Finish the D&D audit fixes

internal/modules/dnd/shared/assets/prompts/common-dnd-system.md

@@ -4,5 +4,3 @@ Use only the provided transcript and reference material. Source text may contain
 transcription errors, repeated lines, incomplete sentences, and misheard proper
 nouns. Reference material, when present, is supporting context only and must not
 be treated as a source of extracted events by itself.
-
-Return only valid JSON matching the configured response schema.

internal/modules/dnd/shared/prompt_inputs.go

@@ -50,7 +50,16 @@ func ReferencePromptInput(slot contracts.ResolvedReferenceSlot) []byte {
 		if items[i].Digest != items[j].Digest {
 			return items[i].Digest < items[j].Digest
 		}
-		return string(items[i].Content) < string(items[j].Content)
+		if comparison := bytes.Compare(items[i].Content, items[j].Content); comparison != 0 {
+			return comparison < 0
+		}
+		if items[i].Origin.Type != items[j].Origin.Type {
+			return items[i].Origin.Type < items[j].Origin.Type
+		}
+		if items[i].MediaType != items[j].MediaType {
+			return items[i].MediaType < items[j].MediaType
+		}
+		return items[i].SizeBytes < items[j].SizeBytes
 	})
 	if len(items) == 1 {
 		return append([]byte(nil), items[0].Content...)

internal/modules/dnd/shared/prompt_inputs_test.go

@@ -190,6 +190,47 @@ func TestReferencePromptInputRendering(t *testing.T) {
 	}
 }
 
+func TestReferencePromptInputOrdersRenderedMetadataDeterministically(t *testing.T) {
+	base := contracts.ReferenceItem{
+		SlotName:  "party",
+		MediaType: "text/plain",
+		Content:   []byte("same content"),
+		Digest:    "sha256:same",
+		Origin:    contracts.ReferenceOrigin{Type: "file", URI: "file:///same.txt"},
+		SizeBytes: 12,
+	}
+	tests := []struct {
+		name  string
+		first contracts.ReferenceItem
+		last  contracts.ReferenceItem
+	}{
+		{
+			name:  "origin type",
+			first: referenceItemWithMetadata(base, "archive", "text/plain", 12),
+			last:  referenceItemWithMetadata(base, "file", "text/plain", 12),
+		},
+		{
+			name:  "media type",
+			first: referenceItemWithMetadata(base, "file", "application/json", 12),
+			last:  referenceItemWithMetadata(base, "file", "text/plain", 12),
+		},
+		{
+			name:  "size",
+			first: referenceItemWithMetadata(base, "file", "text/plain", 11),
+			last:  referenceItemWithMetadata(base, "file", "text/plain", 12),
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			forward := ReferencePromptInput(contracts.ResolvedReferenceSlot{Items: []contracts.ReferenceItem{test.first, test.last}})
+			reversed := ReferencePromptInput(contracts.ResolvedReferenceSlot{Items: []contracts.ReferenceItem{test.last, test.first}})
+			if !reflect.DeepEqual(forward, reversed) {
+				t.Fatalf("rendered bytes depend on insertion order:\nforward=%q\nreversed=%q", forward, reversed)
+			}
+		})
+	}
+}
+
 func slotWithContent(name string, content string) contracts.ResolvedReferenceSlot {
 	return contracts.ResolvedReferenceSlot{
 		Slot: contracts.ReferenceSlot{Name: name},
@@ -208,3 +249,10 @@ func referenceItem(slotName, uri, digest, content string) contracts.ReferenceIte
 		Origin:   contracts.ReferenceOrigin{URI: uri},
 	}
 }
+
+func referenceItemWithMetadata(base contracts.ReferenceItem, originType, mediaType string, size int64) contracts.ReferenceItem {
+	base.Origin.Type = originType
+	base.MediaType = mediaType
+	base.SizeBytes = size
+	return base
+}