Write workspace debug artifacts during runs

docs/config.md

@@ -356,7 +356,8 @@ When `workspace.resume.enabled` is true, runs write stage-owned checkpoint
 artifacts under `<workspace.directory>/checkpoints/`. `notarius run --resume`
 can reuse valid checkpoints from a compatible invocation.
 
-Debug artifact writers are not part of the current workflow.
+When `workspace.debug.enabled` is true, runs write per-invocation debug
+artifacts under `<workspace.directory>/debug/<run-id>/`.
 
 ## Diagnostics
 

docs/internal/diagnostics.md

@@ -34,6 +34,7 @@ Implemented artifact names:
 - `effective-config.json`
 - `resolved-pipeline.json`
 - `resolved-references.json`
+- `checkpoint-events.json`
 - `source-document.json`
 - `run-manifest.json`
 - `run-report.json`

docs/internal/overview.md

@@ -44,9 +44,10 @@ production modules.
   encoders, and structured LLM clients.
 - `internal/framework/checkpoint`: workspace-backed checkpoint recorder and
   checkpoint payload envelope serialization.
+- `internal/framework/debug`: workspace-backed debug artifact writer.
 - `internal/framework/pipeline`: module registries, module specs, profile
-  resolution, capability checks, run orchestration, checkpoint recorder
-  boundaries, warnings, validation, and manifest population.
+  resolution, capability checks, run orchestration, checkpoint and debug
+  recorder boundaries, warnings, validation, and manifest population.
 - `internal/framework/llm`: Scriptorium-backed structured-output client,
   prompt/schema asset registry, scheduler, schema registry, and secret
   redaction.

docs/internal/pipeline.md

@@ -83,6 +83,11 @@ status, identity digest, dependency fingerprints, payload files, and payload
 digests validate for the current invocation. Missing or invalid checkpoints fall
 back to normal execution and are refreshed by the recorder.
 
+When workspace debug output is enabled, the CLI passes a debug recorder for the
+current run ID. The runner writes framework-boundary inputs, outputs,
+structured LLM calls, validator calls, timing, and retry attempt metadata
+through that interface. Concrete modules still do not receive workspace paths.
+
 ## Registries And Module Specs
 
 `pipeline.Registries` holds concrete constructors for execution. A

docs/operations.md

@@ -111,6 +111,27 @@ payload digests match the current invocation. Changes to input bytes, resolved
 pipeline digest, selected lanes, runtime LLM profile override, or materialized
 reference digests invalidate reuse.
 
+## Debug
+
+When `workspace.debug.enabled: true` and `workspace.directory` is set, runs
+write debug artifacts under:
+
+```text
+<workspace.directory>/debug/<run-id>/
+```
+
+Debug output is per invocation. It is independent of checkpointing and is not
+used for resume. Enabling debug does not write checkpoints, and enabling resume
+checkpointing does not write debug output.
+
+Debug artifacts include framework-boundary inputs and outputs for source,
+chunk, extract, merge, normalize, and output work, structured LLM request and
+response data from Notarius contracts, validator requests and results, timing,
+and retry attempt metadata. Debug artifacts may contain source material,
+reference material, prompt inputs, model outputs, and other sensitive data.
+Obvious credential-shaped values and sensitive map keys are redacted, but debug
+directories should still be protected as sensitive local state.
+
 ## Retention
 
 Diagnostics retention is configured with `workspace.diagnostics.retention`,