Record every retry attempt outcome

docs/internal/pipeline.md

@@ -228,10 +228,15 @@ normally. Dependency fingerprints and debug content digests use the same stable
 codec bytes that cross those boundaries.
 
 Debug instrumentation wraps run, stage, attempt, validator, and structured LLM
-boundaries. Every executed module retry has an attempt envelope containing its
-candidate, accepted-attempt warnings, rejection or error, and only the LLM
-calls made by that module attempt. Validator attempts retain independent scopes
-under `validate/`. Debug-write failures are framework errors; debug data is
+boundaries. Every executed chunk, extract, merge, and normalize attempt writes
+one terminal envelope for acceptance, validator rejection, module or validator
+error, or applicable candidate or final serialization error. The envelope
+contains its attempt-local warnings, any available candidate and rejection,
+and terminal error text; failures before a candidate exists omit that payload.
+Only LLM calls made by the module operation belong to the module attempt.
+Validator calls retain independent scopes under `validate/` and are not
+duplicated into the module envelope. A failed terminal-envelope write is a
+framework error and is joined with any primary attempt error. Debug data is
 never used as a checkpoint source. Typed artifact debug envelopes are
 domain-neutral, redact sensitive metadata and bytes through the common debug
 policy, and record codec identity plus schema and content digests.