Write workspace debug artifacts during runs

docs/internal/diagnostics.md

@@ -34,6 +34,7 @@ Implemented artifact names:
 - `effective-config.json`
 - `resolved-pipeline.json`
 - `resolved-references.json`
+- `checkpoint-events.json`
 - `source-document.json`
 - `run-manifest.json`
 - `run-report.json`

docs/internal/overview.md

@@ -44,9 +44,10 @@ production modules.
   encoders, and structured LLM clients.
 - `internal/framework/checkpoint`: workspace-backed checkpoint recorder and
   checkpoint payload envelope serialization.
+- `internal/framework/debug`: workspace-backed debug artifact writer.
 - `internal/framework/pipeline`: module registries, module specs, profile
-  resolution, capability checks, run orchestration, checkpoint recorder
-  boundaries, warnings, validation, and manifest population.
+  resolution, capability checks, run orchestration, checkpoint and debug
+  recorder boundaries, warnings, validation, and manifest population.
 - `internal/framework/llm`: Scriptorium-backed structured-output client,
   prompt/schema asset registry, scheduler, schema registry, and secret
   redaction.

docs/internal/pipeline.md

@@ -83,6 +83,11 @@ status, identity digest, dependency fingerprints, payload files, and payload
 digests validate for the current invocation. Missing or invalid checkpoints fall
 back to normal execution and are refreshed by the recorder.
 
+When workspace debug output is enabled, the CLI passes a debug recorder for the
+current run ID. The runner writes framework-boundary inputs, outputs,
+structured LLM calls, validator calls, timing, and retry attempt metadata
+through that interface. Concrete modules still do not receive workspace paths.
+
 ## Registries And Module Specs
 
 `pipeline.Registries` holds concrete constructors for execution. A