Enable structural output repair by default

docs/config.md

@@ -222,7 +222,7 @@ pipelines:
 | Field | Type | Default | Rules |
 | --- | --- | --- | --- |
 | **llm_profile** | string | none | Optional non-empty default PromptKit profile ID for selected LLM-backed bindings and validators. An explicitly present blank value is invalid. |
-| **structured_output_repair_attempts** | integer | prompt-owned | Optional structural-repair limit from 0 through 3 for selected LLM-backed bindings and validators. Omission leaves the prompt's declared policy in control; explicit 0 disables structural repair at that scope. |
+| **structured_output_repair_attempts** | integer | prompt-owned (1 in maintained production prompts) | Optional structural-repair limit from 0 through 3 for selected LLM-backed bindings and validators. Omission leaves the prompt's declared policy in control; explicit 0 disables structural repair at that scope. |
 | **input** | module binding | none | Required. |
 | **chunk** | module binding | **generic** | Optional. |
 | **output** | module binding | **json** | Optional. |
@@ -288,7 +288,7 @@ extract:
 | --- | --- | --- | --- |
 | **module** | string | none | Required for an object binding. Must be a registered compatible key. |
 | **llm_profile** | string | none | Optional non-empty PromptKit profile ID for an LLM-backed binding. It overrides the pipeline default unless the run supplies **--llm-profile**. |
-| **structured_output_repair_attempts** | integer | pipeline or prompt-owned | Optional structural-repair limit from 0 through 3 for an LLM-backed binding. It overrides the pipeline value; explicit 0 disables structural repair. |
+| **structured_output_repair_attempts** | integer | pipeline or prompt-owned (1 in maintained production prompts) | Optional structural-repair limit from 0 through 3 for an LLM-backed binding. It overrides the pipeline value; explicit 0 disables structural repair. |
 | **retries** | integer | 0 | Non-negative additional attempts for chunk, extract, merge, and normalize bindings. |
 | **options** | object | none | Must satisfy the selected module. |
 | **references** | map | none | Valid only on chunk, extract, merge, and normalize bindings. |

docs/integrations/pkg-promptkit.md

@@ -115,7 +115,7 @@ the conventional local backend.
 
 PromptKit API or format changes outside this boundary are not implicitly
 supported. Updating the pinned version requires reviewing the adapter and
-profile/configuration contracts against the upstream documentation.
-
-This dependency update does not change any production prompt's declared
-`repair_attempts` budget.
+profile/configuration contracts against the upstream documentation. Maintained
+production prompts use PromptKit's bounded structural-repair contract; their
+current declaration is one additional repair attempt. Notarius retains the
+transport-neutral boundary and does not expose PromptKit types to modules.

docs/internal/llm.md

@@ -210,14 +210,29 @@ caller context takes precedence. The adapter does not retry capacity failures;
 the pipeline's existing binding attempt policy sees the operational error and
 decides whether to rerun the complete operation.
 
-Prompt-declared repair is executed within PromptKit’s structured-output flow.
-The current production D&D prompt manifests set repair attempts to zero. That
-setting does not replace pipeline retry behavior: a binding’s configured retry
-count reruns its stage attempt after an error or rejection, and an exhausted
-rejection is a recorded output rather than a provider error. The pipeline owns
-attempt lifecycle, validation chains, and retry diagnostics; see
-[Pipeline Internals](pipeline.md#validation-retries-and-output) and the
-[binding reference](../config.md#module-bindings-and-validators).
+PromptKit executes structural repair within its structured-output flow. The
+maintained production prompt manifests declare one additional repair attempt.
+When a resolved binding supplies a repair value, the adapter inspects the
+prompt, copies its complete output contract, changes only the repair limit, and
+passes that complete replacement contract to PromptKit. This preserves the
+prompt's output format, validation mode, schema, and provider structured-output
+settings.
+
+A successful repair is an ordinary successful completion, not a warning. The
+adapter reports PromptKit's actual repair count and its cumulative usage
+directly, without adding the initial and corrective counts again. Debug prompt
+material records the configured complete contract; debug response material
+records the repaired response and actual validation result. If the repair
+budget is exhausted, the adapter retains the final raw bytes and debug material
+and reports `ErrInvalidStructuredOutput`. Generation failures during an initial
+or corrective call remain provider-neutral operational errors with the same
+redaction boundary.
+
+Structural repair does not replace pipeline retry behavior: a binding's
+configured retry count reruns its complete stage attempt after an error or
+rejection. The pipeline owns attempt lifecycle, validation chains, and retry
+diagnostics; see [Pipeline Internals](pipeline.md#validation-retries-and-output)
+and the [binding reference](../config.md#module-bindings-and-validators).
 
 ## Timeout Ownership
 

docs/internal/pipeline.md

@@ -43,6 +43,9 @@ leaves the prompt-owned policy intact. An explicit repair value on a
 deterministic binding is rejected. Resolved bindings own copied repair values,
 and these effective values are part of the digest, so execution and checkpoint
 consumers do not repeat profile inheritance or configuration resolution.
+Each LLM request receives its own copy of that resolved value. PromptKit spends
+it only for structural correction inside one completion; the runner's binding
+retry policy remains the separate outer budget for complete stage attempts.
 Configuration resolution supplies the selected profile and catalog; see
 [Configuration Internals](configuration.md).
 

docs/operations.md

@@ -281,12 +281,23 @@ selected binding, then the pipeline, then the prompt declaration; see
 [module bindings](config.md#module-bindings-and-validators). This is distinct
 from Notarius binding **retries**, which rerun the complete module operation
 and validation chain and do not consume or replenish the structural-repair
-limit.
+limit. The maintained production prompts declare one repair attempt, paid only
+after a structural failure. One structured completion with repair budget **R**
+makes at most **R + 1** serial provider calls. If one stage attempt performs
+**C** structured completions, a binding with **retries: N** has a maximum of
+**(N + 1) * C * (R + 1)** provider calls; LLM-backed validators have their own
+corresponding invocation counts and budgets. This is an upper bound, not a
+promise that every call reaches a provider.
 
 Timeouts are layered. Caller cancellation is the outer authority. A positive
 effective generation timeout adds an inner request deadline, while zero
 disables only that generation deadline. The HTTP client timeout remains a
 transport-wide cap. Notarius does not add another timeout around PromptKit.
+Repairs are serial within the same caller context, so their worst-case latency
+and cost follow the provider-call bound above; provision run deadlines and
+provider budgets accordingly. Credentials remain optional unless the selected
+PromptKit profile requires one, in which case preparation fails before a
+provider call when its configured credential is unavailable.
 The pinned upstream boundary and profile-format links are in
 [PromptKit Integration](integrations/pkg-promptkit.md).
 
@@ -303,6 +314,11 @@ positive value makes the effective active local-generation bound the smaller
 of **total_llm** and that local limit, so a local limit of four permits no more
 than four active local generations.
 
+The Notarius scheduler admits one logical structured completion and holds that
+permit while PromptKit performs its serial corrective calls. PromptKit applies
+its selected-backend admission to each provider call; Notarius does not
+reacquire a permit or add another scheduler for a repair.
+
 For a positive local limit, PromptKit owns its default waiting capacity and
 admission behavior. When a PromptKit backend has admitted all active and queued
 work, a new call fails as capacity exhaustion before generation. The adapter

docs/policy/architecture.md

@@ -195,6 +195,10 @@ The caller of the LLM owns prompt selection, prompt inputs, response schema,
 and interpretation of structured output. Provider adapters do not own source-
 or domain-specific prompt logic.
 
+PromptKit owns bounded structural correction within one structured completion.
+Notarius owns outer stage attempts, semantic validation, and acceptance policy;
+the two budgets must remain separate.
+
 When a model selects an application entity, callers must supply a contextual
 selection and deterministically attach the opaque application identity whenever
 the selection resolves exactly. Models do not receive or reproduce opaque

docs/roadmap/implementation.md

@@ -676,7 +676,7 @@ git diff --check
 - Current configuration, pipeline, and operations documentation matches the
   implemented behavior.
 
-## Stage 10: Enable The Default, Finish Documentation, And Verify The Feature
+## Stage 10: Enable The Default, Finish Documentation, And Verify The Feature ✅
 
 ### Goal