capped at
+8 MiB per invocation. Narratio does not retain configured credential values in
+these logs or their error tails; reaching a capture limit terminates the command
+tree and reports which stream exceeded the limit.
 
 Run-local diagnostics are:
 
@@ -145,11 +315,15 @@ Run-local diagnostics are:
 - `runs/{run_id}/extract/notarius.stderr.log`
 - `runs/{run_id}/extract/notarius-output/` before durable promotion
 
-The run-record upload excludes the complete
-`extract/notarius-output/**` subtree. The receipt and stderr files remain
-eligible run-record diagnostics. The durable bundle is never scanned for
-implicit publication; only lanes named by explicit `pipeline.publish.outputs`
-rules are uploaded.
+The run upload is an allowlist derived from the session manifest's declared
+current-run outputs, logs, and generated configurations, not a workspace scan.
+References to canonical session files and prior-run paths are excluded. Each
+declared source is opened without following symlinked ancestors or the leaf,
+verified as a regular file, and streamed from that verified descriptor.
+Unlisted files and unsafe entries are never uploaded; a run with no declared
+current-run diagnostics uploads no run-local files. No distinguished diagnostic
+file is uploaded. The durable bundle is never scanned for implicit publication;
+only lanes named by explicit `pipeline.publish.outputs` rules are uploaded.
 
 To intentionally replace the current extraction result, run:
 
@@ -157,15 +331,27 @@ To intentionally replace the current extraction result, run:
 narratio run-stage extract 2026-04-04 --force
 ```
 
-Narratio automatically reruns extraction when its recorded invocation contract
-or durable output validation changes. It cannot fingerprint configuration
-files, profiles, prompts, modules, or references loaded transitively by
-Notarius. Force extraction after changing any of those inputs, even when the
-top-level Narratio and Notarius config paths remain the same. A forced extract
+Narratio automatically reruns extraction when its recorded invocation contract,
+prepared Narratio reference identities, or durable output validation changes.
+The semantic portion covers Notarius enablement, pipeline identity, declared
+reference mapping, and output contracts. Executable, timeout, working directory,
+and private config-file paths are operational and do not invalidate a current
+result.
+It cannot fingerprint configuration files, profiles, prompts, modules, or
+other references loaded transitively by Notarius itself. Force extraction after
+changing any of those inputs, even when the top-level Narratio and Notarius
+config paths remain the same. A forced extract
 marks successful downstream stages stale. Ordinary extraction failures or
 outcome changes also stale affected downstream stages, while an identical
 repeated `notarius_disabled` self-skip does not repeatedly invalidate them.
 
+Publish reuse additionally tracks enabled/run-upload behavior, normalized
+output rules, and remote backend/bucket/region/endpoint/root identity.
+Credential environment names, local workspace placement, and run IDs are
+excluded. Regardless of semantic reuse evidence, executing publish reads
+independent remote locks directly and rechecks initially unlocked sources
+before commit selection.
+
 ## Publish Workflow
 
 Run publish only:
@@ -180,31 +366,70 @@ Equivalent:
 narratio run-stage publish 2026-04-04 --force
 ```
 
+This standalone command stops after publish and does not invoke cleanup. A
+default full `run` continues through notify and cleanup.
+
 Publish commit model:
 
 - uploads eligible run files under `{session_prefix}/runs/{run_id}/`, excluding
   audio and the run-local Notarius staging bundle;
-- uploads configured published outputs, including only explicitly configured
-  extraction lanes;
-- uploads `previous/**` cache files when present;
-- writes `current/manifest.json`;
-- writes `current/run_id.txt` last.
+- uploads configured published outputs and `previous/**` cache files into the
+  same immutable run scope, including only explicitly configured extraction
+  lanes;
+- writes `{session_prefix}/runs/{run_id}/commit.json` after all declared
+  immutable objects are uploaded and verified; and
+- writes `{session_prefix}/current/commit-pointer.json` once, last.
 
-`current/run_id.txt` is the remote current-state commit marker.
+`current/commit-pointer.json` is the remote current-state commit marker. It
+selects exactly one immutable commit, which declares the complete object set.
+
+## Remote Commit Migration
+
+The immutable remote commit contract uses
+`runs/{run_id}/commit.json` to declare a run's complete object set and a small
+`current/commit-pointer.json` to select it. The pointer binds the selected
+commit by version, checksum, size, and storage generation; committed artifacts
+are also checksum- and generation-bound. Readers accept this contract now and
+strictly reject mismatched or unknown data.
+
+A selected commit may carry a `published_output` declaration from an earlier
+run in the same campaign/session. Restore, previous-session caching, status,
+and artifact inspection use that declaration's exact immutable key and stable
+source; they do not reconstruct a current-run key or scan the session prefix.
+Other artifact types remain confined to the selected commit's own run.
+
+When the pointer is absent, remote state is not published; republish the
+session to establish a committed snapshot. Remote commit state does not carry
+local `current_pointer_written` metadata.
 
 ## Publish Locks
 
-Lock sources:
+Each mutable lock is an independent strict JSON object at
+`{session_prefix}/locks/{sha256(source)}.lock`. The lowercase digest is computed
+from the exact canonical source. Listing validates every object in that
+reserved prefix and reports locks sorted by source.
 
-- static locks in `pipeline.publish.locks`
-- mutable remote locks in `{session_prefix}/locks.yml`
+Upgrades do not read, migrate, or delete the retired `{session_prefix}/locks.yml`
+object. It has no effect on publication and may be removed manually after
+verifying lock commands and publication behavior with the upgraded Narratio
+version. No migration command is required.
 
-Effective lock rules:
+Operational rules:
 
-- static and remote locks are merged;
-- static locks win on source collisions;
-- locked outputs are intentional skips;
-- lock add/remove commands mutate only remote lock state.
+- add uses conditional creation and reports an existing lock;
+- add with `--force` observes the current generation and attempts one
+  generation-matched replacement. A concurrent change is reported for an
+  explicit operator retry;
+- remove is idempotent and reports whether a lock was present;
+- the initial publish lock snapshot controls output planning. A locked source
+  carries its exact declaration from the prior current commit when available;
+  a never-published locked source remains absent even when required;
+- carried bytes are not copied. Publish verifies the prior object's exact key,
+  size, and generation without downloading it; and
+- after immutable uploads and the immutable commit, publish re-reads every
+  initially unlocked participating source. A newly added lock prevents the
+  current pointer from advancing, although the immutable attempt may remain.
+  A removed initial lock may conservatively cause one carry.
 
 Examples:
 
@@ -230,20 +455,39 @@ Apply:
 narratio session restore 2026-04-04
 ```
 
+`--dry-run` does not write durable session files. It still reads the selected
+remote current state and may read object identity/content needed to classify the
+plan, so it is not a network-free operation.
+
 Default restore scope:
 
-- `manifest.json`
-- `transcripts/**`
-- `artifacts/**`
-- `previous/**` when needed by configured previous-session artifact inputs
+- the committed session manifest and the committed transcript/artifact objects
+  declared by the selected remote commit
+- `previous/**` when needed by configured previous-session artifact inputs;
+  each is selected from its exact committed `published_output` declaration
 
 Optional:
 
 - `--include-audio` to include `audio/**`
-- `--force` to overwrite local conflicts
+- `--force` to overwrite eligible conflicting regular files; it never replaces
+  directories, symlinks, or other non-regular local targets
+
+Restore treats a local leaf symlink or any symlinked ancestor beneath the
+selected session root as a conflict, even when the linked content matches the
+selected remote object. `--force` does not override that conflict.
+
+Before each install, restore validates the destination again beneath the
+selected session root. A target changed into a symlink, directory, or other
+non-regular entry is not overwritten.
 
 Restore writes an execution report at `reports/restore-latest.json`.
 
+If restore fails after beginning installation, it leaves a durable
+`.restore-incomplete.json` marker in the session root. Pipeline runs will stop
+until you rerun the same restore command and it completes. Restore intentionally
+does not try to roll back files already installed; retrying the selected remote
+snapshot is the recovery procedure.
+
 ## Local State Layout
 
 Session root:
@@ -263,6 +507,12 @@ Durable session paths:
 - `config/**`
 - `runs/**`
 
+`manifest.json` is the versioned session-progress document. Narratio accepts
+only `narratio.session-manifest.v1`. Do not edit unsupported session state to
+add missing markers. Move it aside and regenerate it, restore a verified
+current committed snapshot, or republish healthy regenerated state as the
+relevant workflow requires.
+
 Validated Notarius bundles live below `artifacts/notarius/{run_id}/`; receipt,
 stderr, and pre-promotion output remain in the producing run's `extract`
 directory as described in [Extraction Workflow](#extraction-workflow).
@@ -284,6 +534,40 @@ Cache layout (durable S3 audio cache):
 
 - `{cache.root}/s3/{bucket}/...`
 
+Each cached audio file has an adjacent managed identity record. It binds the
+file to its remote object version and verified digest; deleting or altering the
+record simply causes Narratio to download and verify the object again.
+Remote audio and restored files are fully transferred into sibling temporary
+files and validated before they replace their canonical workspace paths.
+
+### Workspace Permissions
+
+Ordinary Narratio workspace content is intentionally shareable with the
+workspace group. On POSIX systems, Narratio-created workspace, spool, and cache
+directories converge on setgid `02775`; ordinary files, including manifests,
+transcripts, generated configuration, logs, reports, and Notarius artifacts,
+converge on `0664`. Narratio explicitly applies these modes so a restrictive
+caller umask does not remove group write or setgid. It does not change file or
+directory ownership: the configured workspace's existing group is inherited.
+
+Windows does not implement POSIX mode bits or setgid semantics. Configure the
+workspace, spool, and cache locations with an ACL that grants the collaborating
+group read/write access, and configure credential locations with an ACL limited
+to the intended credential owner. Do not use POSIX mode displays as evidence of
+Windows access control.
+
+API keys are credentials, not ordinary workspace data. Store them outside the
+shared workspace or in a separately restricted credential location; ordinary
+workspace group access must never be treated as authorization to read keys.
+On POSIX, provision a credential directory as `0700` and credential files as
+`0600`; Narratio rejects group- or other-readable configured credential paths.
+On Windows, restrict the directory and files with ACLs to the credential owner.
+
+External adapter results are individually bounded before Narratio validates or
+materializes them. These per-file limits do not reserve disk space: prevent hard
+disk exhaustion with filesystem, service, container, or volume quotas sized for
+the session workload.
+
 ## Cleanup
 
 Session-scoped cleanup:
@@ -309,9 +593,30 @@ Rules:
 
 - `clean` deletes work/spool session state;
 - cache is preserved unless `--clear-cache` is set;
-- automatic post-publish cleanup is gated by successful publish commit plus:
+- each deletion is confined beneath its configured workspace, spool, or cache
+  root; root, traversal, and out-of-root targets are refused;
+- the final cleanup stage is gated by successful publish evidence plus:
   - `pipeline.spool.delete_audio_after_publish=true`
   - `pipeline.workspace.cleanup_after_publish=true`
+  - the manifest publish record has `uploaded=true`, the published run ID, the
+    exact remote commit key, and the current commit-pointer key.
+
+Cleanup derives only the configured run-scoped spool and workspace targets,
+uses root-confined deletion, and does not read or mutate object storage. A
+failure leaves publish succeeded and the remote committed snapshot current.
+Retry with a normal full run: valid upstream work, including publish and notify,
+is skipped while the failed cleanup stage runs again. `run-stage cleanup` is
+also available when the manifest has valid publish evidence. A range ending at
+`notify` or earlier and the standalone `publish` command never delete local
+state.
+
+Older local manifests that contain the retired cleanup-obligation field are
+intentionally incompatible with strict manifest decoding. If such an
+obligation is still outstanding, complete it with the pre-upgrade binary.
+Otherwise verify that the remote publication is committed, move aside or
+regenerate the incompatible local manifest (or restore the verified remote
+snapshot), and then use the cleanup stage. Manual JSON editing is not the
+normal migration path.
 
 ## Operational Caveats
 

docs/policy/architecture.md

@@ -29,6 +29,10 @@ in the [integration documentation](../integrations/).
 The pipeline has one canonical ordered stage set. Configuration may enable,
 disable, or parameterize supported behavior, but it must not turn that sequence
 into an arbitrary DAG or hide orchestration in generic workflow abstractions.
+An invocation selects either the full sequence or one inclusive contiguous
+range of it. Execution remains flat and canonical even though invalidation is
+dependency-aware: the application owns a separate fixed relation used only to
+stale transitive dependents, including dependents outside a selected range.
 The implemented stage inventory belongs in the
 [Internal Overview](../internal/overview.md).
 
@@ -87,8 +91,10 @@ merely on incidental files existing on disk.
 
 A failed or interrupted stage must not be presented as successful. Failure
 should preserve enough local state and diagnostics for inspection, recovery,
-and resume. Forcing an upstream stage invalidates succeeded downstream work
-according to the canonical stage order.
+and resume. Forcing a stage invalidates succeeded transitive dependents
+according to a fixed application-owned relation that is separate from canonical
+execution order. The relation is validated against the stage inventory and is
+not configurable.
 
 A stage may explicitly self-skip with a stable reason and no outputs. That
 outcome is persisted, clears older outputs owned by the stage, and is
@@ -110,8 +116,11 @@ adapter and publish metadata.
 
 Resume and skip decisions are manifest-driven. Filesystem state may be
 inspected and validated, but file presence alone does not replace recorded
-stage state. Invocation-scoped run records provide an audit of one execution;
-they do not replace the session manifest as progress authority.
+stage state. Each invocation retains an in-memory command summary and a
+run-local workspace identity, but neither is a durable progress ledger. The
+physical run directory is created on demand only when an executing stage
+requires it; a fully reused invocation or a cleanup-only invocation does not
+leave an empty run directory.
 
 Restore treats committed remote current state as its authority. It must plan
 deterministically, confine remote-to-local paths, protect local conflicts, and
@@ -119,6 +128,17 @@ install the validated session manifest after other restored durable files. The
 physical workflow and recovery procedures belong in
 [Operations](../operations.md).
 
+Restore and runner transitions for one session use the same local lock. A
+durable incomplete-restore marker blocks runner reuse after a partial restore;
+safe retry, rather than rollback of arbitrary local effects, is the recovery
+mechanism. Restored manifest-local references must be confined to the selected
+local session root, never trusted as producer-machine absolute paths.
+
+For the immutable remote-commit protocol, a restore or status operation binds
+to one pointer-selected commit and only its declared object identities. A force
+flag may replace an eligible regular managed file, but never turns a directory
+or other non-regular conflict into a successful restore.
+
 ## Configuration
 
 Configuration is strict, explicit, centralized, and operator-oriented.
@@ -128,6 +148,14 @@ Configuration is strict, explicit, centralized, and operator-oriented.
 - Empty configured values do not silently replace meaningful defaults.
 - Validation rejects invalid composition before stage execution where
   practical.
+- Root-owned imports and one selected profile resolve deterministically through
+  the configuration owner; commands do not implement their own merge rules.
+- Canonical party rosters are campaign-owned. Their derived players projection
+  and concrete character-family artifacts are resolved before runtime stages
+  or adapters receive configuration.
+- Resume uses stage- or artifact-owned semantic evidence for observable
+  result-affecting configuration; profile identity and an effective digest are
+  provenance, never blanket cache keys.
 - Session templating remains narrow and deterministic rather than becoming a
   general configuration language.
 - Secret values are supplied indirectly and are not persisted in ordinary
@@ -146,6 +174,10 @@ Canonical helpers own workspace, spool, cache, session, run, input, transcript,
 artifact, log, report, configuration, and publish-current paths. Callers must
 not reconstruct canonical paths through scattered string concatenation.
 
+Reusable audio cache entries require a typed record that binds a confined,
+no-follow regular file and its digest to the selected remote object identity.
+Size alone and unqualified multipart ETags are not content-integrity evidence.
+
 Artifact resolution is deterministic and manifest-aware. Producers materialize
 canonical outputs before reporting success, and consumers resolve declared
 artifact identities rather than infer files from unrelated directory contents.
@@ -156,8 +188,8 @@ availability.
 Writes, moves, replacements, and deletions must use narrow, explicit,
 root-confined destinations. Symlinks, traversal, broad roots, and ambiguous
 relative destinations must not expand the scope of an operation. Cleanup is
-permitted only through explicit operator action or configured post-publish
-gates, and it must preserve durable cache unless cache removal is explicitly
+permitted only through explicit operator action or the configured final cleanup
+stage, and it must preserve durable cache unless cache removal is explicitly
 requested.
 
 Physical layout, retention, and operational lifecycle belong in
@@ -167,22 +199,48 @@ contracts belong under [Integrations](../integrations/).
 ## Publish Commit Boundary
 
 Publish has one explicit remote commit boundary. A remote run becomes current
-only after Narratio has successfully uploaded the run record, required published
-outputs, `current/manifest.json`, and finally `current/run_id.txt`.
+only after Narratio has successfully uploaded its immutable run-scoped objects,
+the immutable commit manifest, and finally the current commit pointer.
 
-`current/run_id.txt` is the commit marker and must be written last. Failed,
-incomplete, skipped, or uncommitted publish attempts must not be presented as
-current remote state. Publish locks remain authoritative and are not bypassed by
-a forced run.
+`current/commit-pointer.json` is the sole mutable selector and must be written
+exactly once, last. Failed, incomplete, skipped, or uncommitted publish attempts
+must not be presented as current remote state. Publish locks remain authoritative
+and are not bypassed by a forced run. Each mutable remote lock is an independent
+per-source object; lock mutations use provider-enforced generation preconditions.
+Publish revalidates every initially unlocked participating source after writing
+the immutable commit and before pointer selection. A lock observed then leaves
+the prior committed snapshot current. A lock created after that final check may
+race the pointer write; the commit protocol does not claim a stronger distributed
+transaction boundary.
 
 Automatic local cleanup is permitted only after a successful publish commit,
 only when explicitly configured, and only through the path-safety guardrails.
+It is the final ordinary pipeline stage after `notify`. The stage derives its
+exact run-scoped targets from validated publish metadata and the configured
+campaign/session identity; it never infers a target from directory contents or
+rereads remote storage. A cleanup failure makes the invocation incomplete while
+leaving publish succeeded and the committed remote snapshot authoritative. A
+normal later full run reuses valid upstream stages and retries cleanup.
+
+The standalone `publish` command selects only publish and therefore never
+invokes cleanup. Operators may select cleanup directly only when the manifest
+contains valid successful publication evidence.
 
 ## Security, Privacy, And Diagnostics
 
-Narratio handles private campaign material. Transcripts, prompts, generated
-artifacts, reports, logs, manifests, and diagnostic files are potentially
-sensitive.
+Narratio distinguishes ordinary workspace data from credentials. Campaign and
+session material—including manifests, transcripts, prompts, generated
+configuration, logs, reports, diagnostics, and Notarius artifacts—is
+intentionally shareable with the configured workspace group. API-key material
+is sensitive and is not covered by the ordinary workspace-sharing policy.
+
+On POSIX systems, Narratio-created ordinary workspace directories converge on
+setgid `02775` and ordinary workspace files on `0664`, even when the caller's
+umask is restrictive. This preserves the existing workspace group for nested
+creation and atomic replacements without changing ownership. API-key storage
+uses a separate restrictive contract. On Windows, POSIX mode bits and setgid
+are not authoritative; operators must provide the equivalent shared-group and
+credential-restricted ACLs described in [Operations](../operations.md#workspace-permissions).
 
 Raw secrets must not be stored in pipeline, campaign, or session YAML or written
 to manifests, logs, generated configuration, reports, publish metadata,

docs/policy/documentation.md

@@ -59,6 +59,8 @@ secret values.
 | --- | --- | --- | --- |
 | Product orientation and minimal end-to-end quickstart | `README.md` | What Narratio is, why it is useful, one shortest successful invocation, and links onward. | Complete command reference, configuration reference, operational procedures, implementation detail. |
 | Contributor entry point | `docs/development.md` | Task-oriented reading guide, minimal contributor orientation, baseline validation commands, and links to canonical docs. | Package inventory, architecture rules, subsystem behavior, detailed change recipes. |
+| Maintainer release procedure | `docs/release.md` | Version selection, candidate preparation and validation, guarded tag publication, release completion boundary, failure recovery, and optional asynchronous inspection. | Script implementation mechanics, current application contracts, and historical release summaries. |
+| Historical release summary | `docs/releases/<tag>.md` | Immutable summary, compatibility, upgrade, and changes for one released version. | Current maintainer procedure and current application contract details. |
 | Current application architecture | `docs/policy/architecture.md` | System shape, normative ownership, dependency direction, architectural boundaries, invariants, safety properties, and non-goals. | Concrete package inventory, implementation mechanics, contributor procedures, decision history, future work. |
 | Documentation organization | `docs/policy/documentation.md` | Documentation ownership, audience boundaries, maintenance rules, and ADR/document lifecycle. | Application architecture or product behavior. |
 | Testing policy | `docs/policy/testing.md` | Test philosophy, risk-based sufficiency, test boundaries, doubles, coverage guidance, regression-test policy, and criteria for adding, rewriting, or deleting tests. | Subsystem behavior, application contracts, subsystem-specific test inventories, and implementation plans. |

docs/release.md

@@ -0,0 +1,104 @@
+# Releasing Narratio
+
+This document is the maintainer procedure for creating a Narratio source and
+binary release. The synchronous release boundary is a successful push of one
+new tag to `origin`; Woodpecker and Gitea publication happen later and do not
+change that result.
+
+## Go prerequisite
+
+Release preparation requires the maintained Go 1.26 baseline. Tag CI currently
+uses the explicitly pinned `golang:1.26.7` image for candidate validation and
+asset construction; that asynchronous work does not change the tag-push
+completion boundary.
+
+## Choose a version and write its note
+
+Narratio is past `v1.0.0`. Use an unused stable tag in the exact form
+`vMAJOR.MINOR.PATCH`:
+
+- increment `MINOR` for backward-compatible features;
+- increment `PATCH` for backward-compatible fixes; and
+- reserve a new `MAJOR` for an intentional breaking documented contract.
+
+Before preparing the candidate, create
+`docs/releases/vMAJOR.MINOR.PATCH.md` with this structure:
+
+```markdown
+# Narratio vMAJOR.MINOR.PATCH
+
+This release ...
+
+## Summary
+
+## Compatibility
+
+## Upgrade
+
+## Changes
+```
+
+The compatibility section identifies relevant CLI, configuration, artifact,
+integration, or operating-contract changes. The upgrade section states the
+required operator action, or explicitly says that no special action is
+required. Release notes are immutable historical summaries; link to the
+current canonical documentation for detailed behavior.
+
+Commit the note and all candidate changes, then use the ordinary development
+workflow to push that commit to `main`. Do not create a release tag before the
+candidate is committed and `origin/main` contains the exact same commit.
+
+## Validate the candidate
+
+Run the shared checker from any directory:
+
+```sh
+scripts/check-release-candidate.sh vMAJOR.MINOR.PATCH
+```
+
+It validates the version and matching note, module hygiene, formatting,
+whitespace, uncached tests, race tests, static checks, documentation, examples,
+and six official cross-build assets. It uses `GOWORK=off`, does not contact
+application services, CI, or Gitea, and does not create tags or modify tracked
+source. Fix any failure on `main`, commit it, push it normally, and rerun the
+checker.
+
+The checker builds Linux, macOS, and Windows assets for `amd64` and `arm64`.
+Cross-builds prove compilation; they are not native macOS or Windows runtime
+evidence.
+
+## Publish the tag
+
+From a clean checkout on `main` whose `HEAD` equals `origin/main`, run:
+
+```sh
+scripts/release.sh vMAJOR.MINOR.PATCH
+```
+
+The command fetches and checks `origin/main`, re-runs candidate validation,
+then fetches and checks again before creating an explicitly unsigned lightweight
+tag for the originally recorded commit. It refuses dirty, divergent, changed,
+or already-tagged candidates. It pushes only:
+
+```text
+refs/tags/vMAJOR.MINOR.PATCH:refs/tags/vMAJOR.MINOR.PATCH
+```
+
+It never commits changes, pushes `main`, force-pushes, moves a tag, or pushes
+all tags. A successful push of that exact ref completes the release command;
+the command prints the tag and commit, then returns without waiting for CI,
+querying Gitea, downloading assets, or checking checksums.
+
+If a failure occurs before the tag is created, correct the candidate on `main`
+and repeat validation. If the push fails after local tag creation, the local tag
+is intentionally retained for inspection and the command must not be retried
+blindly. Once the upstream tag has been pushed, it is immutable. Correct any
+defect or failed asynchronous publication with a new patch version, a new
+release note, and the complete procedure again.
+
+## Optional asynchronous inspection
+
+After a successful tag push, a human may later inspect the tag-triggered
+Woodpecker run and the corresponding Gitea release for binaries and checksums.
+This is optional follow-up only. Automated releasers must not wait for, poll,
+or treat CI/Gitea completion as a condition of the successful tag push.

docs/releases/README.md

@@ -0,0 +1,26 @@
+# Release Notes
+
+This directory contains immutable historical release notes for Narratio.
+Future notes are created with the matching stable version and use this minimum
+structure:
+
+```markdown
+# Narratio vMAJOR.MINOR.PATCH
+
+This release ...
+
+## Summary
+
+## Compatibility
+
+## Upgrade
+
+## Changes
+```
+
+See the [release procedure](../release.md) for creating a candidate and tag.
+When asynchronous publication succeeds, the corresponding Gitea release is the
+canonical source for downloadable binaries and checksums.
+
+- [v1.6.0](v1.6.0.md)
+- [v1.5.0](v1.5.0.md)

docs/releases/v1.5.0.md

@@ -0,0 +1,47 @@
+# Narratio v1.5.0
+
+Narratio v1.5.0 makes repeated post-transcript artifact development faster and
+more explicit while retaining the fixed, stage-driven pipeline model.
+
+## Highlights
+
+- The canonical pipeline now completes deterministic rendering before
+  extraction, cleanly separating transcript-generating stages from
+  artifact-generating stages.
+- `narratio run` and `narratio session plan` accept inclusive `--from` and
+  `--through` bounds. Excluded transcript stages are not executed or
+  invalidated by a bounded artifact-regeneration run.
+- `narratio regenerate-artifacts SESSION` is an exact convenience alias for a
+  forced run from `extract` through `analyze`, including focused
+  `--artifacts` selections.
+- Configured Scriptorium artifacts now have independent,
+  manifest-authoritative freshness. Narratio reuses validated current work,
+  rebuilds stale prerequisites in dependency order, and persists successful,
+  failed, and newly stale artifact state when an analysis invocation only
+  partially succeeds.
+- Publish consumes only configured artifacts backed by current manifest
+  evidence; incidental or tampered files are not promoted as current output.
+
+## Reliability And Administration
+
+- Bounded prerequisites are checked again under the session lock before any
+  run mutation, closing a concurrent-run race.
+- Analysis fingerprints are stable across executable and configuration path
+  changes and continue to cover only Narratio-observable semantic inputs.
+- Runner composition now carries one validated execution plan from command
+  parsing through prerequisite validation, adapter composition, manifest
+  recording, and stage execution.
+- `narratio version` reports the exact tag embedded in official release
+  binaries; ordinary source builds report `dev`.
+
+## Upgrade Notes
+
+- Existing unbounded commands and direct `run-stage`, `analyze`, and `publish`
+  workflows retain their meanings.
+- Manifests written before artifact-level analysis state remain readable.
+  Legacy aggregate analysis success is not sufficient freshness evidence, so
+  the first analysis evaluation after upgrading may regenerate configured
+  artifacts once.
+- Narratio cannot observe executable contents or configuration, prompt,
+  profile, module, and other files loaded privately by Scriptorium. Explicitly
+  force affected artifacts after changing those private inputs.

docs/releases/v1.6.0.md

@@ -0,0 +1,74 @@
+# Narratio v1.6.0
+
+Narratio v1.6.0 makes large pipeline configurations easier to organize,
+inspect, and vary while adding character-oriented artifact generation and a
+guarded, reproducible release procedure.
+
+## Summary
+
+Pipeline configuration can now be assembled from explicit additive imports and
+a selected production or testing profile. Campaigns can own a canonical,
+versioned party roster, and Scriptorium artifact families can expand one
+definition into concrete per-character artifacts, dependencies, variables, and
+publish rules.
+
+New read-only configuration commands expose the fully resolved pipeline,
+source provenance, semantic digest, and profile differences before a session is
+run. Stage reuse now records configuration-sensitive semantic evidence so
+profile or configuration changes cannot silently reuse incompatible work.
+
+## Compatibility
+
+This is a backward-compatible feature release. Existing monolithic pipeline
+files, concrete Scriptorium artifacts, publish rules, and configurations
+without profiles remain supported. When profiles are declared and no explicit
+profile is selected, Narratio uses the configured production default.
+
+An unversioned party file plus a separate players file remains available as an
+isolated legacy compatibility path, but it cannot drive artifact families. New
+campaigns and new party-oriented features should use the `narratio.party.v1`
+schema. Existing manifests remain readable; missing legacy semantic evidence
+is treated as stale rather than trusted.
+
+Narratio continues to consume the documented Notarius D&D pipeline contract.
+The release workflow still cross-compiles Linux, macOS, and Windows binaries
+for `amd64` and `arm64`; cross-compilation is not native runtime evidence for
+macOS or Windows.
+
+## Upgrade
+
+No special action is required for existing monolithic configurations that do
+not adopt profiles or artifact families. On the first run after upgrading,
+stages recorded by older manifests may regenerate once because those records do
+not contain the new semantic configuration evidence.
+
+To adopt the new configuration model, use the maintained
+`examples/production-testing` bundle as a migration reference: split stable
+settings into explicit imports, define a production default and optional
+testing profile, convert campaign party data to `narratio.party.v1`, remove the
+separate players file, and then introduce character artifact families. Review
+the result with `narratio config validate`, `config show`, `config sources`, and
+`config diff` before running a session.
+
+Campaign, session, previous-session, and run identifiers must satisfy the
+documented portable identity grammar. Existing manifests or remote state with
+unsafe legacy identifiers must be migrated before use.
+
+## Changes
+
+- Added root-owned, non-recursive additive pipeline imports with strict,
+  source-aware conflict detection.
+- Added named pipeline profiles with an explicit production default and
+  deliberate command-line selection.
+- Added `config validate`, `config show`, `config sources`, and `config diff`
+  for read-only inspection of resolved configuration and provenance.
+- Added the strict `narratio.party.v1` campaign roster, including stable
+  character IDs, player and character names, optional aliases, and classes.
+- Added deterministic players derivation and canonical party delivery to
+  downstream integrations.
+- Added character-oriented artifact families, corresponding member
+  dependencies, family selection, and generated publish policies.
+- Added semantic configuration fingerprints and stage-specific resume checks
+  across transcript and artifact stages.
+- Added shared release candidate, asset build, and guarded tag-publication
+  scripts, with tag-triggered publication remaining asynchronous.

docs/releases/v1.7.0.md

@@ -0,0 +1,100 @@
+# Narratio v1.7.0
+
+Narratio v1.7.0 completes the maintainability refactor begun after v1.6.0. It
+simplifies filesystem and process handling, makes resumable work more precise,
+replaces legacy local and remote state with explicit authorities, and turns
+cleanup into the final ordinary pipeline stage.
+
+## Summary
+
+The session manifest is now the sole durable local progress ledger. Analyze
+checkpoints successful artifacts individually, allowing an interrupted or
+partially failed analysis to resume at the first incomplete artifact without
+rerunning successful siblings unless forced.
+
+Remote publication now commits immutable run state before advancing one
+verified current pointer. Publish locks are independent per-source objects;
+locked outputs retain their previously committed declarations rather than
+being overwritten or silently omitted. Local cleanup runs after notification
+as a separately recorded, safely retryable stage.
+
+The release also adopts Go 1.26, simplifies ordinary file operations around
+Narratio's trusted group-owned workspace model, improves subprocess lifecycle
+handling, decomposes several large orchestration and validation components,
+and removes mutable global test seams.
+
+## Compatibility
+
+This is a minor release with deliberate removal of compatibility paths that
+were deprecated and documented as subject to removal:
+
+- Campaigns must use one versioned `narratio.party.v1` `party.yml`. Separate
+  players files, session-level party overrides, and unversioned party documents
+  are rejected.
+- Session manifests must declare `schema_version:
+  narratio.session-manifest.v1` and satisfy the current strict schema. Older
+  unversioned state and manifests containing the retired
+  `post_publish_cleanup` obligation are rejected rather than migrated.
+- Remote current state must be selected by
+  `current/commit-pointer.json` and its referenced immutable run commit. Legacy
+  current-state layouts are no longer inferred.
+- The retired aggregate `locks.yml` object is ignored. Publish locks now live
+  as independent strict objects under the session lock prefix.
+- Run manifests are no longer produced or consumed. The session manifest owns
+  durable stage progress; invocation summaries and run workspaces remain
+  operational data rather than a second progress authority.
+
+The CLI and current pipeline/configuration formats otherwise remain compatible.
+Building and maintaining Narratio now requires Go 1.26. Cross-built Linux,
+macOS, and Windows assets remain available for `amd64` and `arm64`.
+
+## Upgrade
+
+Before upgrading a campaign that still uses compatibility data:
+
+1. Replace legacy party/player inputs with the documented
+   [`narratio.party.v1`](../integrations/party.md) campaign roster.
+2. If a local manifest contains an outstanding `post_publish_cleanup`
+   obligation, complete it with the pre-upgrade binary. Otherwise verify the
+   remote commit, move aside or regenerate the incompatible manifest, or
+   restore a verified committed snapshot. Do not migrate state by manually
+   editing JSON.
+3. Republish sessions that do not yet have a valid immutable run commit and
+   `current/commit-pointer.json`; legacy remote layouts are not current state in
+   v1.7.0.
+4. Recreate any required publication locks with `narratio session locks add`.
+   After verifying the new locks and publication behavior, the ignored legacy
+   `locks.yml` object may be removed manually.
+
+Existing compatible session manifests and already committed remote snapshots
+need no special action. Consult [Operations](../operations.md) and
+[Troubleshooting](../troubleshooting.md) for recovery procedures.
+
+## Changes
+
+- Upgraded the maintained development and release baseline to Go 1.26.
+- Reworked subprocess execution and Windows process-tree supervision while
+  preserving contextual wait and cleanup failures.
+- Replaced custom confined ordinary I/O and directory-promotion machinery with
+  simpler standard-library operations while retaining bounded reads, atomic
+  single-file visibility, workspace modes, validated downloads, and
+  root-confined destructive operations.
+- Removed legacy party, manifest, artifact-discovery, remote-current, and lock
+  compatibility paths.
+- Consolidated durable progress in the session manifest and removed the run
+  manifest domain model.
+- Unified runner planning and execution decisions, separated invocation
+  lifecycle responsibilities, and avoided creating empty run workspaces for
+  fully reused or cleanup-only invocations.
+- Added per-artifact analyze execution, checkpointing, reconciliation, and
+  recovery.
+- Decomposed configuration validation by domain and made validation diagnostics
+  deterministic without treating incidental ordering or wording as a contract.
+- Introduced immutable remote publish commits, one final current pointer,
+  explicit output planning, safe cross-run carried outputs, and independent
+  per-artifact remote locks.
+- Added `cleanup` as the final canonical stage after `notify`, with validated
+  publish evidence, safe retry, explicit selection, and no separate cleanup
+  obligation.
+- Replaced mutable command test hooks with invocation-scoped dependencies and
+  improved structural test diagnostics.

docs/troubleshooting.md

@@ -56,7 +56,8 @@ Symptom:
 
 Likely cause:
 
-- stale field name, typo, invalid enum, or invalid duration/path format.
+- stale field name, typo, invalid enum, invalid duration/path format, or an
+  unsupported local manifest schema/state marker.
 
 Diagnostics:
 
@@ -68,9 +69,69 @@ Safe fix:
 
 - align config with [Configuration](./config.md) and the
   [maintained examples](../examples/README.md).
+- for a manifest schema error, move the unsupported local state aside and
+  regenerate it; restore a verified current committed snapshot or republish
+  healthy regenerated state when appropriate. Do not add version or stage
+  markers by hand.
+- if an older manifest is rejected for its retired cleanup-obligation field,
+  finish outstanding cleanup with the pre-upgrade binary. Otherwise verify the
+  remote commit, move aside or regenerate the incompatible manifest, and use
+  the cleanup stage. Do not treat manual JSON editing as the normal migration
+  path.
 
 Relevant reference: [Configuration](./config.md).
 
+## Party schema version rejected
+
+Symptom:
+
+- configuration loading reports that `party.schema_version` is required or
+  unsupported.
+
+Likely cause:
+
+- the campaign `party.yml` is an unversioned legacy document, or names a
+  schema other than `narratio.party.v1`.
+
+Safe fix:
+
+- replace the file with one exact, single-document
+  [`narratio.party.v1` party](./integrations/party.md); do not add a version
+  marker to an otherwise incompatible legacy structure. The versioned party is
+  the only configured roster authority.
+
+Relevant reference: [Canonical Party Input](./integrations/party.md).
+
+## Unexpected imported or profile value
+
+Symptom:
+
+- an effective configuration value differs from the root file, or a duplicate
+  ownership/configuration error is hard to locate.
+
+Diagnostics:
+
+```bash
+narratio config sources --config /path/pipeline.yml --profile testing
+```
+
+Add `--campaign` or `--campaign-file` when the pipeline has party-driven
+artifact families. The output identifies each effective logical field's root,
+import, profile, default, campaign, party, or family source without printing
+the field value or credential contents.
+
+Safe fix:
+
+- move a duplicated base field so it has one owner;
+- correct the selected profile or its overlay; or
+- correct the campaign party/family declaration that owns generated values.
+
+To review what would actually change before switching profiles, run `config
+diff` with the same pipeline and campaign selectors. It compares normalized
+effective values rather than YAML formatting or source-file layout.
+
+Relevant reference: [Configuration inspection](./config.md#read-only-effective-pipeline-inspection).
+
 ## Audio mode conflict
 
 Symptom:
@@ -117,6 +178,41 @@ Safe fix:
 
 Relevant reference: [CLI artifact selection](./cli.md).
 
+## Bounded run prerequisite is unusable
+
+Symptom:
+
+- `run` or `session plan` reports that a prerequisite stage is absent or has a
+  pending, running, failed, stale, or interrupted status before the selected
+  start.
+
+Likely cause:
+
+- `--from` excludes upstream work that has not reached the terminal
+  `succeeded` or `skipped` state in the session manifest.
+
+Diagnostics:
+
+```bash
+narratio session status 2026-04-04
+narratio session plan 2026-04-04 --from render --through analyze
+```
+
+Safe fix:
+
+- widen the bounded range to include the first reported stage, or recover that
+  stage explicitly with `run-stage` before retrying. The failed check does not
+  create a run-local directory or modify the manifest. Narratio does not
+  resume-validate excluded prefix stages, and stages after `--through` are not
+  prerequisites.
+
+If prerequisite statuses are terminal but a selected stage reports a missing,
+unsafe, or checksum-inconsistent artifact, repair the artifact at the stage
+that owns it; do not edit the manifest to bypass the selected stage's concrete
+input validation.
+
+Relevant reference: [Operations: Stage Execution and Continuation Behavior](./operations.md#stage-execution-and-continuation-behavior).
+
 ## Notarius executable missing
 
 Symptom:
@@ -158,28 +254,65 @@ is expected audit state, not a signal to relink the old bundle manually.
 
 Relevant reference: [Operations: Extraction Workflow](./operations.md#extraction-workflow).
 
-## Atomic Notarius promotion unsupported
+## Prepared Notarius reference missing or inconsistent
 
 Symptom:
 
-- extraction fails with `atomic no-replace directory promotion is unsupported`
-  before a durable bundle or temporary promotion tree is created.
+- extraction or resume validation reports that a configured reference source is
+  unavailable, unsafe, empty, or checksum-inconsistent and recommends
+  `prepare --force`.
 
-Likely cause:
+Likely causes:
 
-- Narratio is running on an operating system other than Linux, macOS, or
-  Windows, where the required atomic no-replace directory primitive has not
-  been implemented and verified.
+- `prepare` has not run since the campaign/session stable input changed;
+- the configured source file is missing;
+- a prepared `inputs/` file or its manifest record was modified independently;
+- a spell-catalog binding exists without an effective `spell_catalog_file`.
+
+Diagnostics:
+
+```bash
+narratio session status 2026-04-04
+narratio session validate 2026-04-04
+```
 
 Safe fix:
 
-- run extraction on Linux, macOS, or Windows. Do not replace the atomic commit
-  with a manual copy or move; the session manifest must never observe a partial
-  or overwritten bundle.
+- correct the campaign/session input path, then refresh canonical prepared
+  evidence before extraction:
 
-This is an extraction-specific platform boundary, not a support statement for
-unrelated Narratio workflows. See
-[Operations: Extraction Workflow](./operations.md#extraction-workflow).
+```bash
+narratio run-stage prepare 2026-04-04 --force
+```
+
+Do not point Notarius directly at the original source path or edit the manifest
+checksum. Relevant references: [Notarius reference configuration](./config.md#notarius-reference-bindings)
+and [Operations: Extraction Workflow](./operations.md#extraction-workflow).
+
+## Notarius reference selector or generated-handoff collision
+
+Symptom:
+
+- Notarius exits nonzero with an undeclared reference-slot, incompatible media,
+  or external/generated reference collision error.
+
+Likely causes:
+
+- a selector does not identify a slot declared by the selected Notarius target;
+- a prepared file does not satisfy that slot's Notarius media contract; or
+- a CLI binding attempts to replace a same-run generated D&D handoff.
+
+Safe fix:
+
+- compare external bindings with the selected Notarius pipeline's canonical
+  consumer documentation;
+- keep only campaign-owned external slots on the CLI; and
+- leave registry, scene, combat, and occurrence handoffs to Notarius pipeline
+  composition.
+
+Narratio validates selector structure and prepared evidence, while Notarius
+owns slot declarations, media compatibility, and generated-handoff conflicts.
+Relevant reference: [Notarius integration](./integrations/notarius.md).
 
 ## Notarius receipt or index incompatible
 
@@ -198,7 +331,7 @@ Safe fix:
 
 - compare installed Notarius output with the canonical Notarius contracts,
   including receipt `index_file: index.json` and index management names
-  `manifest.json`, `rejected.json`, and `warnings.json`; align
+  `manifest.json`, `rejected.json`, `warnings.json`, and `diagnostics.json`; align
   `pipeline.notarius` constraints and rerun. Do not bypass confinement or schema
   checks.
 
@@ -230,14 +363,16 @@ Likely causes:
 
 - the executable/config path, pipeline ID, timeout, working directory, or
   configured output contracts changed;
+- a configured prepared reference selector, source, path, checksum, or byte
+  size changed;
 - the durable bundle, index, lane set, provenance, regular-file status, or
   checksum no longer validates.
 
 Safe fix:
 
 - allow the automatic rerun after verifying the current configuration. Treat
-  an unsafe path or symlink error as filesystem corruption or tampering and
-  investigate it rather than replacing files manually.
+  an unsafe path or bundle symlink error as filesystem corruption or tampering
+  and investigate it rather than replacing files manually.
 
 ## Notarius transitive configuration changed
 
@@ -252,12 +387,158 @@ Safe fix:
 narratio run-stage extract 2026-04-04 --force
 ```
 
-Narratio fingerprints its invocation contract, not the contents of transitive
-Notarius inputs. Always force extraction after changing them; downstream
+Narratio fingerprints its invocation contract and prepared Narratio reference
+identities, not the contents of other transitive Notarius inputs. Always force
+extraction after changing those external inputs; downstream
 successful stages are then marked stale normally.
 
 Relevant reference: [Operations: Extraction Workflow](./operations.md#extraction-workflow).
 
+## Analysis artifact evidence is not current
+
+Symptom:
+
+- ordinary continuation or `session plan` schedules one or more configured
+  artifacts even though a canonical output file exists; or
+- publish reports a configured artifact source unavailable.
+
+Likely causes:
+
+- the per-artifact record is stale, missing, failed, unselected, or malformed;
+- a configured prompt/profile, dependency, input identity, output path, or
+  effective variable changed; or
+- the recorded output is missing, unsafe, empty, or has a size/checksum that no
+  longer matches its manifest evidence.
+
+Diagnostics:
+
+```bash
+narratio session status 2026-04-04
+narratio session artifacts 2026-04-04
+narratio session plan 2026-04-04 --from analyze --through analyze
+```
+
+Safe fix:
+
+- investigate unexpected path or checksum changes as possible tampering;
+- otherwise let the selected analyze work rerun, or explicitly regenerate only
+  the affected targets; and
+- never edit the fingerprint/checksum in the manifest or copy an old file into
+  the canonical path as a substitute for current evidence.
+
+```bash
+narratio analyze 2026-04-04 --artifacts session_recap
+```
+
+Relevant references: [Operations: Artifact Selection](./operations.md#artifact-selection)
+and [Artifact Internals](./internal/artifacts.md#resolution-rules).
+
+## Analysis manifest checkpoint failed
+
+Symptom:
+
+- analyze reports that it could not save the session manifest after completing
+  an artifact.
+
+Likely causes:
+
+- the workspace is unwritable or out of space;
+- the manifest path or its parent directory has unsafe permissions or type; or
+- a transient local filesystem error interrupted atomic manifest replacement.
+
+Safe fix:
+
+- correct the reported filesystem or permission problem;
+- inspect `session artifacts` to identify the last durable current records; and
+- rerun analyze normally. Narratio reuses earlier successful checkpoints and
+  retries the failed or non-current artifact and its required dependents.
+
+Do not treat a newly created canonical artifact file as current when its
+checkpoint failed, and do not edit the manifest to advertise it. If the error
+recurs, preserve the manifest and run-local diagnostics before repairing the
+workspace.
+
+Relevant references: [Operations: Stage Execution and Continuation Behavior](./operations.md#stage-execution-and-continuation-behavior)
+and [Manifest Internals](./internal/manifest.md#persistence-semantics).
+
+## Built-in transcript or bounds source is unavailable
+
+Symptom:
+
+- analyze, extract, render, or publish says a built-in source is unavailable
+  even though a file exists at its usual session path.
+
+Likely cause:
+
+- the producing stage has not succeeded, its output lacks the exact registered
+  source, run ID, or checksum, its evidence is duplicated or stale, or the
+  durable bytes no longer match the manifest checksum.
+
+Safe fix:
+
+- do not copy or rename the file to make it discoverable. Rerun the producing
+  stage to regenerate both the bytes and current manifest evidence, then retry
+  the consumer.
+
+## An older manifest schema is rejected
+
+Symptom:
+
+- Narratio rejects a local session manifest because `schema_version` is missing
+  or unsupported; or
+- restore rejects a committed remote session manifest for the same reason.
+
+Likely cause:
+
+- the manifest predates the supported canonical state contract. Narratio
+  rejects it at the schema boundary rather than interpreting aggregate output
+  lists or incidental files as current authority.
+
+Safe fix:
+
+- for unsupported local state, move the old manifest aside and regenerate, or
+  restore a verified current committed snapshot when one is authoritative;
+- for unsupported committed remote state, regenerate healthy local state as
+  needed and republish the session.
+
+```bash
+narratio run 2026-04-04
+narratio publish 2026-04-04
+```
+
+After current records exist, inspect them and publish explicitly. Do not copy
+old files into canonical paths merely to influence selection; availability is
+manifest-owned.
+
+Relevant references: [Operations: Stage Execution and Continuation Behavior](./operations.md#stage-execution-and-continuation-behavior)
+and [Manifest Internals](./internal/manifest.md#analyze-owned-artifact-state).
+
+## Scriptorium private input changed without a rerun
+
+Symptom:
+
+- a prompt, profile, imported configuration file, executable, or other input
+  loaded privately by Scriptorium changed, but Narratio still considers an
+  artifact current.
+
+Likely cause:
+
+- analysis fingerprints cover Narratio-observable semantic identities, not
+  executable contents or arbitrary files and transitive configuration that
+  Scriptorium loads behind its configured paths and identifiers.
+
+Safe fix:
+
+- explicitly force the affected target after changing an unobserved private
+  input. Force applies to explicit targets; current prerequisites remain
+  reusable unless selected themselves.
+
+```bash
+narratio analyze 2026-04-04 --artifacts session_recap
+```
+
+Relevant reference: [Analyze Internals](./internal/stage-analyze.md#invariants).
+
 ## Previous-session artifact input missing
 
 Symptom:
@@ -267,7 +548,9 @@ Symptom:
 Likely causes:
 
 - missing `session.previous_session_id`;
-- previous artifact not restored/published for source session.
+- the selected previous-session commit does not declare the required canonical
+  source as a `published_output`; or
+- the declared published object is unavailable or fails identity validation.
 
 Diagnostics:
 
@@ -299,7 +582,7 @@ Symptom:
 Likely causes:
 
 - another process is running for the same session;
-- stale lock left by interrupted process.
+- a process still holds the operating-system lock while it is shutting down.
 
 Diagnostics:
 
@@ -311,7 +594,8 @@ ps aux | grep narratio
 Safe fix:
 
 - wait for active process completion;
-- remove stale lock only after confirming no live process owns it.
+- retry after an interrupted holder has exited; the kernel releases its lock
+  even though the `.lock` metadata file remains for inspection.
 
 Relevant reference: [Operations: Local State Layout](./operations.md#local-state-layout).
 
@@ -324,6 +608,8 @@ Symptom:
 Likely cause:
 
 - local durable files differ from remote restore sources.
+- a restore target or one of its ancestors is a symlink or another non-regular
+  filesystem entry.
 
 Diagnostics:
 
@@ -334,7 +620,11 @@ narratio session restore 2026-04-04 --dry-run
 Safe fix:
 
 - review conflicts;
-- rerun with `--force` only when remote state should overwrite local.
+- rerun with `--force` only when remote state should overwrite an eligible
+  regular local file; repair a symlink or other non-regular conflict first.
+
+If the filesystem changed after the plan was printed, rerun restore after
+repairing the destination; installation performs the same safety check again.
 
 Relevant reference: [Operations: Restore Workflow](./operations.md#restore-workflow).
 
@@ -435,7 +725,7 @@ Diagnostics:
 
 ```bash
 ls -la /path/to/secrets_dir
-env | grep -E 'OBJECT_STORAGE|AWS|AUDITA|SCRIPTORIUM'
+env | sed 's/=.*//' | grep -E 'OBJECT_STORAGE|AWS|AUDITA|SCRIPTORIUM'
 ```
 
 Safe fix:

examples/README.md

@@ -11,6 +11,18 @@ in the [configuration reference](../docs/config.md).
   WhisperX URL.
 - [Production-shaped pipeline](pipeline.production.yml): S3 storage, publish,
   external tools, and configured Scriptorium artifacts.
+- [Production/testing split bundle](production-testing/pipeline.yml): explicit
+  `conf.d` imports, a production default, and selectable production/testing
+  overlays. It also demonstrates canonical-party artifact families and a
+  testing-only disabled artifact. Validate it with:
+
+  ```sh
+  narratio config validate --config examples/production-testing/pipeline.yml --campaign-file examples/campaigns/sample-campaign/campaign.yml
+  narratio config diff production testing --config examples/production-testing/pipeline.yml --campaign-file examples/campaigns/sample-campaign/campaign.yml
+  ```
+
+  `config show` and `config sources` accept the same selectors and remain
+  read-only.
 - [Full annotated pipeline](pipeline.full.annotated.yml): every implemented
   pipeline section with explanatory comments.
 - [Extraction subset pipeline](pipeline.extraction-subset.yml): a focused
@@ -37,9 +49,11 @@ with the sample campaign and a compatible local- or S3-audio session.
 - The sample campaign references its local
   [speakers](campaigns/sample-campaign/speakers.yml),
   [autocorrect](campaigns/sample-campaign/autocorrect.yml),
-  [glossary](campaigns/sample-campaign/glossary.yml),
-  [players](campaigns/sample-campaign/players.yml), and
-  [party](campaigns/sample-campaign/party.yml) fixtures.
+  [glossary](campaigns/sample-campaign/glossary.yml), and canonical
+  [party](campaigns/sample-campaign/party.yml) fixture, plus an optional
+  [spell-catalog overlay](campaigns/sample-campaign/spell_catalog.json) that
+  follows the Notarius v0.6 contract. Narratio derives the players projection
+  from this party source.
 - [Sample speaker audio](audio/sample-speaker.flac) is a text placeholder that
   reserves the expected filename and directory shape. Replace it with a real
   FLAC file before running transcription.

examples/campaigns/sample-campaign/campaign.yml

@@ -4,5 +4,5 @@ inputs:
   speakers_file: ./speakers.yml
   autocorrect_file: ./autocorrect.yml
   glossary_file: ./glossary.yml
-  players_file: ./players.yml
   party_file: ./party.yml
+  spell_catalog_file: ./spell_catalog.json

examples/campaigns/sample-campaign/party.yml

@@ -1,2 +1,26 @@
-- name: Example Hero
-  type: pc
+schema_version: narratio.party.v1
+
+characters:
+  arannis:
+    player:
+      name: Rowan Hale
+    character:
+      name: Arannis
+      alias:
+        - Ari
+        - The Grey Owl
+      classes:
+        - name: wizard
+          level: 8
+  brenna:
+    player:
+      name: Rowan Hale
+    character:
+      name: Brenna
+      alias:
+        - Shield of Dawn
+      classes:
+        - name: paladin
+          level: 6
+        - name: warlock
+          level: 2

examples/campaigns/sample-campaign/players.yml

@@ -1,2 +0,0 @@
-- name: Example Player
-  role: player

examples/campaigns/sample-campaign/spell_catalog.json

@@ -0,0 +1,18 @@
+{
+  "schema_version": "notarius.dnd.spell-catalog-overlay.v1",
+  "catalogs": [
+    {
+      "id": "narratio.sample-campaign",
+      "ruleset": "dnd-5e-2014",
+      "source": {
+        "title": "Narratio sample campaign spell names"
+      },
+      "spells": [
+        {
+          "name": "Aegis of Emberfall",
+          "aliases": ["Emberfall Aegis"]
+        }
+      ]
+    }
+  ]
+}

examples/pipeline.extraction-subset.yml

@@ -14,6 +14,11 @@ notarius:
   config_path: /usr/local/etc/notarius/config.yml
   pipeline_id: dnd-session
   timeout: 3h
+  references:
+    glossary: narratio.input.glossary
+    party: narratio.input.party
+    players: narratio.input.players
+    spell_catalog: narratio.input.spell_catalog
   outputs:
     npc_registry:
       lane_id: npc-registry
@@ -52,4 +57,3 @@ scriptorium:
         scenes:
           source: narratio.extraction.scene_descriptions
           required: true
-

examples/pipeline.full.annotated.yml

@@ -12,7 +12,7 @@ workspace:
 #   env_dir: ./secrets
 
 storage:
-  # Optional storage backend selector; use "s3" for publish + S3 audio workflows.
+  # Defaults to "local". Use "s3" explicitly for publish + S3 audio workflows.
   backend: s3
   s3:
     # Required when using S3 audio or S3 publish uploads.
@@ -136,6 +136,13 @@ notarius:
   pipeline_id: dnd-session
   timeout: 3h
   working_directory: /usr/local/etc/notarius
+  # External campaign references use prepared Narratio source IDs. Omit an
+  # optional binding when the selected Notarius pipeline does not need it.
+  references:
+    glossary: narratio.input.glossary
+    party: narratio.input.party
+    players: narratio.input.players
+    spell_catalog: narratio.input.spell_catalog
   # Each key creates source narratio.extraction.<key>. These constraints match
   # the current Notarius D&D lane contracts; update them with Notarius.
   outputs:
@@ -260,7 +267,5 @@ scriptorium:
         output_kind: player_handout
 
 notification:
-  # Optional notification settings.
-  backend: ""
-  recipient: ""
-  timeout: 30s
+  # No delivery provider is currently implemented.
+  mode: noop

examples/pipeline.production.yml

@@ -125,4 +125,4 @@ scriptorium:
         output_kind: player_handout
 
 notification:
-  timeout: 30s
+  mode: noop

examples/production-testing/conf.d/artifacts.yml

@@ -0,0 +1,32 @@
+scriptorium:
+  binary: scriptorium
+  config_path: ./scriptorium/config.yml
+  artifact_families:
+    character_meta:
+      enabled: true
+      for_each: party.characters
+      prompt_id: dnd.character_meta
+      output_path_pattern: artifacts/characters/{character_id}/meta.md
+      member_vars:
+        character_id: character_id
+        character_name: character.name
+        player_name: player.name
+        class_summary: character.class_summary
+    character_items:
+      enabled: true
+      for_each: party.characters
+      prompt_id: dnd.character_items
+      output_path_pattern: artifacts/characters/{character_id}/items.md
+      member_dependencies: [character_meta]
+      inputs:
+        character_meta:
+          source: narratio.member_artifact.character_meta
+          required: true
+      member_vars:
+        character_id: character_id
+        character_name: character.name
+        aliases: character.alias_summary
+      publish:
+        enabled: true
+        required: false
+        dest_pattern: artifacts/characters/{character_id}/items.md

examples/production-testing/conf.d/platform.yml

@@ -0,0 +1,12 @@
+workspace:
+  root: ./workspace
+
+campaigns:
+  root: ../../campaigns
+  default_campaign_id: sample-campaign
+
+cache:
+  root: ./cache
+
+spool:
+  root: ./spool

examples/production-testing/conf.d/publish.yml

@@ -0,0 +1,7 @@
+publish:
+  enabled: true
+  upload_run: false
+  outputs:
+    - source: narratio.transcript.final_markdown
+      dest: transcripts/final.md
+      required: true

examples/production-testing/conf.d/storage.yml

@@ -0,0 +1,2 @@
+storage:
+  backend: local

examples/production-testing/conf.d/transcript.yml

@@ -0,0 +1,16 @@
+whisperx:
+  transcribe_url: https://transcription.example.com/transcribe
+  language: en
+
+seriatim:
+  binary: seriatim
+  output_schema: seriatim-intermediate
+
+audita:
+  binary: audita
+  modules: [glossary, grammar]
+  output_schema: audita-v1
+
+normalize:
+  output_path: transcripts/final.json
+  output_schema: seriatim-intermediate

examples/production-testing/pipeline.yml

@@ -0,0 +1,15 @@
+# Copyable production/testing pipeline entry point. Every fragment is named
+# explicitly; Narratio never scans conf.d automatically.
+composition:
+  imports:
+    - conf.d/platform.yml
+    - conf.d/storage.yml
+    - conf.d/transcript.yml
+    - conf.d/artifacts.yml
+    - conf.d/publish.yml
+  default_profile: production
+  profiles:
+    production:
+      overlay: profiles/production.yml
+    testing:
+      overlay: profiles/testing.yml

examples/production-testing/profiles/production.yml

@@ -0,0 +1,10 @@
+audita:
+  model: narratio-production-model-placeholder
+  validation_model: narratio-production-validator-placeholder
+
+scriptorium:
+  artifact_families:
+    character_meta:
+      profile_id: production-placeholder
+    character_items:
+      profile_id: production-placeholder

examples/production-testing/profiles/testing.yml

@@ -0,0 +1,14 @@
+audita:
+  model: narratio-testing-model-placeholder
+  validation_model: narratio-testing-validator-placeholder
+
+scriptorium:
+  artifacts:
+    testing_notes:
+      enabled: false
+      output_path: artifacts/testing-notes.md
+  artifact_families:
+    character_meta:
+      profile_id: testing-placeholder
+    character_items:
+      profile_id: testing-placeholder

go.mod

@@ -1,12 +1,14 @@
 module gitea.maximumdirect.net/eric/narratio
 
-go 1.25.0
+go 1.26.0
 
 require (
 	github.com/aws/aws-sdk-go-v2/config v1.32.17
 	github.com/aws/aws-sdk-go-v2/credentials v1.19.16
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.101.0
 	github.com/aws/smithy-go v1.25.1
+	github.com/google/go-cmp v0.7.0
+	golang.org/x/sync v0.22.0
 	golang.org/x/sys v0.47.0
 	gopkg.in/yaml.v3 v3.0.1
 )

go.sum

@@ -34,6 +34,10 @@ github.com/aws/aws-sdk-go-v2/service/sts v1.42.1 h1:F/M5Y9I3nwr2IEpshZgh1GeHpOIt
 github.com/aws/aws-sdk-go-v2/service/sts v1.42.1/go.mod h1:mTNxImtovCOEEuD65mKW7DCsL+2gjEH+RPEAexAzAio=
 github.com/aws/smithy-go v1.25.1 h1:J8ERsGSU7d+aCmdQur5Txg6bVoYelvQJgtZehD12GkI=
 github.com/aws/smithy-go v1.25.1/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
 golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=

internal/adapters/audita/fake.go

@@ -4,10 +4,9 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"os"
 	"path/filepath"
 
-	"gitea.maximumdirect.net/eric/narratio/internal/adapters/subprocess"
+	"gitea.maximumdirect.net/eric/narratio/internal/fileops"
 )
 
 // NoopRunner is a deterministic no-op audita adapter.
@@ -84,17 +83,17 @@ func materializePlaceholders(req PolishRequest) error {
 			"merged_transcript_path": req.MergedTranscriptPath,
 			"output_path":            req.OutputProcessedPath,
 		}
-		if err := subprocess.WriteYAMLAtomic(req.GeneratedConfigPath, payload, 0o644); err != nil {
+		if err := writeGeneratedYAML(req.GeneratedConfigPath, payload); err != nil {
 			return fmt.Errorf("write generated config %q: %w", req.GeneratedConfigPath, err)
 		}
 	}
 	if req.StdoutLogPath != "" {
-		if err := subprocess.WriteFileAtomic(req.StdoutLogPath, []byte("audita noop/fake stdout placeholder\n"), 0o644); err != nil {
+		if err := fileops.WriteFileAtomic(req.StdoutLogPath, []byte("audita noop/fake stdout placeholder\n"), fileops.WorkspaceFileMode); err != nil {
 			return fmt.Errorf("write stdout log %q: %w", req.StdoutLogPath, err)
 		}
 	}
 	if req.StderrLogPath != "" {
-		if err := subprocess.WriteFileAtomic(req.StderrLogPath, []byte("audita noop/fake stderr placeholder\n"), 0o644); err != nil {
+		if err := fileops.WriteFileAtomic(req.StderrLogPath, []byte("audita noop/fake stderr placeholder\n"), fileops.WorkspaceFileMode); err != nil {
 			return fmt.Errorf("write stderr log %q: %w", req.StderrLogPath, err)
 		}
 	}
@@ -117,14 +116,14 @@ func writeJSONIfRequested(path string, payload any) error {
 	if path == "" {
 		return nil
 	}
-	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+	if err := fileops.EnsureWorkspaceDirectory(filepath.Dir(path)); err != nil {
 		return fmt.Errorf("create parent directory %q: %w", filepath.Dir(path), err)
 	}
 	data, err := json.Marshal(payload)
 	if err != nil {
 		return fmt.Errorf("marshal placeholder json for %q: %w", path, err)
 	}
-	if err := subprocess.WriteFileAtomic(path, data, 0o644); err != nil {
+	if err := fileops.WriteFileAtomic(path, data, fileops.WorkspaceFileMode); err != nil {
 		return fmt.Errorf("write placeholder json %q: %w", path, err)
 	}
 	return nil

internal/adapters/audita/generated_config.go

@@ -0,0 +1,19 @@
+package audita
+
+import (
+	"fmt"
+
+	"gitea.maximumdirect.net/eric/narratio/internal/fileops"
+	"gopkg.in/yaml.v3"
+)
+
+func writeGeneratedYAML(path string, payload any) error {
+	data, err := yaml.Marshal(payload)
+	if err != nil {
+		return fmt.Errorf("marshal generated YAML for %q: %w", path, err)
+	}
+	if err := fileops.WriteFileAtomic(path, data, fileops.WorkspaceFileMode); err != nil {
+		return fmt.Errorf("write generated YAML %q: %w", path, err)
+	}
+	return nil
+}

internal/adapters/audita/runner.go

@@ -6,8 +6,6 @@ import (
 	"time"
 )
 
-// TODO: implement a real Audita subprocess/service adapter.
-
 // Runner is the adapter boundary for audita polish invocations.
 type Runner interface {
 	Run(ctx context.Context, req PolishRequest) (PolishResult, error)
@@ -15,25 +13,15 @@ type Runner interface {
 
 // PolishRequest describes an audita invocation.
 type PolishRequest struct {
-	GeneratedConfigPath      string
-	MergedTranscriptPath     string
-	OutputProcessedPath      string
-	GlossaryPath             string
-	ReportPath               string
-	WorkDir                  string
-	Modules                  []string
-	BaseURL                  string
-	Model                    string
-	TranscriptDescription    string
-	ConfigPath               string
-	OutputSchema             string
-	WorkDirRetention         string
-	TotalLLMConcurrency      *int
-	ProposalLLMConcurrency   *int
-	ValidationModel          string
-	ValidationLLMConcurrency *int
-	StdoutLogPath            string
-	StderrLogPath            string
+	GeneratedConfigPath  string
+	MergedTranscriptPath string
+	OutputProcessedPath  string
+	GlossaryPath         string
+	ReportPath           string
+	WorkDir              string
+	Modules              []string
+	StdoutLogPath        string
+	StderrLogPath        string
 }
 
 // PolishResult describes a polish output.

internal/adapters/audita/subprocess.go

@@ -11,8 +11,15 @@ import (
 	"time"
 
 	"gitea.maximumdirect.net/eric/narratio/internal/adapters/subprocess"
+	"gitea.maximumdirect.net/eric/narratio/internal/fileops"
 )
 
+// MaxProcessedOutputBytes bounds Audita's processed-transcript JSON result.
+const MaxProcessedOutputBytes int64 = 64 * 1024 * 1024
+
+// MaxReportOutputBytes bounds Audita's optional report JSON result.
+const MaxReportOutputBytes int64 = 16 * 1024 * 1024
+
 // SubprocessRunnerConfig defines deterministic settings for Audita CLI execution.
 type SubprocessRunnerConfig struct {
 	Binary                   string
@@ -207,12 +214,13 @@ func (r *SubprocessRunner) Run(ctx context.Context, req PolishRequest) (PolishRe
 	}
 
 	runRes, err := subprocess.Run(ctx, subprocess.RunRequest{
-		Executable:    r.binary,
-		Args:          args,
-		Timeout:       r.timeout,
-		EnvOverrides:  env,
-		StdoutLogPath: req.StdoutLogPath,
-		StderrLogPath: req.StderrLogPath,
+		Executable:      r.binary,
+		Args:            args,
+		Timeout:         r.timeout,
+		EnvOverrides:    env,
+		DiagnosticOwner: "audita",
+		StdoutLogPath:   req.StdoutLogPath,
+		StderrLogPath:   req.StderrLogPath,
 	})
 	if err != nil {
 		wrappedMessage := fmt.Sprintf(
@@ -370,13 +378,13 @@ func (r *SubprocessRunner) writeInvocationConfig(req PolishRequest, args []strin
 		"credential_env_var":         r.llmAPIKeyEnv,
 		"credential_present":         credentialPresent,
 	}
-	return subprocess.WriteYAMLAtomic(req.GeneratedConfigPath, payload, 0o644)
+	return writeGeneratedYAML(req.GeneratedConfigPath, payload)
 }
 
 func validateProcessedOutput(path string) error {
-	data, err := os.ReadFile(path)
+	data, err := readAuditaResult(path, MaxProcessedOutputBytes, "processed transcript")
 	if err != nil {
-		return fmt.Errorf("read file: %w", err)
+		return err
 	}
 
 	var payload map[string]any
@@ -405,9 +413,9 @@ func addSubprocessStreamHint(message string, runErr error) string {
 }
 
 func validateJSONFile(path string) error {
-	data, err := os.ReadFile(path)
+	data, err := readAuditaResult(path, MaxReportOutputBytes, "report")
 	if err != nil {
-		return fmt.Errorf("read file: %w", err)
+		return err
 	}
 	var v any
 	if err := json.Unmarshal(data, &v); err != nil {
@@ -415,3 +423,11 @@ func validateJSONFile(path string) error {
 	}
 	return nil
 }
+
+func readAuditaResult(path string, limit int64, category string) ([]byte, error) {
+	data, err := fileops.ReadFileBounded(path, limit)
+	if err != nil {
+		return nil, fmt.Errorf("audita %s result exceeds or cannot be read within %d-byte limit: %w", category, limit, err)
+	}
+	return data, nil
+}

internal/adapters/audita/subprocess_test.go

@@ -189,7 +189,7 @@ func TestSubprocessRunnerUnconfiguredCredentialEnvOmitsCredential(t *testing.T)
 	}
 }
 
-func TestSubprocessRunnerInheritsParentEnvironment(t *testing.T) {
+func TestSubprocessRunnerOmitsUnspecifiedParentEnvironment(t *testing.T) {
 	if runtime.GOOS == "windows" {
 		t.Skip("helper wrapper script uses /bin/sh")
 	}
@@ -214,8 +214,8 @@ func TestSubprocessRunnerInheritsParentEnvironment(t *testing.T) {
 	}
 
 	rec := readAuditaHelperRecord(t, recordPath)
-	if rec.Env["AUDITA_INHERITED_MARKER"] != "inherited-from-parent" {
-		t.Fatalf("AUDITA_INHERITED_MARKER = %q, want inherited-from-parent", rec.Env["AUDITA_INHERITED_MARKER"])
+	if rec.Env["AUDITA_INHERITED_MARKER"] != "" {
+		t.Fatalf("AUDITA_INHERITED_MARKER = %q, want omitted from the child environment", rec.Env["AUDITA_INHERITED_MARKER"])
 	}
 }
 

internal/adapters/notarius/fake.go

@@ -14,7 +14,9 @@ func (f *FakeRunner) Run(ctx context.Context, req RunRequest) (RunResult, error)
 	if err := ctx.Err(); err != nil {
 		return RunResult{}, err
 	}
-	f.Requests = append(f.Requests, req)
+	copyRequest := req
+	copyRequest.References = append([]ReferenceBinding(nil), req.References...)
+	f.Requests = append(f.Requests, copyRequest)
 	if f.Err != nil {
 		return RunResult{}, f.Err
 	}

internal/adapters/notarius/runner.go

@@ -6,13 +6,20 @@ import (
 	"time"
 )
 
-const ReceiptSchemaVersion = "notarius.run-result.v1"
+const ReceiptSchemaVersion = "notarius.run-result.v2"
 
 // Runner is the adapter boundary for a complete Notarius pipeline invocation.
 type Runner interface {
 	Run(ctx context.Context, req RunRequest) (RunResult, error)
 }
 
+// ReferenceBinding maps one normalized Notarius selector to an absolute
+// external reference path.
+type ReferenceBinding struct {
+	Selector string
+	Path     string
+}
+
 // RunRequest contains the resolved inputs and diagnostic destinations for one invocation.
 type RunRequest struct {
 	Binary           string
@@ -24,20 +31,41 @@ type RunRequest struct {
 	ReceiptPath      string
 	LogPath          string
 	Timeout          time.Duration
+	References       []ReferenceBinding
 }
 
 // Receipt is the transport-neutral successful run receipt.
 type Receipt struct {
-	SchemaVersion         string
-	RunID                 string
-	PipelineID            string
-	OutputDirectory       string
-	IndexFile             string
-	NormalizedOutputCount int
-	RejectedOutputCount   int
-	WarningCount          int
-	ValidationStatus      string
-	DebugDirectory        string
+	SchemaVersion             string
+	RunID                     string
+	PipelineID                string
+	OutputDirectory           string
+	IndexFile                 string
+	NormalizedOutputCount     int
+	RejectedOutputCount       int
+	WarningGroupCount         int
+	WarningOccurrenceCount    int
+	DiagnosticGroupCount      int
+	DiagnosticOccurrenceCount int
+	DiagnosticsTruncated      bool
+	ValidationStatus          string
+	ValidationSummaries       []ValidationSummary
+	DebugDirectory            string
+}
+
+// ValidationSummary retains the bounded outcome of one Notarius producer result.
+type ValidationSummary struct {
+	Stage                string
+	StepID               string
+	LaneID               string
+	ModuleKey            string
+	ChunkID              string
+	Status               string
+	RejectingValidators  []string
+	ReasonCodes          []string
+	IncompleteValidators []string
+	ProducerAttemptCount int
+	TerminalAction       string
 }
 
 // LaneDescriptor identifies one normalized lane payload discovered through the index.
@@ -72,6 +100,8 @@ type Index struct {
 	RejectedPath    string
 	WarningsFile    string
 	WarningsPath    string
+	DiagnosticsFile string
+	DiagnosticsPath string
 	Lanes           []LaneDescriptor
 	ChunkMap        *PipelineDescriptor
 	EvidenceContext *PipelineDescriptor
@@ -90,8 +120,29 @@ type RejectionSummary struct {
 
 // WarningSummary retains structured warning identity without free-form messages.
 type WarningSummary struct {
-	Scope      string
-	ReasonCode string
+	Disposition     string
+	Category        string
+	ReasonCode      string
+	Origin          DiagnosticOrigin
+	OccurrenceCount int
+}
+
+// DiagnosticOrigin identifies the framework-owned pipeline location of a finding.
+type DiagnosticOrigin struct {
+	Stage        string
+	StepID       string
+	LaneID       string
+	ModuleKey    string
+	ValidatorKey string
+}
+
+// DiagnosticSummary retains bounded advisory or observation group metadata.
+type DiagnosticSummary struct {
+	Disposition     string
+	Category        string
+	ReasonCode      string
+	Origin          DiagnosticOrigin
+	OccurrenceCount int
 }
 
 // RunResult describes a successfully decoded and validated Notarius bundle.
@@ -105,4 +156,5 @@ type RunResult struct {
 	Duration    time.Duration
 	Rejections  []RejectionSummary
 	Warnings    []WarningSummary
+	Diagnostics []DiagnosticSummary
 }

internal/adapters/notarius/subprocess.go

@@ -5,23 +5,30 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"io"
 	"os"
 	"path/filepath"
 	"strings"
 
 	"gitea.maximumdirect.net/eric/narratio/internal/adapters/subprocess"
+	"gitea.maximumdirect.net/eric/narratio/internal/fileops"
+	"gitea.maximumdirect.net/eric/narratio/internal/notariusref"
 	"gitea.maximumdirect.net/eric/narratio/internal/pathsafe"
 )
 
 const (
-	maxReceiptBytes       = 1 << 20
-	maxIndexBytes         = 4 << 20
-	maxSummaryBytes       = 4 << 20
-	canonicalIndexFile    = "index.json"
-	canonicalManifestFile = "manifest.json"
-	canonicalRejectedFile = "rejected.json"
-	canonicalWarningsFile = "warnings.json"
+	maxReceiptBytes          = 1 << 20
+	maxIndexBytes            = 4 << 20
+	maxSummaryBytes          = 4 << 20
+	canonicalIndexFile       = "index.json"
+	canonicalManifestFile    = "manifest.json"
+	canonicalRejectedFile    = "rejected.json"
+	canonicalWarningsFile    = "warnings.json"
+	canonicalDiagnosticsFile = "diagnostics.json"
+	warningsSchemaVersion    = "notarius.warnings.v2"
+	diagnosticsSchemaVersion = "notarius.diagnostics.v1"
+	maxWarningGroups         = 128
+	maxDiagnosticGroups      = 256
+	maxFindingSamples        = 3
 )
 
 type subprocessRun func(context.Context, subprocess.RunRequest) (subprocess.RunResult, error)
@@ -41,7 +48,8 @@ func (r *SubprocessRunner) Run(ctx context.Context, req RunRequest) (RunResult,
 	if r == nil || r.run == nil {
 		return RunResult{}, fmt.Errorf("notarius subprocess runner is nil")
 	}
-	if err := validateRunRequest(req); err != nil {
+	references, err := validateRunRequest(req)
+	if err != nil {
 		return RunResult{}, err
 	}
 
@@ -50,15 +58,19 @@ func (r *SubprocessRunner) Run(ctx context.Context, req RunRequest) (RunResult,
 		"--config", req.ConfigPath,
 		"--input", req.InputPath,
 		"--output-dir", req.OutputRoot,
-		"--json",
 	}
+	for _, reference := range references {
+		args = append(args, "--reference", reference.Selector+"="+reference.Path)
+	}
+	args = append(args, "--json")
 	processResult, err := r.run(ctx, subprocess.RunRequest{
-		Executable:    req.Binary,
-		Args:          args,
-		WorkingDir:    req.WorkingDirectory,
-		Timeout:       req.Timeout,
-		StdoutLogPath: req.ReceiptPath,
-		StderrLogPath: req.LogPath,
+		Executable:      req.Binary,
+		Args:            args,
+		WorkingDir:      req.WorkingDirectory,
+		Timeout:         req.Timeout,
+		DiagnosticOwner: "notarius",
+		StdoutLogPath:   req.ReceiptPath,
+		StderrLogPath:   req.LogPath,
 	})
 	baseResult := RunResult{
 		ReceiptPath: req.ReceiptPath,
@@ -94,24 +106,42 @@ func (r *SubprocessRunner) Run(ctx context.Context, req RunRequest) (RunResult,
 	if err != nil {
 		return baseResult, err
 	}
+	diagnostics, diagnosticOccurrences, diagnosticsTruncated, err := loadDiagnostics(index.DiagnosticsPath)
+	if err != nil {
+		return baseResult, err
+	}
+	if receipt.NormalizedOutputCount != len(index.Lanes) || receipt.RejectedOutputCount != len(rejections) ||
+		receipt.WarningGroupCount != len(warnings) || receipt.DiagnosticGroupCount != len(diagnostics) {
+		return baseResult, fmt.Errorf("notarius receipt counts do not match published bundle")
+	}
+	warningOccurrences, err := sumWarningOccurrences(warnings)
+	if err != nil {
+		return baseResult, err
+	}
+	if receipt.WarningOccurrenceCount != warningOccurrences ||
+		receipt.DiagnosticOccurrenceCount != diagnosticOccurrences ||
+		receipt.DiagnosticsTruncated != diagnosticsTruncated {
+		return baseResult, fmt.Errorf("notarius receipt occurrence counts do not match published bundle")
+	}
 
 	baseResult.Receipt = receipt
 	baseResult.Index = index
 	baseResult.BundleRoot = bundleRoot
 	baseResult.Rejections = rejections
 	baseResult.Warnings = warnings
+	baseResult.Diagnostics = diagnostics
 	return baseResult, nil
 }
 
-func validateRunRequest(req RunRequest) error {
+func validateRunRequest(req RunRequest) ([]ReferenceBinding, error) {
 	if strings.TrimSpace(req.Binary) == "" {
-		return fmt.Errorf("notarius binary is required")
+		return nil, fmt.Errorf("notarius binary is required")
 	}
 	if strings.TrimSpace(req.PipelineID) == "" {
-		return fmt.Errorf("notarius pipeline id is required")
+		return nil, fmt.Errorf("notarius pipeline id is required")
 	}
 	if req.Timeout <= 0 {
-		return fmt.Errorf("notarius timeout must be positive")
+		return nil, fmt.Errorf("notarius timeout must be positive")
 	}
 	for label, path := range map[string]string{
 		"config":            req.ConfigPath,
@@ -122,47 +152,124 @@ func validateRunRequest(req RunRequest) error {
 		"log":               req.LogPath,
 	} {
 		if strings.TrimSpace(path) == "" {
-			return fmt.Errorf("notarius %s path is required", label)
+			return nil, fmt.Errorf("notarius %s path is required", label)
 		}
 		if !filepath.IsAbs(path) {
-			return fmt.Errorf("notarius %s path must be absolute", label)
+			return nil, fmt.Errorf("notarius %s path must be absolute", label)
 		}
 	}
 	if filepath.Clean(req.ReceiptPath) == filepath.Clean(req.LogPath) {
-		return fmt.Errorf("notarius receipt and log paths must be different")
+		return nil, fmt.Errorf("notarius receipt and log paths must be different")
+	}
+	references := make([]ReferenceBinding, 0, len(req.References))
+	selectors := make(map[string]struct{}, len(req.References))
+	for index, binding := range req.References {
+		selector, err := notariusref.NormalizeSelector(binding.Selector)
+		if err != nil {
+			return nil, fmt.Errorf("notarius reference %d selector: %w", index, err)
+		}
+		if _, duplicate := selectors[selector]; duplicate {
+			return nil, fmt.Errorf("notarius reference selector %q is duplicated", selector)
+		}
+		selectors[selector] = struct{}{}
+		if strings.TrimSpace(binding.Path) == "" {
+			return nil, fmt.Errorf("notarius reference %q path is required", selector)
+		}
+		if !filepath.IsAbs(binding.Path) {
+			return nil, fmt.Errorf("notarius reference %q path must be absolute", selector)
+		}
+		references = append(references, ReferenceBinding{Selector: selector, Path: binding.Path})
 	}
 	if err := requireRegularFile(req.ConfigPath); err != nil {
-		return fmt.Errorf("validate notarius config path: %w", err)
+		return nil, fmt.Errorf("validate notarius config path: %w", err)
 	}
 	if err := requireRegularFile(req.InputPath); err != nil {
-		return fmt.Errorf("validate notarius input path: %w", err)
+		return nil, fmt.Errorf("validate notarius input path: %w", err)
 	}
 	if err := requireDirectory(req.OutputRoot); err != nil {
-		return fmt.Errorf("validate notarius output root: %w", err)
+		return nil, fmt.Errorf("validate notarius output root: %w", err)
 	}
 	if err := requireDirectory(req.WorkingDirectory); err != nil {
-		return fmt.Errorf("validate notarius working directory: %w", err)
+		return nil, fmt.Errorf("validate notarius working directory: %w", err)
 	}
 	if err := validateLogDestination(req.ReceiptPath); err != nil {
-		return fmt.Errorf("validate notarius receipt path: %w", err)
+		return nil, fmt.Errorf("validate notarius receipt path: %w", err)
 	}
 	if err := validateLogDestination(req.LogPath); err != nil {
-		return fmt.Errorf("validate notarius log path: %w", err)
+		return nil, fmt.Errorf("validate notarius log path: %w", err)
 	}
-	return nil
+	return references, nil
 }
 
 type receiptDocument struct {
-	SchemaVersion         string `json:"schema_version"`
-	RunID                 string `json:"run_id"`
-	PipelineID            string `json:"pipeline_id"`
-	OutputDirectory       string `json:"output_directory"`
-	IndexFile             string `json:"index_file"`
-	NormalizedOutputCount *int   `json:"normalized_output_count"`
-	RejectedOutputCount   *int   `json:"rejected_output_count"`
-	WarningCount          *int   `json:"warning_count"`
-	ValidationStatus      string `json:"validation_status"`
-	DebugDirectory        string `json:"debug_directory"`
+	SchemaVersion             string                      `json:"schema_version"`
+	RunID                     string                      `json:"run_id"`
+	PipelineID                string                      `json:"pipeline_id"`
+	OutputDirectory           string                      `json:"output_directory"`
+	IndexFile                 string                      `json:"index_file"`
+	NormalizedOutputCount     *int                        `json:"normalized_output_count"`
+	RejectedOutputCount       *int                        `json:"rejected_output_count"`
+	WarningGroupCount         *int                        `json:"warning_group_count"`
+	WarningOccurrenceCount    *int                        `json:"warning_occurrence_count"`
+	DiagnosticGroupCount      *int                        `json:"diagnostic_group_count"`
+	DiagnosticOccurrenceCount *int                        `json:"diagnostic_occurrence_count"`
+	DiagnosticsTruncated      *bool                       `json:"diagnostics_truncated"`
+	ValidationStatus          string                      `json:"validation_status"`
+	ValidationSummaries       []validationSummaryDocument `json:"validation_summaries"`
+	DebugDirectory            string                      `json:"debug_directory"`
+}
+
+type validationSummaryDocument struct {
+	Stage                string   `json:"stage"`
+	StepID               string   `json:"step_id"`
+	LaneID               string   `json:"lane_id"`
+	ModuleKey            string   `json:"module_key"`
+	ChunkID              string   `json:"chunk_id"`
+	Status               string   `json:"status"`
+	RejectingValidators  []string `json:"rejecting_validators"`
+	ReasonCodes          []string `json:"reason_codes"`
+	IncompleteValidators []string `json:"incomplete_validators"`
+	ProducerAttemptCount *int     `json:"producer_attempt_count"`
+	TerminalAction       string   `json:"terminal_action"`
+}
+
+func validValidationStatus(value string) bool {
+	switch value {
+	case "approved", "rejected", "incomplete":
+		return true
+	default:
+		return false
+	}
+}
+
+func validateValidationSummaries(documents []validationSummaryDocument) ([]ValidationSummary, error) {
+	summaries := make([]ValidationSummary, 0, len(documents))
+	for _, document := range documents {
+		if document.Status != "complete" && document.Status != "rejected" && document.Status != "incomplete" {
+			return nil, fmt.Errorf("notarius validation summary status %q is invalid", document.Status)
+		}
+		if document.ProducerAttemptCount == nil || *document.ProducerAttemptCount <= 0 || !validTerminalAction(document.TerminalAction) {
+			return nil, fmt.Errorf("notarius validation summary is missing required fields")
+		}
+		summaries = append(summaries, ValidationSummary{
+			Stage: document.Stage, StepID: document.StepID, LaneID: document.LaneID,
+			ModuleKey: document.ModuleKey, ChunkID: document.ChunkID, Status: document.Status,
+			RejectingValidators:  append([]string(nil), document.RejectingValidators...),
+			ReasonCodes:          append([]string(nil), document.ReasonCodes...),
+			IncompleteValidators: append([]string(nil), document.IncompleteValidators...),
+			ProducerAttemptCount: *document.ProducerAttemptCount, TerminalAction: document.TerminalAction,
+		})
+	}
+	return summaries, nil
+}
+
+func validTerminalAction(value string) bool {
+	switch value {
+	case "accepted", "reject_output", "warn_continue", "fail_run":
+		return true
+	default:
+		return false
+	}
 }
 
 func loadReceipt(path, pipelineID string) (Receipt, error) {
@@ -176,7 +283,9 @@ func loadReceipt(path, pipelineID string) (Receipt, error) {
 	if strings.TrimSpace(document.RunID) == "" || strings.TrimSpace(document.PipelineID) == "" ||
 		strings.TrimSpace(document.OutputDirectory) == "" || strings.TrimSpace(document.ValidationStatus) == "" ||
 		document.NormalizedOutputCount == nil ||
-		document.RejectedOutputCount == nil || document.WarningCount == nil {
+		document.RejectedOutputCount == nil || document.WarningGroupCount == nil ||
+		document.WarningOccurrenceCount == nil || document.DiagnosticGroupCount == nil ||
+		document.DiagnosticOccurrenceCount == nil || document.DiagnosticsTruncated == nil {
 		return Receipt{}, fmt.Errorf("notarius receipt is missing required fields")
 	}
 	if document.IndexFile != canonicalIndexFile {
@@ -185,9 +294,18 @@ func loadReceipt(path, pipelineID string) (Receipt, error) {
 	if document.PipelineID != pipelineID {
 		return Receipt{}, fmt.Errorf("notarius receipt pipeline id %q does not match requested pipeline %q", document.PipelineID, pipelineID)
 	}
-	if *document.NormalizedOutputCount < 0 || *document.RejectedOutputCount < 0 || *document.WarningCount < 0 {
+	if *document.NormalizedOutputCount < 0 || *document.RejectedOutputCount < 0 ||
+		*document.WarningGroupCount < 0 || *document.WarningOccurrenceCount < 0 ||
+		*document.DiagnosticGroupCount < 0 || *document.DiagnosticOccurrenceCount < 0 {
 		return Receipt{}, fmt.Errorf("notarius receipt counts must be non-negative")
 	}
+	if !validValidationStatus(document.ValidationStatus) {
+		return Receipt{}, fmt.Errorf("notarius receipt validation_status %q is invalid", document.ValidationStatus)
+	}
+	validationSummaries, err := validateValidationSummaries(document.ValidationSummaries)
+	if err != nil {
+		return Receipt{}, err
+	}
 	if !filepath.IsAbs(document.OutputDirectory) {
 		return Receipt{}, fmt.Errorf("notarius receipt output directory must be absolute")
 	}
@@ -195,16 +313,21 @@ func loadReceipt(path, pipelineID string) (Receipt, error) {
 		return Receipt{}, fmt.Errorf("notarius receipt debug directory must be absolute when present")
 	}
 	return Receipt{
-		SchemaVersion:         document.SchemaVersion,
-		RunID:                 document.RunID,
-		PipelineID:            document.PipelineID,
-		OutputDirectory:       filepath.Clean(document.OutputDirectory),
-		IndexFile:             document.IndexFile,
-		NormalizedOutputCount: *document.NormalizedOutputCount,
-		RejectedOutputCount:   *document.RejectedOutputCount,
-		WarningCount:          *document.WarningCount,
-		ValidationStatus:      document.ValidationStatus,
-		DebugDirectory:        document.DebugDirectory,
+		SchemaVersion:             document.SchemaVersion,
+		RunID:                     document.RunID,
+		PipelineID:                document.PipelineID,
+		OutputDirectory:           filepath.Clean(document.OutputDirectory),
+		IndexFile:                 document.IndexFile,
+		NormalizedOutputCount:     *document.NormalizedOutputCount,
+		RejectedOutputCount:       *document.RejectedOutputCount,
+		WarningGroupCount:         *document.WarningGroupCount,
+		WarningOccurrenceCount:    *document.WarningOccurrenceCount,
+		DiagnosticGroupCount:      *document.DiagnosticGroupCount,
+		DiagnosticOccurrenceCount: *document.DiagnosticOccurrenceCount,
+		DiagnosticsTruncated:      *document.DiagnosticsTruncated,
+		ValidationStatus:          document.ValidationStatus,
+		ValidationSummaries:       validationSummaries,
+		DebugDirectory:            document.DebugDirectory,
 	}, nil
 }
 
@@ -213,6 +336,7 @@ type indexDocument struct {
 	OutputFiles     *[]laneDocument   `json:"output_files"`
 	RejectedFile    string            `json:"rejected_file"`
 	WarningsFile    string            `json:"warnings_file"`
+	DiagnosticsFile string            `json:"diagnostics_file"`
 	ChunkMap        *pipelineDocument `json:"chunk_map"`
 	EvidenceContext *pipelineDocument `json:"evidence_context"`
 }
@@ -249,6 +373,7 @@ func loadIndex(bundleRoot, indexPath string) (Index, error) {
 		{name: "manifest_file", got: document.ManifestFile, want: canonicalManifestFile},
 		{name: "rejected_file", got: document.RejectedFile, want: canonicalRejectedFile},
 		{name: "warnings_file", got: document.WarningsFile, want: canonicalWarningsFile},
+		{name: "diagnostics_file", got: document.DiagnosticsFile, want: canonicalDiagnosticsFile},
 	} {
 		if field.got != field.want {
 			return Index{}, fmt.Errorf("notarius index %s %q is incompatible; want %q", field.name, field.got, field.want)
@@ -259,10 +384,11 @@ func loadIndex(bundleRoot, indexPath string) (Index, error) {
 	}
 
 	index := Index{
-		Path:         indexPath,
-		ManifestFile: document.ManifestFile,
-		RejectedFile: document.RejectedFile,
-		WarningsFile: document.WarningsFile,
+		Path:            indexPath,
+		ManifestFile:    document.ManifestFile,
+		RejectedFile:    document.RejectedFile,
+		WarningsFile:    document.WarningsFile,
+		DiagnosticsFile: document.DiagnosticsFile,
 	}
 	var err error
 	if index.ManifestPath, err = resolveRegularFile(bundleRoot, index.ManifestFile); err != nil {
@@ -274,6 +400,9 @@ func loadIndex(bundleRoot, indexPath string) (Index, error) {
 	if index.WarningsPath, err = resolveRegularFile(bundleRoot, index.WarningsFile); err != nil {
 		return Index{}, fmt.Errorf("resolve notarius warning file: %w", err)
 	}
+	if index.DiagnosticsPath, err = resolveRegularFile(bundleRoot, index.DiagnosticsFile); err != nil {
+		return Index{}, fmt.Errorf("resolve notarius diagnostics file: %w", err)
+	}
 
 	seenLanes := make(map[string]struct{}, len(*document.OutputFiles))
 	for _, lane := range *document.OutputFiles {
@@ -361,12 +490,34 @@ func loadRejections(path string) ([]RejectionSummary, error) {
 	return summaries, nil
 }
 
-type warningDocument struct {
-	Warnings *[]struct {
+type findingGroupDocument struct {
+	Disposition     string                   `json:"disposition"`
+	Category        string                   `json:"category"`
+	ReasonCode      string                   `json:"reason_code"`
+	Origin          diagnosticOriginDocument `json:"origin"`
+	OccurrenceCount *int                     `json:"occurrence_count"`
+	Samples         *[]struct {
 		Scope      string `json:"scope"`
-		ReasonCode string `json:"reason_code"`
 		Message    string `json:"message"`
-	} `json:"warnings"`
+		ChunkID    string `json:"chunk_id"`
+		ChunkIndex *int   `json:"chunk_index"`
+	} `json:"samples"`
+	OmittedSampleCount *int `json:"omitted_sample_count"`
+}
+
+type diagnosticOriginDocument struct {
+	Stage        string `json:"stage"`
+	StepID       string `json:"step_id"`
+	LaneID       string `json:"lane_id"`
+	ModuleKey    string `json:"module_key"`
+	ValidatorKey string `json:"validator_key"`
+}
+
+type warningDocument struct {
+	SchemaVersion   string                  `json:"schema_version"`
+	GroupCount      *int                    `json:"group_count"`
+	OccurrenceCount *int                    `json:"occurrence_count"`
+	Groups          *[]findingGroupDocument `json:"groups"`
 }
 
 func loadWarnings(path string) ([]WarningSummary, error) {
@@ -374,46 +525,155 @@ func loadWarnings(path string) ([]WarningSummary, error) {
 	if err := decodeBoundedJSON(path, maxSummaryBytes, &document); err != nil {
 		return nil, fmt.Errorf("decode notarius warnings: %w", err)
 	}
-	if document.Warnings == nil {
-		return nil, fmt.Errorf("notarius warning document is missing warnings array")
+	if document.SchemaVersion != warningsSchemaVersion || document.GroupCount == nil ||
+		document.OccurrenceCount == nil || document.Groups == nil {
+		return nil, fmt.Errorf("notarius warning document is missing or incompatible required fields")
 	}
-	summaries := make([]WarningSummary, 0, len(*document.Warnings))
-	for _, item := range *document.Warnings {
-		if strings.TrimSpace(item.ReasonCode) == "" || strings.TrimSpace(item.Message) == "" {
-			return nil, fmt.Errorf("notarius warning entries require reason_code and message")
+	if *document.GroupCount < 0 || *document.GroupCount > maxWarningGroups || *document.OccurrenceCount < 0 ||
+		*document.GroupCount != len(*document.Groups) {
+		return nil, fmt.Errorf("notarius warning document counts are inconsistent")
+	}
+	summaries := make([]WarningSummary, 0, len(*document.Groups))
+	occurrences := 0
+	for _, group := range *document.Groups {
+		if err := validateFindingGroup(group); err != nil {
+			return nil, fmt.Errorf("notarius warning group: %w", err)
 		}
-		summaries = append(summaries, WarningSummary{Scope: item.Scope, ReasonCode: item.ReasonCode})
+		if group.Disposition != "warning" {
+			return nil, fmt.Errorf("notarius warning group disposition %q is invalid", group.Disposition)
+		}
+		if *group.OccurrenceCount > int(^uint(0)>>1)-occurrences {
+			return nil, fmt.Errorf("notarius warning occurrence count overflows")
+		}
+		occurrences += *group.OccurrenceCount
+		summaries = append(summaries, WarningSummary{
+			Disposition: group.Disposition, Category: group.Category, ReasonCode: group.ReasonCode,
+			Origin: diagnosticOrigin(group.Origin), OccurrenceCount: *group.OccurrenceCount,
+		})
+	}
+	if occurrences != *document.OccurrenceCount {
+		return nil, fmt.Errorf("notarius warning document occurrence count is inconsistent")
 	}
 	return summaries, nil
 }
 
+type diagnosticDocument struct {
+	SchemaVersion                string                  `json:"schema_version"`
+	GroupCount                   *int                    `json:"group_count"`
+	OccurrenceCount              *int                    `json:"occurrence_count"`
+	Truncated                    *bool                   `json:"truncated"`
+	UnrepresentedOccurrenceCount *int                    `json:"unrepresented_occurrence_count"`
+	Groups                       *[]findingGroupDocument `json:"groups"`
+}
+
+func loadDiagnostics(path string) ([]DiagnosticSummary, int, bool, error) {
+	var document diagnosticDocument
+	if err := decodeBoundedJSON(path, maxSummaryBytes, &document); err != nil {
+		return nil, 0, false, fmt.Errorf("decode notarius diagnostics: %w", err)
+	}
+	if document.SchemaVersion != diagnosticsSchemaVersion || document.GroupCount == nil ||
+		document.OccurrenceCount == nil || document.Truncated == nil ||
+		document.UnrepresentedOccurrenceCount == nil || document.Groups == nil {
+		return nil, 0, false, fmt.Errorf("notarius diagnostics document is missing or incompatible required fields")
+	}
+	if *document.GroupCount < 0 || *document.GroupCount > maxDiagnosticGroups || *document.OccurrenceCount < 0 ||
+		*document.UnrepresentedOccurrenceCount < 0 || *document.GroupCount != len(*document.Groups) {
+		return nil, 0, false, fmt.Errorf("notarius diagnostics document counts are inconsistent")
+	}
+	if !*document.Truncated && *document.UnrepresentedOccurrenceCount != 0 {
+		return nil, 0, false, fmt.Errorf("notarius diagnostics document has unrepresented occurrences without truncation")
+	}
+	summaries := make([]DiagnosticSummary, 0, len(*document.Groups))
+	representedOccurrences := 0
+	for _, group := range *document.Groups {
+		if err := validateFindingGroup(group); err != nil {
+			return nil, 0, false, fmt.Errorf("notarius diagnostic group: %w", err)
+		}
+		if group.Disposition != "advisory" && group.Disposition != "observation" {
+			return nil, 0, false, fmt.Errorf("notarius diagnostic group disposition %q is invalid", group.Disposition)
+		}
+		if *group.OccurrenceCount > int(^uint(0)>>1)-representedOccurrences {
+			return nil, 0, false, fmt.Errorf("notarius diagnostic occurrence count overflows")
+		}
+		representedOccurrences += *group.OccurrenceCount
+		summaries = append(summaries, DiagnosticSummary{
+			Disposition: group.Disposition, Category: group.Category, ReasonCode: group.ReasonCode,
+			Origin: diagnosticOrigin(group.Origin), OccurrenceCount: *group.OccurrenceCount,
+		})
+	}
+	if *document.UnrepresentedOccurrenceCount > int(^uint(0)>>1)-representedOccurrences ||
+		representedOccurrences+*document.UnrepresentedOccurrenceCount != *document.OccurrenceCount {
+		return nil, 0, false, fmt.Errorf("notarius diagnostics document occurrence count is inconsistent")
+	}
+	return summaries, *document.OccurrenceCount, *document.Truncated, nil
+}
+
+func validateFindingGroup(group findingGroupDocument) error {
+	if strings.TrimSpace(group.Disposition) == "" || strings.TrimSpace(group.Category) == "" ||
+		strings.TrimSpace(group.ReasonCode) == "" || !validDiagnosticOriginStage(group.Origin.Stage) ||
+		!validDiagnosticCategory(group.Disposition, group.Category) ||
+		group.OccurrenceCount == nil || *group.OccurrenceCount <= 0 || group.Samples == nil ||
+		group.OmittedSampleCount == nil || *group.OmittedSampleCount < 0 {
+		return fmt.Errorf("missing required fields")
+	}
+	if len(*group.Samples) == 0 || len(*group.Samples) > maxFindingSamples ||
+		*group.OmittedSampleCount != *group.OccurrenceCount-len(*group.Samples) {
+		return fmt.Errorf("sample counts are inconsistent")
+	}
+	for _, sample := range *group.Samples {
+		if strings.TrimSpace(sample.Scope) == "" || strings.TrimSpace(sample.Message) == "" ||
+			(sample.ChunkIndex != nil && *sample.ChunkIndex < 0) {
+			return fmt.Errorf("samples require scope and message")
+		}
+	}
+	return nil
+}
+
+func validDiagnosticCategory(disposition, category string) bool {
+	switch disposition {
+	case "warning":
+		return category == "configuration" || category == "degradation" ||
+			category == "validation_incomplete" || category == "fallback"
+	case "advisory":
+		return category == "data_quality"
+	case "observation":
+		return category == "normalization"
+	default:
+		return false
+	}
+}
+
+func validDiagnosticOriginStage(stage string) bool {
+	switch stage {
+	case "references", "chunk", "extract", "merge", "normalize":
+		return true
+	default:
+		return false
+	}
+}
+
+func diagnosticOrigin(document diagnosticOriginDocument) DiagnosticOrigin {
+	return DiagnosticOrigin{
+		Stage: document.Stage, StepID: document.StepID, LaneID: document.LaneID,
+		ModuleKey: document.ModuleKey, ValidatorKey: document.ValidatorKey,
+	}
+}
+
+func sumWarningOccurrences(values []WarningSummary) (int, error) {
+	total := 0
+	for _, value := range values {
+		if value.OccurrenceCount > int(^uint(0)>>1)-total {
+			return 0, fmt.Errorf("notarius warning occurrence count overflows")
+		}
+		total += value.OccurrenceCount
+	}
+	return total, nil
+}
+
 func decodeBoundedJSON(path string, limit int64, destination any) error {
-	inspected, err := os.Lstat(path)
+	data, err := fileops.ReadFileBounded(path, limit)
 	if err != nil {
-		return err
-	}
-	if inspected.Mode()&os.ModeSymlink != 0 || !inspected.Mode().IsRegular() {
-		return fmt.Errorf("path %q must be a regular file without symlinks", path)
-	}
-	file, err := os.Open(path)
-	if err != nil {
-		return err
-	}
-	defer func() { _ = file.Close() }()
-	opened, err := file.Stat()
-	if err != nil {
-		return err
-	}
-	if !opened.Mode().IsRegular() || !os.SameFile(inspected, opened) {
-		return fmt.Errorf("file %q changed before it could be read", path)
-	}
-	reader := io.LimitReader(file, limit+1)
-	data, err := io.ReadAll(reader)
-	if err != nil {
-		return err
-	}
-	if int64(len(data)) > limit {
-		return fmt.Errorf("file %q exceeds %d-byte limit", path, limit)
+		return fmt.Errorf("notarius JSON result exceeds or cannot be read within %d-byte limit: %w", limit, err)
 	}
 	if err := json.Unmarshal(data, destination); err != nil {
 		return err

internal/adapters/notarius/subprocess_test.go

@@ -52,6 +52,10 @@ func TestSubprocessRunnerBuildsExactInvocationAndDiscoversBundle(t *testing.T) {
 	if result.Receipt.SchemaVersion != ReceiptSchemaVersion || result.Receipt.RunID != "notarius-run-1" {
 		t.Fatalf("receipt = %#v", result.Receipt)
 	}
+	if len(result.Receipt.ValidationSummaries) != 1 || result.Receipt.ValidationSummaries[0].LaneID != "npc-registry" ||
+		result.Receipt.ValidationSummaries[0].Status != "complete" {
+		t.Fatalf("validation summaries = %#v", result.Receipt.ValidationSummaries)
+	}
 	if len(result.Index.Lanes) != 1 || result.Index.Lanes[0].LaneID != "npc-registry" {
 		t.Fatalf("lanes = %#v", result.Index.Lanes)
 	}
@@ -64,12 +68,110 @@ func TestSubprocessRunnerBuildsExactInvocationAndDiscoversBundle(t *testing.T) {
 	if len(result.Rejections) != 1 || result.Rejections[0].LaneID != "spells" || result.Rejections[0].ReasonCode != "invalid_spell" {
 		t.Fatalf("rejections = %#v", result.Rejections)
 	}
-	if len(result.Warnings) != 1 || result.Warnings[0].Scope != "lane:npc-registry" || result.Warnings[0].ReasonCode != "normalized_name" {
+	if len(result.Warnings) != 1 || result.Warnings[0].Category != "degradation" || result.Warnings[0].ReasonCode != "normalized_name" {
 		t.Fatalf("warnings = %#v", result.Warnings)
 	}
+	if len(result.Diagnostics) != 1 || result.Diagnostics[0].Category != "data_quality" || result.Diagnostics[0].ReasonCode != "low_confidence" {
+		t.Fatalf("diagnostics = %#v", result.Diagnostics)
+	}
 }
 
-func TestSubprocessRunnerInheritsEnvironmentAndSeparatesStreams(t *testing.T) {
+func TestSubprocessRunnerBuildsOrderedReferenceArguments(t *testing.T) {
+	req := validRunRequest(t)
+	referenceRoot := t.TempDir()
+	req.References = []ReferenceBinding{
+		{Selector: " party ", Path: filepath.Join(referenceRoot, "party context=primary.json")},
+		{Selector: " npc-registry . extract . glossary ", Path: filepath.Join(referenceRoot, "glossary.json")},
+	}
+	originalReferences := append([]ReferenceBinding(nil), req.References...)
+	var captured sharedsubprocess.RunRequest
+	runner := &SubprocessRunner{run: func(_ context.Context, processReq sharedsubprocess.RunRequest) (sharedsubprocess.RunResult, error) {
+		captured = processReq
+		writeValidBundleAndReceipt(t, req, false)
+		return sharedsubprocess.RunResult{ExitCode: 0}, nil
+	}}
+
+	if _, err := runner.Run(context.Background(), req); err != nil {
+		t.Fatalf("Run() error = %v", err)
+	}
+	wantArgs := []string{
+		"run", req.PipelineID,
+		"--config", req.ConfigPath,
+		"--input", req.InputPath,
+		"--output-dir", req.OutputRoot,
+		"--reference", "party=" + req.References[0].Path,
+		"--reference", "npc-registry.extract.glossary=" + req.References[1].Path,
+		"--json",
+	}
+	if !reflect.DeepEqual(captured.Args, wantArgs) {
+		t.Fatalf("subprocess args = %#v, want %#v", captured.Args, wantArgs)
+	}
+	if !reflect.DeepEqual(req.References, originalReferences) {
+		t.Fatalf("Run() mutated caller references = %#v, want %#v", req.References, originalReferences)
+	}
+}
+
+func TestSubprocessRunnerRejectsInvalidReferencesBeforeLaunch(t *testing.T) {
+	tests := []struct {
+		name       string
+		references func(string) []ReferenceBinding
+		wantErr    string
+	}{
+		{
+			name: "invalid selector",
+			references: func(root string) []ReferenceBinding {
+				return []ReferenceBinding{{Selector: "lane.prepare.party", Path: filepath.Join(root, "party.json")}}
+			},
+			wantErr: "selector",
+		},
+		{
+			name: "duplicate normalized selector",
+			references: func(root string) []ReferenceBinding {
+				return []ReferenceBinding{
+					{Selector: "lane.party", Path: filepath.Join(root, "party.json")},
+					{Selector: " lane . party ", Path: filepath.Join(root, "party-2.json")},
+				}
+			},
+			wantErr: "duplicated",
+		},
+		{
+			name: "empty path",
+			references: func(string) []ReferenceBinding {
+				return []ReferenceBinding{{Selector: "party", Path: "  "}}
+			},
+			wantErr: "path is required",
+		},
+		{
+			name: "relative path",
+			references: func(string) []ReferenceBinding {
+				return []ReferenceBinding{{Selector: "party", Path: "references/party.json"}}
+			},
+			wantErr: "path must be absolute",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			req := validRunRequest(t)
+			req.References = tt.references(t.TempDir())
+			started := false
+			runner := &SubprocessRunner{run: func(context.Context, sharedsubprocess.RunRequest) (sharedsubprocess.RunResult, error) {
+				started = true
+				return sharedsubprocess.RunResult{}, nil
+			}}
+
+			_, err := runner.Run(context.Background(), req)
+			if err == nil || !strings.Contains(err.Error(), tt.wantErr) {
+				t.Fatalf("Run() error = %v, want containing %q", err, tt.wantErr)
+			}
+			if started {
+				t.Fatal("subprocess started after request validation failure")
+			}
+		})
+	}
+}
+
+func TestSubprocessRunnerUsesMinimalEnvironmentAndSeparatesStreams(t *testing.T) {
 	req := validRunRequest(t)
 	writeValidBundleAndReceipt(t, req, false)
 	receiptFixture := req.ReceiptPath + ".fixture"
@@ -103,7 +205,7 @@ cat "$NOTARIUS_RECEIPT_FIXTURE"
 		t.Fatalf("Run() error = %v", err)
 	}
 	assertTextFile(t, filepath.Join(captureDir, "working-directory"), req.WorkingDirectory+"\n")
-	assertTextFile(t, filepath.Join(captureDir, "environment"), "inherited-value")
+	assertTextFile(t, filepath.Join(captureDir, "environment"), "")
 	assertTextFile(t, req.LogPath, "diagnostic stream\n")
 	receiptBytes, err := os.ReadFile(req.ReceiptPath)
 	if err != nil {
@@ -171,8 +273,10 @@ func TestLoadReceiptValidation(t *testing.T) {
 	valid := map[string]any{
 		"schema_version": ReceiptSchemaVersion, "run_id": "run-1", "pipeline_id": "pipeline-1",
 		"output_directory": filepath.Join(root, "outputs", "run-1"), "index_file": "index.json",
-		"normalized_output_count": 1, "rejected_output_count": 0, "warning_count": 0,
-		"validation_status": "approved", "future_field": true,
+		"normalized_output_count": 1, "rejected_output_count": 0,
+		"warning_group_count": 0, "warning_occurrence_count": 0,
+		"diagnostic_group_count": 0, "diagnostic_occurrence_count": 0,
+		"diagnostics_truncated": false, "validation_status": "approved", "future_field": true,
 	}
 	tests := []struct {
 		name      string
@@ -183,11 +287,12 @@ func TestLoadReceiptValidation(t *testing.T) {
 	}{
 		{name: "unknown fields tolerated", wantOK: true},
 		{name: "malformed", raw: []byte("{")},
-		{name: "unsupported version", mutate: func(v map[string]any) { v["schema_version"] = "notarius.run-result.v2" }},
+		{name: "unsupported version", mutate: func(v map[string]any) { v["schema_version"] = "notarius.run-result.v1" }},
 		{name: "missing field", mutate: func(v map[string]any) { delete(v, "run_id") }},
 		{name: "pipeline mismatch", mutate: func(v map[string]any) { v["pipeline_id"] = "other" }},
 		{name: "relative output", mutate: func(v map[string]any) { v["output_directory"] = "run-1" }},
-		{name: "negative count", mutate: func(v map[string]any) { v["warning_count"] = -1 }},
+		{name: "negative count", mutate: func(v map[string]any) { v["warning_group_count"] = -1 }},
+		{name: "invalid validation status", mutate: func(v map[string]any) { v["validation_status"] = "valid" }},
 		{
 			name: "nested index", mutate: func(v map[string]any) { v["index_file"] = "nested/index.json" },
 			wantError: `index_file "nested/index.json"`,
@@ -369,22 +474,26 @@ func TestLoadDiagnosticSummariesValidateBoundsAndTolerateUnknownFields(t *testin
 	root := t.TempDir()
 	rejectedPath := filepath.Join(root, "rejected.json")
 	warningsPath := filepath.Join(root, "warnings.json")
+	diagnosticsPath := filepath.Join(root, "diagnostics.json")
 	writeJSONFile(t, rejectedPath, map[string]any{"rejected": []any{map[string]any{
 		"stage": "validate", "lane_id": "spells", "reason_code": "invalid", "message": "do not retain this", "future": true,
 	}}, "future": true})
-	writeJSONFile(t, warningsPath, map[string]any{"warnings": []any{map[string]any{
-		"scope": "lane:spells", "reason_code": "bounded", "message": "do not retain this", "future": true,
-	}}, "future": true})
+	writeJSONFile(t, warningsPath, findingEnvelope(warningsSchemaVersion, []any{findingGroup("warning", "degradation", "bounded", "normalize", 2)}, 2, false, 0))
+	writeJSONFile(t, diagnosticsPath, findingEnvelope(diagnosticsSchemaVersion, []any{findingGroup("advisory", "data_quality", "low_confidence", "normalize", 3)}, 4, true, 1))
 	rejections, err := loadRejections(rejectedPath)
 	if err != nil || len(rejections) != 1 || rejections[0].ReasonCode != "invalid" {
 		t.Fatalf("loadRejections() = %#v, %v", rejections, err)
 	}
 	warnings, err := loadWarnings(warningsPath)
-	if err != nil || len(warnings) != 1 || warnings[0].Scope != "lane:spells" {
+	if err != nil || len(warnings) != 1 || warnings[0].Category != "degradation" || warnings[0].OccurrenceCount != 2 {
 		t.Fatalf("loadWarnings() = %#v, %v", warnings, err)
 	}
+	diagnostics, occurrences, truncated, err := loadDiagnostics(diagnosticsPath)
+	if err != nil || len(diagnostics) != 1 || occurrences != 4 || !truncated || diagnostics[0].Category != "data_quality" {
+		t.Fatalf("loadDiagnostics() = %#v, %d, %t, %v", diagnostics, occurrences, truncated, err)
+	}
 
-	for name, path := range map[string]string{"rejections": rejectedPath, "warnings": warningsPath} {
+	for name, path := range map[string]string{"rejections": rejectedPath, "warnings": warningsPath, "diagnostics": diagnosticsPath} {
 		t.Run("malformed "+name, func(t *testing.T) {
 			if err := os.WriteFile(path, []byte("{"), 0o644); err != nil {
 				t.Fatalf("WriteFile() error = %v", err)
@@ -392,8 +501,10 @@ func TestLoadDiagnosticSummariesValidateBoundsAndTolerateUnknownFields(t *testin
 			var err error
 			if name == "rejections" {
 				_, err = loadRejections(path)
-			} else {
+			} else if name == "warnings" {
 				_, err = loadWarnings(path)
+			} else {
+				_, _, _, err = loadDiagnostics(path)
 			}
 			if err == nil {
 				t.Fatal("summary decoder error = nil")
@@ -410,16 +521,23 @@ func TestLoadDiagnosticSummariesValidateBoundsAndTolerateUnknownFields(t *testin
 	if _, err := loadRejections(oversized); err == nil || !strings.Contains(err.Error(), "exceeds") {
 		t.Fatalf("loadRejections(oversized) error = %v", err)
 	}
+	if _, _, _, err := loadDiagnostics(oversized); err == nil || !strings.Contains(err.Error(), "exceeds") {
+		t.Fatalf("loadDiagnostics(oversized) error = %v", err)
+	}
 }
 
 func TestFakeRunnerCapturesRequestsAndHonorsContextAndError(t *testing.T) {
-	req := RunRequest{PipelineID: "pipeline"}
+	req := RunRequest{PipelineID: "pipeline", References: []ReferenceBinding{{Selector: "party", Path: "/references/party.json"}}}
 	want := RunResult{BundleRoot: "/bundle"}
 	fake := &FakeRunner{Result: want}
 	got, err := fake.Run(context.Background(), req)
 	if err != nil || !reflect.DeepEqual(got, want) || !reflect.DeepEqual(fake.Requests, []RunRequest{req}) {
 		t.Fatalf("Run() = %#v, %v; requests = %#v", got, err, fake.Requests)
 	}
+	req.References[0].Path = "/references/changed.json"
+	if fake.Requests[0].References[0].Path != "/references/party.json" {
+		t.Fatalf("fake retained aliased request references: %#v", fake.Requests[0].References)
+	}
 
 	wantErr := errors.New("configured failure")
 	fake.Err = wantErr
@@ -478,13 +596,12 @@ func writeValidBundleAndReceipt(t *testing.T, req RunRequest, includeUnknown boo
 		}
 	}
 	rejection := map[string]any{"stage": "validate", "lane_id": "spells", "reason_code": "invalid_spell", "message": strings.Repeat("external detail", 20)}
-	warning := map[string]any{"scope": "lane:npc-registry", "reason_code": "normalized_name", "message": strings.Repeat("external warning", 20)}
 	if includeUnknown {
 		rejection["future"] = true
-		warning["future"] = true
 	}
 	writeJSONFile(t, filepath.Join(bundle, "rejected.json"), map[string]any{"rejected": []any{rejection}, "future": true})
-	writeJSONFile(t, filepath.Join(bundle, "warnings.json"), map[string]any{"warnings": []any{warning}, "future": true})
+	writeJSONFile(t, filepath.Join(bundle, "warnings.json"), findingEnvelope(warningsSchemaVersion, []any{findingGroup("warning", "degradation", "normalized_name", "normalize", 2)}, 2, false, 0))
+	writeJSONFile(t, filepath.Join(bundle, "diagnostics.json"), findingEnvelope(diagnosticsSchemaVersion, []any{findingGroup("advisory", "data_quality", "low_confidence", "normalize", 3)}, 4, true, 1))
 	index := validIndexValue([]any{map[string]any{
 		"lane_id": "npc-registry", "file": "lanes/npc.json", "media_type": "application/json",
 		"module_key": "dnd/npc-registry", "schema_id": "notarius.dnd.npc_registry",
@@ -503,7 +620,13 @@ func writeValidBundleAndReceipt(t *testing.T, req RunRequest, includeUnknown boo
 	receipt := map[string]any{
 		"schema_version": ReceiptSchemaVersion, "run_id": "notarius-run-1", "pipeline_id": req.PipelineID,
 		"output_directory": bundle, "index_file": "index.json", "normalized_output_count": 1,
-		"rejected_output_count": 1, "warning_count": 1, "validation_status": "rejected",
+		"rejected_output_count": 1, "warning_group_count": 1, "warning_occurrence_count": 2,
+		"diagnostic_group_count": 1, "diagnostic_occurrence_count": 4,
+		"diagnostics_truncated": true, "validation_status": "rejected",
+		"validation_summaries": []any{map[string]any{
+			"stage": "normalize", "lane_id": "npc-registry", "status": "complete",
+			"producer_attempt_count": 1, "terminal_action": "accepted",
+		}},
 	}
 	if includeUnknown {
 		receipt["future"] = true
@@ -517,7 +640,7 @@ func createBundleSkeleton(t *testing.T) string {
 	if err := os.MkdirAll(filepath.Join(bundle, "lanes"), 0o755); err != nil {
 		t.Fatalf("MkdirAll(bundle) error = %v", err)
 	}
-	for _, name := range []string{"manifest.json", "rejected.json", "warnings.json", "lanes/npc.json", "chunk-map.json"} {
+	for _, name := range []string{"manifest.json", "rejected.json", "warnings.json", "diagnostics.json", "lanes/npc.json", "chunk-map.json"} {
 		if err := os.WriteFile(filepath.Join(bundle, filepath.FromSlash(name)), []byte("{}"), 0o644); err != nil {
 			t.Fatalf("WriteFile(%q) error = %v", name, err)
 		}
@@ -528,10 +651,31 @@ func createBundleSkeleton(t *testing.T) string {
 func validIndexValue(lanes []any) map[string]any {
 	return map[string]any{
 		"manifest_file": "manifest.json", "output_files": lanes,
-		"rejected_file": "rejected.json", "warnings_file": "warnings.json",
+		"rejected_file": "rejected.json", "warnings_file": "warnings.json", "diagnostics_file": "diagnostics.json",
 	}
 }
 
+func findingGroup(disposition, category, reasonCode, origin string, occurrences int) map[string]any {
+	return map[string]any{
+		"disposition": disposition, "category": category, "reason_code": reasonCode,
+		"origin": map[string]any{"stage": origin, "lane_id": "npc-registry"}, "occurrence_count": occurrences,
+		"samples":              []any{map[string]any{"scope": "lane:npc-registry", "message": "external detail"}},
+		"omitted_sample_count": occurrences - 1,
+	}
+}
+
+func findingEnvelope(schema string, groups []any, occurrences int, truncated bool, unrepresented int) map[string]any {
+	value := map[string]any{
+		"schema_version": schema, "group_count": len(groups), "occurrence_count": occurrences,
+		"groups": groups,
+	}
+	if schema == diagnosticsSchemaVersion {
+		value["truncated"] = truncated
+		value["unrepresented_occurrence_count"] = unrepresented
+	}
+	return value
+}
+
 func writeJSONFile(t *testing.T, path string, value any) {
 	t.Helper()
 	data, err := json.Marshal(value)

internal/adapters/scriptorium/fake.go

@@ -4,7 +4,7 @@ import (
 	"context"
 	"fmt"
 
-	"gitea.maximumdirect.net/eric/narratio/internal/adapters/subprocess"
+	"gitea.maximumdirect.net/eric/narratio/internal/fileops"
 )
 
 // NoopRunner is a deterministic no-op scriptorium adapter.
@@ -142,7 +142,7 @@ func (f *FakeRunner) RenderArtifact(ctx context.Context, req RenderArtifactReque
 
 func materializeRunPlaceholders(req RunArtifactRequest) error {
 	if req.OutputPath != "" {
-		if err := subprocess.WriteFileAtomic(req.OutputPath, []byte("scriptorium noop/fake run artifact\n"), 0o644); err != nil {
+		if err := fileops.WriteFileAtomic(req.OutputPath, []byte("scriptorium noop/fake run artifact\n"), fileops.WorkspaceFileMode); err != nil {
 			return fmt.Errorf("write run output %q: %w", req.OutputPath, err)
 		}
 	}
@@ -154,17 +154,17 @@ func materializeRunPlaceholders(req RunArtifactRequest) error {
 			"prompt_id":   req.PromptID,
 			"output_path": req.OutputPath,
 		}
-		if err := subprocess.WriteYAMLAtomic(req.GeneratedConfigPath, payload, 0o644); err != nil {
+		if err := writeGeneratedYAML(req.GeneratedConfigPath, payload); err != nil {
 			return fmt.Errorf("write generated config %q: %w", req.GeneratedConfigPath, err)
 		}
 	}
 	if req.StdoutLogPath != "" {
-		if err := subprocess.WriteFileAtomic(req.StdoutLogPath, []byte("scriptorium noop/fake run stdout placeholder\n"), 0o644); err != nil {
+		if err := fileops.WriteFileAtomic(req.StdoutLogPath, []byte("scriptorium noop/fake run stdout placeholder\n"), fileops.WorkspaceFileMode); err != nil {
 			return fmt.Errorf("write stdout log %q: %w", req.StdoutLogPath, err)
 		}
 	}
 	if req.StderrLogPath != "" {
-		if err := subprocess.WriteFileAtomic(req.StderrLogPath, []byte("scriptorium noop/fake run stderr placeholder\n"), 0o644); err != nil {
+		if err := fileops.WriteFileAtomic(req.StderrLogPath, []byte("scriptorium noop/fake run stderr placeholder\n"), fileops.WorkspaceFileMode); err != nil {
 			return fmt.Errorf("write stderr log %q: %w", req.StderrLogPath, err)
 		}
 	}
@@ -173,7 +173,7 @@ func materializeRunPlaceholders(req RunArtifactRequest) error {
 
 func materializeRenderPlaceholders(req RenderArtifactRequest) error {
 	if req.OutputPath != "" {
-		if err := subprocess.WriteFileAtomic(req.OutputPath, []byte("{\"schema\":\"scriptorium.render.v1\",\"placeholder\":true}\n"), 0o644); err != nil {
+		if err := fileops.WriteFileAtomic(req.OutputPath, []byte("{\"schema\":\"scriptorium.render.v1\",\"placeholder\":true}\n"), fileops.WorkspaceFileMode); err != nil {
 			return fmt.Errorf("write render output %q: %w", req.OutputPath, err)
 		}
 	}
@@ -185,17 +185,17 @@ func materializeRenderPlaceholders(req RenderArtifactRequest) error {
 			"prompt_id":   req.PromptID,
 			"output_path": req.OutputPath,
 		}
-		if err := subprocess.WriteYAMLAtomic(req.GeneratedConfigPath, payload, 0o644); err != nil {
+		if err := writeGeneratedYAML(req.GeneratedConfigPath, payload); err != nil {
 			return fmt.Errorf("write generated config %q: %w", req.GeneratedConfigPath, err)
 		}
 	}
 	if req.StdoutLogPath != "" {
-		if err := subprocess.WriteFileAtomic(req.StdoutLogPath, []byte("scriptorium noop/fake render stdout placeholder\n"), 0o644); err != nil {
+		if err := fileops.WriteFileAtomic(req.StdoutLogPath, []byte("scriptorium noop/fake render stdout placeholder\n"), fileops.WorkspaceFileMode); err != nil {
 			return fmt.Errorf("write stdout log %q: %w", req.StdoutLogPath, err)
 		}
 	}
 	if req.StderrLogPath != "" {
-		if err := subprocess.WriteFileAtomic(req.StderrLogPath, []byte("scriptorium noop/fake render stderr placeholder\n"), 0o644); err != nil {
+		if err := fileops.WriteFileAtomic(req.StderrLogPath, []byte("scriptorium noop/fake render stderr placeholder\n"), fileops.WorkspaceFileMode); err != nil {
 			return fmt.Errorf("write stderr log %q: %w", req.StderrLogPath, err)
 		}
 	}

internal/adapters/scriptorium/generated_config.go

@@ -0,0 +1,19 @@
+package scriptorium
+
+import (
+	"fmt"
+
+	"gitea.maximumdirect.net/eric/narratio/internal/fileops"
+	"gopkg.in/yaml.v3"
+)
+
+func writeGeneratedYAML(path string, payload any) error {
+	data, err := yaml.Marshal(payload)
+	if err != nil {
+		return fmt.Errorf("marshal generated YAML for %q: %w", path, err)
+	}
+	if err := fileops.WriteFileAtomic(path, data, fileops.WorkspaceFileMode); err != nil {
+		return fmt.Errorf("write generated YAML %q: %w", path, err)
+	}
+	return nil
+}

internal/adapters/scriptorium/subprocess.go

@@ -9,8 +9,12 @@ import (
 	"time"
 
 	"gitea.maximumdirect.net/eric/narratio/internal/adapters/subprocess"
+	"gitea.maximumdirect.net/eric/narratio/internal/fileops"
 )
 
+// MaxOutputFileBytes bounds one Scriptorium artifact result.
+const MaxOutputFileBytes int64 = 64 * 1024 * 1024
+
 // SubprocessRunner invokes Scriptorium through its public CLI.
 type SubprocessRunner struct{}
 
@@ -52,13 +56,17 @@ func (r *SubprocessRunner) RunArtifact(ctx context.Context, req RunArtifactReque
 		}
 	}
 
+	envOverrides, sensitiveNames := credentialEnvironment(req.APIKeyEnv)
 	runRes, runErr := subprocess.Run(ctx, subprocess.RunRequest{
-		Executable:    req.Binary,
-		Args:          args,
-		WorkingDir:    req.WorkingDir,
-		Timeout:       req.Timeout,
-		StdoutLogPath: req.StdoutLogPath,
-		StderrLogPath: req.StderrLogPath,
+		Executable:        req.Binary,
+		Args:              args,
+		WorkingDir:        req.WorkingDir,
+		Timeout:           req.Timeout,
+		EnvOverrides:      envOverrides,
+		SensitiveEnvNames: sensitiveNames,
+		DiagnosticOwner:   "scriptorium",
+		StdoutLogPath:     req.StdoutLogPath,
+		StderrLogPath:     req.StderrLogPath,
 	})
 
 	result := ArtifactResult{
@@ -134,13 +142,17 @@ func (r *SubprocessRunner) RenderArtifact(ctx context.Context, req RenderArtifac
 		}
 	}
 
+	envOverrides, sensitiveNames := credentialEnvironment(req.APIKeyEnv)
 	runRes, runErr := subprocess.Run(ctx, subprocess.RunRequest{
-		Executable:    req.Binary,
-		Args:          args,
-		WorkingDir:    req.WorkingDir,
-		Timeout:       req.Timeout,
-		StdoutLogPath: req.StdoutLogPath,
-		StderrLogPath: req.StderrLogPath,
+		Executable:        req.Binary,
+		Args:              args,
+		WorkingDir:        req.WorkingDir,
+		Timeout:           req.Timeout,
+		EnvOverrides:      envOverrides,
+		SensitiveEnvNames: sensitiveNames,
+		DiagnosticOwner:   "scriptorium",
+		StdoutLogPath:     req.StdoutLogPath,
+		StderrLogPath:     req.StderrLogPath,
 	})
 
 	result := ArtifactResult{
@@ -223,6 +235,15 @@ func validateCommonRunRequest(
 	return true, nil
 }
 
+func credentialEnvironment(apiKeyEnv string) (map[string]string, []string) {
+	name := strings.TrimSpace(apiKeyEnv)
+	if name == "" {
+		return nil, nil
+	}
+	value, _ := os.LookupEnv(name)
+	return map[string]string{name: value}, []string{name}
+}
+
 func buildRunArgs(req RunArtifactRequest) []string {
 	args := []string{"run", "--prompt", strings.TrimSpace(req.PromptID)}
 	if cfgPath := strings.TrimSpace(req.ConfigPath); cfgPath != "" {
@@ -321,18 +342,15 @@ func writeInvocationConfig(path string, payload invocationPayload) error {
 		"render_format":        payload.RenderFormat,
 		"render_prompt_logged": payload.RenderPromptStore,
 	}
-	return subprocess.WriteYAMLAtomic(path, data, 0o644)
+	return writeGeneratedYAML(path, data)
 }
 
 func validateNonEmptyOutput(path string) error {
-	info, err := os.Stat(path)
+	data, err := fileops.ReadFileBounded(path, MaxOutputFileBytes)
 	if err != nil {
-		return fmt.Errorf("stat file: %w", err)
+		return fmt.Errorf("scriptorium artifact output exceeds or cannot be read within %d-byte limit: %w", MaxOutputFileBytes, err)
 	}
-	if info.IsDir() {
-		return fmt.Errorf("path is a directory")
-	}
-	if info.Size() <= 0 {
+	if len(data) == 0 {
 		return fmt.Errorf("file is empty")
 	}
 	return nil

internal/adapters/seriatim/fake.go

@@ -4,7 +4,7 @@ import (
 	"context"
 	"fmt"
 
-	"gitea.maximumdirect.net/eric/narratio/internal/adapters/subprocess"
+	"gitea.maximumdirect.net/eric/narratio/internal/fileops"
 )
 
 // NoopRunner is a deterministic no-op seriatim adapter.
@@ -260,7 +260,7 @@ func (f *FakeRunner) Render(ctx context.Context, req RenderRequest) (RenderResul
 
 func materializePlaceholders(req MergeRequest) error {
 	if req.OutputMergedTranscriptPath != "" {
-		if err := subprocess.WriteFileAtomic(req.OutputMergedTranscriptPath, []byte(`{"schema":"seriatim.intermediate.v1","segments":[]}`), 0o644); err != nil {
+		if err := fileops.WriteFileAtomic(req.OutputMergedTranscriptPath, []byte(`{"schema":"seriatim.intermediate.v1","segments":[]}`), fileops.WorkspaceFileMode); err != nil {
 			return fmt.Errorf("write merged transcript %q: %w", req.OutputMergedTranscriptPath, err)
 		}
 	}
@@ -271,22 +271,22 @@ func materializePlaceholders(req MergeRequest) error {
 			"input_transcript_paths": req.InputTranscriptPaths,
 			"output_path":            req.OutputMergedTranscriptPath,
 		}
-		if err := subprocess.WriteYAMLAtomic(req.GeneratedConfigPath, payload, 0o644); err != nil {
+		if err := writeGeneratedYAML(req.GeneratedConfigPath, payload); err != nil {
 			return fmt.Errorf("write generated config %q: %w", req.GeneratedConfigPath, err)
 		}
 	}
 	if req.StdoutLogPath != "" {
-		if err := subprocess.WriteFileAtomic(req.StdoutLogPath, []byte("seriatim noop/fake stdout placeholder\n"), 0o644); err != nil {
+		if err := fileops.WriteFileAtomic(req.StdoutLogPath, []byte("seriatim noop/fake stdout placeholder\n"), fileops.WorkspaceFileMode); err != nil {
 			return fmt.Errorf("write stdout log %q: %w", req.StdoutLogPath, err)
 		}
 	}
 	if req.StderrLogPath != "" {
-		if err := subprocess.WriteFileAtomic(req.StderrLogPath, []byte("seriatim noop/fake stderr placeholder\n"), 0o644); err != nil {
+		if err := fileops.WriteFileAtomic(req.StderrLogPath, []byte("seriatim noop/fake stderr placeholder\n"), fileops.WorkspaceFileMode); err != nil {
 			return fmt.Errorf("write stderr log %q: %w", req.StderrLogPath, err)
 		}
 	}
 	if req.ReportPath != "" {
-		if err := subprocess.WriteFileAtomic(req.ReportPath, []byte(`{"schema":"seriatim.report.v1","placeholder":true}`), 0o644); err != nil {
+		if err := fileops.WriteFileAtomic(req.ReportPath, []byte(`{"schema":"seriatim.report.v1","placeholder":true}`), fileops.WorkspaceFileMode); err != nil {
 			return fmt.Errorf("write report %q: %w", req.ReportPath, err)
 		}
 	}
@@ -295,7 +295,7 @@ func materializePlaceholders(req MergeRequest) error {
 
 func materializeTrimPlaceholders(req TrimRequest) error {
 	if req.OutputTrimmedPath != "" {
-		if err := subprocess.WriteFileAtomic(req.OutputTrimmedPath, []byte(`{"schema":"seriatim.intermediate.v1","segments":[]}`), 0o644); err != nil {
+		if err := fileops.WriteFileAtomic(req.OutputTrimmedPath, []byte(`{"schema":"seriatim.intermediate.v1","segments":[]}`), fileops.WorkspaceFileMode); err != nil {
 			return fmt.Errorf("write trimmed transcript %q: %w", req.OutputTrimmedPath, err)
 		}
 	}
@@ -308,17 +308,17 @@ func materializeTrimPlaceholders(req TrimRequest) error {
 			"output_path":   req.OutputTrimmedPath,
 			"keep_selector": req.KeepSelector,
 		}
-		if err := subprocess.WriteYAMLAtomic(req.GeneratedConfigPath, payload, 0o644); err != nil {
+		if err := writeGeneratedYAML(req.GeneratedConfigPath, payload); err != nil {
 			return fmt.Errorf("write generated config %q: %w", req.GeneratedConfigPath, err)
 		}
 	}
 	if req.StdoutLogPath != "" {
-		if err := subprocess.WriteFileAtomic(req.StdoutLogPath, []byte("seriatim noop/fake trim stdout placeholder\n"), 0o644); err != nil {
+		if err := fileops.WriteFileAtomic(req.StdoutLogPath, []byte("seriatim noop/fake trim stdout placeholder\n"), fileops.WorkspaceFileMode); err != nil {
 			return fmt.Errorf("write stdout log %q: %w", req.StdoutLogPath, err)
 		}
 	}
 	if req.StderrLogPath != "" {
-		if err := subprocess.WriteFileAtomic(req.StderrLogPath, []byte("seriatim noop/fake trim stderr placeholder\n"), 0o644); err != nil {
+		if err := fileops.WriteFileAtomic(req.StderrLogPath, []byte("seriatim noop/fake trim stderr placeholder\n"), fileops.WorkspaceFileMode); err != nil {
 			return fmt.Errorf("write stderr log %q: %w", req.StderrLogPath, err)
 		}
 	}
@@ -327,7 +327,7 @@ func materializeTrimPlaceholders(req TrimRequest) error {
 
 func materializeNormalizePlaceholders(req NormalizeRequest) error {
 	if req.OutputNormalizedPath != "" {
-		if err := subprocess.WriteFileAtomic(req.OutputNormalizedPath, []byte(`{"schema":"seriatim.intermediate.v1","segments":[]}`), 0o644); err != nil {
+		if err := fileops.WriteFileAtomic(req.OutputNormalizedPath, []byte(`{"schema":"seriatim.intermediate.v1","segments":[]}`), fileops.WorkspaceFileMode); err != nil {
 			return fmt.Errorf("write normalized transcript %q: %w", req.OutputNormalizedPath, err)
 		}
 	}
@@ -343,22 +343,22 @@ func materializeNormalizePlaceholders(req NormalizeRequest) error {
 		if req.ReportPath != "" {
 			payload["report_path"] = req.ReportPath
 		}
-		if err := subprocess.WriteYAMLAtomic(req.GeneratedConfigPath, payload, 0o644); err != nil {
+		if err := writeGeneratedYAML(req.GeneratedConfigPath, payload); err != nil {
 			return fmt.Errorf("write generated config %q: %w", req.GeneratedConfigPath, err)
 		}
 	}
 	if req.StdoutLogPath != "" {
-		if err := subprocess.WriteFileAtomic(req.StdoutLogPath, []byte("seriatim noop/fake normalize stdout placeholder\n"), 0o644); err != nil {
+		if err := fileops.WriteFileAtomic(req.StdoutLogPath, []byte("seriatim noop/fake normalize stdout placeholder\n"), fileops.WorkspaceFileMode); err != nil {
 			return fmt.Errorf("write stdout log %q: %w", req.StdoutLogPath, err)
 		}
 	}
 	if req.StderrLogPath != "" {
-		if err := subprocess.WriteFileAtomic(req.StderrLogPath, []byte("seriatim noop/fake normalize stderr placeholder\n"), 0o644); err != nil {
+		if err := fileops.WriteFileAtomic(req.StderrLogPath, []byte("seriatim noop/fake normalize stderr placeholder\n"), fileops.WorkspaceFileMode); err != nil {
 			return fmt.Errorf("write stderr log %q: %w", req.StderrLogPath, err)
 		}
 	}
 	if req.ReportPath != "" {
-		if err := subprocess.WriteFileAtomic(req.ReportPath, []byte(`{"schema":"seriatim.report.v1","placeholder":true}`), 0o644); err != nil {
+		if err := fileops.WriteFileAtomic(req.ReportPath, []byte(`{"schema":"seriatim.report.v1","placeholder":true}`), fileops.WorkspaceFileMode); err != nil {
 			return fmt.Errorf("write report %q: %w", req.ReportPath, err)
 		}
 	}
@@ -367,7 +367,7 @@ func materializeNormalizePlaceholders(req NormalizeRequest) error {
 
 func materializeRenderPlaceholders(req RenderRequest) error {
 	if req.OutputRenderedPath != "" {
-		if err := subprocess.WriteFileAtomic(req.OutputRenderedPath, []byte("# Transcript\n\nRendered markdown placeholder.\n"), 0o644); err != nil {
+		if err := fileops.WriteFileAtomic(req.OutputRenderedPath, []byte("# Transcript\n\nRendered markdown placeholder.\n"), fileops.WorkspaceFileMode); err != nil {
 			return fmt.Errorf("write rendered transcript %q: %w", req.OutputRenderedPath, err)
 		}
 	}
@@ -384,17 +384,17 @@ func materializeRenderPlaceholders(req RenderRequest) error {
 			"include_segment_ids": req.IncludeSegmentIDs,
 			"include_metadata":    req.IncludeMetadata,
 		}
-		if err := subprocess.WriteYAMLAtomic(req.GeneratedConfigPath, payload, 0o644); err != nil {
+		if err := writeGeneratedYAML(req.GeneratedConfigPath, payload); err != nil {
 			return fmt.Errorf("write generated config %q: %w", req.GeneratedConfigPath, err)
 		}
 	}
 	if req.StdoutLogPath != "" {
-		if err := subprocess.WriteFileAtomic(req.StdoutLogPath, []byte("seriatim noop/fake render stdout placeholder\n"), 0o644); err != nil {
+		if err := fileops.WriteFileAtomic(req.StdoutLogPath, []byte("seriatim noop/fake render stdout placeholder\n"), fileops.WorkspaceFileMode); err != nil {
 			return fmt.Errorf("write stdout log %q: %w", req.StdoutLogPath, err)
 		}
 	}
 	if req.StderrLogPath != "" {
-		if err := subprocess.WriteFileAtomic(req.StderrLogPath, []byte("seriatim noop/fake render stderr placeholder\n"), 0o644); err != nil {
+		if err := fileops.WriteFileAtomic(req.StderrLogPath, []byte("seriatim noop/fake render stderr placeholder\n"), fileops.WorkspaceFileMode); err != nil {
 			return fmt.Errorf("write stderr log %q: %w", req.StderrLogPath, err)
 		}
 	}

internal/adapters/seriatim/generated_config.go

@@ -0,0 +1,19 @@
+package seriatim
+
+import (
+	"fmt"
+
+	"gitea.maximumdirect.net/eric/narratio/internal/fileops"
+	"gopkg.in/yaml.v3"
+)
+
+func writeGeneratedYAML(path string, payload any) error {
+	data, err := yaml.Marshal(payload)
+	if err != nil {
+		return fmt.Errorf("marshal generated YAML for %q: %w", path, err)
+	}
+	if err := fileops.WriteFileAtomic(path, data, fileops.WorkspaceFileMode); err != nil {
+		return fmt.Errorf("write generated YAML %q: %w", path, err)
+	}
+	return nil
+}

internal/adapters/seriatim/subprocess.go

@@ -4,15 +4,18 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"os"
 	"strconv"
 	"strings"
 	"time"
 	"unicode/utf8"
 
 	"gitea.maximumdirect.net/eric/narratio/internal/adapters/subprocess"
+	"gitea.maximumdirect.net/eric/narratio/internal/fileops"
 )
 
+// MaxOutputFileBytes bounds each Seriatim JSON or rendered-text result.
+const MaxOutputFileBytes int64 = 64 * 1024 * 1024
+
 // EnvConfig defines optional Seriatim environment tuning values.
 type EnvConfig struct {
 	OverlapWordRunGap           *float64
@@ -129,12 +132,13 @@ func (r *SubprocessRunner) Run(ctx context.Context, req MergeRequest) (MergeResu
 	}
 
 	runRes, err := subprocess.Run(ctx, subprocess.RunRequest{
-		Executable:    r.binary,
-		Args:          args,
-		Timeout:       r.timeout,
-		EnvOverrides:  env,
-		StdoutLogPath: req.StdoutLogPath,
-		StderrLogPath: req.StderrLogPath,
+		Executable:      r.binary,
+		Args:            args,
+		Timeout:         r.timeout,
+		EnvOverrides:    env,
+		DiagnosticOwner: "seriatim",
+		StdoutLogPath:   req.StdoutLogPath,
+		StderrLogPath:   req.StderrLogPath,
 	})
 	if err != nil {
 		return MergeResult{
@@ -232,11 +236,12 @@ func (r *SubprocessRunner) Trim(ctx context.Context, req TrimRequest) (TrimResul
 	}
 
 	runRes, err := subprocess.Run(ctx, subprocess.RunRequest{
-		Executable:    binary,
-		Args:          args,
-		Timeout:       timeout,
-		StdoutLogPath: req.StdoutLogPath,
-		StderrLogPath: req.StderrLogPath,
+		Executable:      binary,
+		Args:            args,
+		Timeout:         timeout,
+		DiagnosticOwner: "seriatim",
+		StdoutLogPath:   req.StdoutLogPath,
+		StderrLogPath:   req.StderrLogPath,
 	})
 	if err != nil {
 		return TrimResult{
@@ -320,11 +325,12 @@ func (r *SubprocessRunner) Normalize(ctx context.Context, req NormalizeRequest)
 	}
 
 	runRes, err := subprocess.Run(ctx, subprocess.RunRequest{
-		Executable:    binary,
-		Args:          args,
-		Timeout:       timeout,
-		StdoutLogPath: req.StdoutLogPath,
-		StderrLogPath: req.StderrLogPath,
+		Executable:      binary,
+		Args:            args,
+		Timeout:         timeout,
+		DiagnosticOwner: "seriatim",
+		StdoutLogPath:   req.StdoutLogPath,
+		StderrLogPath:   req.StderrLogPath,
 	})
 	if err != nil {
 		return NormalizeResult{
@@ -425,11 +431,12 @@ func (r *SubprocessRunner) Render(ctx context.Context, req RenderRequest) (Rende
 	}
 
 	runRes, err := subprocess.Run(ctx, subprocess.RunRequest{
-		Executable:    binary,
-		Args:          args,
-		Timeout:       timeout,
-		StdoutLogPath: req.StdoutLogPath,
-		StderrLogPath: req.StderrLogPath,
+		Executable:      binary,
+		Args:            args,
+		Timeout:         timeout,
+		DiagnosticOwner: "seriatim",
+		StdoutLogPath:   req.StdoutLogPath,
+		StderrLogPath:   req.StderrLogPath,
 	})
 	if err != nil {
 		return RenderResult{
@@ -546,7 +553,7 @@ func (r *SubprocessRunner) writeMergeInvocationConfig(req MergeRequest, args []s
 		payload["coalesce_gap"] = *r.coalesceGap
 	}
 
-	return subprocess.WriteYAMLAtomic(req.GeneratedConfigPath, payload, 0o644)
+	return writeGeneratedYAML(req.GeneratedConfigPath, payload)
 }
 
 func buildTrimArgs(req TrimRequest) []string {
@@ -598,7 +605,7 @@ func writeTrimInvocationConfig(req TrimRequest, args []string, binary string, ti
 		"output_path":   req.OutputTrimmedPath,
 		"keep_selector": req.KeepSelector,
 	}
-	return subprocess.WriteYAMLAtomic(req.GeneratedConfigPath, payload, 0o644)
+	return writeGeneratedYAML(req.GeneratedConfigPath, payload)
 }
 
 func writeNormalizeInvocationConfig(req NormalizeRequest, args []string, binary string, timeout time.Duration, outputSchema string) error {
@@ -613,7 +620,7 @@ func writeNormalizeInvocationConfig(req NormalizeRequest, args []string, binary
 		"output_schema": outputSchema,
 		"report_path":   req.ReportPath,
 	}
-	return subprocess.WriteYAMLAtomic(req.GeneratedConfigPath, payload, 0o644)
+	return writeGeneratedYAML(req.GeneratedConfigPath, payload)
 }
 
 func writeRenderInvocationConfig(req RenderRequest, args []string, binary string, timeout time.Duration, format string) error {
@@ -631,13 +638,13 @@ func writeRenderInvocationConfig(req RenderRequest, args []string, binary string
 		"include_segment_ids": req.IncludeSegmentIDs,
 		"include_metadata":    req.IncludeMetadata,
 	}
-	return subprocess.WriteYAMLAtomic(req.GeneratedConfigPath, payload, 0o644)
+	return writeGeneratedYAML(req.GeneratedConfigPath, payload)
 }
 
 func validateJSONFile(path string) error {
-	data, err := os.ReadFile(path)
+	data, err := readSeriatimResult(path, "JSON output")
 	if err != nil {
-		return fmt.Errorf("read file: %w", err)
+		return err
 	}
 	var v any
 	if err := json.Unmarshal(data, &v); err != nil {
@@ -647,9 +654,9 @@ func validateJSONFile(path string) error {
 }
 
 func validateJSONFileWithSegments(path string) error {
-	data, err := os.ReadFile(path)
+	data, err := readSeriatimResult(path, "transcript JSON output")
 	if err != nil {
-		return fmt.Errorf("read file: %w", err)
+		return err
 	}
 
 	var payload map[string]any
@@ -668,9 +675,9 @@ func validateJSONFileWithSegments(path string) error {
 }
 
 func validateNonEmptyTextFile(path string) error {
-	data, err := os.ReadFile(path)
+	data, err := readSeriatimResult(path, "rendered text output")
 	if err != nil {
-		return fmt.Errorf("read file: %w", err)
+		return err
 	}
 	if len(data) == 0 {
 		return fmt.Errorf("file is empty")
@@ -683,3 +690,11 @@ func validateNonEmptyTextFile(path string) error {
 	}
 	return nil
 }
+
+func readSeriatimResult(path, category string) ([]byte, error) {
+	data, err := fileops.ReadFileBounded(path, MaxOutputFileBytes)
+	if err != nil {
+		return nil, fmt.Errorf("seriatim %s exceeds or cannot be read within %d-byte limit: %w", category, MaxOutputFileBytes, err)
+	}
+	return data, nil
+}

internal/adapters/storage/bounded_read.go

@@ -0,0 +1,90 @@
+package storage
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"math"
+	"strings"
+)
+
+// ReadLimitError reports that a remote object exceeded its caller-owned read
+// limit. The limit is enforced against both available object metadata and the
+// bytes returned by the opened object body.
+type ReadLimitError struct {
+	Key      string
+	Limit    int64
+	Observed int64
+}
+
+func (e *ReadLimitError) Error() string {
+	return fmt.Sprintf("object %q exceeds %d-byte read limit (observed at least %d bytes)", e.Key, e.Limit, e.Observed)
+}
+
+// ReadObjectBounded opens one object version and retains at most maxBytes of
+// its content. Object metadata may reject an oversized body early, but a
+// limit-plus-one read always enforces the boundary when transfer begins.
+func ReadObjectBounded(ctx context.Context, store ObjectStore, key string, maxBytes int64) (info ObjectInfo, data []byte, err error) {
+	key = strings.TrimSpace(key)
+	if store == nil {
+		return ObjectInfo{}, nil, fmt.Errorf("read bounded object: store is required")
+	}
+	if key == "" {
+		return ObjectInfo{}, nil, fmt.Errorf("read bounded object: key is required")
+	}
+	if maxBytes <= 0 || maxBytes == math.MaxInt64 {
+		return ObjectInfo{}, nil, fmt.Errorf("read bounded object %q: limit must be between 1 and %d bytes", key, int64(math.MaxInt64-1))
+	}
+	if err := ctx.Err(); err != nil {
+		return ObjectInfo{}, nil, err
+	}
+
+	info, body, err := store.Read(ctx, key)
+	if err != nil {
+		return ObjectInfo{}, nil, err
+	}
+	if body == nil {
+		return ObjectInfo{}, nil, fmt.Errorf("read bounded object %q: store returned no body", key)
+	}
+	defer func() {
+		if closeErr := body.Close(); closeErr != nil {
+			data = nil
+			err = errors.Join(err, fmt.Errorf("close object %q: %w", key, closeErr))
+		}
+	}()
+
+	if info.Size > maxBytes {
+		return info, nil, &ReadLimitError{Key: key, Limit: maxBytes, Observed: info.Size}
+	}
+
+	data, err = io.ReadAll(io.LimitReader(contextReader{ctx: ctx, reader: body}, maxBytes+1))
+	if err != nil {
+		return info, nil, err
+	}
+	if err := ctx.Err(); err != nil {
+		return info, nil, err
+	}
+	if int64(len(data)) > maxBytes {
+		return info, nil, &ReadLimitError{Key: key, Limit: maxBytes, Observed: int64(len(data))}
+	}
+	return info, data, nil
+}
+
+type contextReader struct {
+	ctx    context.Context
+	reader io.Reader
+}
+
+func (r contextReader) Read(p []byte) (int, error) {
+	if err := r.ctx.Err(); err != nil {
+		return 0, err
+	}
+	n, err := r.reader.Read(p)
+	if err == nil {
+		if contextErr := r.ctx.Err(); contextErr != nil {
+			return n, contextErr
+		}
+	}
+	return n, err
+}

internal/adapters/storage/bounded_read_test.go

@@ -0,0 +1,135 @@
+package storage
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"io"
+	"testing"
+)
+
+func TestReadObjectBoundedAcceptsExactLimitWithAbsentSizeMetadata(t *testing.T) {
+	body := &trackingReadCloser{reader: bytes.NewReader([]byte("12345678")), chunkSize: 2}
+	store := &boundedReadStore{read: func(context.Context, string) (ObjectInfo, io.ReadCloser, error) {
+		return ObjectInfo{Key: "control.json", ETag: "generation"}, body, nil
+	}}
+
+	info, data, err := ReadObjectBounded(context.Background(), store, "control.json", 8)
+	if err != nil {
+		t.Fatalf("ReadObjectBounded() error = %v", err)
+	}
+	if string(data) != "12345678" || info.ETag != "generation" {
+		t.Fatalf("ReadObjectBounded() = (%#v, %q), want opened object metadata and bytes", info, data)
+	}
+	if !body.closed {
+		t.Fatal("object body was not closed")
+	}
+}
+
+func TestReadObjectBoundedRejectsLimitPlusOneDespiteMissingOrInaccurateMetadata(t *testing.T) {
+	tests := []struct {
+		name         string
+		metadataSize int64
+	}{
+		{name: "missing", metadataSize: 0},
+		{name: "inaccurate", metadataSize: 2},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			body := &trackingReadCloser{reader: bytes.NewReader([]byte("123456789")), chunkSize: 1}
+			store := &boundedReadStore{read: func(context.Context, string) (ObjectInfo, io.ReadCloser, error) {
+				return ObjectInfo{Key: "control.json", Size: test.metadataSize}, body, nil
+			}}
+
+			_, data, err := ReadObjectBounded(context.Background(), store, "control.json", 8)
+			var limitErr *ReadLimitError
+			if !errors.As(err, &limitErr) {
+				t.Fatalf("ReadObjectBounded() error = %v, want ReadLimitError", err)
+			}
+			if data != nil || body.bytesRead != 9 || !body.closed {
+				t.Fatalf("data=%q bytes read=%d closed=%t, want nil, 9, true", data, body.bytesRead, body.closed)
+			}
+		})
+	}
+}
+
+func TestReadObjectBoundedRejectsOversizedMetadataBeforeTransfer(t *testing.T) {
+	body := &trackingReadCloser{reader: bytes.NewReader([]byte("small"))}
+	store := &boundedReadStore{read: func(context.Context, string) (ObjectInfo, io.ReadCloser, error) {
+		return ObjectInfo{Key: "control.json", Size: 9}, body, nil
+	}}
+
+	_, _, err := ReadObjectBounded(context.Background(), store, "control.json", 8)
+	var limitErr *ReadLimitError
+	if !errors.As(err, &limitErr) {
+		t.Fatalf("ReadObjectBounded() error = %v, want ReadLimitError", err)
+	}
+	if body.bytesRead != 0 || !body.closed {
+		t.Fatalf("bytes read=%d closed=%t, want zero-byte transfer and closed body", body.bytesRead, body.closed)
+	}
+}
+
+func TestReadObjectBoundedPropagatesCancellationAndClosesBody(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	body := &trackingReadCloser{reader: bytes.NewReader([]byte("12345678")), chunkSize: 1, afterRead: cancel}
+	store := &boundedReadStore{read: func(context.Context, string) (ObjectInfo, io.ReadCloser, error) {
+		return ObjectInfo{Key: "control.json"}, body, nil
+	}}
+
+	_, data, err := ReadObjectBounded(ctx, store, "control.json", 8)
+	if !errors.Is(err, context.Canceled) {
+		t.Fatalf("ReadObjectBounded() error = %v, want context cancellation", err)
+	}
+	if data != nil || body.bytesRead != 1 || !body.closed {
+		t.Fatalf("data=%q bytes read=%d closed=%t, want nil, 1, true", data, body.bytesRead, body.closed)
+	}
+}
+
+func TestReadObjectBoundedReturnsCloseFailure(t *testing.T) {
+	closeErr := errors.New("close failed")
+	body := &trackingReadCloser{reader: bytes.NewReader([]byte("ok")), closeErr: closeErr}
+	store := &boundedReadStore{read: func(context.Context, string) (ObjectInfo, io.ReadCloser, error) {
+		return ObjectInfo{Key: "control.json", Size: 2}, body, nil
+	}}
+
+	_, data, err := ReadObjectBounded(context.Background(), store, "control.json", 8)
+	if !errors.Is(err, closeErr) || data != nil || !body.closed {
+		t.Fatalf("data=%q error=%v closed=%t, want close failure and no retained data", data, err, body.closed)
+	}
+}
+
+type boundedReadStore struct {
+	ObjectStore
+	read func(context.Context, string) (ObjectInfo, io.ReadCloser, error)
+}
+
+func (s *boundedReadStore) Read(ctx context.Context, key string) (ObjectInfo, io.ReadCloser, error) {
+	return s.read(ctx, key)
+}
+
+type trackingReadCloser struct {
+	reader    io.Reader
+	chunkSize int
+	afterRead func()
+	closeErr  error
+	bytesRead int
+	closed    bool
+}
+
+func (r *trackingReadCloser) Read(p []byte) (int, error) {
+	if r.chunkSize > 0 && len(p) > r.chunkSize {
+		p = p[:r.chunkSize]
+	}
+	n, err := r.reader.Read(p)
+	r.bytesRead += n
+	if n > 0 && r.afterRead != nil {
+		r.afterRead()
+		r.afterRead = nil
+	}
+	return n, err
+}
+
+func (r *trackingReadCloser) Close() error {
+	r.closed = true
+	return r.closeErr
+}

internal/adapters/storage/download_writer.go

@@ -0,0 +1,23 @@
+package storage
+
+import (
+	"context"
+	"fmt"
+	"io"
+)
+
+// WriterDownloader is implemented by storage backends that stream an object
+// into a caller-owned file handle.
+type WriterDownloader interface {
+	DownloadTo(ctx context.Context, key string, destination io.Writer) error
+}
+
+// DownloadTo streams one object into destination. Destination-confined callers
+// require this capability rather than granting a backend a mutable pathname.
+func DownloadTo(ctx context.Context, store ObjectStore, key string, destination io.Writer) error {
+	writer, ok := store.(WriterDownloader)
+	if !ok {
+		return fmt.Errorf("object store does not support handle-confined downloads")
+	}
+	return writer.DownloadTo(ctx, key, destination)
+}

internal/adapters/storage/factory.go

@@ -14,16 +14,15 @@ func NewObjectStoreFromConfig(ctx context.Context, cfg *config.Config) (ObjectSt
 		return nil, fmt.Errorf("pipeline config is required")
 	}
 
-	if strings.EqualFold(strings.TrimSpace(cfg.Pipeline.Storage.Backend), "s3") {
+	switch strings.ToLower(strings.TrimSpace(cfg.Pipeline.Storage.Backend)) {
+	case config.StorageBackendS3:
 		if cfg.Pipeline.Storage.S3 == nil {
 			return nil, fmt.Errorf("pipeline.storage.s3 is required when pipeline.storage.backend is s3")
 		}
 		return NewS3BackendFromConfig(ctx, *cfg.Pipeline.Storage.S3)
+	case "", config.StorageBackendLocal:
+		return nil, fmt.Errorf("no remote object store backend is configured")
+	default:
+		return nil, fmt.Errorf("unsupported pipeline.storage.backend %q", cfg.Pipeline.Storage.Backend)
 	}
-
-	if cfg.Pipeline.Storage.S3 != nil && strings.TrimSpace(cfg.Pipeline.Storage.S3.Bucket) != "" {
-		return NewS3BackendFromConfig(ctx, *cfg.Pipeline.Storage.S3)
-	}
-
-	return nil, fmt.Errorf("no remote object store backend is configured")
 }

internal/adapters/storage/factory_test.go

@@ -54,3 +54,35 @@ func TestNewObjectStoreFromConfigNoRemoteBackendConfigured(t *testing.T) {
 		t.Fatalf("NewObjectStoreFromConfig() error = %v, want no-backend error", err)
 	}
 }
+
+func TestNewObjectStoreFromConfigDoesNotInferS3FromProviderFields(t *testing.T) {
+	called := false
+	original := newS3Client
+	t.Cleanup(func() { newS3Client = original })
+	newS3Client = func(_ context.Context, _ s3ClientOptions) (s3API, error) {
+		called = true
+		return &fakeS3API{}, nil
+	}
+
+	_, err := NewObjectStoreFromConfig(context.Background(), &config.Config{
+		Pipeline: &config.PipelineConfig{Storage: config.StorageConfig{
+			Backend: config.StorageBackendLocal,
+			S3:      &config.StorageS3Config{Bucket: "my-archive"},
+		}},
+	})
+	if err == nil || !strings.Contains(err.Error(), "no remote object store backend is configured") {
+		t.Fatalf("NewObjectStoreFromConfig() error = %v, want no-backend error", err)
+	}
+	if called {
+		t.Fatal("NewObjectStoreFromConfig() constructed S3 from incidental provider fields")
+	}
+}
+
+func TestNewObjectStoreFromConfigRejectsUnknownBackend(t *testing.T) {
+	_, err := NewObjectStoreFromConfig(context.Background(), &config.Config{
+		Pipeline: &config.PipelineConfig{Storage: config.StorageConfig{Backend: "s33"}},
+	})
+	if err == nil || !strings.Contains(err.Error(), "unsupported pipeline.storage.backend") {
+		t.Fatalf("NewObjectStoreFromConfig() error = %v, want unsupported-backend error", err)
+	}
+}

internal/adapters/storage/fake.go

@@ -1,25 +1,38 @@
 package storage
 
 import (
+	"bytes"
 	"context"
+	"crypto/sha256"
+	"encoding/hex"
 	"fmt"
+	"io"
 	"os"
 	"path/filepath"
 	"sort"
 	"strings"
+	"sync"
 	"time"
 )
 
 // FakeBackend provides a deterministic in-memory object store for tests.
 type FakeBackend struct {
-	Objects   map[string]FakeObject
-	Uploads   []FakeUploadCall
-	Downloads []FakeDownloadCall
+	mu sync.RWMutex
 
-	ListErr     error
-	DownloadErr error
-	UploadErr   error
-	ExistsErr   error
+	Objects    map[string]FakeObject
+	Uploads    []FakeUploadCall
+	Downloads  []FakeDownloadCall
+	Reads      []FakeReadCall
+	Deletes    []string
+	ExistsKeys []string
+
+	ListErr      error
+	DownloadErr  error
+	UploadErr    error
+	DeleteErr    error
+	ExistsErr    error
+	UploadHook   func(FakeUploadCall) error
+	DownloadHook func(FakeDownloadCall) error
 }
 
 // FakeUploadCall captures one upload invocation in call order.
@@ -33,6 +46,12 @@ type FakeUploadCall struct {
 type FakeDownloadCall struct {
 	Key       string
 	LocalPath string
+	Bytes     int64
+}
+
+// FakeReadCall captures one opened object in call order.
+type FakeReadCall struct {
+	Key string
 }
 
 // FakeObject is a deterministic fake object-store record.
@@ -46,6 +65,12 @@ type FakeObject struct {
 
 // SeedObject inserts or replaces an object in the fake object store.
 func (f *FakeBackend) SeedObject(obj FakeObject) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.seedObject(obj)
+}
+
+func (f *FakeBackend) seedObject(obj FakeObject) {
 	if f.Objects == nil {
 		f.Objects = map[string]FakeObject{}
 	}
@@ -53,6 +78,9 @@ func (f *FakeBackend) SeedObject(obj FakeObject) {
 	obj.Key = key
 	obj.Data = append([]byte(nil), obj.Data...)
 	obj.Metadata = copyMetadata(obj.Metadata)
+	if obj.ETag == "" {
+		obj.ETag = fakeObjectETag(obj.Data)
+	}
 	f.Objects[key] = obj
 }
 
@@ -65,6 +93,8 @@ func (f *FakeBackend) List(ctx context.Context, prefix string) ([]ObjectInfo, er
 		return nil, f.ListErr
 	}
 
+	f.mu.RLock()
+	defer f.mu.RUnlock()
 	normalizedPrefix := normalizeObjectKey(prefix)
 	keys := make([]string, 0, len(f.Objects))
 	for key := range f.Objects {
@@ -87,34 +117,77 @@ func (f *FakeBackend) List(ctx context.Context, prefix string) ([]ObjectInfo, er
 	return out, nil
 }
 
-// Download writes one object to a local path.
-func (f *FakeBackend) Download(ctx context.Context, key, localPath string) error {
+// Read returns a stable object body and the generation observed with it.
+func (f *FakeBackend) Read(ctx context.Context, key string) (ObjectInfo, io.ReadCloser, error) {
+	if err := ctx.Err(); err != nil {
+		return ObjectInfo{}, nil, err
+	}
+	if f.DownloadErr != nil {
+		return ObjectInfo{}, nil, f.DownloadErr
+	}
+	normalizedKey := normalizeObjectKey(key)
+	f.mu.RLock()
+	obj, ok := f.Objects[normalizedKey]
+	if ok {
+		obj.Data = append([]byte(nil), obj.Data...)
+		obj.Metadata = copyMetadata(obj.Metadata)
+	}
+	f.mu.RUnlock()
+	if !ok {
+		return ObjectInfo{}, nil, fmt.Errorf("read object %q: %w", normalizedKey, os.ErrNotExist)
+	}
+	f.mu.Lock()
+	f.Reads = append(f.Reads, FakeReadCall{Key: normalizedKey})
+	f.mu.Unlock()
+	return ObjectInfo{Key: obj.Key, Size: int64(len(obj.Data)), ETag: obj.ETag, LastModified: obj.LastModified}, io.NopCloser(bytes.NewReader(obj.Data)), nil
+}
+
+// DownloadTo writes one object to a caller-owned destination writer.
+func (f *FakeBackend) DownloadTo(ctx context.Context, key string, destination io.Writer) error {
 	if err := ctx.Err(); err != nil {
 		return err
 	}
 	if f.DownloadErr != nil {
 		return f.DownloadErr
 	}
+	if destination == nil {
+		return fmt.Errorf("download object: destination writer is required")
+	}
+	if f.DownloadHook != nil {
+		if err := f.DownloadHook(FakeDownloadCall{Key: normalizeObjectKey(key)}); err != nil {
+			return err
+		}
+	}
+
+	_, source, err := f.Read(ctx, key)
+	if err != nil {
+		return err
+	}
+	defer source.Close()
+	count, err := io.Copy(destination, source)
+	if err != nil {
+		return fmt.Errorf("download object %q: write destination: %w", key, err)
+	}
+	f.mu.Lock()
+	f.Downloads = append(f.Downloads, FakeDownloadCall{Key: normalizeObjectKey(key), Bytes: count})
+	f.mu.Unlock()
+	return nil
+}
+
+// Download writes one object to a local path.
+func (f *FakeBackend) Download(ctx context.Context, key, localPath string) error {
 	if strings.TrimSpace(localPath) == "" {
 		return fmt.Errorf("download object: local path is required")
 	}
-
-	obj, ok := f.Objects[normalizeObjectKey(key)]
-	if !ok {
-		return fmt.Errorf("download object %q: %w", key, os.ErrNotExist)
-	}
-	f.Downloads = append(f.Downloads, FakeDownloadCall{
-		Key:       normalizeObjectKey(key),
-		LocalPath: localPath,
-	})
-
 	if err := os.MkdirAll(filepath.Dir(localPath), 0o755); err != nil {
 		return fmt.Errorf("download object %q: create parent directory: %w", key, err)
 	}
-	if err := os.WriteFile(localPath, obj.Data, 0o644); err != nil {
-		return fmt.Errorf("download object %q: write local file: %w", key, err)
+	destination, err := os.Create(localPath)
+	if err != nil {
+		return fmt.Errorf("download object %q: create local file: %w", key, err)
 	}
-	return nil
+	defer destination.Close()
+	return f.DownloadTo(ctx, key, destination)
 }
 
 // Upload reads a local file and stores it under key.
@@ -132,33 +205,136 @@ func (f *FakeBackend) Upload(ctx context.Context, localPath, key string, opts Up
 		return ObjectInfo{}, fmt.Errorf("upload object: key is required")
 	}
 
-	data, err := os.ReadFile(localPath)
+	file, err := os.Open(localPath)
+	if err != nil {
+		return ObjectInfo{}, fmt.Errorf("upload object %q from %q: %w", key, localPath, err)
+	}
+	defer file.Close()
+	return f.uploadReader(ctx, file, key, opts, localPath)
+}
+
+// UploadReader stores content provided by a caller-owned reader.
+func (f *FakeBackend) UploadReader(ctx context.Context, source io.Reader, key string, opts UploadOptions) (ObjectInfo, error) {
+	return f.uploadReader(ctx, source, key, opts, "reader")
+}
+
+func (f *FakeBackend) uploadReader(ctx context.Context, source io.Reader, key string, opts UploadOptions, localPath string) (ObjectInfo, error) {
+	if err := ctx.Err(); err != nil {
+		return ObjectInfo{}, err
+	}
+	if f.UploadErr != nil {
+		return ObjectInfo{}, f.UploadErr
+	}
+	if source == nil {
+		return ObjectInfo{}, fmt.Errorf("upload object: source is required")
+	}
+	if strings.TrimSpace(key) == "" {
+		return ObjectInfo{}, fmt.Errorf("upload object: key is required")
+	}
+
+	data, err := io.ReadAll(source)
 	if err != nil {
 		return ObjectInfo{}, fmt.Errorf("upload object %q from %q: %w", key, localPath, err)
 	}
 
 	normalizedKey := normalizeObjectKey(key)
-	f.Uploads = append(f.Uploads, FakeUploadCall{
+	call := FakeUploadCall{
 		LocalPath: localPath,
 		Key:       normalizedKey,
 		Options: UploadOptions{
 			Metadata:    copyMetadata(opts.Metadata),
 			ContentType: opts.ContentType,
 		},
-	})
-	now := time.Now().UTC()
-	obj := FakeObject{
-		Key:          normalizedKey,
-		Data:         data,
-		Metadata:     copyMetadata(opts.Metadata),
-		LastModified: &now,
 	}
-	f.SeedObject(obj)
-	return ObjectInfo{
-		Key:          normalizedKey,
-		Size:         int64(len(data)),
-		LastModified: &now,
-	}, nil
+	f.mu.Lock()
+	f.Uploads = append(f.Uploads, call)
+	f.mu.Unlock()
+	if f.UploadHook != nil {
+		if err := f.UploadHook(call); err != nil {
+			return ObjectInfo{}, err
+		}
+	}
+	return f.storeUploadedObject(normalizedKey, data, opts), nil
+}
+
+// UploadConditional atomically checks and replaces one mutable object.
+func (f *FakeBackend) UploadConditional(ctx context.Context, source io.Reader, key string, opts UploadOptions, condition WriteCondition) (ObjectInfo, error) {
+	if err := ctx.Err(); err != nil {
+		return ObjectInfo{}, err
+	}
+	if err := validateWriteCondition(condition); err != nil {
+		return ObjectInfo{}, err
+	}
+	if f.UploadErr != nil {
+		return ObjectInfo{}, f.UploadErr
+	}
+	if source == nil {
+		return ObjectInfo{}, fmt.Errorf("upload object: source is required")
+	}
+	normalizedKey := normalizeObjectKey(key)
+	if normalizedKey == "" {
+		return ObjectInfo{}, fmt.Errorf("upload object: key is required")
+	}
+	data, err := io.ReadAll(source)
+	if err != nil {
+		return ObjectInfo{}, fmt.Errorf("upload object %q: %w", normalizedKey, err)
+	}
+	call := FakeUploadCall{Key: normalizedKey, Options: UploadOptions{Metadata: copyMetadata(opts.Metadata), ContentType: opts.ContentType}}
+	f.mu.Lock()
+	f.Uploads = append(f.Uploads, call)
+	f.mu.Unlock()
+	if f.UploadHook != nil {
+		if err := f.UploadHook(call); err != nil {
+			return ObjectInfo{}, err
+		}
+	}
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	existing, found := f.Objects[normalizedKey]
+	if condition.RequireAbsent && found {
+		return ObjectInfo{}, ErrConditionNotMet
+	}
+	if expected := strings.TrimSpace(condition.MatchETag); expected != "" && (!found || existing.ETag != expected) {
+		return ObjectInfo{}, ErrConditionNotMet
+	}
+	return f.storeUploadedObjectLocked(normalizedKey, data, opts), nil
+}
+
+func (f *FakeBackend) storeUploadedObject(key string, data []byte, opts UploadOptions) ObjectInfo {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return f.storeUploadedObjectLocked(key, data, opts)
+}
+
+func (f *FakeBackend) storeUploadedObjectLocked(key string, data []byte, opts UploadOptions) ObjectInfo {
+	now := time.Now().UTC()
+	obj := FakeObject{Key: key, Data: append([]byte(nil), data...), Metadata: copyMetadata(opts.Metadata), LastModified: &now}
+	f.seedObject(obj)
+	return ObjectInfo{Key: key, Size: int64(len(data)), ETag: fakeObjectETag(data), LastModified: &now}
+}
+
+func fakeObjectETag(data []byte) string {
+	sum := sha256.Sum256(data)
+	return hex.EncodeToString(sum[:])
+}
+
+// Delete removes one object. Removing an absent object succeeds.
+func (f *FakeBackend) Delete(ctx context.Context, key string) error {
+	if err := ctx.Err(); err != nil {
+		return err
+	}
+	if f.DeleteErr != nil {
+		return f.DeleteErr
+	}
+	normalizedKey := normalizeObjectKey(key)
+	if normalizedKey == "" {
+		return fmt.Errorf("delete object: key is required")
+	}
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.Deletes = append(f.Deletes, normalizedKey)
+	delete(f.Objects, normalizedKey)
+	return nil
 }
 
 // Exists checks object presence.
@@ -169,7 +345,13 @@ func (f *FakeBackend) Exists(ctx context.Context, key string) (bool, error) {
 	if f.ExistsErr != nil {
 		return false, f.ExistsErr
 	}
-	_, ok := f.Objects[normalizeObjectKey(key)]
+	normalizedKey := normalizeObjectKey(key)
+	f.mu.Lock()
+	f.ExistsKeys = append(f.ExistsKeys, normalizedKey)
+	f.mu.Unlock()
+	f.mu.RLock()
+	_, ok := f.Objects[normalizedKey]
+	f.mu.RUnlock()
 	return ok, nil
 }
 

internal/adapters/storage/fake_test.go

@@ -71,8 +71,55 @@ func TestFakeBackendUploadAndExists(t *testing.T) {
 	}
 }
 
+func TestFakeBackendDeleteIsIdempotent(t *testing.T) {
+	fake := &FakeBackend{}
+	fake.SeedObject(FakeObject{Key: "locks/source.lock", Data: []byte("lock")})
+
+	for range 2 {
+		if err := fake.Delete(context.Background(), `locks\source.lock`); err != nil {
+			t.Fatalf("Delete() error = %v", err)
+		}
+	}
+	if _, ok := fake.Objects["locks/source.lock"]; ok {
+		t.Fatal("Delete() left the object present")
+	}
+	if len(fake.Deletes) != 2 || fake.Deletes[0] != "locks/source.lock" || fake.Deletes[1] != "locks/source.lock" {
+		t.Fatalf("Delete() calls = %#v, want two normalized keys", fake.Deletes)
+	}
+}
+
+func TestFakeBackendDeleteHonorsContextAndInjectedError(t *testing.T) {
+	canceled, cancel := context.WithCancel(context.Background())
+	cancel()
+	fake := &FakeBackend{}
+	if err := fake.Delete(canceled, "locks/source.lock"); !errors.Is(err, context.Canceled) {
+		t.Fatalf("Delete() canceled error = %v, want context.Canceled", err)
+	}
+
+	wantErr := errors.New("delete fail")
+	fake.DeleteErr = wantErr
+	if err := fake.Delete(context.Background(), "locks/source.lock"); !errors.Is(err, wantErr) {
+		t.Fatalf("Delete() injected error = %v, want %v", err, wantErr)
+	}
+}
+
+func TestFakeBackendConditionalUploadRejectsStaleGeneration(t *testing.T) {
+	fake := &FakeBackend{}
+	fake.SeedObject(FakeObject{Key: "control.json", Data: []byte("old")})
+	old := fake.Objects["control.json"].ETag
+	if _, err := fake.UploadConditional(context.Background(), strings.NewReader("new"), "control.json", UploadOptions{}, WriteCondition{MatchETag: old}); err != nil {
+		t.Fatalf("UploadConditional() error = %v", err)
+	}
+	if _, err := fake.UploadConditional(context.Background(), strings.NewReader("lost"), "control.json", UploadOptions{}, WriteCondition{MatchETag: old}); !errors.Is(err, ErrConditionNotMet) {
+		t.Fatalf("UploadConditional() error = %v, want ErrConditionNotMet", err)
+	}
+	if got := string(fake.Objects["control.json"].Data); got != "new" {
+		t.Fatalf("control object = %q, want successful replacement preserved", got)
+	}
+}
+
 func TestFakeBackendObjectErrors(t *testing.T) {
-	fake := &FakeBackend{DownloadErr: errors.New("download fail"), UploadErr: errors.New("upload fail"), ListErr: errors.New("list fail"), ExistsErr: errors.New("exists fail")}
+	fake := &FakeBackend{DownloadErr: errors.New("download fail"), UploadErr: errors.New("upload fail"), ListErr: errors.New("list fail"), DeleteErr: errors.New("delete fail"), ExistsErr: errors.New("exists fail")}
 
 	if _, err := fake.List(context.Background(), "x"); err == nil || !strings.Contains(err.Error(), "list fail") {
 		t.Fatalf("List() error = %v, want list fail", err)
@@ -85,6 +132,9 @@ func TestFakeBackendObjectErrors(t *testing.T) {
 	if _, err := fake.Upload(context.Background(), local, "x", UploadOptions{}); err == nil || !strings.Contains(err.Error(), "upload fail") {
 		t.Fatalf("Upload() error = %v, want upload fail", err)
 	}
+	if err := fake.Delete(context.Background(), "x"); err == nil || !strings.Contains(err.Error(), "delete fail") {
+		t.Fatalf("Delete() error = %v, want delete fail", err)
+	}
 	if _, err := fake.Exists(context.Background(), "x"); err == nil || !strings.Contains(err.Error(), "exists fail") {
 		t.Fatalf("Exists() error = %v, want exists fail", err)
 	}

internal/adapters/storage/object_store.go

@@ -2,9 +2,21 @@ package storage
 
 import (
 	"context"
+	"errors"
+	"io"
 	"time"
 )
 
+// ErrConditionNotMet reports that an object changed or already existed before a
+// conditional write could be committed.
+var ErrConditionNotMet = errors.New("object write condition not met")
+
+// ReaderUploader streams caller-owned, already-opened content to object storage.
+// Callers retain source-selection and filesystem-confinement policy.
+type ReaderUploader interface {
+	UploadReader(ctx context.Context, source io.Reader, key string, opts UploadOptions) (ObjectInfo, error)
+}
+
 // ObjectStore is a remote object storage boundary used by prepare, restore, and publish work.
 //
 // Key invariant:
@@ -12,8 +24,11 @@ import (
 // infer Narratio session semantics and do not prepend root prefixes.
 type ObjectStore interface {
 	List(ctx context.Context, prefix string) ([]ObjectInfo, error)
+	Read(ctx context.Context, key string) (ObjectInfo, io.ReadCloser, error)
 	Download(ctx context.Context, key, localPath string) error
 	Upload(ctx context.Context, localPath, key string, opts UploadOptions) (ObjectInfo, error)
+	UploadConditional(ctx context.Context, source io.Reader, key string, opts UploadOptions, condition WriteCondition) (ObjectInfo, error)
+	Delete(ctx context.Context, key string) error
 	Exists(ctx context.Context, key string) (bool, error)
 }
 
@@ -30,3 +45,10 @@ type UploadOptions struct {
 	Metadata    map[string]string
 	ContentType string
 }
+
+// WriteCondition protects a mutable object update against a stale snapshot.
+// Exactly one condition is required by UploadConditional.
+type WriteCondition struct {
+	MatchETag     string
+	RequireAbsent bool
+}

internal/adapters/storage/s3_backend.go

@@ -23,6 +23,7 @@ type s3API interface {
 	ListObjectsV2(ctx context.Context, params *s3.ListObjectsV2Input, optFns ...func(*s3.Options)) (*s3.ListObjectsV2Output, error)
 	GetObject(ctx context.Context, params *s3.GetObjectInput, optFns ...func(*s3.Options)) (*s3.GetObjectOutput, error)
 	PutObject(ctx context.Context, params *s3.PutObjectInput, optFns ...func(*s3.Options)) (*s3.PutObjectOutput, error)
+	DeleteObject(ctx context.Context, params *s3.DeleteObjectInput, optFns ...func(*s3.Options)) (*s3.DeleteObjectOutput, error)
 	HeadObject(ctx context.Context, params *s3.HeadObjectInput, optFns ...func(*s3.Options)) (*s3.HeadObjectOutput, error)
 }
 
@@ -117,6 +118,7 @@ func (b *S3Backend) List(ctx context.Context, prefix string) ([]ObjectInfo, erro
 	normalizedPrefix := normalizeObjectKey(prefix)
 	out := make([]ObjectInfo, 0)
 	var token *string
+	seenTokens := map[string]struct{}{}
 
 	for {
 		resp, err := b.client.ListObjectsV2(ctx, &s3.ListObjectsV2Input{
@@ -142,44 +144,78 @@ func (b *S3Backend) List(ctx context.Context, prefix string) ([]ObjectInfo, erro
 			})
 		}
 
-		if !valueOrFalseBool(resp.IsTruncated) || resp.NextContinuationToken == nil {
+		if !valueOrFalseBool(resp.IsTruncated) {
 			break
 		}
-		token = resp.NextContinuationToken
+		next := strings.TrimSpace(valueOrEmpty(resp.NextContinuationToken))
+		if next == "" {
+			return nil, fmt.Errorf("s3 list objects bucket %q prefix %q: truncated response has an empty continuation token", b.bucket, normalizedPrefix)
+		}
+		if _, repeated := seenTokens[next]; repeated {
+			return nil, fmt.Errorf("s3 list objects bucket %q prefix %q: truncated response repeated continuation token", b.bucket, normalizedPrefix)
+		}
+		seenTokens[next] = struct{}{}
+		token = &next
 	}
 	return out, nil
 }
 
+// Read retrieves an object together with the generation observed for its body.
+func (b *S3Backend) Read(ctx context.Context, key string) (ObjectInfo, io.ReadCloser, error) {
+	normalizedKey := normalizeObjectKey(key)
+	resp, err := b.client.GetObject(ctx, &s3.GetObjectInput{Bucket: &b.bucket, Key: &normalizedKey})
+	if err != nil {
+		if isS3NotFound(err) {
+			return ObjectInfo{}, nil, fmt.Errorf("read object %q: %w", normalizedKey, os.ErrNotExist)
+		}
+		return ObjectInfo{}, nil, fmt.Errorf("read object %q: %w", normalizedKey, err)
+	}
+	var lastModified *time.Time
+	if resp.LastModified != nil {
+		t := *resp.LastModified
+		lastModified = &t
+	}
+	return ObjectInfo{
+		Key: normalizedKey, Size: valueOrZeroInt64(resp.ContentLength),
+		ETag: strings.Trim(valueOrEmpty(resp.ETag), "\""), LastModified: lastModified,
+	}, resp.Body, nil
+}
+
+// DownloadTo retrieves one object into the caller-owned destination writer.
+func (b *S3Backend) DownloadTo(ctx context.Context, key string, destination io.Writer) error {
+	if destination == nil {
+		return fmt.Errorf("download object: destination writer is required")
+	}
+	_, body, err := b.Read(ctx, key)
+	if err != nil {
+		return fmt.Errorf("download object %q: %w", normalizeObjectKey(key), err)
+	}
+	defer body.Close()
+
+	if _, err := io.Copy(destination, body); err != nil {
+		return fmt.Errorf("download object %q: copy body: %w", normalizeObjectKey(key), err)
+	}
+	return nil
+}
+
 // Download retrieves one object to localPath, creating parent directories as needed.
 func (b *S3Backend) Download(ctx context.Context, key, localPath string) error {
-	normalizedKey := normalizeObjectKey(key)
 	if strings.TrimSpace(localPath) == "" {
 		return fmt.Errorf("download object: local path is required")
 	}
-
-	resp, err := b.client.GetObject(ctx, &s3.GetObjectInput{
-		Bucket: &b.bucket,
-		Key:    &normalizedKey,
-	})
-	if err != nil {
-		return fmt.Errorf("download object %q: %w", normalizedKey, err)
-	}
-	defer resp.Body.Close()
-
 	if err := os.MkdirAll(filepath.Dir(localPath), 0o755); err != nil {
-		return fmt.Errorf("download object %q: create parent directory: %w", normalizedKey, err)
+		return fmt.Errorf("download object %q: create parent directory: %w", key, err)
 	}
 	dst, err := os.Create(localPath)
 	if err != nil {
-		return fmt.Errorf("download object %q: create local file: %w", normalizedKey, err)
+		return fmt.Errorf("download object %q: create local file: %w", key, err)
 	}
 	defer dst.Close()
-
-	if _, err := io.Copy(dst, resp.Body); err != nil {
-		return fmt.Errorf("download object %q: copy body: %w", normalizedKey, err)
+	if err := b.DownloadTo(ctx, key, dst); err != nil {
+		return err
 	}
 	if err := dst.Sync(); err != nil {
-		return fmt.Errorf("download object %q: sync local file: %w", normalizedKey, err)
+		return fmt.Errorf("download object %q: sync local file: %w", key, err)
 	}
 	return nil
 }
@@ -204,28 +240,84 @@ func (b *S3Backend) Upload(ctx context.Context, localPath, key string, opts Uplo
 	if err != nil {
 		return ObjectInfo{}, fmt.Errorf("upload object %q from %q: stat local file: %w", normalizedKey, localPath, err)
 	}
+	return b.uploadReader(ctx, file, key, opts, stat.Size(), WriteCondition{})
+}
+
+// UploadReader sends caller-owned content to key.
+func (b *S3Backend) UploadReader(ctx context.Context, source io.Reader, key string, opts UploadOptions) (ObjectInfo, error) {
+	return b.uploadReader(ctx, source, key, opts, 0, WriteCondition{})
+}
+
+// UploadConditional uploads a mutable object only when its observed generation
+// still matches, or when no object exists yet.
+func (b *S3Backend) UploadConditional(ctx context.Context, source io.Reader, key string, opts UploadOptions, condition WriteCondition) (ObjectInfo, error) {
+	if err := validateWriteCondition(condition); err != nil {
+		return ObjectInfo{}, err
+	}
+	return b.uploadReader(ctx, source, key, opts, 0, condition)
+}
+
+func (b *S3Backend) uploadReader(ctx context.Context, source io.Reader, key string, opts UploadOptions, size int64, condition WriteCondition) (ObjectInfo, error) {
+	normalizedKey := normalizeObjectKey(key)
+	if source == nil {
+		return ObjectInfo{}, fmt.Errorf("upload object: source is required")
+	}
+	if normalizedKey == "" {
+		return ObjectInfo{}, fmt.Errorf("upload object: key is required")
+	}
 
 	input := &s3.PutObjectInput{
 		Bucket:   &b.bucket,
 		Key:      &normalizedKey,
-		Body:     file,
+		Body:     source,
 		Metadata: copyMetadata(opts.Metadata),
 	}
 	if strings.TrimSpace(opts.ContentType) != "" {
 		ct := strings.TrimSpace(opts.ContentType)
 		input.ContentType = &ct
 	}
+	if condition.RequireAbsent {
+		wildcard := "*"
+		input.IfNoneMatch = &wildcard
+	} else if expected := strings.TrimSpace(condition.MatchETag); expected != "" {
+		input.IfMatch = &expected
+	}
 
 	resp, err := b.client.PutObject(ctx, input)
 	if err != nil {
-		return ObjectInfo{}, fmt.Errorf("upload object %q from %q: %w", normalizedKey, localPath, err)
+		if isS3ConditionalConflict(err) {
+			return ObjectInfo{}, fmt.Errorf("upload object %q: %w", normalizedKey, ErrConditionNotMet)
+		}
+		return ObjectInfo{}, fmt.Errorf("upload object %q: %w", normalizedKey, err)
 	}
 
-	return ObjectInfo{
+	info := ObjectInfo{
 		Key:  normalizedKey,
-		Size: stat.Size(),
 		ETag: strings.Trim(valueOrEmpty(resp.ETag), "\""),
-	}, nil
+	}
+	if size > 0 {
+		info.Size = size
+	}
+	return info, nil
+}
+
+// Delete removes one object. S3 deletion is idempotent when the key is absent.
+func (b *S3Backend) Delete(ctx context.Context, key string) error {
+	if err := ctx.Err(); err != nil {
+		return err
+	}
+	normalizedKey := normalizeObjectKey(key)
+	if normalizedKey == "" {
+		return fmt.Errorf("delete object: key is required")
+	}
+	_, err := b.client.DeleteObject(ctx, &s3.DeleteObjectInput{
+		Bucket: &b.bucket,
+		Key:    &normalizedKey,
+	})
+	if err != nil {
+		return fmt.Errorf("delete object %q: %w", normalizedKey, err)
+	}
+	return nil
 }
 
 // Exists checks whether one object key exists.
@@ -239,18 +331,43 @@ func (b *S3Backend) Exists(ctx context.Context, key string) (bool, error) {
 		return true, nil
 	}
 
+	if isS3NotFound(err) {
+		return false, nil
+	}
+	return false, fmt.Errorf("head object %q: %w", normalizedKey, err)
+}
+
+func validateWriteCondition(condition WriteCondition) error {
+	if condition.RequireAbsent == (strings.TrimSpace(condition.MatchETag) != "") {
+		return fmt.Errorf("conditional upload requires exactly one of MatchETag or RequireAbsent")
+	}
+	return nil
+}
+
+func isS3NotFound(err error) bool {
 	var notFound *types.NotFound
 	if errors.As(err, &notFound) {
-		return false, nil
+		return true
 	}
 	var apiErr smithy.APIError
 	if errors.As(err, &apiErr) {
 		switch apiErr.ErrorCode() {
 		case "NotFound", "NoSuchKey", "404":
-			return false, nil
+			return true
 		}
 	}
-	return false, fmt.Errorf("head object %q: %w", normalizedKey, err)
+	return false
+}
+
+func isS3ConditionalConflict(err error) bool {
+	var apiErr smithy.APIError
+	if errors.As(err, &apiErr) {
+		switch apiErr.ErrorCode() {
+		case "PreconditionFailed", "ConditionalRequestConflict", "412", "409":
+			return true
+		}
+	}
+	return false
 }
 
 func valueOrEmpty(v *string) string {

internal/adapters/storage/s3_backend_test.go

@@ -2,6 +2,7 @@ package storage
 
 import (
 	"context"
+	"errors"
 	"io"
 	"os"
 	"path/filepath"
@@ -17,34 +18,83 @@ import (
 )
 
 type fakeS3API struct {
-	listOut *s3.ListObjectsV2Output
-	listErr error
+	listOut     *s3.ListObjectsV2Output
+	listOutputs []*s3.ListObjectsV2Output
+	listErr     error
+	listCalls   int
 
-	getBody io.ReadCloser
-	getErr  error
+	getBody         io.ReadCloser
+	getErr          error
+	getSize         *int64
+	getETag         *string
+	getLastModified *time.Time
 
-	putOut *s3.PutObjectOutput
-	putErr error
+	putOut    *s3.PutObjectOutput
+	putErr    error
+	deleteErr error
 
 	headErr error
 
-	lastList *s3.ListObjectsV2Input
-	lastGet  *s3.GetObjectInput
-	lastPut  *s3.PutObjectInput
-	lastHead *s3.HeadObjectInput
+	lastList   *s3.ListObjectsV2Input
+	lastLists  []*s3.ListObjectsV2Input
+	lastGet    *s3.GetObjectInput
+	lastPut    *s3.PutObjectInput
+	lastDelete *s3.DeleteObjectInput
+	lastHead   *s3.HeadObjectInput
 }
 
 func (f *fakeS3API) ListObjectsV2(_ context.Context, params *s3.ListObjectsV2Input, _ ...func(*s3.Options)) (*s3.ListObjectsV2Output, error) {
 	f.lastList = params
+	f.lastLists = append(f.lastLists, params)
 	if f.listErr != nil {
 		return nil, f.listErr
 	}
+	if f.listCalls < len(f.listOutputs) {
+		out := f.listOutputs[f.listCalls]
+		f.listCalls++
+		return out, nil
+	}
 	if f.listOut == nil {
 		return &s3.ListObjectsV2Output{}, nil
 	}
 	return f.listOut, nil
 }
 
+func TestS3BackendListPaginatesAndRejectsNonProgressingTokens(t *testing.T) {
+	t.Run("multiple pages", func(t *testing.T) {
+		client := &fakeS3API{listOutputs: []*s3.ListObjectsV2Output{
+			{Contents: []types.Object{{Key: strPtr("prefix/a"), Size: int64Ptr(1)}}, IsTruncated: boolPtr(true), NextContinuationToken: strPtr("next")},
+			{Contents: []types.Object{{Key: strPtr("prefix/b"), Size: int64Ptr(2)}}, IsTruncated: boolPtr(false)},
+		}}
+		items, err := (&S3Backend{bucket: "bucket-1", client: client}).List(context.Background(), "prefix/")
+		if err != nil {
+			t.Fatalf("List() error = %v", err)
+		}
+		if len(items) != 2 || items[0].Key != "prefix/a" || items[1].Key != "prefix/b" {
+			t.Fatalf("List() items = %#v", items)
+		}
+		if len(client.lastLists) != 2 || client.lastLists[1].ContinuationToken == nil || *client.lastLists[1].ContinuationToken != "next" {
+			t.Fatalf("continuation calls = %#v", client.lastLists)
+		}
+	})
+
+	for _, test := range []struct {
+		name    string
+		outputs []*s3.ListObjectsV2Output
+		want    string
+	}{
+		{name: "empty", outputs: []*s3.ListObjectsV2Output{{IsTruncated: boolPtr(true)}}, want: "empty continuation token"},
+		{name: "repeated", outputs: []*s3.ListObjectsV2Output{{IsTruncated: boolPtr(true), NextContinuationToken: strPtr("again")}, {IsTruncated: boolPtr(true), NextContinuationToken: strPtr("again")}}, want: "repeated continuation token"},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			_, err := (&S3Backend{bucket: "bucket-1", client: &fakeS3API{listOutputs: test.outputs}}).List(context.Background(), "prefix/")
+			if err == nil || !strings.Contains(err.Error(), test.want) || !strings.Contains(err.Error(), "bucket-1") || !strings.Contains(err.Error(), "prefix/") {
+				t.Fatalf("List() error = %v, want contextual %q", err, test.want)
+			}
+		})
+	}
+}
+
 func (f *fakeS3API) GetObject(_ context.Context, params *s3.GetObjectInput, _ ...func(*s3.Options)) (*s3.GetObjectOutput, error) {
 	f.lastGet = params
 	if f.getErr != nil {
@@ -54,7 +104,7 @@ func (f *fakeS3API) GetObject(_ context.Context, params *s3.GetObjectInput, _ ..
 	if body == nil {
 		body = io.NopCloser(strings.NewReader(""))
 	}
-	return &s3.GetObjectOutput{Body: body}, nil
+	return &s3.GetObjectOutput{Body: body, ContentLength: f.getSize, ETag: f.getETag, LastModified: f.getLastModified}, nil
 }
 
 func (f *fakeS3API) PutObject(_ context.Context, params *s3.PutObjectInput, _ ...func(*s3.Options)) (*s3.PutObjectOutput, error) {
@@ -68,6 +118,14 @@ func (f *fakeS3API) PutObject(_ context.Context, params *s3.PutObjectInput, _ ..
 	return f.putOut, nil
 }
 
+func (f *fakeS3API) DeleteObject(_ context.Context, params *s3.DeleteObjectInput, _ ...func(*s3.Options)) (*s3.DeleteObjectOutput, error) {
+	f.lastDelete = params
+	if f.deleteErr != nil {
+		return nil, f.deleteErr
+	}
+	return &s3.DeleteObjectOutput{}, nil
+}
+
 func (f *fakeS3API) HeadObject(_ context.Context, params *s3.HeadObjectInput, _ ...func(*s3.Options)) (*s3.HeadObjectOutput, error) {
 	f.lastHead = params
 	if f.headErr != nil {
@@ -126,6 +184,33 @@ func TestS3BackendDownloadCreatesParentDirectory(t *testing.T) {
 	}
 }
 
+func TestS3BackendReadReturnsOpenedObjectMetadata(t *testing.T) {
+	lastModified := time.Date(2026, 8, 11, 1, 2, 3, 0, time.UTC)
+	client := &fakeS3API{
+		getBody:         io.NopCloser(strings.NewReader("state")),
+		getSize:         int64Ptr(5),
+		getETag:         strPtr(`"generation"`),
+		getLastModified: &lastModified,
+	}
+	backend := &S3Backend{bucket: "bucket-1", client: client}
+
+	info, body, err := backend.Read(context.Background(), `sessions\control.json`)
+	if err != nil {
+		t.Fatalf("Read() error = %v", err)
+	}
+	data, readErr := io.ReadAll(body)
+	closeErr := body.Close()
+	if readErr != nil || closeErr != nil {
+		t.Fatalf("read body error=%v close error=%v", readErr, closeErr)
+	}
+	if info.Key != "sessions/control.json" || info.Size != 5 || info.ETag != "generation" || info.LastModified == nil || !info.LastModified.Equal(lastModified) {
+		t.Fatalf("Read() info = %#v, want opened object metadata", info)
+	}
+	if string(data) != "state" || client.lastGet == nil || *client.lastGet.Key != "sessions/control.json" {
+		t.Fatalf("Read() data=%q request=%#v", data, client.lastGet)
+	}
+}
+
 func TestS3BackendUploadAndExists(t *testing.T) {
 	client := &fakeS3API{putOut: &s3.PutObjectOutput{ETag: strPtr(`"etag123"`)}}
 	backend := &S3Backend{bucket: "bucket-1", client: client}
@@ -160,6 +245,22 @@ func TestS3BackendUploadAndExists(t *testing.T) {
 	}
 }
 
+func TestS3BackendConditionalUploadUsesProviderPrecondition(t *testing.T) {
+	client := &fakeS3API{putOut: &s3.PutObjectOutput{ETag: strPtr(`"etag123"`)}}
+	backend := &S3Backend{bucket: "bucket-1", client: client}
+	if _, err := backend.UploadConditional(context.Background(), strings.NewReader("payload"), "control.json", UploadOptions{}, WriteCondition{MatchETag: "before"}); err != nil {
+		t.Fatalf("UploadConditional() error = %v", err)
+	}
+	if client.lastPut == nil || client.lastPut.IfMatch == nil || *client.lastPut.IfMatch != "before" || client.lastPut.IfNoneMatch != nil {
+		t.Fatalf("PutObject conditional input = %#v", client.lastPut)
+	}
+	client.putErr = &smithy.GenericAPIError{Code: "PreconditionFailed", Message: "changed"}
+	_, err := backend.UploadConditional(context.Background(), strings.NewReader("payload"), "control.json", UploadOptions{}, WriteCondition{RequireAbsent: true})
+	if !errors.Is(err, ErrConditionNotMet) {
+		t.Fatalf("UploadConditional() error = %v, want ErrConditionNotMet", err)
+	}
+}
+
 func TestS3BackendUploadMissingLocalFile(t *testing.T) {
 	backend := &S3Backend{bucket: "bucket-1", client: &fakeS3API{}}
 	_, err := backend.Upload(context.Background(), filepath.Join(t.TempDir(), "missing.txt"), "key.txt", UploadOptions{})
@@ -184,6 +285,37 @@ func TestS3BackendExistsNotFound(t *testing.T) {
 	}
 }
 
+func TestS3BackendDeleteMapsRequestAndErrors(t *testing.T) {
+	client := &fakeS3API{}
+	backend := &S3Backend{bucket: "bucket-1", client: client}
+	if err := backend.Delete(context.Background(), `locks\source.lock`); err != nil {
+		t.Fatalf("Delete() error = %v", err)
+	}
+	if client.lastDelete == nil || *client.lastDelete.Bucket != "bucket-1" || *client.lastDelete.Key != "locks/source.lock" {
+		t.Fatalf("DeleteObject input = %#v, want normalized bucket and key", client.lastDelete)
+	}
+
+	wantErr := errors.New("permission denied")
+	client.deleteErr = wantErr
+	err := backend.Delete(context.Background(), "locks/source.lock")
+	if !errors.Is(err, wantErr) || !strings.Contains(err.Error(), "locks/source.lock") {
+		t.Fatalf("Delete() error = %v, want contextual backend error", err)
+	}
+}
+
+func TestS3BackendDeleteHonorsCancellation(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	client := &fakeS3API{}
+	err := (&S3Backend{bucket: "bucket-1", client: client}).Delete(ctx, "locks/source.lock")
+	if !errors.Is(err, context.Canceled) {
+		t.Fatalf("Delete() error = %v, want context.Canceled", err)
+	}
+	if client.lastDelete != nil {
+		t.Fatal("Delete() called S3 after cancellation")
+	}
+}
+
 func TestNewS3BackendFromConfigUsesClientOptions(t *testing.T) {
 	original := newS3Client
 	t.Cleanup(func() { newS3Client = original })
@@ -249,5 +381,6 @@ func TestNewS3BackendFromConfigFallsBackWhenCredentialEnvMissing(t *testing.T) {
 
 func strPtr(v string) *string { return &v }
 func int64Ptr(v int64) *int64 { return &v }
+func boolPtr(v bool) *bool    { return &v }
 
 var _ s3API = (*fakeS3API)(nil)

internal/adapters/storage/temp_download_test.go

@@ -12,9 +12,9 @@ import (
 
 func TestDownloadObjectToTempSuccess(t *testing.T) {
 	store := &FakeBackend{}
-	store.SeedObject(FakeObject{Key: "sessions/a/current/run_id.txt", Data: []byte("run-123\n")})
+	store.SeedObject(FakeObject{Key: "sessions/a/runs/run-123/metadata.txt", Data: []byte("run-123\n")})
 
-	path, err := DownloadObjectToTemp(context.Background(), store, "sessions/a/current/run_id.txt", "narratio-test-*.txt")
+	path, err := DownloadObjectToTemp(context.Background(), store, "sessions/a/runs/run-123/metadata.txt", "narratio-test-*.txt")
 	if err != nil {
 		t.Fatalf("DownloadObjectToTemp() error = %v", err)
 	}
@@ -38,7 +38,7 @@ func TestDownloadObjectToTempFailedDownloadRemovesTempFile(t *testing.T) {
 		t.Fatalf("Glob(before) error = %v", err)
 	}
 
-	path, err := DownloadObjectToTemp(context.Background(), store, "sessions/a/current/run_id.txt", pattern)
+	path, err := DownloadObjectToTemp(context.Background(), store, "sessions/a/runs/run-123/metadata.txt", pattern)
 	if !errors.Is(err, sentinel) {
 		t.Fatalf("DownloadObjectToTemp() error = %v, want %v", err, sentinel)
 	}
@@ -58,7 +58,7 @@ func TestDownloadObjectToTempCallerContextWrappingPreservesCause(t *testing.T) {
 	sentinel := errors.New("object missing")
 	store := &FakeBackend{DownloadErr: sentinel}
 
-	_, err := DownloadObjectToTemp(context.Background(), store, "sessions/a/current/run_id.txt", "narratio-test-*.txt")
+	_, err := DownloadObjectToTemp(context.Background(), store, "sessions/a/runs/run-123/metadata.txt", "narratio-test-*.txt")
 	if err == nil {
 		t.Fatal("DownloadObjectToTemp() error = nil, want error")
 	}

internal/adapters/subprocess/diagnostics.go

@@ -0,0 +1,391 @@
+package subprocess
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+	"sync"
+
+	"gitea.maximumdirect.net/eric/narratio/internal/fileops"
+)
+
+const (
+	// MaxStdoutDiagnosticBytes bounds persisted stdout from one external command.
+	MaxStdoutDiagnosticBytes int64 = 8 * 1024 * 1024
+	// MaxStderrDiagnosticBytes bounds persisted stderr from one external command.
+	MaxStderrDiagnosticBytes int64 = 8 * 1024 * 1024
+	diagnosticTailBytes            = 2048
+)
+
+var inheritedEnvironmentNames = map[string]struct{}{
+	"COMSPEC":    {},
+	"HOME":       {},
+	"PATH":       {},
+	"SYSTEMROOT": {},
+	"TMP":        {},
+	"TMPDIR":     {},
+	"TEMP":       {},
+	"WINDIR":     {},
+	// These test-only helper destinations let the adapter package tests exercise
+	// real command invocation without widening the production environment.
+	"AUDITA_HELPER_RECORD_PATH":      {},
+	"AUDITA_HELPER_MODE":             {},
+	"GO_WANT_AUDITA_HELPER":          {},
+	"GO_WANT_SCRIPTORIUM_HELPER":     {},
+	"GO_WANT_SERIATIM_HELPER":        {},
+	"GO_WANT_SUBPROCESS_HELPER":      {},
+	"NOTARIUS_CAPTURE_DIR":           {},
+	"NOTARIUS_RECEIPT_FIXTURE":       {},
+	"SCRIPTORIUM_HELPER_RECORD_PATH": {},
+	"SCRIPTORIUM_HELPER_MODE":        {},
+	"SERIATIM_HELPER_RECORD_PATH":    {},
+	"SERIATIM_HELPER_MODE":           {},
+}
+
+var sensitiveEnvironmentNames = map[string]struct{}{
+	"ANTHROPIC_API_KEY":     {},
+	"API_KEY":               {},
+	"AUDITA_LLM_API_KEY":    {},
+	"AWS_ACCESS_KEY_ID":     {},
+	"AWS_SECRET_ACCESS_KEY": {},
+	"AWS_SESSION_TOKEN":     {},
+	"OPENAI_API_KEY":        {},
+	"OPENROUTER_API_KEY":    {},
+}
+
+type captureLimitError struct {
+	stream string
+	owner  string
+	limit  int64
+}
+
+func (e *captureLimitError) Error() string {
+	return fmt.Sprintf("%s diagnostic capture for %s exceeded %d bytes", e.stream, e.owner, e.limit)
+}
+
+type logWriters struct {
+	files  []*os.File
+	Stdout io.Writer
+	Stderr io.Writer
+
+	limits chan error
+	mu     sync.Mutex
+	limit  *captureLimitError
+	stdout *diagnosticWriter
+	stderr *diagnosticWriter
+}
+
+type diagnosticWriter struct {
+	logs      *logWriters
+	stream    string
+	owner     string
+	target    io.Writer
+	limit     int64
+	received  int64
+	persisted int64
+	redactor  streamRedactor
+	tail      []byte
+}
+
+func openLogWriters(stdoutPath, stderrPath, owner string, sensitiveValues []string) (*logWriters, error) {
+	logs := &logWriters{limits: make(chan error, 1)}
+	cleanStdout := cleanLogPath(stdoutPath)
+	cleanStderr := cleanLogPath(stderrPath)
+
+	stdoutFile, err := openDiagnosticFile(cleanStdout)
+	if err != nil {
+		return nil, fmt.Errorf("open stdout log: %w", err)
+	}
+	stderrFile := stdoutFile
+	if cleanStdout != cleanStderr {
+		stderrFile, err = openDiagnosticFile(cleanStderr)
+		if err != nil {
+			_ = stdoutFile.Close()
+			return nil, fmt.Errorf("open stderr log: %w", err)
+		}
+	}
+	if cleanStdout == cleanStderr {
+		logs.files = []*os.File{stdoutFile}
+	} else {
+		logs.files = []*os.File{stdoutFile, stderrFile}
+	}
+
+	logs.stdout = newDiagnosticWriter(logs, "stdout", owner, stdoutFile, MaxStdoutDiagnosticBytes, sensitiveValues)
+	logs.stderr = newDiagnosticWriter(logs, "stderr", owner, stderrFile, MaxStderrDiagnosticBytes, sensitiveValues)
+	logs.Stdout = logs.stdout
+	logs.Stderr = logs.stderr
+	return logs, nil
+}
+
+func newDiagnosticWriter(logs *logWriters, stream, owner string, target io.Writer, limit int64, sensitiveValues []string) *diagnosticWriter {
+	return &diagnosticWriter{
+		logs:     logs,
+		stream:   stream,
+		owner:    owner,
+		target:   target,
+		limit:    limit,
+		redactor: newStreamRedactor(sensitiveValues),
+	}
+}
+
+func (w *diagnosticWriter) Write(data []byte) (int, error) {
+	if w.received >= w.limit {
+		return len(data), w.reachLimit()
+	}
+	accepted := data
+	if remaining := w.limit - w.received; int64(len(accepted)) > remaining {
+		accepted = accepted[:remaining]
+	}
+	w.received += int64(len(accepted))
+	if err := w.writeRedacted(w.redactor.Write(accepted)); err != nil {
+		return len(data), err
+	}
+	if len(accepted) != len(data) {
+		return len(data), w.reachLimit()
+	}
+	return len(data), nil
+}
+
+func (w *diagnosticWriter) Flush() error {
+	return w.writeRedacted(w.redactor.Flush())
+}
+
+func (w *diagnosticWriter) writeRedacted(data []byte) error {
+	if len(data) == 0 {
+		return nil
+	}
+	w.logs.mu.Lock()
+	remaining := w.limit - w.persisted
+	if remaining <= 0 {
+		w.logs.mu.Unlock()
+		return w.reachLimit()
+	}
+	toWrite := data
+	exceeded := int64(len(data)) > remaining
+	if exceeded {
+		toWrite = toWrite[:remaining]
+	}
+	written, err := w.target.Write(toWrite)
+	w.persisted += int64(written)
+	w.retainTail(toWrite[:written])
+	w.logs.mu.Unlock()
+	if err != nil {
+		return err
+	}
+	if exceeded {
+		return w.reachLimit()
+	}
+	return nil
+}
+
+func (w *diagnosticWriter) Tail() string {
+	w.logs.mu.Lock()
+	defer w.logs.mu.Unlock()
+	return strings.TrimSpace(string(w.tail))
+}
+
+func (w *diagnosticWriter) retainTail(data []byte) {
+	if len(data) >= diagnosticTailBytes {
+		if cap(w.tail) < diagnosticTailBytes {
+			w.tail = make([]byte, diagnosticTailBytes)
+		} else {
+			w.tail = w.tail[:diagnosticTailBytes]
+		}
+		copy(w.tail, data[len(data)-diagnosticTailBytes:])
+		return
+	}
+	if cap(w.tail) < diagnosticTailBytes {
+		retained := make([]byte, len(w.tail), diagnosticTailBytes)
+		copy(retained, w.tail)
+		w.tail = retained
+	}
+	if overflow := len(w.tail) + len(data) - diagnosticTailBytes; overflow > 0 {
+		copy(w.tail, w.tail[overflow:])
+		w.tail = w.tail[:len(w.tail)-overflow]
+	}
+	w.tail = append(w.tail, data...)
+}
+
+func (w *diagnosticWriter) reachLimit() error {
+	limit := &captureLimitError{stream: w.stream, owner: w.owner, limit: w.limit}
+	w.logs.mu.Lock()
+	if w.logs.limit == nil {
+		w.logs.limit = limit
+		w.logs.limits <- limit
+	}
+	w.logs.mu.Unlock()
+	return limit
+}
+
+func (l *logWriters) Limits() <-chan error { return l.limits }
+
+func (l *logWriters) Limit() *captureLimitError {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	return l.limit
+}
+
+func (l *logWriters) Flush() error {
+	return joinErrors(l.stdout.Flush(), l.stderr.Flush())
+}
+
+func (l *logWriters) Close() {
+	_ = l.Flush()
+	for _, file := range l.files {
+		_ = file.Close()
+	}
+}
+
+func cleanLogPath(path string) string {
+	trimmed := strings.TrimSpace(path)
+	if trimmed == "" {
+		return ""
+	}
+	return filepath.Clean(trimmed)
+}
+
+func openDiagnosticFile(path string) (*os.File, error) {
+	if path == "" {
+		return os.OpenFile(os.DevNull, os.O_WRONLY, 0)
+	}
+	if err := fileops.EnsureWorkspaceDirectory(filepath.Dir(path)); err != nil {
+		return nil, fmt.Errorf("create log directory for %q: %w", path, err)
+	}
+	file, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, fileops.WorkspaceFileMode)
+	if err != nil {
+		return nil, fmt.Errorf("open log file %q: %w", path, err)
+	}
+	if err := file.Chmod(fileops.WorkspaceFileMode); err != nil {
+		_ = file.Close()
+		return nil, fmt.Errorf("set log file permissions %q: %w", path, err)
+	}
+	return file, nil
+}
+
+func (r RunRequest) diagnosticOwner() string {
+	if owner := strings.TrimSpace(r.DiagnosticOwner); owner != "" {
+		return owner
+	}
+	return "subprocess"
+}
+
+func buildChildEnvironment(base []string, overrides map[string]string) []string {
+	values := make(map[string]string, len(inheritedEnvironmentNames)+len(overrides))
+	for _, item := range base {
+		name, value, ok := strings.Cut(item, "=")
+		if !ok {
+			continue
+		}
+		normalized := strings.ToUpper(name)
+		if _, allowed := inheritedEnvironmentNames[normalized]; allowed {
+			values[name] = value
+		}
+	}
+	for name, value := range overrides {
+		values[name] = value
+	}
+	names := make([]string, 0, len(values))
+	for name := range values {
+		names = append(names, name)
+	}
+	sort.Strings(names)
+	out := make([]string, 0, len(names))
+	for _, name := range names {
+		out = append(out, name+"="+values[name])
+	}
+	return out
+}
+
+func sensitiveEnvironmentValues(environment []string, additionalNames []string) []string {
+	names := make(map[string]struct{}, len(sensitiveEnvironmentNames)+len(additionalNames))
+	for name := range sensitiveEnvironmentNames {
+		names[name] = struct{}{}
+	}
+	for _, name := range additionalNames {
+		if trimmed := strings.ToUpper(strings.TrimSpace(name)); trimmed != "" {
+			names[trimmed] = struct{}{}
+		}
+	}
+	values := make([]string, 0, len(names))
+	for _, item := range environment {
+		name, value, ok := strings.Cut(item, "=")
+		if !ok || strings.TrimSpace(value) == "" {
+			continue
+		}
+		if _, sensitive := names[strings.ToUpper(name)]; sensitive {
+			values = append(values, value)
+		}
+	}
+	return values
+}
+
+type streamRedactor struct {
+	values []string
+	buffer []byte
+	maxLen int
+}
+
+func newStreamRedactor(values []string) streamRedactor {
+	unique := make(map[string]struct{}, len(values))
+	for _, value := range values {
+		if value != "" {
+			unique[value] = struct{}{}
+		}
+	}
+	sorted := make([]string, 0, len(unique))
+	for value := range unique {
+		sorted = append(sorted, value)
+	}
+	sort.Slice(sorted, func(i, j int) bool { return len(sorted[i]) > len(sorted[j]) })
+	maxLen := 1
+	for _, value := range sorted {
+		if len(value) > maxLen {
+			maxLen = len(value)
+		}
+	}
+	return streamRedactor{values: sorted, maxLen: maxLen}
+}
+
+func (r *streamRedactor) Write(data []byte) []byte {
+	r.buffer = append(r.buffer, data...)
+	safeCut := len(r.buffer) - r.maxLen + 1
+	if safeCut <= 0 {
+		return nil
+	}
+	emitCut := safeCut
+	for _, value := range r.values {
+		start := 0
+		for {
+			index := bytes.Index(r.buffer[start:], []byte(value))
+			if index < 0 {
+				break
+			}
+			index += start
+			if index+len(value) > safeCut && index < emitCut {
+				emitCut = index
+			}
+			start = index + 1
+		}
+	}
+	output := redactBytes(r.buffer[:emitCut], r.values)
+	r.buffer = append(r.buffer[:0], r.buffer[emitCut:]...)
+	return output
+}
+
+func (r *streamRedactor) Flush() []byte {
+	output := redactBytes(r.buffer, r.values)
+	r.buffer = nil
+	return output
+}
+
+func redactBytes(data []byte, values []string) []byte {
+	out := append([]byte(nil), data...)
+	for _, value := range values {
+		out = bytes.ReplaceAll(out, []byte(value), []byte("<redacted>"))
+	}
+	return out
+}

internal/adapters/subprocess/doc.go

@@ -1,3 +1,4 @@
-// Package subprocess provides reusable process execution and generated-config helpers.
+// Package subprocess provides internal process execution and Narratio-specific
+// subprocess policy. Its private execution mechanism owns process lifecycle;
+// the Run boundary owns environments, diagnostics, redaction, and errors.
 package subprocess
-

internal/adapters/subprocess/execution.go

@@ -0,0 +1,91 @@
+package subprocess
+
+import (
+	"context"
+	"fmt"
+	"os/exec"
+	"time"
+)
+
+type executionReason uint8
+
+const (
+	executionNotStarted executionReason = iota
+	executionNaturalExit
+	executionCanceled
+	executionDeadline
+	executionAborted
+)
+
+type executionOutcome struct {
+	reason      executionReason
+	startedAt   time.Time
+	completedAt time.Time
+	exitCode    int
+	startErr    error
+	waitErr     error
+	contextErr  error
+	abortErr    error
+	cleanupErr  error
+}
+
+func executeOwnedCommand(ctx context.Context, cmd *exec.Cmd, abort <-chan error) (outcome executionOutcome) {
+	outcome = executionOutcome{startedAt: time.Now().UTC(), exitCode: -1}
+	defer func() { outcome.completedAt = time.Now().UTC() }()
+	if outcome.contextErr = ctx.Err(); outcome.contextErr != nil {
+		outcome.reason = executionNotStarted
+		return outcome
+	}
+	tree, err := newOwnedProcessTree()
+	if err != nil {
+		outcome.reason, outcome.startErr = executionNotStarted, err
+		return outcome
+	}
+	defer func() { outcome.cleanupErr = joinErrors(outcome.cleanupErr, tree.Dispose()) }()
+	cmd.WaitDelay = forcefulTerminationWait
+	if outcome.startErr = tree.Start(cmd); outcome.startErr != nil {
+		outcome.reason = executionNotStarted
+		return outcome
+	}
+	waitCh := make(chan error, 1)
+	go func() { waitCh <- cmd.Wait() }()
+	select {
+	case outcome.waitErr = <-waitCh:
+		outcome.reason = executionNaturalExit
+	case <-ctx.Done():
+		outcome.contextErr = ctx.Err()
+		if outcome.contextErr == context.DeadlineExceeded {
+			outcome.reason = executionDeadline
+		} else {
+			outcome.reason = executionCanceled
+		}
+		outcome.waitErr, outcome.cleanupErr = terminateAndReap(tree, waitCh)
+	case outcome.abortErr = <-abort:
+		outcome.reason = executionAborted
+		outcome.waitErr, outcome.cleanupErr = terminateAndReap(tree, waitCh)
+	}
+	if cmd.ProcessState != nil {
+		outcome.exitCode = cmd.ProcessState.ExitCode()
+	}
+	return outcome
+}
+
+func terminateAndReap(tree ownedProcessTree, waitCh <-chan error) (waitErr, cleanupErr error) {
+	cleanupErr = tree.TerminateGracefully()
+	timer := time.NewTimer(gracefulTerminationWait)
+	defer timer.Stop()
+	select {
+	case waitErr = <-waitCh:
+		return waitErr, joinErrors(cleanupErr, tree.TerminateForcefully())
+	case <-timer.C:
+	}
+	cleanupErr = joinErrors(cleanupErr, tree.TerminateForcefully())
+	forcefulTimer := time.NewTimer(forcefulTerminationWait)
+	defer forcefulTimer.Stop()
+	select {
+	case waitErr = <-waitCh:
+		return waitErr, cleanupErr
+	case <-forcefulTimer.C:
+		return nil, joinErrors(cleanupErr, fmt.Errorf("owned subprocess did not reap within %s after forceful termination", forcefulTerminationWait))
+	}
+}

internal/adapters/subprocess/execution_test.go

@@ -0,0 +1,54 @@
+package subprocess
+
+import (
+	"errors"
+	"os/exec"
+	"testing"
+)
+
+func TestTerminateAndReapPreservesWaitAndCleanupErrors(t *testing.T) {
+	waitErr := errors.New("wait failed")
+	gracefulErr := errors.New("graceful termination failed")
+	forcefulErr := errors.New("forceful termination failed")
+	tree := &recordingProcessTree{
+		gracefulErr: gracefulErr,
+		forcefulErr: forcefulErr,
+	}
+	waitCh := make(chan error, 1)
+	waitCh <- waitErr
+
+	gotWaitErr, gotCleanupErr := terminateAndReap(tree, waitCh)
+	if !errors.Is(gotWaitErr, waitErr) {
+		t.Fatalf("wait error = %v, want %v", gotWaitErr, waitErr)
+	}
+	for _, want := range []error{gracefulErr, forcefulErr} {
+		if !errors.Is(gotCleanupErr, want) {
+			t.Fatalf("cleanup error = %v, want wrapped %v", gotCleanupErr, want)
+		}
+	}
+	if tree.gracefulCalls != 1 || tree.forcefulCalls != 1 {
+		t.Fatalf("termination calls = graceful %d, forceful %d; want 1 each", tree.gracefulCalls, tree.forcefulCalls)
+	}
+}
+
+type recordingProcessTree struct {
+	gracefulErr error
+	forcefulErr error
+
+	gracefulCalls int
+	forcefulCalls int
+}
+
+func (*recordingProcessTree) Start(*exec.Cmd) error { return nil }
+
+func (tree *recordingProcessTree) TerminateGracefully() error {
+	tree.gracefulCalls++
+	return tree.gracefulErr
+}
+
+func (tree *recordingProcessTree) TerminateForcefully() error {
+	tree.forcefulCalls++
+	return tree.forcefulErr
+}
+
+func (*recordingProcessTree) Dispose() error { return nil }

internal/adapters/subprocess/process_tree.go

@@ -0,0 +1,31 @@
+package subprocess
+
+import (
+	"errors"
+	"os/exec"
+	"time"
+)
+
+const (
+	gracefulTerminationWait = 2 * time.Second
+	forcefulTerminationWait = 2 * time.Second
+)
+
+// ownedProcessTree owns every process started by a command invocation.
+// Implementations must tolerate a leader that has already exited.
+type ownedProcessTree interface {
+	Start(*exec.Cmd) error
+	TerminateGracefully() error
+	TerminateForcefully() error
+	Dispose() error
+}
+
+func joinErrors(errs ...error) error {
+	filtered := make([]error, 0, len(errs))
+	for _, err := range errs {
+		if err != nil {
+			filtered = append(filtered, err)
+		}
+	}
+	return errors.Join(filtered...)
+}

internal/adapters/subprocess/process_tree_supported_test.go

@@ -0,0 +1,227 @@
+//go:build linux || darwin || windows
+
+package subprocess
+
+import (
+	"context"
+	"errors"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestRunCancellationTerminatesProcessTree(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	resultCh := make(chan runOutcome, 1)
+	req, sentinelPath := processTreeRequest(t)
+	go func() {
+		result, err := Run(ctx, req)
+		resultCh <- runOutcome{result: result, err: err}
+	}()
+
+	awaitHelperReady(t, req.EnvOverrides["SUBPROCESS_HELPER_READY_PATH"])
+	cancel()
+
+	outcome := awaitRunOutcome(t, resultCh)
+	if !outcome.result.Canceled {
+		t.Fatalf("Canceled = %v, want true", outcome.result.Canceled)
+	}
+	if !errors.Is(outcome.err, context.Canceled) {
+		t.Fatalf("error = %v, want context cancellation", outcome.err)
+	}
+	assertDescendantDidNotSurvive(t, sentinelPath)
+}
+
+func TestRunTimeoutTerminatesProcessTree(t *testing.T) {
+	req, sentinelPath := processTreeRequest(t)
+	req.Timeout = 100 * time.Millisecond
+
+	result, err := Run(context.Background(), req)
+	if !result.TimedOut {
+		t.Fatalf("TimedOut = %v, want true", result.TimedOut)
+	}
+	if !errors.Is(err, context.DeadlineExceeded) {
+		t.Fatalf("error = %v, want context deadline exceeded", err)
+	}
+	assertDescendantDidNotSurvive(t, sentinelPath)
+}
+
+func TestRunCaptureLimitTerminatesProcessTree(t *testing.T) {
+	req, sentinelPath := processTreeRequest(t)
+	req.Args[len(req.Args)-1] = "tree-spam"
+
+	result, err := Run(context.Background(), req)
+	if err == nil {
+		t.Fatal("Run() error = nil, want capture-limit error")
+	}
+	if result.ExitCode == 0 {
+		t.Fatalf("ExitCode = %d, want terminated process", result.ExitCode)
+	}
+	if !strings.Contains(err.Error(), "stdout diagnostic capture for subprocess exceeded") {
+		t.Fatalf("error = %q, want stdout capture-limit context", err)
+	}
+	info, statErr := os.Stat(req.StdoutLogPath)
+	if statErr != nil {
+		t.Fatalf("stat stdout diagnostic: %v", statErr)
+	}
+	if info.Size() != MaxStdoutDiagnosticBytes {
+		t.Fatalf("stdout diagnostic size = %d, want %d", info.Size(), MaxStdoutDiagnosticBytes)
+	}
+	assertDescendantDidNotSurvive(t, sentinelPath)
+}
+
+func TestRunDisposesDescendantsAfterLeaderExit(t *testing.T) {
+	tests := []struct {
+		name          string
+		mode          string
+		wantExitCode  int
+		wantWaitDelay bool
+		ignoreTerm    bool
+	}{
+		{name: "success retaining streams", mode: "leader-exit-retained", wantExitCode: 0, wantWaitDelay: true},
+		{name: "success redirecting streams", mode: "leader-exit-redirected", wantExitCode: 0},
+		{name: "failed leader", mode: "leader-fail-redirected", wantExitCode: 9, ignoreTerm: true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			req, sentinelPath, releasePath := leaderExitRequest(t, tt.mode)
+			if tt.ignoreTerm {
+				req.EnvOverrides["SUBPROCESS_HELPER_IGNORE_TERM"] = "1"
+			}
+			outcomes := make(chan runOutcome, 1)
+			go func() {
+				result, err := Run(context.Background(), req)
+				outcomes <- runOutcome{result: result, err: err}
+			}()
+
+			var outcome runOutcome
+			select {
+			case outcome = <-outcomes:
+			case <-time.After(6 * time.Second):
+				t.Fatal("Run() did not complete bounded owned-tree disposal")
+			}
+			if outcome.result.ExitCode != tt.wantExitCode {
+				t.Fatalf("ExitCode = %d, want %d", outcome.result.ExitCode, tt.wantExitCode)
+			}
+			if tt.wantWaitDelay {
+				if !errors.Is(outcome.err, exec.ErrWaitDelay) {
+					t.Fatalf("error = %v, want exec.ErrWaitDelay", outcome.err)
+				}
+			} else if tt.wantExitCode == 0 && outcome.err != nil {
+				t.Fatalf("Run() error = %v, want nil", outcome.err)
+			} else if tt.wantExitCode != 0 {
+				var exitErr *exec.ExitError
+				if !errors.As(outcome.err, &exitErr) || exitErr.ExitCode() != tt.wantExitCode {
+					t.Fatalf("error = %v, want exit code %d", outcome.err, tt.wantExitCode)
+				}
+			}
+			if _, err := os.Stat(req.EnvOverrides["SUBPROCESS_HELPER_READY_PATH"]); err != nil {
+				t.Fatalf("descendant readiness file: %v", err)
+			}
+			if err := os.WriteFile(releasePath, []byte("release"), 0o600); err != nil {
+				t.Fatalf("WriteFile(release) error = %v", err)
+			}
+			assertDescendantDidNotSurvive(t, sentinelPath)
+		})
+	}
+}
+
+type runOutcome struct {
+	result RunResult
+	err    error
+}
+
+func processTreeRequest(t *testing.T) (RunRequest, string) {
+	t.Helper()
+
+	executable, err := os.Executable()
+	if err != nil {
+		t.Fatalf("os.Executable() error = %v", err)
+	}
+	dir := t.TempDir()
+	readyPath := filepath.Join(dir, "ready")
+	sentinelPath := filepath.Join(dir, "descendant-survived")
+	return RunRequest{
+		Executable: executable,
+		Args:       []string{"-test.run=^TestSubprocessHelper$", "--", "tree"},
+		EnvOverrides: map[string]string{
+			"GO_WANT_SUBPROCESS_HELPER":       "1",
+			"SUBPROCESS_HELPER_READY_PATH":    readyPath,
+			"SUBPROCESS_HELPER_SENTINEL_PATH": sentinelPath,
+		},
+		StdoutLogPath: filepath.Join(dir, "stdout.log"),
+		StderrLogPath: filepath.Join(dir, "stderr.log"),
+	}, sentinelPath
+}
+
+func leaderExitRequest(t *testing.T, mode string) (RunRequest, string, string) {
+	t.Helper()
+
+	executable, err := os.Executable()
+	if err != nil {
+		t.Fatalf("os.Executable() error = %v", err)
+	}
+	dir := t.TempDir()
+	readyPath := filepath.Join(dir, "ready")
+	releasePath := filepath.Join(dir, "release")
+	sentinelPath := filepath.Join(dir, "descendant-survived")
+	return RunRequest{
+		Executable: executable,
+		Args:       []string{"-test.run=^TestSubprocessHelper$", "--", mode},
+		EnvOverrides: map[string]string{
+			"GO_WANT_SUBPROCESS_HELPER":       "1",
+			"SUBPROCESS_HELPER_READY_PATH":    readyPath,
+			"SUBPROCESS_HELPER_RELEASE_PATH":  releasePath,
+			"SUBPROCESS_HELPER_SENTINEL_PATH": sentinelPath,
+		},
+		StdoutLogPath: filepath.Join(dir, "stdout.log"),
+		StderrLogPath: filepath.Join(dir, "stderr.log"),
+	}, sentinelPath, releasePath
+}
+
+func awaitHelperReady(t *testing.T, readyPath string) {
+	t.Helper()
+
+	deadline := time.Now().Add(2 * time.Second)
+	for time.Now().Before(deadline) {
+		if _, err := os.Stat(readyPath); err == nil {
+			return
+		} else if !errors.Is(err, os.ErrNotExist) {
+			t.Fatalf("stat helper readiness: %v", err)
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	t.Fatal("helper did not start its descendant")
+}
+
+func awaitRunOutcome(t *testing.T, outcomes <-chan runOutcome) runOutcome {
+	t.Helper()
+
+	select {
+	case outcome := <-outcomes:
+		if outcome.err == nil {
+			t.Fatal("Run() error = nil, want cancellation error")
+		}
+		return outcome
+	case <-time.After(3 * time.Second):
+		t.Fatal("Run() did not return after cancellation")
+		return runOutcome{}
+	}
+}
+
+func assertDescendantDidNotSurvive(t *testing.T, sentinelPath string) {
+	t.Helper()
+
+	time.Sleep(700 * time.Millisecond)
+	if _, err := os.Stat(sentinelPath); err == nil {
+		t.Fatal("descendant survived cancellation and wrote its sentinel")
+	} else if !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("stat descendant sentinel: %v", err)
+	}
+}

internal/adapters/subprocess/process_tree_unix.go

@@ -0,0 +1,104 @@
+//go:build linux || darwin
+
+package subprocess
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"syscall"
+	"time"
+)
+
+const processGroupPollInterval = 10 * time.Millisecond
+
+type unixProcessTree struct {
+	processGroupID int
+}
+
+func newOwnedProcessTree() (ownedProcessTree, error) {
+	return &unixProcessTree{}, nil
+}
+
+func (tree *unixProcessTree) Start(cmd *exec.Cmd) error {
+	cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
+	if err := cmd.Start(); err != nil {
+		return err
+	}
+	tree.processGroupID = cmd.Process.Pid
+	return nil
+}
+
+func (tree *unixProcessTree) TerminateGracefully() error {
+	return tree.signal(syscall.SIGTERM)
+}
+
+func (tree *unixProcessTree) TerminateForcefully() error {
+	return tree.signal(syscall.SIGKILL)
+}
+
+func (tree *unixProcessTree) Dispose() error {
+	hasMembers, err := tree.hasMembers()
+	if err != nil || !hasMembers {
+		return err
+	}
+
+	cleanupErr := tree.TerminateGracefully()
+	empty, waitErr := tree.waitUntilEmpty(gracefulTerminationWait)
+	cleanupErr = joinErrors(cleanupErr, waitErr)
+	if empty {
+		return cleanupErr
+	}
+
+	cleanupErr = joinErrors(cleanupErr, tree.TerminateForcefully())
+	empty, waitErr = tree.waitUntilEmpty(forcefulTerminationWait)
+	cleanupErr = joinErrors(cleanupErr, waitErr)
+	if !empty {
+		cleanupErr = joinErrors(cleanupErr, fmt.Errorf("owned subprocess group did not exit within %s after forceful termination", forcefulTerminationWait))
+	}
+	return cleanupErr
+}
+
+func (tree *unixProcessTree) signal(signal syscall.Signal) error {
+	if tree.processGroupID <= 0 {
+		return nil
+	}
+	err := syscall.Kill(-tree.processGroupID, signal)
+	if errors.Is(err, syscall.ESRCH) || errors.Is(err, os.ErrProcessDone) {
+		return nil
+	}
+	return err
+}
+
+func (tree *unixProcessTree) hasMembers() (bool, error) {
+	if tree.processGroupID <= 0 {
+		return false, nil
+	}
+	err := syscall.Kill(-tree.processGroupID, 0)
+	if err == nil || errors.Is(err, syscall.EPERM) {
+		return true, nil
+	}
+	if errors.Is(err, syscall.ESRCH) || errors.Is(err, os.ErrProcessDone) {
+		return false, nil
+	}
+	return false, fmt.Errorf("inspect owned subprocess group: %w", err)
+}
+
+func (tree *unixProcessTree) waitUntilEmpty(timeout time.Duration) (bool, error) {
+	deadline := time.Now().Add(timeout)
+	for {
+		hasMembers, err := tree.hasMembers()
+		if err != nil || !hasMembers {
+			return !hasMembers, err
+		}
+		remaining := time.Until(deadline)
+		if remaining <= 0 {
+			return false, nil
+		}
+		if remaining > processGroupPollInterval {
+			remaining = processGroupPollInterval
+		}
+		time.Sleep(remaining)
+	}
+}

internal/adapters/subprocess/process_tree_unsupported.go

@@ -0,0 +1,12 @@
+//go:build !linux && !darwin && !windows
+
+package subprocess
+
+import (
+	"fmt"
+	"runtime"
+)
+
+func newOwnedProcessTree() (ownedProcessTree, error) {
+	return nil, fmt.Errorf("owned subprocess trees are unsupported on %s", runtime.GOOS)
+}

internal/adapters/subprocess/process_tree_windows.go

@@ -0,0 +1,145 @@
+//go:build windows
+
+package subprocess
+
+import (
+	"errors"
+	"fmt"
+	"os/exec"
+	"syscall"
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+)
+
+type windowsProcessTree struct {
+	job windows.Handle
+}
+
+func newOwnedProcessTree() (ownedProcessTree, error) {
+	return &windowsProcessTree{}, nil
+}
+
+func (tree *windowsProcessTree) Start(cmd *exec.Cmd) error {
+	job, err := windows.CreateJobObject(nil, nil)
+	if err != nil {
+		return fmt.Errorf("create job object: %w", err)
+	}
+
+	limits := windows.JOBOBJECT_EXTENDED_LIMIT_INFORMATION{}
+	limits.BasicLimitInformation.LimitFlags = windows.JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE
+	if _, err := windows.SetInformationJobObject(job, windows.JobObjectExtendedLimitInformation, uintptr(unsafe.Pointer(&limits)), uint32(unsafe.Sizeof(limits))); err != nil {
+		_ = windows.CloseHandle(job)
+		return fmt.Errorf("configure job object: %w", err)
+	}
+
+	cmd.SysProcAttr = &syscall.SysProcAttr{CreationFlags: windows.CREATE_SUSPENDED}
+	if err := cmd.Start(); err != nil {
+		_ = windows.CloseHandle(job)
+		return err
+	}
+
+	var assignErr error
+	withHandleErr := cmd.Process.WithHandle(func(handle uintptr) {
+		assignErr = windows.AssignProcessToJobObject(job, windows.Handle(handle))
+	})
+	if withHandleErr != nil {
+		return failWindowsProcessStart(cmd, job, fmt.Errorf("acquire stable process handle for job assignment: %w", withHandleErr))
+	}
+	if assignErr != nil {
+		return failWindowsProcessStart(cmd, job, fmt.Errorf("assign process to job object: %w", assignErr))
+	}
+	if err := resumeInitialThread(uint32(cmd.Process.Pid)); err != nil {
+		return failWindowsProcessStart(cmd, job, fmt.Errorf("resume initial process thread: %w", err))
+	}
+
+	tree.job = job
+	return nil
+}
+
+func failWindowsProcessStart(cmd *exec.Cmd, job windows.Handle, setupErr error) error {
+	killErr := cmd.Process.Kill()
+	waitErr := cmd.Wait()
+	var exitErr *exec.ExitError
+	if killErr == nil && errors.As(waitErr, &exitErr) {
+		// A killed suspended child normally reports a non-zero exit from Wait;
+		// successful reaping is not an additional setup failure.
+		waitErr = nil
+	}
+	return joinErrors(
+		setupErr,
+		wrapWindowsProcessCleanupError("kill suspended child", killErr),
+		wrapWindowsProcessCleanupError("reap suspended child", waitErr),
+		wrapWindowsProcessCleanupError("close unowned job object", windows.CloseHandle(job)),
+	)
+}
+
+func wrapWindowsProcessCleanupError(operation string, err error) error {
+	if err == nil {
+		return nil
+	}
+	return fmt.Errorf("%s: %w", operation, err)
+}
+
+func resumeInitialThread(processID uint32) error {
+	snapshot, err := windows.CreateToolhelp32Snapshot(windows.TH32CS_SNAPTHREAD, 0)
+	if err != nil {
+		return fmt.Errorf("snapshot initial thread: %w", err)
+	}
+	defer func() { _ = windows.CloseHandle(snapshot) }()
+
+	entry := windows.ThreadEntry32{Size: uint32(unsafe.Sizeof(windows.ThreadEntry32{}))}
+	if err := windows.Thread32First(snapshot, &entry); err != nil {
+		return fmt.Errorf("find initial thread: %w", err)
+	}
+	for {
+		if entry.OwnerProcessID != processID {
+			// Keep enumerating until the suspended process's only initial thread
+			// is found.
+		} else {
+			thread, openErr := windows.OpenThread(windows.THREAD_SUSPEND_RESUME, false, entry.ThreadID)
+			if openErr != nil {
+				return fmt.Errorf("open initial thread: %w", openErr)
+			}
+			defer func() { _ = windows.CloseHandle(thread) }()
+			if _, resumeErr := windows.ResumeThread(thread); resumeErr != nil {
+				return fmt.Errorf("resume initial thread: %w", resumeErr)
+			}
+			return nil
+		}
+
+		if err := windows.Thread32Next(snapshot, &entry); err != nil {
+			if errors.Is(err, windows.ERROR_NO_MORE_FILES) {
+				break
+			}
+			return fmt.Errorf("find initial thread: %w", err)
+		}
+	}
+	return fmt.Errorf("find initial thread: no thread found for process %d", processID)
+}
+
+func (tree *windowsProcessTree) TerminateGracefully() error {
+	// Windows jobs have no portable graceful signal. Terminating the owned job
+	// is the safe fallback and prevents a descendant from escaping cleanup.
+	return tree.terminate()
+}
+
+func (tree *windowsProcessTree) TerminateForcefully() error {
+	return tree.terminate()
+}
+
+func (tree *windowsProcessTree) Dispose() error {
+	if tree.job == 0 {
+		return nil
+	}
+	err := windows.CloseHandle(tree.job)
+	tree.job = 0
+	return err
+}
+
+func (tree *windowsProcessTree) terminate() error {
+	if tree.job == 0 {
+		return nil
+	}
+	return windows.TerminateJobObject(tree.job, 1)
+}

internal/adapters/subprocess/run.go

@@ -2,28 +2,24 @@ package subprocess
 
 import (
 	"context"
-	"errors"
 	"fmt"
-	"io"
 	"os"
 	"os/exec"
-	"path/filepath"
-	"sort"
 	"strings"
 	"time"
-
-	"gopkg.in/yaml.v3"
 )
 
 // RunRequest defines a subprocess invocation.
 type RunRequest struct {
-	Executable    string
-	Args          []string
-	WorkingDir    string
-	EnvOverrides  map[string]string
-	Timeout       time.Duration
-	StdoutLogPath string
-	StderrLogPath string
+	Executable        string
+	Args              []string
+	WorkingDir        string
+	EnvOverrides      map[string]string
+	SensitiveEnvNames []string
+	DiagnosticOwner   string
+	Timeout           time.Duration
+	StdoutLogPath     string
+	StderrLogPath     string
 }
 
 // RunResult captures subprocess execution details.
@@ -54,212 +50,59 @@ func Run(ctx context.Context, req RunRequest) (RunResult, error) {
 	}
 	defer cancel()
 
-	logs, err := openLogWriters(req.StdoutLogPath, req.StderrLogPath)
+	childEnv := buildChildEnvironment(os.Environ(), req.EnvOverrides)
+	logs, err := openLogWriters(req.StdoutLogPath, req.StderrLogPath, req.diagnosticOwner(), sensitiveEnvironmentValues(childEnv, req.SensitiveEnvNames))
 	if err != nil {
 		return RunResult{}, err
 	}
 	defer logs.Close()
 
-	cmd := exec.CommandContext(runCtx, req.Executable, req.Args...)
+	cmd := exec.Command(req.Executable, req.Args...)
 	cmd.Dir = req.WorkingDir
-	cmd.Env = mergeEnv(os.Environ(), req.EnvOverrides)
+	cmd.Env = childEnv
 	cmd.Stdout = logs.Stdout
 	cmd.Stderr = logs.Stderr
-
-	started := time.Now().UTC()
-	result := RunResult{
-		ExitCode:      -1,
-		StartedAt:     started,
-		StdoutLogPath: req.StdoutLogPath,
-		StderrLogPath: req.StderrLogPath,
+	outcome := executeOwnedCommand(runCtx, cmd, logs.Limits())
+	cleanupErr := joinErrors(outcome.cleanupErr, logs.Flush())
+	captureLimit, _ := outcome.abortErr.(*captureLimitError)
+	if captureLimit == nil {
+		captureLimit = logs.Limit()
 	}
-
-	if err := cmd.Start(); err != nil {
-		result.CompletedAt = time.Now().UTC()
-		result.Duration = result.CompletedAt.Sub(result.StartedAt)
-		return result, fmt.Errorf("start command %q with args %v: %w", req.Executable, req.Args, err)
-	}
-
-	waitErr := cmd.Wait()
-	result.CompletedAt = time.Now().UTC()
+	result := RunResult{ExitCode: outcome.exitCode, StartedAt: outcome.startedAt, CompletedAt: outcome.completedAt, StdoutLogPath: req.StdoutLogPath, StderrLogPath: req.StderrLogPath}
 	result.Duration = result.CompletedAt.Sub(result.StartedAt)
-	if cmd.ProcessState != nil {
-		result.ExitCode = cmd.ProcessState.ExitCode()
-	}
+	result.TimedOut = outcome.reason == executionDeadline
+	result.Canceled = outcome.reason == executionCanceled
 
-	ctxErr := runCtx.Err()
-	if errors.Is(ctxErr, context.DeadlineExceeded) {
-		result.TimedOut = true
-	}
-	if errors.Is(ctxErr, context.Canceled) && !result.TimedOut {
-		result.Canceled = true
-	}
-
-	if waitErr == nil {
+	if outcome.reason == executionNaturalExit && outcome.waitErr == nil && cleanupErr == nil {
 		return result, nil
 	}
 
-	stderrTail := readRedactedTail(req.StderrLogPath, req.EnvOverrides, 2048)
+	stderrTail := logs.stderr.Tail()
 	diagnostics := buildDiagnostics(req, result, stderrTail)
 
+	if captureLimit != nil {
+		if cause := joinErrors(outcome.waitErr, cleanupErr); cause != nil {
+			return result, fmt.Errorf("%w (%s): %w", captureLimit, diagnostics, cause)
+		}
+		return result, fmt.Errorf("%w (%s)", captureLimit, diagnostics)
+	}
 	if result.TimedOut {
-		return result, fmt.Errorf("command timed out after %s (%s)", req.Timeout, diagnostics)
+		return result, fmt.Errorf("command timed out after %s (%s): %w", req.Timeout, diagnostics, joinErrors(outcome.contextErr, outcome.waitErr, cleanupErr))
 	}
 	if result.Canceled {
-		return result, fmt.Errorf("command canceled (%s)", diagnostics)
+		return result, fmt.Errorf("command canceled (%s): %w", diagnostics, joinErrors(outcome.contextErr, outcome.waitErr, cleanupErr))
 	}
-	if exitErr, ok := waitErr.(*exec.ExitError); ok {
-		return result, fmt.Errorf("command failed with exit code %d (%s): %w", exitErr.ExitCode(), diagnostics, waitErr)
+	if exitErr, ok := outcome.waitErr.(*exec.ExitError); ok {
+		return result, fmt.Errorf("command failed with exit code %d (%s): %w", exitErr.ExitCode(), diagnostics, joinErrors(outcome.waitErr, cleanupErr))
+	}
+	if cleanupErr != nil {
+		return result, fmt.Errorf("command cleanup failed (%s): %w", diagnostics, joinErrors(outcome.waitErr, cleanupErr))
 	}
 
-	return result, fmt.Errorf("command failed to run (%s): %w", diagnostics, waitErr)
-}
-
-// WriteYAMLAtomic marshals value as YAML and atomically writes it to path.
-func WriteYAMLAtomic(path string, value any, perm os.FileMode) error {
-	data, err := yaml.Marshal(value)
-	if err != nil {
-		return fmt.Errorf("marshal yaml for %q: %w", path, err)
-	}
-	if err := WriteFileAtomic(path, data, perm); err != nil {
-		return fmt.Errorf("write yaml %q: %w", path, err)
-	}
-	return nil
-}
-
-// WriteFileAtomic writes bytes via same-directory temp file + atomic rename.
-func WriteFileAtomic(path string, data []byte, perm os.FileMode) error {
-	if strings.TrimSpace(path) == "" {
-		return fmt.Errorf("write file: path is required")
-	}
-
-	dir := filepath.Dir(path)
-	if err := os.MkdirAll(dir, 0o755); err != nil {
-		return fmt.Errorf("create parent directory %q: %w", dir, err)
-	}
-
-	base := filepath.Base(path)
-	tmp, err := os.CreateTemp(dir, "."+base+".tmp-*")
-	if err != nil {
-		return fmt.Errorf("create temp file: %w", err)
-	}
-	tmpPath := tmp.Name()
-	removeTmp := true
-	defer func() {
-		if removeTmp {
-			_ = os.Remove(tmpPath)
-		}
-	}()
-
-	if _, err := tmp.Write(data); err != nil {
-		_ = tmp.Close()
-		return fmt.Errorf("write temp file: %w", err)
-	}
-	if err := tmp.Sync(); err != nil {
-		_ = tmp.Close()
-		return fmt.Errorf("sync temp file: %w", err)
-	}
-	if err := tmp.Close(); err != nil {
-		return fmt.Errorf("close temp file: %w", err)
-	}
-	if err := os.Chmod(tmpPath, perm); err != nil {
-		return fmt.Errorf("chmod temp file: %w", err)
-	}
-	if err := os.Rename(tmpPath, path); err != nil {
-		return fmt.Errorf("rename temp file: %w", err)
-	}
-	removeTmp = false
-	return nil
-}
-
-type logWriters struct {
-	files  []*os.File
-	Stdout io.Writer
-	Stderr io.Writer
-}
-
-func (l *logWriters) Close() {
-	for _, f := range l.files {
-		_ = f.Close()
-	}
-}
-
-func openLogWriters(stdoutPath, stderrPath string) (*logWriters, error) {
-	cleanStdout := cleanLogPath(stdoutPath)
-	cleanStderr := cleanLogPath(stderrPath)
-
-	// Keep stdout/stderr on the same file descriptor when both paths target
-	// the same file to avoid descriptor aliasing surprises across runtimes.
-	if cleanStdout != "" && cleanStdout == cleanStderr {
-		f, err := openLogFile(cleanStdout)
-		if err != nil {
-			return nil, fmt.Errorf("open shared stdout/stderr log %q: %w", cleanStdout, err)
-		}
-		return &logWriters{
-			files:  []*os.File{f},
-			Stdout: f,
-			Stderr: f,
-		}, nil
-	}
-
-	stdoutFile, stdoutWriter, err := logWriter(cleanStdout)
-	if err != nil {
-		return nil, fmt.Errorf("open stdout log: %w", err)
-	}
-	stderrFile, stderrWriter, err := logWriter(cleanStderr)
-	if err != nil {
-		closeFile(stdoutFile)
-		return nil, fmt.Errorf("open stderr log: %w", err)
-	}
-
-	files := make([]*os.File, 0, 2)
-	if stdoutFile != nil {
-		files = append(files, stdoutFile)
-	}
-	if stderrFile != nil {
-		files = append(files, stderrFile)
-	}
-	return &logWriters{
-		files:  files,
-		Stdout: stdoutWriter,
-		Stderr: stderrWriter,
-	}, nil
-}
-
-func cleanLogPath(path string) string {
-	trimmed := strings.TrimSpace(path)
-	if trimmed == "" {
-		return ""
-	}
-	return filepath.Clean(trimmed)
-}
-
-func logWriter(path string) (*os.File, io.Writer, error) {
-	if strings.TrimSpace(path) == "" {
-		return nil, io.Discard, nil
-	}
-	f, err := openLogFile(path)
-	if err != nil {
-		return nil, nil, err
-	}
-	return f, f, nil
-}
-
-func openLogFile(path string) (*os.File, error) {
-	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
-		return nil, fmt.Errorf("create log directory for %q: %w", path, err)
-	}
-	f, err := os.Create(path)
-	if err != nil {
-		return nil, fmt.Errorf("open log file %q: %w", path, err)
-	}
-	return f, nil
-}
-
-func closeFile(f *os.File) {
-	if f != nil {
-		_ = f.Close()
+	if outcome.startErr != nil {
+		return result, fmt.Errorf("start command %q with args %v: %w", req.Executable, req.Args, outcome.startErr)
 	}
+	return result, fmt.Errorf("command failed to run (%s): %w", diagnostics, joinErrors(outcome.waitErr, outcome.contextErr, outcome.abortErr, cleanupErr))
 }
 
 func buildDiagnostics(req RunRequest, result RunResult, stderrTail string) string {
@@ -298,87 +141,3 @@ func fdDiagnosticsHint(exitCode int, stderrTail string) string {
 	}
 	return ""
 }
-
-func readRedactedTail(path string, envOverrides map[string]string, maxBytes int64) string {
-	if strings.TrimSpace(path) == "" || maxBytes <= 0 {
-		return ""
-	}
-	f, err := os.Open(path)
-	if err != nil {
-		return ""
-	}
-	defer f.Close()
-
-	info, err := f.Stat()
-	if err != nil {
-		return ""
-	}
-	size := info.Size()
-	start := int64(0)
-	if size > maxBytes {
-		start = size - maxBytes
-	}
-	if _, err := f.Seek(start, io.SeekStart); err != nil {
-		return ""
-	}
-	data, err := io.ReadAll(f)
-	if err != nil {
-		return ""
-	}
-	tail := strings.TrimSpace(string(data))
-	if tail == "" {
-		return ""
-	}
-	return redactSensitiveTail(tail, envOverrides)
-}
-
-func redactSensitiveTail(tail string, envOverrides map[string]string) string {
-	out := tail
-	for k, v := range envOverrides {
-		if strings.TrimSpace(v) == "" {
-			continue
-		}
-		if looksSensitiveEnvKey(k) {
-			out = strings.ReplaceAll(out, v, "<redacted>")
-		}
-	}
-	return out
-}
-
-func looksSensitiveEnvKey(key string) bool {
-	k := strings.ToUpper(strings.TrimSpace(key))
-	return strings.Contains(k, "KEY") ||
-		strings.Contains(k, "TOKEN") ||
-		strings.Contains(k, "SECRET") ||
-		strings.Contains(k, "PASSWORD")
-}
-
-func mergeEnv(base []string, overrides map[string]string) []string {
-	if len(overrides) == 0 {
-		return base
-	}
-
-	kv := make(map[string]string, len(base)+len(overrides))
-	for _, item := range base {
-		k, v, ok := strings.Cut(item, "=")
-		if !ok {
-			continue
-		}
-		kv[k] = v
-	}
-	for k, v := range overrides {
-		kv[k] = v
-	}
-
-	keys := make([]string, 0, len(kv))
-	for k := range kv {
-		keys = append(keys, k)
-	}
-	sort.Strings(keys)
-
-	out := make([]string, 0, len(keys))
-	for _, k := range keys {
-		out = append(out, k+"="+kv[k])
-	}
-	return out
-}

internal/adapters/subprocess/run_test.go

@@ -1,14 +1,19 @@
 package subprocess
 
 import (
+	"bytes"
 	"context"
+	"errors"
 	"os"
+	"os/exec"
+	"os/signal"
 	"path/filepath"
+	"runtime"
+	"strconv"
 	"strings"
+	"syscall"
 	"testing"
 	"time"
-
-	"gopkg.in/yaml.v3"
 )
 
 func TestRunSuccessCapturesStdoutStderr(t *testing.T) {
@@ -120,6 +125,316 @@ func TestRunFailureRedactsSensitiveTail(t *testing.T) {
 	if !strings.Contains(err.Error(), "<redacted>") {
 		t.Fatalf("error = %q, want redacted stderr tail marker", err.Error())
 	}
+	for _, path := range []string{req.StdoutLogPath, req.StderrLogPath} {
+		data, readErr := os.ReadFile(path)
+		if readErr != nil {
+			t.Fatalf("read diagnostic %q: %v", path, readErr)
+		}
+		if strings.Contains(string(data), secretValue) {
+			t.Fatalf("diagnostic %q leaked secret: %q", path, data)
+		}
+	}
+}
+
+func TestRunRejectsSymlinkDiagnosticWithoutTruncatingTarget(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("creating symlinks requires privileges that are not available on every Windows runner")
+	}
+	exe, err := os.Executable()
+	if err != nil {
+		t.Fatalf("os.Executable() error = %v", err)
+	}
+
+	dir := t.TempDir()
+	targetPath := filepath.Join(dir, "outside.log")
+	const original = "must remain unchanged"
+	if err := os.WriteFile(targetPath, []byte(original), 0o600); err != nil {
+		t.Fatalf("WriteFile(target) error = %v", err)
+	}
+	stdoutPath := filepath.Join(dir, "stdout.log")
+	if err := os.Symlink(targetPath, stdoutPath); err != nil {
+		t.Fatalf("Symlink() error = %v", err)
+	}
+
+	_, err = Run(context.Background(), RunRequest{
+		Executable:    exe,
+		Args:          []string{"-test.run=^TestSubprocessHelper$", "--", "success"},
+		EnvOverrides:  map[string]string{"GO_WANT_SUBPROCESS_HELPER": "1"},
+		StdoutLogPath: stdoutPath,
+		StderrLogPath: filepath.Join(dir, "stderr.log"),
+	})
+	if err != nil {
+		t.Fatalf("Run() error = %v", err)
+	}
+	data, readErr := os.ReadFile(targetPath)
+	if readErr != nil {
+		t.Fatalf("ReadFile(target) error = %v", readErr)
+	}
+	if string(data) == original {
+		t.Fatal("diagnostic target was not replaced")
+	}
+}
+
+func TestRunFailureUsesOpenedDiagnosticAfterPathReplacement(t *testing.T) {
+	exe, err := os.Executable()
+	if err != nil {
+		t.Fatalf("os.Executable() error = %v", err)
+	}
+
+	dir := t.TempDir()
+	readyPath := filepath.Join(dir, "ready")
+	releasePath := filepath.Join(dir, "release")
+	stderrPath := filepath.Join(dir, "stderr.log")
+	openedPath := filepath.Join(dir, "opened-stderr.log")
+	const secretValue = "replacement-api-key-value"
+	const commandContent = "trusted command failure"
+	req := RunRequest{
+		Executable: exe,
+		Args:       []string{"-test.run=^TestSubprocessHelper$", "--", "delayed-fail"},
+		EnvOverrides: map[string]string{
+			"GO_WANT_SUBPROCESS_HELPER":      "1",
+			"API_KEY":                        secretValue,
+			"SUBPROCESS_HELPER_READY_PATH":   readyPath,
+			"SUBPROCESS_HELPER_RELEASE_PATH": releasePath,
+			"SUBPROCESS_HELPER_STDERR":       commandContent,
+		},
+		StdoutLogPath: filepath.Join(dir, "stdout.log"),
+		StderrLogPath: stderrPath,
+	}
+
+	resultCh := make(chan error, 1)
+	go func() {
+		_, runErr := Run(context.Background(), req)
+		resultCh <- runErr
+	}()
+	waitForHelperFile(t, readyPath)
+	if err := os.Rename(stderrPath, openedPath); err != nil {
+		t.Fatalf("Rename(stderr log) error = %v", err)
+	}
+	if err := os.WriteFile(stderrPath, []byte(secretValue), 0o600); err != nil {
+		t.Fatalf("WriteFile(replacement) error = %v", err)
+	}
+	if err := os.WriteFile(releasePath, []byte("continue"), 0o600); err != nil {
+		t.Fatalf("WriteFile(release) error = %v", err)
+	}
+
+	select {
+	case runErr := <-resultCh:
+		if runErr == nil {
+			t.Fatal("Run() error = nil, want command failure")
+		}
+		if strings.Contains(runErr.Error(), secretValue) {
+			t.Fatalf("error read replacement-path content: %q", runErr)
+		}
+		if !strings.Contains(runErr.Error(), commandContent) {
+			t.Fatalf("error = %q, want retained command diagnostic", runErr)
+		}
+	case <-time.After(3 * time.Second):
+		t.Fatal("Run() did not return after helper release")
+	}
+
+	openedData, err := os.ReadFile(openedPath)
+	if err != nil {
+		t.Fatalf("ReadFile(opened diagnostic) error = %v", err)
+	}
+	if !strings.Contains(string(openedData), commandContent) {
+		t.Fatalf("opened diagnostic = %q, want command content", openedData)
+	}
+	replacementData, err := os.ReadFile(stderrPath)
+	if err != nil {
+		t.Fatalf("ReadFile(replacement diagnostic) error = %v", err)
+	}
+	if string(replacementData) != secretValue {
+		t.Fatalf("replacement diagnostic = %q, want %q", replacementData, secretValue)
+	}
+}
+
+func TestRunRedactsSplitCredentialInSeparateAndSharedDiagnostics(t *testing.T) {
+	exe, err := os.Executable()
+	if err != nil {
+		t.Fatalf("os.Executable() error = %v", err)
+	}
+	const secretValue = "split-super-secret-value"
+
+	for _, shared := range []bool{false, true} {
+		t.Run(map[bool]string{false: "separate", true: "shared"}[shared], func(t *testing.T) {
+			dir := t.TempDir()
+			stdoutPath := filepath.Join(dir, "stdout.log")
+			stderrPath := filepath.Join(dir, "stderr.log")
+			if shared {
+				stderrPath = stdoutPath
+			}
+			req := RunRequest{
+				Executable: exe,
+				Args:       []string{"-test.run=^TestSubprocessHelper$", "--", "splitsecret"},
+				EnvOverrides: map[string]string{
+					"GO_WANT_SUBPROCESS_HELPER": "1",
+					"API_KEY":                   secretValue,
+				},
+				StdoutLogPath: stdoutPath,
+				StderrLogPath: stderrPath,
+			}
+
+			_, runErr := Run(context.Background(), req)
+			if runErr == nil {
+				t.Fatal("Run() error = nil, want command failure")
+			}
+			if strings.Contains(runErr.Error(), secretValue) || !strings.Contains(runErr.Error(), "<redacted>") {
+				t.Fatalf("error = %q, want redacted credential", runErr)
+			}
+			paths := map[string]struct{}{stdoutPath: {}, stderrPath: {}}
+			for path := range paths {
+				data, readErr := os.ReadFile(path)
+				if readErr != nil {
+					t.Fatalf("ReadFile(%q) error = %v", path, readErr)
+				}
+				if strings.Contains(string(data), secretValue) || !strings.Contains(string(data), "<redacted>") {
+					t.Fatalf("diagnostic %q = %q, want redacted credential", path, data)
+				}
+			}
+		})
+	}
+}
+
+func TestRunRedactsInheritedSensitiveEnvironment(t *testing.T) {
+	exe, err := os.Executable()
+	if err != nil {
+		t.Fatalf("os.Executable() error = %v", err)
+	}
+	secretValue := "inherited-secret-value"
+	t.Setenv("OPENROUTER_API_KEY", secretValue)
+	dir := t.TempDir()
+	req := RunRequest{
+		Executable: exe,
+		Args:       []string{"-test.run=TestSubprocessHelper", "--", "echoenv"},
+		EnvOverrides: map[string]string{
+			"GO_WANT_SUBPROCESS_HELPER": "1",
+			"SUBPROCESS_HELPER_ENV_KEY": "OPENROUTER_API_KEY",
+		},
+		StdoutLogPath: filepath.Join(dir, "stdout.log"),
+		StderrLogPath: filepath.Join(dir, "stderr.log"),
+	}
+	_, err = Run(context.Background(), req)
+	if err == nil {
+		t.Fatal("Run() error = nil, want non-nil")
+	}
+	if strings.Contains(err.Error(), secretValue) {
+		t.Fatalf("error leaked inherited secret: %q", err)
+	}
+	for _, path := range []string{req.StdoutLogPath, req.StderrLogPath} {
+		data, readErr := os.ReadFile(path)
+		if readErr != nil {
+			t.Fatalf("read diagnostic %q: %v", path, readErr)
+		}
+		if strings.Contains(string(data), secretValue) {
+			t.Fatalf("diagnostic %q leaked inherited secret: %q", path, data)
+		}
+	}
+}
+
+func TestRunRedactsSensitiveOutputAndErrorTail(t *testing.T) {
+	exe, err := os.Executable()
+	if err != nil {
+		t.Fatalf("os.Executable() error = %v", err)
+	}
+	secretValue := "override-secret-value"
+	dir := t.TempDir()
+	req := RunRequest{
+		Executable: exe,
+		Args:       []string{"-test.run=TestSubprocessHelper", "--", "echoenv"},
+		EnvOverrides: map[string]string{
+			"GO_WANT_SUBPROCESS_HELPER": "1",
+			"SUBPROCESS_HELPER_ENV_KEY": "OPENROUTER_API_KEY",
+			"OPENROUTER_API_KEY":        secretValue,
+		},
+		StdoutLogPath: filepath.Join(dir, "stdout.log"),
+		StderrLogPath: filepath.Join(dir, "stderr.log"),
+	}
+	_, err = Run(context.Background(), req)
+	if err == nil {
+		t.Fatal("Run() error = nil, want non-nil")
+	}
+	if strings.Contains(err.Error(), secretValue) || !strings.Contains(err.Error(), "<redacted>") {
+		t.Fatalf("error = %q, want redacted secret", err)
+	}
+	for _, path := range []string{req.StdoutLogPath, req.StderrLogPath} {
+		data, readErr := os.ReadFile(path)
+		if readErr != nil {
+			t.Fatalf("read diagnostic %q: %v", path, readErr)
+		}
+		if strings.Contains(string(data), secretValue) || !strings.Contains(string(data), "<redacted>") {
+			t.Fatalf("diagnostic %q = %q, want redacted secret", path, data)
+		}
+	}
+}
+
+func TestStreamRedactorHandlesSplitAndOverlappingSecrets(t *testing.T) {
+	redactor := newStreamRedactor([]string{"abc", "abcde", "cde", ""})
+	var output bytes.Buffer
+	output.Write(redactor.Write([]byte("start-ab")))
+	output.Write(redactor.Write([]byte("cde-end")))
+	output.Write(redactor.Flush())
+	if got := output.String(); got != "start-<redacted>-end" {
+		t.Fatalf("redacted output = %q, want one redacted marker", got)
+	}
+}
+
+func TestDiagnosticWriterHonorsExactLimitAndCapPlusOne(t *testing.T) {
+	exactLogs := &logWriters{limits: make(chan error, 1)}
+	var exactOutput bytes.Buffer
+	exact := newDiagnosticWriter(exactLogs, "stdout", "test", &exactOutput, 5, nil)
+	if _, err := exact.Write([]byte("abcde")); err != nil {
+		t.Fatalf("exact Write() error = %v", err)
+	}
+	if err := exact.Flush(); err != nil {
+		t.Fatalf("exact Flush() error = %v", err)
+	}
+	if got := exactOutput.String(); got != "abcde" {
+		t.Fatalf("exact output = %q, want abcde", got)
+	}
+	if exactLogs.Limit() != nil {
+		t.Fatal("exact write recorded a capture limit")
+	}
+
+	cappedLogs := &logWriters{limits: make(chan error, 1)}
+	var cappedOutput bytes.Buffer
+	capped := newDiagnosticWriter(cappedLogs, "stderr", "test", &cappedOutput, 5, nil)
+	if _, err := capped.Write([]byte("abcdef")); err == nil {
+		t.Fatal("cap-plus-one Write() error = nil, want capture limit")
+	}
+	if err := capped.Flush(); err != nil {
+		t.Fatalf("cap-plus-one Flush() error = %v", err)
+	}
+	if got := cappedOutput.String(); got != "abcde" {
+		t.Fatalf("capped output = %q, want abcde", got)
+	}
+	if limit := cappedLogs.Limit(); limit == nil || limit.stream != "stderr" || limit.limit != 5 {
+		t.Fatalf("capture limit = %#v, want stderr limit 5", limit)
+	}
+}
+
+func TestDiagnosticWriterRetainsBoundedRedactedTail(t *testing.T) {
+	logs := &logWriters{limits: make(chan error, 1)}
+	var output bytes.Buffer
+	secret := "credential-value"
+	writer := newDiagnosticWriter(logs, "stderr", "test", &output, 16*1024, []string{secret})
+	prefix := strings.Repeat("x", diagnosticTailBytes+512)
+	if _, err := writer.Write([]byte(prefix + secret[:7])); err != nil {
+		t.Fatalf("first Write() error = %v", err)
+	}
+	if _, err := writer.Write([]byte(secret[7:] + "-failure")); err != nil {
+		t.Fatalf("second Write() error = %v", err)
+	}
+	if err := writer.Flush(); err != nil {
+		t.Fatalf("Flush() error = %v", err)
+	}
+	tail := writer.Tail()
+	if len(tail) > diagnosticTailBytes {
+		t.Fatalf("retained tail length = %d, want at most %d", len(tail), diagnosticTailBytes)
+	}
+	if strings.Contains(tail, secret) || !strings.Contains(tail, "<redacted>-failure") {
+		t.Fatalf("retained tail = %q, want bounded redacted content", tail)
+	}
 }
 
 func TestRunFailureAddsBadDescriptorHint(t *testing.T) {
@@ -184,15 +499,14 @@ func TestRunInheritsParentEnvironmentByDefault(t *testing.T) {
 		t.Fatalf("os.Executable() error = %v", err)
 	}
 
-	t.Setenv("GO_WANT_SUBPROCESS_HELPER", "1")
-	t.Setenv("SUBPROCESS_HELPER_ENV_KEY", "SUBPROCESS_PARENT_VALUE")
-	t.Setenv("SUBPROCESS_PARENT_VALUE", "inherited-value")
+	t.Setenv("PATH", "inherited-value")
 
 	dir := t.TempDir()
 	stdoutPath := filepath.Join(dir, "stdout.log")
 	req := RunRequest{
 		Executable:    exe,
 		Args:          []string{"-test.run=TestSubprocessHelper", "--", "printenv"},
+		EnvOverrides:  map[string]string{"GO_WANT_SUBPROCESS_HELPER": "1", "SUBPROCESS_HELPER_ENV_KEY": "PATH"},
 		StdoutLogPath: stdoutPath,
 	}
 
@@ -214,16 +528,16 @@ func TestRunEnvOverridesWinOverInheritedValues(t *testing.T) {
 		t.Fatalf("os.Executable() error = %v", err)
 	}
 
-	t.Setenv("GO_WANT_SUBPROCESS_HELPER", "1")
-	t.Setenv("SUBPROCESS_HELPER_ENV_KEY", "SUBPROCESS_PARENT_VALUE")
-	t.Setenv("SUBPROCESS_PARENT_VALUE", "parent-value")
-
 	dir := t.TempDir()
 	stdoutPath := filepath.Join(dir, "stdout.log")
 	req := RunRequest{
-		Executable:    exe,
-		Args:          []string{"-test.run=TestSubprocessHelper", "--", "printenv"},
-		EnvOverrides:  map[string]string{"SUBPROCESS_PARENT_VALUE": "override-value"},
+		Executable: exe,
+		Args:       []string{"-test.run=TestSubprocessHelper", "--", "printenv"},
+		EnvOverrides: map[string]string{
+			"GO_WANT_SUBPROCESS_HELPER": "1",
+			"SUBPROCESS_HELPER_ENV_KEY": "SUBPROCESS_PARENT_VALUE",
+			"SUBPROCESS_PARENT_VALUE":   "override-value",
+		},
 		StdoutLogPath: stdoutPath,
 	}
 
@@ -276,59 +590,6 @@ func TestRunSharedStdoutStderrLogPath(t *testing.T) {
 	}
 }
 
-func TestWriteYAMLAtomic(t *testing.T) {
-	dir := t.TempDir()
-	path := filepath.Join(dir, "config.generated.yml")
-
-	if err := WriteYAMLAtomic(path, map[string]any{"name": "narratio", "stage": "merge"}, 0o644); err != nil {
-		t.Fatalf("WriteYAMLAtomic() error = %v", err)
-	}
-
-	data, err := os.ReadFile(path)
-	if err != nil {
-		t.Fatalf("read yaml: %v", err)
-	}
-
-	var got map[string]any
-	if err := yaml.Unmarshal(data, &got); err != nil {
-		t.Fatalf("yaml unmarshal: %v", err)
-	}
-	if got["name"] != "narratio" {
-		t.Fatalf("name = %#v, want narratio", got["name"])
-	}
-}
-
-func TestWriteYAMLAtomicOverwriteNoTempResidue(t *testing.T) {
-	dir := t.TempDir()
-	path := filepath.Join(dir, "config.generated.yml")
-
-	if err := WriteYAMLAtomic(path, map[string]any{"value": "one"}, 0o644); err != nil {
-		t.Fatalf("first write: %v", err)
-	}
-	if err := WriteYAMLAtomic(path, map[string]any{"value": "two"}, 0o644); err != nil {
-		t.Fatalf("second write: %v", err)
-	}
-
-	data, err := os.ReadFile(path)
-	if err != nil {
-		t.Fatalf("read yaml: %v", err)
-	}
-	if !strings.Contains(string(data), "two") {
-		t.Fatalf("yaml = %q, want overwritten value", string(data))
-	}
-
-	entries, err := os.ReadDir(dir)
-	if err != nil {
-		t.Fatalf("ReadDir() error = %v", err)
-	}
-	for _, entry := range entries {
-		name := entry.Name()
-		if strings.Contains(name, ".tmp-") {
-			t.Fatalf("temp file residue found: %q", name)
-		}
-	}
-}
-
 func TestSubprocessHelper(t *testing.T) {
 	if os.Getenv("GO_WANT_SUBPROCESS_HELPER") != "1" {
 		return
@@ -361,6 +622,30 @@ func TestSubprocessHelper(t *testing.T) {
 	case "failbadfd":
 		_, _ = os.Stderr.WriteString("OSError: [Errno 9] Bad file descriptor\n")
 		os.Exit(120)
+	case "delayed-fail":
+		if err := os.WriteFile(os.Getenv("SUBPROCESS_HELPER_READY_PATH"), []byte("ready"), 0o600); err != nil {
+			os.Exit(4)
+		}
+		deadline := time.Now().Add(2 * time.Second)
+		for {
+			if _, err := os.Stat(os.Getenv("SUBPROCESS_HELPER_RELEASE_PATH")); err == nil {
+				break
+			} else if !errors.Is(err, os.ErrNotExist) || time.Now().After(deadline) {
+				os.Exit(5)
+			}
+			time.Sleep(10 * time.Millisecond)
+		}
+		_, _ = os.Stderr.WriteString(os.Getenv("SUBPROCESS_HELPER_STDERR"))
+		os.Exit(6)
+	case "splitsecret":
+		secret := os.Getenv("API_KEY")
+		split := len(secret) / 2
+		for _, stream := range []*os.File{os.Stdout, os.Stderr} {
+			_, _ = stream.WriteString(secret[:split])
+			time.Sleep(20 * time.Millisecond)
+			_, _ = stream.WriteString(secret[split:] + "\n")
+		}
+		os.Exit(7)
 	case "sleep":
 		time.Sleep(500 * time.Millisecond)
 		os.Exit(0)
@@ -368,7 +653,115 @@ func TestSubprocessHelper(t *testing.T) {
 		key := os.Getenv("SUBPROCESS_HELPER_ENV_KEY")
 		_, _ = os.Stdout.WriteString(os.Getenv(key) + "\n")
 		os.Exit(0)
+	case "echoenv":
+		key := os.Getenv("SUBPROCESS_HELPER_ENV_KEY")
+		value := os.Getenv(key)
+		_, _ = os.Stdout.WriteString(value)
+		_, _ = os.Stderr.WriteString(value)
+		os.Exit(5)
+	case "spam":
+		chunk := strings.Repeat("x", 64*1024)
+		count, _ := strconv.Atoi(os.Getenv("SUBPROCESS_HELPER_CHUNKS"))
+		for range count {
+			_, _ = os.Stdout.WriteString(chunk)
+		}
+		os.Exit(0)
+	case "tree-spam":
+		descendant := exec.Command(os.Args[0], "-test.run=^TestSubprocessHelper$", "--", "descendant")
+		descendant.Env = append(os.Environ(), "GO_WANT_SUBPROCESS_HELPER=1")
+		descendant.Stdout = os.Stdout
+		descendant.Stderr = os.Stderr
+		if err := descendant.Start(); err != nil {
+			os.Exit(3)
+		}
+		if err := os.WriteFile(os.Getenv("SUBPROCESS_HELPER_READY_PATH"), []byte("ready"), 0o600); err != nil {
+			os.Exit(4)
+		}
+		chunk := strings.Repeat("x", 64*1024)
+		for {
+			_, _ = os.Stdout.WriteString(chunk)
+		}
+	case "tree":
+		descendant := exec.Command(os.Args[0], "-test.run=^TestSubprocessHelper$", "--", "descendant")
+		descendant.Env = append(os.Environ(), "GO_WANT_SUBPROCESS_HELPER=1")
+		descendant.Stdout = os.Stdout
+		descendant.Stderr = os.Stderr
+		if err := descendant.Start(); err != nil {
+			os.Exit(3)
+		}
+		if err := os.WriteFile(os.Getenv("SUBPROCESS_HELPER_READY_PATH"), []byte("ready"), 0o600); err != nil {
+			os.Exit(4)
+		}
+		time.Sleep(10 * time.Second)
+		os.Exit(0)
+	case "leader-exit-retained", "leader-exit-redirected", "leader-fail-redirected":
+		descendant := exec.Command(os.Args[0], "-test.run=^TestSubprocessHelper$", "--", "descendant-after-release")
+		descendant.Env = append(os.Environ(), "GO_WANT_SUBPROCESS_HELPER=1")
+		if mode == "leader-exit-retained" {
+			descendant.Stdout = os.Stdout
+			descendant.Stderr = os.Stderr
+		}
+		if err := descendant.Start(); err != nil {
+			os.Exit(3)
+		}
+		if !helperFileAppeared(os.Getenv("SUBPROCESS_HELPER_READY_PATH"), 2*time.Second) {
+			os.Exit(4)
+		}
+		if mode == "leader-fail-redirected" {
+			os.Exit(9)
+		}
+		os.Exit(0)
+	case "descendant-after-release":
+		if os.Getenv("SUBPROCESS_HELPER_IGNORE_TERM") == "1" {
+			signal.Ignore(syscall.SIGTERM)
+		}
+		if err := os.WriteFile(os.Getenv("SUBPROCESS_HELPER_READY_PATH"), []byte("ready"), 0o600); err != nil {
+			os.Exit(4)
+		}
+		deadline := time.Now().Add(10 * time.Second)
+		for time.Now().Before(deadline) {
+			if _, err := os.Stat(os.Getenv("SUBPROCESS_HELPER_RELEASE_PATH")); err == nil {
+				_ = os.WriteFile(os.Getenv("SUBPROCESS_HELPER_SENTINEL_PATH"), []byte("survived"), 0o600)
+				os.Exit(0)
+			} else if !errors.Is(err, os.ErrNotExist) {
+				os.Exit(5)
+			}
+			time.Sleep(10 * time.Millisecond)
+		}
+		os.Exit(0)
+	case "descendant":
+		time.Sleep(500 * time.Millisecond)
+		_ = os.WriteFile(os.Getenv("SUBPROCESS_HELPER_SENTINEL_PATH"), []byte("survived"), 0o600)
+		time.Sleep(10 * time.Second)
+		os.Exit(0)
 	default:
 		os.Exit(2)
 	}
 }
+
+func waitForHelperFile(t *testing.T, path string) {
+	t.Helper()
+	deadline := time.Now().Add(2 * time.Second)
+	for time.Now().Before(deadline) {
+		if _, err := os.Stat(path); err == nil {
+			return
+		} else if !errors.Is(err, os.ErrNotExist) {
+			t.Fatalf("Stat(%q) error = %v", path, err)
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	t.Fatalf("helper file %q was not created", path)
+}
+
+func helperFileAppeared(path string, timeout time.Duration) bool {
+	deadline := time.Now().Add(timeout)
+	for time.Now().Before(deadline) {
+		if _, err := os.Stat(path); err == nil {
+			return true
+		} else if !errors.Is(err, os.ErrNotExist) {
+			return false
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	return false
+}

internal/adapters/whisperx/fake.go

@@ -2,8 +2,10 @@ package whisperx
 
 import (
 	"context"
-	"os"
 	"path/filepath"
+	"sync"
+
+	"gitea.maximumdirect.net/eric/narratio/internal/fileops"
 )
 
 var minimalTranscriptJSON = []byte(`{"schema":"speaker_transcript.v1","segments":[]}`)
@@ -31,7 +33,8 @@ func (n *NoopClient) Transcribe(ctx context.Context, req TranscribeRequest) (Tra
 
 // FakeClient captures requests and returns deterministic responses for tests.
 type FakeClient struct {
-	Requests     []TranscribeRequest
+	requestsMu   sync.RWMutex
+	requests     []TranscribeRequest
 	Err          error
 	Result       TranscribeResult
 	TranscribeFn func(ctx context.Context, req TranscribeRequest) (TranscribeResult, error)
@@ -42,7 +45,9 @@ func (f *FakeClient) Transcribe(ctx context.Context, req TranscribeRequest) (Tra
 	if err := ctx.Err(); err != nil {
 		return TranscribeResult{}, err
 	}
-	f.Requests = append(f.Requests, req)
+	f.requestsMu.Lock()
+	f.requests = append(f.requests, req)
+	f.requestsMu.Unlock()
 	if f.TranscribeFn != nil {
 		return f.TranscribeFn(ctx, req)
 	}
@@ -65,12 +70,19 @@ func (f *FakeClient) Transcribe(ctx context.Context, req TranscribeRequest) (Tra
 	return res, nil
 }
 
+// RequestsSnapshot returns a copy of captured requests safe for concurrent test assertions.
+func (f *FakeClient) RequestsSnapshot() []TranscribeRequest {
+	f.requestsMu.RLock()
+	defer f.requestsMu.RUnlock()
+	return append([]TranscribeRequest(nil), f.requests...)
+}
+
 func writeMinimalJSON(path string) error {
 	if path == "" {
 		return nil
 	}
-	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+	if err := fileops.EnsureWorkspaceDirectory(filepath.Dir(path)); err != nil {
 		return err
 	}
-	return os.WriteFile(path, minimalTranscriptJSON, 0o644)
+	return fileops.WriteFileAtomic(path, minimalTranscriptJSON, fileops.WorkspaceFileMode)
 }

internal/adapters/whisperx/fake_test.go

@@ -3,6 +3,7 @@ package whisperx
 import (
 	"context"
 	"errors"
+	"sync"
 	"testing"
 )
 
@@ -14,8 +15,9 @@ func TestFakeClientCapturesRequestAndReturnsPath(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Transcribe() error = %v", err)
 	}
-	if len(fake.Requests) != 1 || fake.Requests[0].SpeakerID != "alice" {
-		t.Fatalf("requests = %#v, want one alice request", fake.Requests)
+	requests := fake.RequestsSnapshot()
+	if len(requests) != 1 || requests[0].SpeakerID != "alice" {
+		t.Fatalf("requests = %#v, want one alice request", requests)
 	}
 	if res.OutputRawTranscriptPath != req.OutputRawTranscriptPath {
 		t.Fatalf("output path = %q, want %q", res.OutputRawTranscriptPath, req.OutputRawTranscriptPath)
@@ -29,3 +31,22 @@ func TestFakeClientError(t *testing.T) {
 		t.Fatal("expected error, got nil")
 	}
 }
+
+func TestFakeClientRequestsSnapshotSupportsConcurrentCalls(t *testing.T) {
+	fake := &FakeClient{}
+	const callers = 16
+	var group sync.WaitGroup
+	group.Add(callers)
+	for i := 0; i < callers; i++ {
+		go func() {
+			defer group.Done()
+			if _, err := fake.Transcribe(context.Background(), TranscribeRequest{}); err != nil {
+				t.Errorf("Transcribe() error = %v", err)
+			}
+		}()
+	}
+	group.Wait()
+	if got := len(fake.RequestsSnapshot()); got != callers {
+		t.Fatalf("captured requests = %d, want %d", got, callers)
+	}
+}