Document feedback-aware validation retries

docs/internal/llm.md

@@ -50,6 +50,14 @@ correction do not add messages or introduce caller roles. Ordinary request
 summaries record correction byte counts and digests only; complete messages are
 available solely in an explicitly requested debug trace.
 
+The adapter leaves the ordinary rendered message prefix, named inputs,
+variables, session, profile, execution overrides, prepared-execution path, and
+PromptKit repair policy unchanged for a corrected request. It never imports a
+PromptKit message type into a module or pipeline contract. PromptKit reports
+actual structural repair count and cumulative token usage per completion; the
+pipeline's safe terminal debug record projects those values without copying
+message content.
+
 Client construction may also receive a run-wide reasoning-effort override from
 the CLI factory boundary. The adapter copies the caller-owned pointer and
 creates a fresh PromptKit execution override for each request: a nil pointer
@@ -237,10 +245,11 @@ or corrective call remain provider-neutral operational errors with the same
 redaction boundary.
 
 Structural repair does not replace pipeline retry behavior: a binding's
-configured retry count reruns its complete stage attempt after an error or
-rejection. The pipeline owns attempt lifecycle, validation chains, and retry
-diagnostics; see [Pipeline Internals](pipeline.md#validation-retries-and-output)
-and the [binding reference](../config.md#module-bindings-and-validators).
+configured retry count reruns its complete stage attempt after an operational
+or structural error, module-requested retry, or actionable semantic rejection.
+The pipeline owns attempt lifecycle, validation chains, and retry diagnostics;
+see [Pipeline Internals](pipeline.md#validation-retries-and-output) and the
+[binding reference](../config.md#module-bindings-and-validators).
 
 ## Timeout Ownership
 
@@ -270,6 +279,13 @@ surfaced; when the completion already failed, its call error remains the
 result. Debug-bundle location, retention, and handling are operational concerns
 documented in [Operations](../operations.md#debug-bundles).
 
+The attempt-terminal summary is a separate safe trace record: it contains
+attempt kinds, validator outcome counts and reason codes, effective policy,
+terminal action, and repair/usage references. It excludes raw assistant
+responses and correction text. Those values can appear only in the explicitly
+requested detailed prompt and response artifacts, which require sensitive-data
+handling.
+
 Run manifests receive selected profile summaries, including optional effective
 backend and reasoning provenance, and component identities—not prompt, schema,
 source, reference, or response content. The published field semantics belong