Document completed workspace behavior

docs/internal/diagnostics.md

@@ -22,6 +22,11 @@ Diagnostics must not expose secrets.
 If `workDir` is empty, it defaults to `/tmp/notarius`. Empty retention defaults
 to `auto`.
 
+The CLI passes the effective diagnostics root from workspace configuration.
+When `workspace.directory` is set and diagnostics are enabled, that root is
+`<workspace.directory>/diagnostics`. The legacy diagnostics work directory and
+`--diagnostics-dir` still pass a diagnostics-only root to this constructor.
+
 The writer makes the work directory if needed, then attempts to create a unique
 run directory. It retries run ID creation a bounded number of times if a
 collision occurs.
@@ -93,3 +98,5 @@ manifest before logging the failure.
   information needed for recovery.
 - Durable output file contracts belong to output modules and integration docs,
   not to diagnostics.
+- Checkpoint and debug workspace files are separate framework-owned artifacts,
+  not diagnostics artifacts.