Prepare version 0.7.0 and retire completed configuration plans

.woodpecker/release.yml

@@ -0,0 +1,33 @@
+when:
+  - event: tag
+
+steps:
+  - name: validate-release
+    image: golang:1.25.5
+    commands:
+      - |
+        set -eu
+
+        version="$CI_COMMIT_TAG"
+        release_note="docs/releases/$version.md"
+
+        if ! printf '%s\n' "$version" | grep -E -x 'v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)' >/dev/null; then
+          printf '%s\n' "invalid release tag: $version" >&2
+          exit 1
+        fi
+        if [ ! -s "$release_note" ]; then
+          printf '%s\n' "missing release note: $release_note" >&2
+          exit 1
+        fi
+        if ! grep -F -x "# Notarius $version" "$release_note" >/dev/null; then
+          printf '%s\n' "release note heading does not match $version" >&2
+          exit 1
+        fi
+        for heading in '## Summary' '## Compatibility' '## Upgrade' '## Changes'; do
+          if ! grep -F -x "$heading" "$release_note" >/dev/null; then
+            printf '%s\n' "release note is missing heading: $heading" >&2
+            exit 1
+          fi
+        done
+
+        ./scripts/check-release-source.sh "$version"

AGENTS.md

@@ -1,2 +1,7 @@
 Please review `docs/development.md` for initial orientation in this repository
 and follow its task-specific reading guide.
+
+For every planning and implementation task, follow the
+[`Implementation Discipline`](docs/policy/architecture.md#implementation-discipline):
+keep machinery proportionate, do not invent restrictions, and do not elevate
+incidental implementation details into repository policy.

README.md

@@ -2,9 +2,9 @@
 
 Notarius is a Go CLI for turning source material into structured artifacts with
 configured extraction pipelines. The implemented D&D workflow reads Seriatim
-transcript JSON and can produce location registries and occurrences, scene
+transcript JSON and can produce NPC, location, and item registries; their
-descriptions, item and currency events, NPC identities, combat turns, NPC
+source-grounded occurrences; scene descriptions, combat turns, enemy events,
-interactions, enemy events, and spell casts.
+and spell casts.
 
 ## Quickstart
 
@@ -28,6 +28,20 @@ For the complete ordered D&D workflow, use
 [its synthetic transcript](examples/dnd-complete-transcript.json). It
 demonstrates all implemented D&D lanes and the supporting campaign references.
 
+## Install A Source Release
+
+Install a pinned source release with Go:
+
+~~~
+GOWORK=off go install \
+  gitea.maximumdirect.net/eric/notarius/cmd/notarius@<tag>
+~~~
+
+Replace `<tag>` with a stable release tag such as `vMAJOR.MINOR.PATCH`. The
+installed command's diagnostic version is described in the [CLI
+reference](docs/cli.md); maintainers preparing a release should follow [Source
+Releases](docs/release.md).
+
 ## Documentation
 
 - [CLI reference](docs/cli.md) — commands, flags, output streams, and exits.
@@ -39,6 +53,8 @@ demonstrates all implemented D&D lanes and the supporting campaign references.
   artifact formats.
 - [Subprocess consumer guide](docs/consumers/subprocess.md) — invoke Notarius
   from an orchestrator and consume a published result.
+- [Complete D&D consumer guide](docs/consumers/dnd-pipeline.md) — run the full
+  D&D pipeline as a subprocess and discover its structured artifacts.
 - [Internal overview](docs/internal/overview.md) — implemented component map
   for maintainers.
 - [Developer guide](docs/development.md) — contributor orientation and

assets/dnd/combat-turns/prompts/instructions.md

@@ -1,6 +1,18 @@
-Return the combat_turns array even when no combat turn is established. Return
+Extract Dungeons & Dragons combat-turn artifacts from the supplied transcript.
-actor, turn_kind, and source_refs for every record. For turn_kind, use exactly
+Include a record only when the transcript establishes that an in-world
-one of: turn, reaction, legendary_action, lair_action, or other. Cite the
+participant takes a combat turn or performs a discrete interrupting combat
-transcript ranges that establish both the actor and the combat event. Use the
+event. Keep events in transcript chronology; place an interrupting event where
-players, party, and transcript context to map speakers to in-world actors. NPC
+it occurs.
-names may help disambiguate identity but do not replace transcript evidence.
+
+Exclude initiative setup without a turn or combat event, tactical planning,
+table talk, rules lookup, hypothetical events, abandoned intentions, recaps
+outside the current passage, and downstream consequences. Do not infer combat
+events from Dungeons & Dragons rules knowledge. Preserve the session as played
+and attribute relevant nonstandard rulings to the GM or table. Unmatched actors
+remain permitted.
+
+Treat each record as one turn-level event and keep its supporting transcript
+evidence together. Use `turn` for a regular combat turn, `reaction` for an
+off-turn reaction, `legendary_action` for a legendary action,
+`lair_action` for a lair action, and `other` for another discrete combat
+event that does not fit those categories.

assets/dnd/combat-turns/prompts/prompt.yaml

@@ -14,7 +14,7 @@ inputs:
   - name: glossary
     required: false
     content_type: text/plain
-  - name: npcs
+  - name: npc_registry
     required: false
     content_type: application/json
 messages:
@@ -27,15 +27,13 @@ messages:
     cache_control:
       type: ephemeral
   - role: user
-    content_file: ./sharedassets/common-dnd-transcript.md
+    content_file: ./sharedassets/common-dnd-transcript-chunk.md
     cache_control:
       type: ephemeral
   - role: user
     content_file: ./sharedassets/common-dnd-extraction-evidence.md
   - role: user
-    content_file: ./sharedassets/common-dnd-npcs.md
+    content_file: ./sharedassets/common-dnd-npc-registry.md
-  - role: user
-    content_file: ./task.md
   - role: user
     content_file: ./instructions.md
     cache_control:
@@ -44,4 +42,4 @@ output:
   format: json
   validation_mode: json_schema
   schema_path: dnd_combat_turns_llm.v1.json
-  repair_attempts: 0
+  repair_attempts: 1

assets/dnd/combat-turns/prompts/task.md

@@ -1,18 +0,0 @@
-Extract Dungeons & Dragons combat-turn artifacts from the supplied transcript.
-
-Include a record only when the transcript establishes that an in-world
-participant takes a combat turn or performs a discrete interrupting combat
-event. Interrupting events belong at the point where they occur in transcript
-chronology.
-
-Exclude initiative setup without a turn or combat event, tactical planning,
-table talk, rules lookup, hypothetical events, abandoned intentions, recaps
-outside the current passage, and downstream consequences.
-
-Do not infer combat events from D&D rules knowledge. Preserve the session as
-played and attribute relevant nonstandard rulings to the GM or table.
-
-Unmatched actors remain permitted.
-
-Place all supporting transcript ranges for a turn in its turn-level source_refs
-collection.

assets/dnd/combat-turns/schemas/dnd_combat_turns_llm.v1.json

@@ -16,7 +16,8 @@
             "type": "string"
           },
           "turn_kind": {
-            "type": "string"
+            "type": "string",
+            "enum": ["turn", "reaction", "legendary_action", "lair_action", "other"]
           },
           "source_refs": {
             "type": "array",

assets/dnd/enemy-events/prompts/combat-grounding.md

@@ -9,4 +9,4 @@ Combat-turn grounding:
 
 Named combat-opponent grounding:
 
-{{ input "npc_interactions" }}
+{{ input "npc_occurrences" }}

assets/dnd/enemy-events/prompts/instructions.md

@@ -1,14 +1,25 @@
+Extract Dungeons & Dragons enemy events from the supplied combat transcript.
+An `engaged` event requires direct establishment that a subject is actively
+opposing the party in combat. A `killed`, `fled`, `captured`, or
+`incapacitated` event requires explicit establishment of that outcome. An
+outcome may share evidence with an engagement, and a later engagement or
+outcome for the same subject remains a separate observation. Emit at most one
+`engaged` observation for the same subject in this combat scene.
+
+For `killed`, direct death or killing is required. For `fled`, the subject
+must explicitly escape, retreat, or leave combat to avoid continued engagement.
+For `captured`, the subject must be explicitly taken prisoner or secured
+under the party's control. For `incapacitated`, the subject must be explicitly
+unable to continue acting without being established as killed or captured.
+
+When the transcript identifies a named NPC, use its normalized registry
+spelling. A hostile creature without a registry entry is allowed. For unnamed
+individuals or groups, use only the narrowest transcript-grounded label, such
+as `Orcs`, `One orc`, or `Remaining orcs`; never invent member names, IDs,
+or quantities.
+
 Exclude party members, allies, neutral observers, mentioned-but-absent enemies,
 hazards, traps, environmental effects, uncertain allegiance, table talk,
 planning, hypotheses, recaps outside this passage, and downstream inference.
-
 Do not infer an engagement or outcome from initiative, turn absence, damage,
-defeat, movement, a scene ending, combat-opponent grounding, or any auxiliary
+defeat, movement, or a scene ending.
-artifact. Auxiliary inputs can guide attention but cannot prove or supply an
-event. Cite only narrow current-transcript ranges that establish each event.
-
-Return the `events` array even when no enemy event is established. Every event
-must contain only `name`, `kind`, and `source_refs`. Use exactly one kind:
-`engaged`, `killed`, `fled`, `captured`, or `incapacitated`. Each source range
-uses integer `start_unit_id` and `end_unit_id`; omit `source_id` because
-Notarius assigns the current source identity.

assets/dnd/enemy-events/prompts/prompt.yaml

@@ -14,13 +14,13 @@ inputs:
   - name: glossary
     required: false
     content_type: text/plain
-  - name: npcs
+  - name: npc_registry
     required: true
     content_type: application/json
   - name: combat_turns
     required: true
     content_type: application/json
-  - name: npc_interactions
+  - name: npc_occurrences
     required: true
     content_type: application/json
 messages:
@@ -33,17 +33,15 @@ messages:
     cache_control:
       type: ephemeral
   - role: user
-    content_file: ./sharedassets/common-dnd-transcript.md
+    content_file: ./sharedassets/common-dnd-transcript-chunk.md
     cache_control:
       type: ephemeral
   - role: user
     content_file: ./sharedassets/common-dnd-extraction-evidence.md
   - role: user
-    content_file: ./sharedassets/common-dnd-npcs.md
+    content_file: ./sharedassets/common-dnd-npc-registry.md
   - role: user
-    content_file: ./grounding.md
+    content_file: ./combat-grounding.md
-  - role: user
-    content_file: ./task.md
   - role: user
     content_file: ./instructions.md
     cache_control:
@@ -52,4 +50,4 @@ output:
   format: json
   validation_mode: json_schema
   schema_path: dnd_enemy_events_llm.v1.json
-  repair_attempts: 0
+  repair_attempts: 1

assets/dnd/enemy-events/prompts/task.md

@@ -1,20 +0,0 @@
-Extract Dungeons & Dragons enemy events from the supplied combat transcript.
-
-Return an `engaged` event only when the transcript directly establishes that a
-subject is actively opposing the party in combat. Return `killed`, `fled`,
-`captured`, or `incapacitated` only when the transcript explicitly establishes
-that outcome. An outcome may share evidence with an engagement, and a later
-engagement or outcome for the same subject remains a separate observation.
-Emit at most one engagement for the same subject in this combat scene.
-
-For `killed`, direct death or killing is required. For `fled`, the subject must
-explicitly escape, retreat, or leave combat to avoid continued engagement. For
-`captured`, the subject must be explicitly taken prisoner or secured under the
-party's control. For `incapacitated`, the subject must be explicitly unable to
-continue acting without being established as killed or captured.
-
-Use a normalized NPC registry spelling when the transcript identifies that
-named NPC. A hostile creature without a registry entry is allowed. For unnamed
-individuals or groups, use only the narrowest transcript-grounded label, such
-as `Orcs`, `One orc`, or `Remaining orcs`; never invent member names, IDs, or
-quantities.

assets/dnd/enemy-events/schemas/dnd_enemy_events_llm.v1.json

@@ -13,7 +13,10 @@
         "required": ["name", "kind", "source_refs"],
         "properties": {
           "name": {"type": "string"},
-          "kind": {"type": "string"},
+          "kind": {
+            "type": "string",
+            "enum": ["engaged", "killed", "fled", "captured", "incapacitated"]
+          },
           "source_refs": {
             "type": "array",
             "items": {

assets/dnd/entity-reconciliation/schemas/dnd_entity_reconcile_llm.v1.json

@@ -1,24 +0,0 @@
-{
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "notarius.dnd.entity_reconcile.llm",
-  "type": "object",
-  "additionalProperties": false,
-  "required": ["duplicate_groups"],
-  "properties": {
-    "duplicate_groups": {
-      "type": "array",
-      "items": {
-        "type": "object",
-        "additionalProperties": false,
-        "required": ["members", "canonical"],
-        "properties": {
-          "members": {
-            "type": "array",
-            "items": {"type": "string"}
-          },
-          "canonical": {"type": "string"}
-        }
-      }
-    }
-  }
-}

assets/dnd/item-events/prompts/instructions.md

@@ -1,26 +0,0 @@
-Return one event only when the transcript establishes a meaningful item or
-currency occurrence. Use a concise observed item name and preserve the stated
-currency denomination. Set `quantity` to the explicitly stated integer, or to
-`null` when the transcript does not state one.
-
-Use `discovered` when the party learns of or encounters an item without
-establishing possession. Use `acquired` when the party or a party member gains
-possession. Use `lost` when party possession ends through a gift, sale, payment,
-theft, abandonment, or destruction not caused by intended use. Use `consumed`
-when intended use depletes an expendable item. Monetary spending, purchases, and
-payments are always `lost`, not `consumed`. Classify currency as `consumed` only
-when the transcript explicitly describes it being physically destroyed or
-expended as a non-payment component. Use `transferred` only when possession
-moves between two distinct named party members.
-
-Return both `from` and `to` for every event, using `null` when a holder does not
-apply. For `discovered`, set both holders to `null`. For `acquired`, set `from`
-to `null` and provide `to`; for `lost` and `consumed`, provide `from` and set
-`to` to `null`; and for `transferred`, provide both holders. Use `party` only
-for collective or unresolved party possession, never for either side of a
-transfer. Do not emit a transfer for a gift, sale, or payment outside the party.
-
-Ordinary non-depleting use is not an event. Do not infer acquisition from a
-discovery, or discovery from an acquisition: emit both only when each is
-independently established. Every event needs at least one narrow transcript
-range. Return no lore, inventory totals, aliases, or unstated holder details.

assets/dnd/item-events/prompts/task.md

@@ -1,7 +0,0 @@
-Extract meaningful Dungeons & Dragons item and currency events established by
-the transcript. Record only discoveries and changes in party possession, with
-the transcript ranges that support each event.
-
-This is an event history, not an inventory or ledger. Do not calculate balances,
-resolve item identity across records, or infer ownership that the transcript
-does not establish.

assets/dnd/item-occurrences/prompts/instructions.md

@@ -0,0 +1,38 @@
+Extract meaningful Dungeons & Dragons item and currency occurrences: discoveries and changes
+in party possession established by the transcript. This is an occurrence history,
+not an inventory or ledger: do not calculate balances, resolve item identity
+across records, or infer ownership that the transcript does not establish.
+
+For every occurrence, use the supplied canonical item `name`. Record a stated
+quantity as an integer and leave it null when the transcript does not state
+one. Preserve the stated currency denomination through the selected canonical
+registry name.
+
+Use `discovered` when the party learns of or encounters an item without
+establishing possession. Use `acquired` when the party or a party member gains
+possession. Use `lost` when party possession ends through a gift, sale, payment,
+theft, abandonment, or destruction not caused by intended use. Use `consumed`
+when intended use depletes an expendable item. Monetary spending, purchases, and
+payments are always `lost`, not `consumed`. Classify currency as `consumed` only
+when the transcript explicitly describes it being physically destroyed or
+expended as a non-payment component. Use `transferred` only when possession
+moves between two distinct named party members.
+
+Return both `from` and `to` for every occurrence. Use JSON `null`, not an empty
+string, whenever a holder does not apply. Follow this holder matrix exactly:
+
+| `kind` | required `from` | required `to` |
+| --- | --- | --- |
+| `discovered` | `null` | `null` |
+| `acquired` | `null` | `party` or the named party member gaining possession |
+| `lost` | `party` or the named party member losing possession | `null` |
+| `consumed` | `party` or the named party member consuming the item | `null` |
+| `transferred` | one named party member | a different named party member |
+
+Use `party` only for collective or unresolved party possession, never for
+either side of a transfer. Do not emit a transfer for a gift, sale, or payment
+outside the party.
+
+Ordinary non-depleting use is not an occurrence. Do not infer acquisition from a
+discovery, or discovery from an acquisition: emit both only when each is
+independently established.

assets/dnd/item-occurrences/prompts/item-registry.md

@@ -0,0 +1,6 @@
+Use the supplied item registry only to ground each occurrence. Every record
+must use one registry item's canonical `name`; do not invent, rename, merge,
+or infer registry items. The registry is not transcript evidence: cite only the
+current transcript chunk in `source_refs`.
+
+{{ input "item_registry" }}

assets/dnd/item-occurrences/prompts/prompt.yaml

@@ -1,4 +1,4 @@
-id: dnd.npc_interactions
+id: dnd.item_occurrences
 version: "v1"
 default_profile: dnd-extraction
 inputs:
@@ -14,7 +14,7 @@ inputs:
   - name: glossary
     required: false
     content_type: text/plain
-  - name: npcs
+  - name: item_registry
     required: true
     content_type: application/json
 messages:
@@ -27,15 +27,13 @@ messages:
     cache_control:
       type: ephemeral
   - role: user
-    content_file: ./sharedassets/common-dnd-transcript.md
+    content_file: ./sharedassets/common-dnd-transcript-chunk.md
     cache_control:
       type: ephemeral
   - role: user
     content_file: ./sharedassets/common-dnd-extraction-evidence.md
   - role: user
-    content_file: ./sharedassets/common-dnd-npcs.md
+    content_file: ./item-registry.md
-  - role: user
-    content_file: ./task.md
   - role: user
     content_file: ./instructions.md
     cache_control:
@@ -43,5 +41,5 @@ messages:
 output:
   format: json
   validation_mode: json_schema
-  schema_path: dnd_npc_interactions_llm.v1.json
+  schema_path: dnd_item_occurrences_llm.v1.json
-  repair_attempts: 0
+  repair_attempts: 1

assets/dnd/item-occurrences/schemas/dnd_item_occurrences_llm.v1.json

@@ -1,11 +1,11 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "notarius.dnd.item_events.llm",
+  "$id": "notarius.dnd.item_occurrences.llm",
   "type": "object",
   "additionalProperties": false,
-  "required": ["events"],
+  "required": ["occurrences"],
   "properties": {
-    "events": {
+    "occurrences": {
       "type": "array",
       "items": {
         "type": "object",
@@ -13,7 +13,10 @@
         "required": ["name", "kind", "quantity", "from", "to", "source_refs"],
         "properties": {
           "name": {"type": "string"},
-          "kind": {"type": "string"},
+          "kind": {
+            "type": "string",
+            "enum": ["discovered", "acquired", "lost", "consumed", "transferred"]
+          },
           "quantity": {"type": ["integer", "null"]},
           "from": {"type": ["string", "null"]},
           "to": {"type": ["string", "null"]},
@@ -22,10 +25,10 @@
             "items": {
               "type": "object",
               "additionalProperties": false,
-              "required": ["start_segment", "end_segment"],
+              "required": ["start_unit_id", "end_unit_id"],
               "properties": {
-                "start_segment": {"type": "integer"},
+                "start_unit_id": {"type": "integer"},
-                "end_segment": {"type": "integer"}
+                "end_unit_id": {"type": "integer"}
               }
             }
           }

assets/dnd/item-registry/extract/prompts/instructions.md

@@ -0,0 +1,12 @@
+Extract only items established by the provided Dungeons & Dragons transcript.
+
+Include named unique items, concrete reusable item types, and stable unique
+designations. Record each currency denomination separately when it is
+established, such as copper pieces, silver pieces, gold pieces, or platinum
+pieces. Do not use capitalization as an eligibility test. Keep distinct names
+and designations as separate candidates; do not merge aliases or invent
+qualifiers.
+
+Do not record vague categories such as "loot", "treasure", or "some gear";
+generic weapons; inferred properties; quantities; or inferred uniqueness. Omit
+uncertain or unsupported items.

assets/dnd/item-registry/extract/prompts/prompt.yaml

@@ -1,4 +1,4 @@
-id: dnd.npcs
+id: dnd.item_registry
 version: "v1"
 default_profile: dnd-extraction
 inputs:
@@ -24,13 +24,11 @@ messages:
     cache_control:
       type: ephemeral
   - role: user
-    content_file: ./sharedassets/common-dnd-transcript.md
+    content_file: ./sharedassets/common-dnd-transcript-chunk.md
     cache_control:
       type: ephemeral
   - role: user
     content_file: ./sharedassets/common-dnd-extraction-evidence.md
-  - role: user
-    content_file: ./task.md
   - role: user
     content_file: ./instructions.md
     cache_control:
@@ -38,5 +36,5 @@ messages:
 output:
   format: json
   validation_mode: json_schema
-  schema_path: dnd_npcs_llm.v1.json
+  schema_path: dnd_item_registry_llm.v1.json
-  repair_attempts: 0
+  repair_attempts: 1

assets/dnd/item-registry/extract/schemas/dnd_item_registry_llm.v1.json

@@ -0,0 +1,32 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "notarius.dnd.item_registry.llm",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["items"],
+  "properties": {
+    "items": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["name", "source_refs"],
+        "properties": {
+          "name": {"type": "string"},
+          "source_refs": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "additionalProperties": false,
+              "required": ["start_unit_id", "end_unit_id"],
+              "properties": {
+                "start_unit_id": {"type": "integer"},
+                "end_unit_id": {"type": "integer"}
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}

assets/dnd/item-registry/normalize/prompts/instructions.md

@@ -0,0 +1,9 @@
+Determine whether candidates identify the same item type or unique designation
+using their contextual labels and cited transcript windows. Do not treat nearby
+evidence, similar objects, or a shared owner as sufficient.
+
+Keep currency denominations and materially different item types separate. Keep
+uncertain aliases separate. Do not infer an item property or uniqueness.
+
+Set `canonical_candidate_number` to the supplied candidate number whose label
+is the clearest established designation.

assets/dnd/item-registry/normalize/prompts/prompt.yaml

@@ -1,4 +1,4 @@
-id: dnd.npcs.normalize
+id: dnd.item_registry.normalize
 version: "v1"
 default_profile: dnd-extraction
 inputs:
@@ -12,19 +12,19 @@ messages:
   - role: system
     content_file: ./sharedassets/common-dnd-system.md
   - role: user
-    content_file: ./task.md
+    content_file: ./sharedassets/protocol.md
   - role: user
-    content_file: ./sharedassets/common-dnd-entity-reconciliation.md
+    content_file: ./instructions.md
     cache_control:
       type: ephemeral
   - role: user
-    content_file: ./candidates.md
+    content_file: ./sharedassets/candidates.md
   - role: user
-    content_file: ./sharedassets/common-dnd-transcript.md
+    content_file: ./sharedassets/transcript-windows.md
     cache_control:
       type: ephemeral
 output:
   format: json
   validation_mode: json_schema
-  schema_path: dnd_entity_reconcile_llm.v1.json
+  schema_path: semantic_reconciliation_llm.v1.json
-  repair_attempts: 0
+  repair_attempts: 1

assets/dnd/location-occurrences/prompts/instructions.md

@@ -1,8 +1,34 @@
-Return the occurrences array even when no occurrence is established. Every
+Extract Dungeons & Dragons location occurrences from the supplied transcript.
-record must contain location_id, name, kind, and source_refs. Copy location_id
+Include an occurrence only when the transcript establishes one supplied
-and name from one supplied registry record, and cite only narrow transcript
+location, one occurrence kind, and a coherent passage supporting both.
-ranges that support both that location and its classified occurrence.
 
-Do not summarize location descriptions, infer a missing registry record, or
+Use exactly one kind per occurrence:
-use registry context as evidence. Omit source_id; Notarius assigns the current
+
-transcript source identity.
+- visited: party members are physically present, arrive, remain, or depart;
+- planned: the party explicitly proposes, intends, or agrees to future travel;
+- recalled: the transcript explicitly recounts an earlier party visit; or
+- mentioned: the location is explicitly referenced without stronger support,
+  including non-actionable speculation or a mere hypothetical reference.
+
+A mere hypothetical or speculative reference is not planned unless the
+transcript also establishes an actual proposal, intention, or agreement to
+travel. When the hypothetical explicitly names a supplied location, it may be
+mentioned.
+
+A generic phrase in the current chunk may refer to a supplied named registry
+location only when the chunk's context supports that coreference. It must not
+create a registry location, and registry content or provenance must never
+replace current-chunk evidence.
+
+For every occurrence, return the exact selector from the location registry:
+the canonical `name`, plus an empty `registry_refs` array for a unique name or
+the complete ordered `registry_refs` array for a repeated name. Registry ranges
+and context identify the location only; they are not occurrence evidence.
+
+For overlapping support, visited outranks planned, recalled, and mentioned;
+planned outranks recalled and mentioned; recalled outranks mentioned. A passage
+may produce multiple records when it independently establishes separate facts,
+such as recalling an earlier visit while planning a return. Omit inferred,
+unstated, uncertain, or unsupported places and occurrences. Do not infer a
+location or occurrence from surrounding events when the transcript does not
+state it. Do not summarize location descriptions.

assets/dnd/location-occurrences/prompts/location-registry.md

@@ -0,0 +1,11 @@
+A contextual location registry is provided below for identity grounding. It may
+be empty. Every record supplies a canonical display name. A name that appears
+once is selected with that name and an empty `registry_refs` array. A repeated
+name is selected only by copying both its name and its complete, ordered
+`registry_refs` array exactly as supplied.
+
+Registry content is context, not occurrence evidence. Do not derive an
+occurrence or `source_refs` range from the registry. Do not invent a location
+or selector that is absent from it.
+
+{{ input "location_registry" }}

assets/dnd/location-occurrences/prompts/locations.md

@@ -1,9 +0,0 @@
-A normalized location registry is provided below for identity grounding. It may
-be empty. Each record contains the exact location ID and canonical display name
-to copy when the transcript establishes an occurrence of that place.
-
-Registry content is context, not occurrence evidence. Do not derive an
-occurrence or a source range from the registry, and do not infer a location
-that is absent from it.
-
-{{ input "locations" }}

assets/dnd/location-occurrences/prompts/prompt.yaml

@@ -14,7 +14,7 @@ inputs:
   - name: glossary
     required: false
     content_type: text/plain
-  - name: locations
+  - name: location_registry
     required: true
     content_type: application/json
 messages:
@@ -27,15 +27,13 @@ messages:
     cache_control:
       type: ephemeral
   - role: user
-    content_file: ./sharedassets/common-dnd-transcript.md
+    content_file: ./sharedassets/common-dnd-transcript-chunk.md
     cache_control:
       type: ephemeral
   - role: user
     content_file: ./sharedassets/common-dnd-extraction-evidence.md
   - role: user
-    content_file: ./locations.md
+    content_file: ./location-registry.md
-  - role: user
-    content_file: ./task.md
   - role: user
     content_file: ./instructions.md
     cache_control:
@@ -44,4 +42,4 @@ output:
   format: json
   validation_mode: json_schema
   schema_path: dnd_location_occurrences_llm.v1.json
-  repair_attempts: 0
+  repair_attempts: 1

assets/dnd/location-occurrences/prompts/task.md

@@ -1,29 +0,0 @@
-Extract Dungeons & Dragons location occurrences from the supplied transcript.
-
-Include an occurrence only when the transcript establishes one supplied
-location, one occurrence kind, and a coherent passage supporting both. Use
-only the exact ID and name pair from the supplied location registry. Return an
-empty occurrences array when no supplied location has an evidenced occurrence
-in this transcript passage.
-
-Use exactly one kind per occurrence:
-
-- visited: party members are physically present, arrive, remain, or depart;
-- planned: the party explicitly proposes, intends, or agrees to future travel;
-- recalled: the transcript explicitly recounts an earlier party visit; or
-- mentioned: the location is explicitly referenced without stronger support,
-  including non-actionable speculation or a mere hypothetical reference.
-
-A mere hypothetical or speculative reference is not planned unless the
-transcript also establishes an actual proposal, intention, or agreement to
-travel. When the hypothetical itself explicitly names a supplied registry
-location, it may be mentioned using the narrow passage that supports that
-reference.
-
-For overlapping support, visited outranks planned, recalled, and mentioned;
-planned outranks recalled and mentioned; recalled outranks mentioned. A passage
-may produce multiple records when it independently establishes separate facts,
-such as recalling an earlier visit while planning a return. Omit inferred,
-unstated, uncertain, or unsupported places and occurrences. Do not infer a
-location or occurrence from surrounding events when the transcript does not
-state it.

assets/dnd/location-occurrences/schemas/dnd_location_occurrences_llm.v1.json

@@ -10,10 +10,21 @@
       "items": {
         "type": "object",
         "additionalProperties": false,
-        "required": ["location_id", "name", "kind", "source_refs"],
+        "required": ["name", "registry_refs", "kind", "source_refs"],
         "properties": {
-          "location_id": {"type": "string"},
           "name": {"type": "string"},
+          "registry_refs": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "additionalProperties": false,
+              "required": ["start_unit_id", "end_unit_id"],
+              "properties": {
+                "start_unit_id": {"type": "integer", "minimum": 1},
+                "end_unit_id": {"type": "integer", "minimum": 1}
+              }
+            }
+          },
           "kind": {"enum": ["visited", "planned", "recalled", "mentioned"]},
           "source_refs": {
             "type": "array",

assets/dnd/location-registry/extract/prompts/instructions.md

@@ -0,0 +1,13 @@
+Extract only physical places established by the provided Dungeons & Dragons
+transcript that have a stable proper name or unique in-world designation. This
+includes named planes, regions, settlements, districts, buildings, rooms,
+landmarks, routes, and geographic features.
+
+Do not create a registry location for generic, temporary, relative, or merely
+descriptive phrases, including "the room", "the bar", "the hallway",
+"outside", and "upstairs". Do not use capitalization as an eligibility test.
+Keep aliases and nested places when the transcript identifies them; do not merge
+or invent qualifiers for similarly named places.
+
+Exclude people, creatures, objects, organizations, abstract concepts, and
+places merely inferred from an event. Omit uncertain or unsupported places.

assets/dnd/location-registry/extract/prompts/prompt.yaml

@@ -1,4 +1,4 @@
-id: dnd.locations
+id: dnd.location_registry
 version: "v1"
 default_profile: dnd-extraction
 inputs:
@@ -24,13 +24,11 @@ messages:
     cache_control:
       type: ephemeral
   - role: user
-    content_file: ./sharedassets/common-dnd-transcript.md
+    content_file: ./sharedassets/common-dnd-transcript-chunk.md
     cache_control:
       type: ephemeral
   - role: user
     content_file: ./sharedassets/common-dnd-extraction-evidence.md
-  - role: user
-    content_file: ./task.md
   - role: user
     content_file: ./instructions.md
     cache_control:
@@ -38,5 +36,5 @@ messages:
 output:
   format: json
   validation_mode: json_schema
-  schema_path: dnd_locations_llm.v1.json
+  schema_path: dnd_location_registry_llm.v1.json
-  repair_attempts: 0
+  repair_attempts: 1

assets/dnd/location-registry/extract/schemas/dnd_location_registry_llm.v1.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "notarius.dnd.locations.llm",
+  "$id": "notarius.dnd.location_registry.llm",
   "type": "object",
   "additionalProperties": false,
   "required": ["locations"],

assets/dnd/location-registry/normalize/prompts/instructions.md

@@ -0,0 +1,9 @@
+Determine whether candidates identify the same physical place using their
+contextual labels and cited transcript windows. Do not treat matching names,
+nearby evidence, nested places, or generic labels as sufficient.
+
+Keep parent and child places separate, as well as similarly named places and
+uncertain aliases.
+
+Set `canonical_candidate_number` to the supplied candidate number whose label
+is the clearest established name.

assets/dnd/location-registry/normalize/prompts/prompt.yaml

@@ -0,0 +1,30 @@
+id: dnd.location_registry.normalize
+version: "v1"
+default_profile: dnd-extraction
+inputs:
+  - name: candidates
+    required: true
+    content_type: application/json
+  - name: transcript
+    required: true
+    content_type: application/json
+messages:
+  - role: system
+    content_file: ./sharedassets/common-dnd-system.md
+  - role: user
+    content_file: ./sharedassets/protocol.md
+  - role: user
+    content_file: ./instructions.md
+    cache_control:
+      type: ephemeral
+  - role: user
+    content_file: ./sharedassets/candidates.md
+  - role: user
+    content_file: ./sharedassets/transcript-windows.md
+    cache_control:
+      type: ephemeral
+output:
+  format: json
+  validation_mode: json_schema
+  schema_path: semantic_reconciliation_llm.v1.json
+  repair_attempts: 1

assets/dnd/locations/extract/prompts/instructions.md

@@ -1,6 +0,0 @@
-Return only observed location display names and narrow transcript source ranges.
-
-Exclude people, creatures, objects, organizations, abstract concepts, and
-places merely inferred from an event. Omit uncertain or unsupported places.
-Campaign references may clarify terms already present in the transcript, but
-they are not evidence and must never supply a source range.

assets/dnd/locations/extract/prompts/task.md

@@ -1,8 +0,0 @@
-Extract physical places established by the provided Dungeons & Dragons
-transcript and cite where each place is identified.
-
-Include planes, regions, settlements, districts, buildings, rooms, landmarks,
-routes, and geographic features. A generic label such as "the tavern" is
-allowed only when the transcript uses it for a specific place. Keep aliases and
-nested places when the transcript identifies them; do not merge or invent
-qualifiers for similarly named places.

assets/dnd/locations/normalize/prompts/candidates.md

@@ -1,2 +0,0 @@
-Location candidates:
-{{ input "candidates" }}

assets/dnd/locations/normalize/prompts/task.md

@@ -1,8 +0,0 @@
-Review location candidates and cited transcript context. Group candidates only
-when the evidence clearly identifies one physical place.
-
-Do not group candidates solely because their names match, their evidence is
-nearby, one place is nested inside another, or their labels are generic. Keep
-parent and child places, similarly named places, and uncertain aliases
-separate. For an accepted group, select the supplied candidate with the
-clearest established display name as canonical.

assets/dnd/npc-interactions/prompts/task.md

@@ -1,16 +0,0 @@
-Extract Dungeons & Dragons NPC interaction occurrences from the supplied
-transcript.
-
-Include an occurrence only when the transcript establishes one supplied NPC,
-one interaction kind, and a coherent passage supporting both. Use only names
-from the supplied NPC registry. The registry helps ground identity but never
-proves that an interaction occurred.
-
-Do not summarize, infer relationships, sentiment, factions, motives, aliases,
-or persistent state. Do not identify player characters, anonymous groups, or
-invented NPCs. Return an empty interactions array when no supplied NPC has an
-evidenced interaction in this transcript passage.
-
-Keep occurrences within this transcript chunk. Split records when an NPC's
-interaction kind changes, when combat alignment changes, or when an NPC is
-first mentioned and later becomes present.

assets/dnd/npc-occurrences/prompts/instructions.md

@@ -1,6 +1,14 @@
-Return the interactions array even when no interaction is established. Every
+Extract Dungeons & Dragons NPC occurrences from the supplied
-record must contain name, kind, and source_refs. Cite transcript ranges that
+transcript. Include an occurrence only when the transcript establishes one
-support both the NPC identity and the interaction kind.
+supplied NPC, one occurrence kind, and a coherent passage supporting both.
+Use the supplied canonical NPC `name`; never invent or substitute a similar
+name. Cite current-transcript evidence for every occurrence.
+
+Do not summarize, infer relationships, sentiment, factions, motives, aliases,
+or persistent state. Do not identify player characters, anonymous groups, or
+invented NPCs. Split records when an NPC's occurrence kind changes, when
+combat alignment changes, or when an NPC is first mentioned and later becomes
+present.
 
 Use exactly one kind per occurrence:
 

assets/dnd/npc-occurrences/prompts/prompt.yaml

@@ -0,0 +1,45 @@
+id: dnd.npc_occurrences
+version: "v1"
+default_profile: dnd-extraction
+inputs:
+  - name: transcript
+    required: true
+    content_type: application/json
+  - name: players
+    required: false
+    content_type: text/plain
+  - name: party
+    required: false
+    content_type: text/plain
+  - name: glossary
+    required: false
+    content_type: text/plain
+  - name: npc_registry
+    required: true
+    content_type: application/json
+messages:
+  - role: system
+    content_file: ./sharedassets/common-dnd-system.md
+  - role: user
+    content_file: ./sharedassets/common-dnd-identity.md
+  - role: user
+    content_file: ./sharedassets/common-dnd-references.md
+    cache_control:
+      type: ephemeral
+  - role: user
+    content_file: ./sharedassets/common-dnd-transcript-chunk.md
+    cache_control:
+      type: ephemeral
+  - role: user
+    content_file: ./sharedassets/common-dnd-extraction-evidence.md
+  - role: user
+    content_file: ./sharedassets/common-dnd-npc-registry.md
+  - role: user
+    content_file: ./instructions.md
+    cache_control:
+      type: ephemeral
+output:
+  format: json
+  validation_mode: json_schema
+  schema_path: dnd_npc_occurrences_llm.v1.json
+  repair_attempts: 1

assets/dnd/npc-occurrences/schemas/dnd_npc_occurrences_llm.v1.json

@@ -1,11 +1,11 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "notarius.dnd.npc_interactions.llm",
+  "$id": "notarius.dnd.npc_occurrences.llm",
   "type": "object",
   "additionalProperties": false,
-  "required": ["interactions"],
+  "required": ["occurrences"],
   "properties": {
-    "interactions": {
+    "occurrences": {
       "type": "array",
       "items": {
         "type": "object",
@@ -16,7 +16,8 @@
             "type": "string"
           },
           "kind": {
-            "type": "string"
+            "type": "string",
+            "enum": ["mentioned", "noncombat_presence", "dialogue", "combat_ally", "combat_opponent", "other"]
           },
           "source_refs": {
             "type": "array",

assets/dnd/npc-registry/extract/prompts/instructions.md

@@ -0,0 +1,19 @@
+Extract the individually identifiable Dungeons & Dragons non-player characters
+established by the provided transcript.
+
+Include an in-world non-PC only when the transcript factually establishes a
+proper name or a stable, individually distinguishing title or alias. A factual
+third-party mention establishes that identity even when the NPC is not
+physically present, does not speak, and takes no direct action in this chunk.
+Record only the NPC identity and the transcript evidence that establishes it;
+do not infer or classify a separate occurrence.
+
+Exclude human players, transcript speakers, and the GM as out-of-world people;
+player characters identified by the player or party references; names used only
+in hypothetical, speculative, or imagined examples; corrected transcription
+mistakes; anonymous or generic roles; indistinguishable crowds or groups;
+invented descriptive labels; and temporary summoned creatures or spell effects
+without a persistent individual identity.
+
+Preserve observed display spelling. Do not invent a label for an anonymous
+creature, crowd, or generic role.

assets/dnd/npc-registry/extract/prompts/prompt.yaml

@@ -1,4 +1,4 @@
-id: dnd.item_events
+id: dnd.npc_registry
 version: "v1"
 default_profile: dnd-extraction
 inputs:
@@ -24,13 +24,11 @@ messages:
     cache_control:
       type: ephemeral
   - role: user
-    content_file: ./sharedassets/common-dnd-transcript.md
+    content_file: ./sharedassets/common-dnd-transcript-chunk.md
     cache_control:
       type: ephemeral
   - role: user
     content_file: ./sharedassets/common-dnd-extraction-evidence.md
-  - role: user
-    content_file: ./task.md
   - role: user
     content_file: ./instructions.md
     cache_control:
@@ -38,5 +36,5 @@ messages:
 output:
   format: json
   validation_mode: json_schema
-  schema_path: dnd_item_events_llm.v1.json
+  schema_path: dnd_npc_registry_llm.v1.json
-  repair_attempts: 0
+  repair_attempts: 1

assets/dnd/npc-registry/extract/schemas/dnd_npc_registry_llm.v1.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "notarius.dnd.npcs.llm",
+  "$id": "notarius.dnd.npc_registry.llm",
   "type": "object",
   "additionalProperties": false,
   "required": ["npcs"],

assets/dnd/npc-registry/normalize/prompts/instructions.md

@@ -0,0 +1,12 @@
+Determine whether candidates refer to the same individual using their
+contextual labels and cited transcript windows. Preserve distinct individuals
+even when their names are similar or their contextual descriptions are
+identical.
+
+Set `canonical_candidate_number` to the supplied candidate number whose label
+is the preferred canonical display name. Prefer a complete, stable proper name
+over an abbreviation. Prefer an unadorned proper name over that name plus a
+contextual class, role, title, or relationship descriptor unless the transcript
+establishes the descriptor as part of the person's name. A longer display name
+is not inherently more canonical; for example, do not prefer `Captain Aria`
+over `Aria` solely because it includes the contextual title `Captain`.

assets/dnd/npc-registry/normalize/prompts/prompt.yaml

@@ -1,4 +1,4 @@
-id: dnd.locations.normalize
+id: dnd.npc_registry.normalize
 version: "v1"
 default_profile: dnd-extraction
 inputs:
@@ -12,19 +12,19 @@ messages:
   - role: system
     content_file: ./sharedassets/common-dnd-system.md
   - role: user
-    content_file: ./task.md
+    content_file: ./sharedassets/protocol.md
   - role: user
-    content_file: ./sharedassets/common-dnd-entity-reconciliation.md
+    content_file: ./instructions.md
     cache_control:
       type: ephemeral
   - role: user
-    content_file: ./candidates.md
+    content_file: ./sharedassets/candidates.md
   - role: user
-    content_file: ./sharedassets/common-dnd-transcript.md
+    content_file: ./sharedassets/transcript-windows.md
     cache_control:
       type: ephemeral
 output:
   format: json
   validation_mode: json_schema
-  schema_path: dnd_entity_reconcile_llm.v1.json
+  schema_path: semantic_reconciliation_llm.v1.json
-  repair_attempts: 0
+  repair_attempts: 1

assets/dnd/npcs/extract/prompts/instructions.md

@@ -1,8 +0,0 @@
-For every NPC record, return only the observed display name and transcript
-units that support that identity.
-
-Return no other details or lore inferred from general D&D knowledge. Do not
-invent a label for an anonymous creature, crowd, or generic role.
-
-Preserve observed display spelling. Return at least one narrow source range for
-every record.

assets/dnd/npcs/extract/prompts/task.md

@@ -1,12 +0,0 @@
-Extract the individually identifiable Dungeons & Dragons non-player characters
-established by the provided transcript and cite where each identity appears.
-
-Include an in-world non-PC participant only when the transcript gives it a
-proper name or a stable, individually distinguishing title or alias.
-
-Exclude human players, transcript speakers, and the GM as out-of-world people,
-player characters identified by the player or party references, incidental or
-hypothetical name drops, corrected transcription mistakes, anonymous or
-generic roles, indistinguishable crowds or groups, invented descriptive labels,
-and temporary summoned creatures or spell effects without a persistent
-individual identity.

assets/dnd/npcs/normalize/prompts/candidates.md

@@ -1,4 +0,0 @@
-The supplied NPC candidates are below. Use only these display names in the
-response.
-
-{{ input "candidates" }}

assets/dnd/npcs/normalize/prompts/task.md

@@ -1,13 +0,0 @@
-Review NPC candidates and their cited transcript context to identify aliases
-that refer to the same individual. Propose only groups supported by the
-transcript, and preserve distinct individuals even when their names are
-similar.
-
-For every accepted group, choose as canonical only a supplied candidate from
-that evidence-supported duplicate group. Prefer a complete, stable proper name
-over an abbreviation. Prefer an unadorned proper name over that name plus a
-contextual class, role, title, or relationship descriptor unless the transcript
-establishes the descriptor as part of the person's name. A longer display name
-is not inherently more canonical; for example, do not prefer `Captain Aria`
-over `Aria` solely because it includes the contextual title `Captain`. Do not
-invent, edit, or combine display names.

assets/dnd/scene-descriptions/prompts/instructions.md

@@ -1,8 +1,11 @@
-Choose exactly one kind:
+Describe exactly one accepted Dungeons & Dragons scene from the supplied
+transcript chunk. The complete chunk is the evidence boundary: do not split it
+into multiple scenes or use facts that are not supported by it.
 
-- combat: active combat materially organizes the scene, including
+Return one kind, one concise title, and one concise summary. Choose exactly one
-  initiative-like exchanges or sustained hostile action. Planning a fight or
+kind:
-  discussing a completed fight is not combat by itself.
+
+- combat: a scene classified as combat under the shared combat policy.
 - narrative: current-session in-world play that is not principally active
   combat, a prior-session recap, or sustained out-of-character session
   discussion. This includes exploration, travel, dialogue, investigation,
@@ -15,15 +18,13 @@ Choose exactly one kind:
   play.
 
 Narrative is the default for actual current-session gameplay that does not meet
-another definition. When the accepted chunk is mixed:
+another definition. When the accepted chunk has no substantive active combat:
 
-1. use combat when active combat is a substantive central activity, even with
+1. use recap when recounting a previous session is the chunk's
-   brief setup, rules clarification, or immediate aftermath;
-2. otherwise use recap when recounting a previous session is the chunk's
    primary table purpose;
-3. otherwise use meta when sustained out-of-character session discussion is
+2. otherwise use meta when sustained out-of-character session discussion is
    primary and in-world progression is no more than incidental; and
-4. use narrative for all remaining current-session in-world play.
+3. use narrative for all remaining current-session in-world play.
 
 Brief table talk, dice resolution, rules clarification, jokes, or
 administrative comments do not make a gameplay scene meta. A short recollection
@@ -37,8 +38,4 @@ must not invent a proper noun.
 The summary must briefly state the main activity and material transition or
 outcome established within the accepted chunk. Do not add analysis, inferred
 motives, hidden state, future consequences, relationship claims, or facts from
-outside the chunk. Campaign references may disambiguate names but never add
+outside the chunk.
-events or lore.
-
-Do not return identifiers, source identifiers, source ranges, unit identifiers,
-participants, confidence, or any fields besides kind, title, and summary.

assets/dnd/scene-descriptions/prompts/prompt.yaml

@@ -24,11 +24,11 @@ messages:
     cache_control:
       type: ephemeral
   - role: user
-    content_file: ./sharedassets/common-dnd-transcript.md
+    content_file: ./sharedassets/common-dnd-transcript-chunk.md
     cache_control:
       type: ephemeral
   - role: user
-    content_file: ./task.md
+    content_file: ./sharedassets/common-dnd-scene-combat-policy.md
   - role: user
     content_file: ./instructions.md
     cache_control:
@@ -37,4 +37,4 @@ output:
   format: json
   validation_mode: json_schema
   schema_path: dnd_scene_descriptions_llm.v1.json
-  repair_attempts: 0
+  repair_attempts: 1

assets/dnd/scene-descriptions/prompts/task.md

@@ -1,5 +0,0 @@
-Describe exactly one accepted Dungeons & Dragons scene from the supplied
-transcript chunk. The complete chunk is the evidence boundary: do not split it
-into multiple scenes or use facts that are not supported by it.
-
-Return one kind, one concise title, and one concise summary.

assets/dnd/scene-descriptions/schemas/dnd_scene_descriptions_llm.v1.json

@@ -6,7 +6,8 @@
   "required": ["kind", "title", "summary"],
   "properties": {
     "kind": {
-      "type": "string"
+      "type": "string",
+      "enum": ["combat", "narrative", "recap", "meta"]
     },
     "title": {
       "type": "string"

assets/dnd/scene-descriptions/validate/combat-semantics/prompts/instructions.md

@@ -0,0 +1,8 @@
+Classify only whether substantive active combat occurs in the supplied
+transcript chunk under the shared combat policy. Do not judge the scene title,
+summary, non-combat subtype, scene boundary, or any other aspect of a scene
+description.
+
+Return `combat` when the chunk contains substantive active combat and
+`non_combat` otherwise. Give a concise, transcript-grounded explanation for
+the classification.

assets/dnd/scene-descriptions/validate/combat-semantics/prompts/prompt.yaml

@@ -0,0 +1,23 @@
+id: dnd.scene_descriptions.validate_combat
+version: "v1"
+default_profile: dnd-extraction
+inputs:
+  - name: transcript
+    required: true
+    content_type: application/json
+messages:
+  - role: system
+    content_file: ./sharedassets/common-dnd-system.md
+  - role: user
+    content_file: ./sharedassets/common-dnd-scene-combat-policy.md
+  - role: user
+    content_file: ./instructions.md
+  - role: user
+    content_file: ./sharedassets/common-dnd-transcript-chunk.md
+    cache_control:
+      type: ephemeral
+output:
+  format: json
+  validation_mode: json_schema
+  schema_path: dnd_scene_combat_semantics_llm.v1.json
+  repair_attempts: 1

assets/dnd/scene-descriptions/validate/combat-semantics/schemas/dnd_scene_combat_semantics_llm.v1.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "notarius.dnd.scene_descriptions.combat_semantics.llm",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["classification", "explanation"],
+  "properties": {
+    "classification": {
+      "type": "string",
+      "enum": ["combat", "non_combat"]
+    },
+    "explanation": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 512
+    }
+  }
+}

assets/dnd/scenes/prompts/instructions.md

@@ -1,8 +1,19 @@
-Cover the complete provided transcript from its first source unit to its last
+Divide the complete provided transcript into coherent Dungeons & Dragons scenes
-source unit. Return scenes in source-unit order with no gaps or overlaps. Use
+for the `dnd/scenes` chunk module.
-only positive integer source-unit IDs from the transcript, and give every scene
-one inclusive `start_unit_id` and one inclusive `end_unit_id`.
 
-Return exactly one JSON object and no explanatory text. The object must contain
+A scene is a coherent unit of play. Start a new scene when the transcript
-only a non-empty `scenes` array. Each scene object must contain only
+establishes a meaningful change in location, objective, threat, activity,
-`start_unit_id` and `end_unit_id`.
+encounter, or mode of play. Good reasons include a material move, beginning or
+ending combat, a substantially different encounter phase, a shift between
+combat, exploration, social interaction, planning, travel, rest, or downtime,
+a change in the central NPC, faction, threat, or objective, or a sustained
+table-level interruption that materially changes the activity.
+
+Do not split a scene merely because a speaker or combat round changes, a
+routine turn occurs, or the table briefly digresses. Prefer fewer coherent
+scenes over speculative or fine-grained boundaries.
+
+Cover the complete transcript from its first source unit to its last. Return
+scenes in source-unit order with no gaps or overlaps. Use only positive integer
+source-unit IDs from the transcript, and give every scene one inclusive
+`start_unit_id` and one inclusive `end_unit_id`.

assets/dnd/scenes/prompts/prompt.yaml

@@ -21,16 +21,14 @@ messages:
     content_file: ./sharedassets/common-dnd-references.md
     cache_control:
       type: ephemeral
-  - role: user
-    content_file: ./task.md
   - role: user
     content_file: ./instructions.md
   - role: user
-    content_file: ./sharedassets/common-dnd-transcript.md
+    content_file: ./sharedassets/common-dnd-transcript-full.md
     cache_control:
       type: ephemeral
 output:
   format: json
   validation_mode: json_schema
-  schema_path: dnd_scenes.v1.json
+  schema_path: dnd_scenes_llm.v1.json
-  repair_attempts: 0
+  repair_attempts: 1

assets/dnd/scenes/prompts/task.md

@@ -1,18 +0,0 @@
-Divide the provided transcript into coherent Dungeons & Dragons scenes for the
-`dnd/scenes` chunk module.
-
-A scene is a coherent unit of play. Start a new scene when the transcript
-establishes a meaningful change in location, objective, threat, activity,
-encounter, or mode of play. Good reasons include a material move, beginning or
-ending combat, a substantially different encounter phase, a shift between
-combat, exploration, social interaction, planning, travel, rest, or downtime,
-a change in the central NPC, faction, threat, or objective, or a sustained
-table-level interruption that materially changes the activity.
-
-Do not split a scene merely because a speaker or combat round changes, a
-routine turn occurs, or the table briefly digresses. Prefer fewer coherent
-scenes over speculative or fine-grained boundaries.
-
-Return only inclusive `start_unit_id` and `end_unit_id` endpoints for each
-scene. Do not return titles, modes, participants, summaries, boundary notes,
-confidence, caveats, final chunk IDs, or chunk indexes.

assets/dnd/scenes/schemas/dnd_scenes_llm.v1.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "notarius.dnd.scenes",
+  "$id": "notarius.dnd.scenes.llm",
   "type": "object",
   "additionalProperties": false,
   "required": ["scenes"],

assets/dnd/shared/prompts/common-dnd-entity-reconciliation.md

@@ -1,6 +0,0 @@
-Identify only well-supported duplicate groups among the supplied candidates.
-
-Candidate keys are opaque identifiers. Copy each selected key exactly. A group
-must contain at least two supplied keys, and its `canonical` key must be one of
-its members. Do not create keys, records, names, source references, evidence,
-or replacement values. Omit any uncertain or unsafe group.

assets/dnd/shared/prompts/common-dnd-extraction-evidence.md

@@ -1,14 +1,8 @@
 Transcript units are the only evidence for extracted events and factual claims.
-Campaign and registry references may disambiguate names, aliases, speakers, or
-other identities, but they do not establish events, participation, effects, or
-source evidence.
-
 Every reported factual claim must be supported by cited transcript units. Use
-integer `start_unit_id` and `end_unit_id` values from the transcript. Omit
+integer `start_unit_id` and `end_unit_id` values from the transcript.
-`source_id`; Notarius assigns the current source identity.
+Within each range, `start_unit_id` must identify the earlier transcript unit and
+`end_unit_id` the same or a later unit according to transcript order.
 
 When supporting evidence is non-contiguous, use multiple narrow ranges rather
 than a broad range that bridges unrelated conversation.
-
-Return exactly one JSON object and no explanatory text. Output only the
-configured JSON object and fields defined by its response schema.

assets/dnd/shared/prompts/common-dnd-npc-registry.md

@@ -7,4 +7,4 @@ participants, effects, or source references from the registry. Registry source
 references describe registry provenance and may belong to another session; they
 are never evidence for the current transcript.
 
-{{ input "npcs" }}
+{{ input "npc_registry" }}

assets/dnd/shared/prompts/common-dnd-scene-combat-policy.md

@@ -0,0 +1,13 @@
+Use `combat` only when substantive active combat materially organizes the
+scene. Active combat includes initiative or turn exchanges, attacks, combat
+spells, damage, saves, movement, or similarly sustained hostile action.
+
+Do not use `combat` for planning or preparing for a possible fight; threats,
+hostile dialogue, or a tense confrontation; immediate aftermath, looting,
+healing, or discussion of a completed fight; a recap or in-world recollection
+of earlier combat; or out-of-character rules discussion without active
+encounter play.
+
+When a chunk contains substantive active combat alongside brief setup, rules
+clarification, interruption, phase transition, or immediate aftermath, classify
+it as `combat`.

assets/dnd/shared/prompts/common-dnd-system.md

@@ -1,6 +1,5 @@
-You work with Dungeons & Dragons gameplay transcripts.
+You process Dungeons & Dragons gameplay transcripts.
 
-Use only the provided transcript and reference material. Source text may contain
+As input, you will receive one or more portions of a transcript. The transcript may contain transcription errors, repeated lines, incomplete sentences, and misheard proper nouns.
-transcription errors, repeated lines, incomplete sentences, and misheard proper
+
-nouns. Reference material, when present, is supporting context only and must not
+Return exactly one JSON object that conforms to the configured response schema, with no explanatory prose.
-be treated as a source of extracted events by itself.

assets/dnd/shared/prompts/common-dnd-transcript-chunk.md

@@ -0,0 +1,3 @@
+One extraction chunk from a Dungeons & Dragons gameplay transcript is provided below. Report and infer only what is within this chunk. Its unit IDs retain their source-wide meaning.
+
+{{ input "transcript" }}

assets/dnd/shared/prompts/common-dnd-transcript-full.md

@@ -0,0 +1,3 @@
+The complete ordered transcript of this Dungeons & Dragons gameplay session is provided below.
+
+{{ input "transcript" }}

assets/dnd/shared/prompts/common-dnd-transcript.md

@@ -1,3 +0,0 @@
-A transcript of a Dungeons & Dragons gameplay session is provided below.
-
-{{ input "transcript" }}

assets/dnd/spells/prompts/catalog.md

@@ -1,6 +0,0 @@
-The canonical spell-name catalog for this extraction is provided below as JSON.
-Return spell names using the catalog's canonical spelling exactly. Aliases and
-other campaign reference material are not part of this catalog input and must
-not be copied into the output as spell names.
-
-{{ input "spell_catalog" }}

assets/dnd/spells/prompts/instructions.md

@@ -1,16 +1,14 @@
-For each spell cast, source references must collectively support the in-world
+Extract Dungeons & Dragons spell-cast artifacts from the provided transcript.
-caster, spell name, and the fact that the cast or declared attempt occurred.
+Include an actual casting event or an unambiguous declared casting attempt.
+Exclude spell mentions, hypothetical plans, rules discussion, and catalog
+matches that do not establish a casting event in the transcript.
 
-Return only D&D spell-cast artifacts. For each record, identify the in-world
+For every extracted cast, the transcript evidence must collectively support the
-caster, canonical spell name, and source references.
+in-world caster, the spell, and the fact that the cast or declared attempt
+occurred.
 
-Use the player and party references together with transcript context to map
+Attribute every cast to its in-world caster. Map first-person player speech to
-first-person player speech to the associated player character and use the
+the associated player character, and attribute a spell narrated by the GM to
-canonical character name from the references. Likewise, attribute a spell
+the in-world creature that casts it. If the caster cannot be resolved, use only
-narrated by the GM to the in-world creature that casts it. If the caster cannot
+the most specific in-world identity supported by the transcript; do not invent
-be resolved, use only the most specific in-world identity supported by the
+a name.
-transcript; do not invent a name.
-
-Use the canonical spell-name catalog to select spell names. Do not return a
-spell name absent from that catalog, even when it is suggested by general D&D
-knowledge or reference material.

assets/dnd/spells/prompts/prompt.yaml

@@ -17,7 +17,7 @@ inputs:
   - name: glossary
     required: false
     content_type: text/plain
-  - name: npcs
+  - name: npc_registry
     required: false
     content_type: application/json
 messages:
@@ -30,17 +30,15 @@ messages:
     cache_control:
       type: ephemeral
   - role: user
-    content_file: ./sharedassets/common-dnd-transcript.md
+    content_file: ./sharedassets/common-dnd-transcript-chunk.md
     cache_control:
       type: ephemeral
   - role: user
     content_file: ./sharedassets/common-dnd-extraction-evidence.md
   - role: user
-    content_file: ./sharedassets/common-dnd-npcs.md
+    content_file: ./sharedassets/common-dnd-npc-registry.md
   - role: user
-    content_file: ./catalog.md
+    content_file: ./spell-catalog.md
-  - role: user
-    content_file: ./task.md
   - role: user
     content_file: ./instructions.md
     cache_control:
@@ -49,4 +47,4 @@ output:
   format: json
   validation_mode: json_schema
   schema_path: dnd_spells_llm.v1.json
-  repair_attempts: 0
+  repair_attempts: 1

assets/dnd/spells/prompts/spell-catalog.md

@@ -0,0 +1,6 @@
+The spell catalog for this extraction is provided below as JSON. Each entry
+lists a `canonical_name` and its recognized `aliases`. If the transcript uses
+an alias, select that entry's `canonical_name`. Return spell names using the
+canonical spelling exactly; never return an alias as a spell name.
+
+{{ input "spell_catalog" }}

assets/dnd/spells/prompts/task.md

@@ -1,9 +0,0 @@
-Extract Dungeons & Dragons spell-cast artifacts from the provided transcript.
-
-Include an actual casting event or an unambiguous declared casting attempt.
-Exclude spell mentions, hypothetical plans, rules discussion, and catalog
-matches that do not establish a casting event in the transcript.
-
-Use the provided canonical spell-name catalog when naming each extracted spell.
-Return the canonical catalog spelling exactly. The catalog is a recognition
-aid and never evidence that a spell was cast.

assets/dnd/spells/schemas/dnd_spells_llm.v1.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "notarius.dnd.spells",
+  "$id": "notarius.dnd.spells.llm",
   "type": "object",
   "additionalProperties": false,
   "required": ["spell_casts"],

assets/generic/normalize/deduplication/prompts/candidates.md

@@ -0,0 +1,3 @@
+Candidate material, including the exact valid candidate-number range:
+
+{{ input "candidates" }}

assets/generic/normalize/deduplication/prompts/instructions.md

@@ -0,0 +1,5 @@
+Identify only high-confidence duplicate entities among the supplied candidates.
+
+Preserve distinct entities even when their names are similar. Treat contextual descriptions and transcript evidence as supporting material, not as permission to merge ambiguous records.
+
+When several records are duplicates, choose as canonical the candidate with the clearest stable identity. Prefer a complete proper name over an abbreviation, and prefer an unadorned proper name over one with incidental descriptors unless the evidence establishes those descriptors as part of the name. A longer name is not inherently more canonical.

assets/generic/normalize/deduplication/prompts/prompt.yaml

@@ -0,0 +1,27 @@
+id: generic.semantic_reconciliation
+version: "v1"
+inputs:
+  - name: candidates
+    required: true
+    content_type: application/json
+  - name: transcript
+    required: true
+    content_type: application/json
+messages:
+  - role: system
+    content_file: ./system.md
+  - role: user
+    content_file: ./protocol.md
+  - role: user
+    content_file: ./instructions.md
+    cache_control:
+      type: ephemeral
+  - role: user
+    content_file: ./candidates.md
+  - role: user
+    content_file: ./transcript-windows.md
+output:
+  format: json
+  validation_mode: json_schema
+  schema_path: semantic_reconciliation_llm.v1.json
+  repair_attempts: 1

assets/generic/normalize/deduplication/prompts/protocol.md

@@ -0,0 +1,9 @@
+Use only the positive integer `candidate_number` values supplied in the candidate material. Valid candidate numbers are exactly the inclusive `first` through `last` values declared in `candidate_number_range`; use the explicit number attached to each candidate.
+
+Transcript unit `id` values and evidence `start_unit_id` and `end_unit_id` values identify source positions. They are not candidate numbers and must never be used in `candidate_numbers` or `canonical_candidate_number`.
+
+Return a duplicate group only when the evidence supports that every selected candidate describes the same underlying entity. Each group must contain at least two distinct candidate numbers, and its `canonical_candidate_number` must be one of those numbers. A candidate may appear in at most one group.
+
+Omit uncertain matches and candidates that should remain distinct. Do not invent candidates or infer a number that is not explicitly supplied. An empty `duplicate_groups` array is valid.
+
+The response must conform exactly to the selected JSON schema. Return candidate numbers only: do not copy candidate names, evidence, transcript text, source identifiers, or source ranges into the response.

assets/generic/normalize/deduplication/prompts/system.md

@@ -0,0 +1,2 @@
+You reconcile structured records that may describe the same underlying entity.
+Follow the supplied protocol and return only the requested structured result.

assets/generic/normalize/deduplication/prompts/transcript-windows.md

@@ -0,0 +1,3 @@
+Transcript evidence windows:
+
+{{ input "transcript" }}

assets/generic/normalize/deduplication/schemas/semantic_reconciliation_llm.v1.json

@@ -0,0 +1,32 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "notarius.generic.semantic_reconciliation.llm",
+  "title": "notarius_semantic_reconciliation_llm_v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["duplicate_groups"],
+  "properties": {
+    "duplicate_groups": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["candidate_numbers", "canonical_candidate_number"],
+        "properties": {
+          "candidate_numbers": {
+            "type": "array",
+            "minItems": 2,
+            "items": {
+              "type": "integer",
+              "minimum": 1
+            }
+          },
+          "canonical_candidate_number": {
+            "type": "integer",
+            "minimum": 1
+          }
+        }
+      }
+    }
+  }
+}

docs/adr/0012-resolve-opaque-entity-identifiers-deterministically.md

@@ -0,0 +1,64 @@
+# ADR-0012: Resolve opaque entity identifiers deterministically
+
+**Status:** Accepted
+**Date:** 2026-08-08
+
+## Context
+
+Entity IDs in durable Notarius artifacts are application-owned, deterministic
+identifiers. They are useful to artifact consumers, but their hash-based form
+does not help a model distinguish entities and would make the model reproduce
+an opaque implementation detail. A plain name is likewise insufficient where
+multiple supplied records share that name.
+
+The LLM boundary must preserve the typed artifact and durable-schema ownership
+of [ADR-0003](0003-typed-interfaces-with-two-zone-data-model.md) and the distinction
+between disambiguating references and source evidence in
+[ADR-0009](0009-minimal-evidence-grounded-extraction-artifacts.md).
+
+## Decision
+
+Callers present a model with semantic selections: a canonical name when it is
+unique in the request, or a contextual descriptor containing the name and
+source coordinates when that context is needed to distinguish supplied
+records. The model returns only those supplied selections. The caller resolves
+each accepted selection against the request-local supplied records and attaches
+the opaque application ID deterministically.
+
+Source coordinates are permitted in a selection solely as identity context.
+They neither establish an occurrence fact nor replace that occurrence's
+current-transcript evidence. A selector must resolve exactly; unknown,
+ambiguous, partial, reordered, or otherwise unsafe selections are not mapped.
+Where an operation requires a complete grounded artifact, that failure rejects
+the complete artifact rather than accepting a partially mapped result.
+
+An explicitly scoped request-local short label is permitted only when a
+contextual descriptor would be impractical and the caller can deterministically
+map the label within that one request. Such a label is not a durable ID, must
+not escape the request boundary, and requires a concrete justification in its
+own module contract.
+
+## Alternatives considered
+
+- Ask the model to return durable IDs. This exposes opaque implementation
+  state, does not improve semantic disambiguation, and makes model output
+  depend on hash formatting.
+- Select by name alone. This cannot safely distinguish same-name records.
+- Make request-local labels durable identifiers. This would turn prompt
+  presentation into a public identity contract and create avoidable migration
+  pressure.
+- Let the model invent identifiers or resolve ambiguity. This makes identity
+  assignment non-deterministic and weakens validation.
+
+## Consequences
+
+Durable integration contracts retain their exact ID/name pairs while models
+operate on readable contextual selections. Calling modules must own selector
+construction, exact resolution, ambiguity handling, and conversion into their
+durable artifact type; PromptKit and its adapter remain transport-only.
+
+Some ambiguous or invalid proposals are deliberately omitted, retried, or
+rejected according to the caller's existing failure policy. Internal candidate
+keys may support deterministic request-local mapping, but they are not
+model-visible selectors or durable data. This adds local validation work while
+keeping identity assignment auditable and stable.

docs/adr/0013-use-request-local-candidate-handles-for-semantic-reconciliation.md

@@ -0,0 +1,89 @@
+# ADR-0013: Use request-local candidate handles for semantic reconciliation
+
+**Status:** Accepted
+**Date:** 2026-08-09
+
+## Context
+
+Several typed normalize stage modules need semantic reconciliation after
+deterministic preprocessing: a model can judge whether source-backed candidates
+refer to the same underlying entity, while application code remains responsible
+for constructing the normalized artifact. Requiring the model to reproduce a
+candidate's full contextual selector makes the response larger and introduces
+avoidable formatting, ordering, and transcription failure modes.
+
+Reconciliation must preserve the exact typed artifact boundary established by
+[ADR-0003](0003-typed-interfaces-with-two-zone-data-model.md), the domain-neutral
+framework and concrete-domain dependency direction established by
+[ADR-0004](0004-package-modules-by-domain.md), and the distinction in
+[ADR-0009](0009-minimal-evidence-grounded-extraction-artifacts.md) between source
+evidence and auxiliary identity context. It also needs a concrete, narrowly
+scoped application of the request-local-label exception allowed by
+[ADR-0012](0012-resolve-opaque-entity-identifiers-deterministically.md).
+
+## Decision
+
+Semantic reconciliation will be a domain-neutral framework mechanism used by
+typed normalize stage modules. A consuming artifact family will retain
+ownership of its typed records, identity rules, consolidation policy, durable
+IDs, and domain warnings; the framework mechanism will not infer those rules
+from arbitrary data.
+
+For each reconciliation request, deterministic code will assign every eligible
+model-visible candidate a contiguous, one-based integer handle. The model may
+receive the candidate's contextual label, source references, and bounded source
+context needed to judge identity, but its structured response will identify
+candidates only by those supplied handles. A handle is local to one request,
+does not represent entity identity, and must never enter a durable artifact or
+be used to derive a durable ID.
+
+The model will propose duplicate groups and select one supplied member of each
+group as canonical. Deterministic code will resolve the handles through the
+retained request mapping, validate the complete proposal, discard unsafe
+groups, and apply only validated groups through typed domain-owned policy. The
+model will not synthesize replacement records or directly mutate an artifact.
+
+Every reconciliation prompt will combine a mandatory framework-owned protocol
+and safety policy with an explicitly selected semantic policy. The semantic
+policy may be the conservative generic policy or a domain-owned policy, but it
+cannot replace the shared response protocol or deterministic safety boundary.
+
+## Alternatives considered
+
+- Return durable application IDs. Opaque IDs do not help semantic judgment,
+  expose application identity mechanics, and make model output reproduce data
+  that deterministic code already owns.
+- Return names alone or copied contextual selectors. Names can be ambiguous,
+  while reproducing labels and source ranges adds response complexity and
+  creates mismatches without adding semantic information. Request-local
+  handles preserve exact selection without either failure mode.
+- Ask the model to return synthesized canonical replacement records. This
+  would transfer typed artifact construction, provenance consolidation, and
+  durable identity policy to a probabilistic boundary.
+- Reconcile reflection-discovered fields or arbitrary JSON. This would weaken
+  the typed artifact contract and move domain semantics into generic code.
+- Hide reconciliation inside extraction or another stage. This would obscure
+  stage ownership and create cross-stage behavior outside the fixed pipeline;
+  reconciliation remains explicit normalize-stage behavior.
+- Let each domain replace the complete prompt protocol. This would duplicate
+  safety mechanics and allow domain policy to bypass the common response and
+  validation contract.
+
+## Consequences
+
+Model responses become smaller and easier to validate, while deterministic
+application code retains authority over identity, provenance, ordering, and
+typed artifact construction. The framework requires a request-local mapping,
+bounded context preparation, a private integer response contract, proposal
+assessment, and shared prompt assets. Each consuming artifact family still
+requires a typed adapter for its irreducibly domain-specific rules.
+
+Request-local handles are deliberately unsuitable for persistence, logging as
+entity identity, checkpoint contracts, or cross-request correlation. Changes
+to shared protocol and policy assets must participate in the normal prompt,
+schema, and checkpoint fingerprint mechanisms.
+
+The shared mechanism and its initial D&D registry consumers are now
+implemented. Current behavior is documented in
+[Module Internals](../internal/modules.md#semantic-reconciliation) and
+[D&D Module Internals](../internal/dnd.md#semantic-registry-reconciliation).

docs/adr/0014-feedback-aware-validation-retries.md

@@ -0,0 +1,59 @@
+# ADR-0014: Use feedback-aware validation retries
+
+**Status:** Accepted
+**Date:** 2026-08-26
+
+## Context
+
+Validation can identify a candidate defect after a producer has returned an
+otherwise well-formed result. Retrying without the validator's deterministic,
+bounded feedback wastes the useful diagnosis, while treating validator
+execution failures as defects would ask a producer to repair conditions it
+cannot control. The mechanism must preserve typed producer ownership,
+checkpoint safety, and the repository's sensitive-data boundaries.
+
+## Decision
+
+The implementation will keep three independent budgets: the producer binding's
+outer `retries` budget, PromptKit's structured-output repair budget, and each
+validator's execution-retry budget. Validators will run sequentially in their
+configured order and aggregate both rejections and execution failures before a
+candidate disposition is selected.
+
+A correction-capable producer will provide the exact single LLM response that
+controlled its candidate using the `single_response_v1` protocol. A correction
+attempt will reconstruct the ordinary request and append exactly two fresh
+messages: that latest response as `assistant`, followed by one deterministic
+aggregate correction request as `user`. Earlier turns will not accumulate.
+
+Validator failures will not recurse into correction. Pipeline policy owns
+terminal disposition, with field-by-field producer overrides over pipeline
+defaults: structural failure and semantic rejection default to `fail_run`, and
+validator execution failure defaults to `warn_continue`. Validators can report
+facts and bounded corrective guidance, but never decide disposition.
+
+Rejected and structurally invalid candidates will not advance. A candidate
+allowed through after a validator execution failure will retain explicit
+incomplete-validation provenance and will not be checkpointed. Exact response
+and correction text remain attempt-local: they are excluded from ordinary
+errors, warnings, manifests, receipts, caches, checkpoints, and default debug
+summaries.
+
+## Alternatives considered
+
+- Retry every producer after any validation outcome. This conflates producer
+  defects with validator operational failures and wastes retry budget.
+- Let validators decide whether to continue. This would distribute pipeline
+  disposition policy across validators and undermine consistent defaults.
+- Reuse the full prior conversation. Accumulated turns introduce unbounded
+  prompt growth and make correction behavior depend on incidental history.
+- Persist raw responses to simplify diagnosis. Raw model output and correction
+  guidance may be sensitive and do not belong in durable pipeline records.
+
+## Consequences
+
+The framework gains transport-neutral correction and candidate contracts,
+producer capability checks, policy resolution, aggregated validation outcomes,
+and conservative checkpoint handling. Prompt construction remains inside the
+LLM adapter, while modules remain responsible for accurately exposing the
+single response that directly controlled a candidate.

docs/adr/0015-separate-process-warnings-from-quality-diagnostics.md

@@ -0,0 +1,67 @@
+# ADR-0015: Separate process warnings from quality diagnostics
+
+**Status:** Accepted
+**Date:** 2026-08-27
+
+## Context
+
+Notarius currently represents process degradation, incomplete validation,
+extraction-quality doubt, and routine normalization with one flat warning
+record. That makes ordinary successful runs noisy, loses the framework context
+needed to explain a finding, and gives `warning_count` no stable operational
+meaning. It also permits output encoders to add a warning after the durable
+warning file has already been written.
+
+The application needs one bounded diagnostic model that preserves exact
+occurrence counts while retaining only safe, representative samples. Fresh and
+resumed logical runs must present the same groups. The model must not alter
+validation decisions, retry budgets, rejected-output behavior, or process exit
+policy.
+
+## Decision
+
+Warnings are reserved for a completed run that advanced under an allowed
+process-level degradation or incomplete-work policy. Extraction-quality signals
+are advisories, and routine accepted transformations are observations. A
+non-degraded successful run therefore has zero actionable warnings.
+
+Modules and validators own a diagnostic's disposition, category, reason code,
+scope, and safe message. The framework adds pipeline origin, including stage,
+step, lane, module, validator, and chunk context where applicable. It then
+aggregates deterministically by disposition, category, reason code, and full
+origin. Chunk context remains on representative samples so equivalent findings
+across chunks aggregate together.
+
+Diagnostics carry exact occurrence counts, at most three distinct samples, and
+numeric omitted-sample metadata. Producers and validators are bounded to 64
+local groups. Final actionable warning groups are bounded without truncation;
+the non-warning collection may truncate represented groups while preserving an
+exact total occurrence count and explicit truncation metadata.
+
+The public contracts will be versioned: grouped actionable warnings use
+`notarius.warnings.v2`, grouped advisories and observations use
+`notarius.diagnostics.v1`, and the run receipt uses
+`notarius.run-result.v2`. Successful output encoders return logical files or
+an error; they do not add post-encoding warnings.
+
+## Alternatives considered
+
+- Keep one warning list and filter only CLI output. This would leave durable
+  consumers with the same semantically mixed, unbounded contract.
+- Map reason codes to severity in a central framework registry. This would
+  split module-owned meaning between synchronized policy tables and make new
+  diagnostic meaning implicit.
+- Preserve local omission warning records. They inflate visible group counts
+  and lose exact occurrence semantics.
+- Keep output-encoder warnings. A one-pass encoder cannot include those
+  records consistently in files it has already serialized; a two-phase encoder
+  protocol is deferred until a demonstrated need exists.
+
+## Consequences
+
+The framework gains validated diagnostic primitives, local collection,
+origin-aware aggregation, and versioned durable presentation. Existing warning
+transport remains temporarily while producers migrate. Current architecture,
+operator, integration, and internal documentation will describe the behavior
+only as each implementation step lands; this accepted decision does not claim
+that the migration is complete.

docs/adr/0016-feedback-aware-module-requested-retries.md

@@ -0,0 +1,76 @@
+# ADR-0016: Use feedback-aware module-requested retries
+
+**Status:** Accepted
+**Date:** 2026-08-28
+
+## Context
+
+An LLM-backed module can discover that a structurally valid model response is
+unsafe while translating it into a typed candidate, before the ordinary
+validator chain runs. Semantic registry reconciliation is the first such case:
+the shared core can identify invalid duplicate-group proposals, and typed
+application can reject a domain-incompatible group while preserving a safe
+partial result. Repeating the original request without the rejected response or
+corrective explanation gives the model no information with which to improve.
+
+The existing feedback-aware validation mechanism already establishes the safe
+correction protocol, but module-owned retry directives also carry internal
+reason codes, operator messages, and fallback diagnostics. Those values are not
+model instructions. Some module retry conditions, including exhausted
+structured-output repair, also have no valid exact response to append.
+
+## Decision
+
+An LLM-backed normalizer may attach optional, bounded model-facing correction
+guidance to a module-requested retry. Guidance is a separate contract field; the
+framework never derives it from a reason code, operator message, diagnostic, or
+error. A feedback-capable directive must include the exact model candidate that
+controlled the safe fallback and must use `single_response_v1`.
+
+The artifact-neutral producer-attempt state machine constructs the correction
+from that exact latest response and the supplied guidance. The producer rebuilds
+its complete ordinary request and appends the response as one assistant message
+and the guidance as one user message. Earlier attempts do not accumulate, and
+the attempt consumes the same configured stage retry budget as operational,
+structural, validation, and feedback-free module retries.
+
+A module retry without guidance remains valid and starts a fresh attempt. This
+is the required behavior when no valid model candidate exists, including after
+structured-output repair is exhausted. If feedback is supplied without a valid
+supported candidate, the framework fails the module contract rather than
+retrying blindly or inventing guidance.
+
+After retry exhaustion, the normalizer's safe fallback continues through its
+validator chain. Safe semantic groups may remain applied, unsafe groups remain
+separate, and bounded fallback diagnostics may explain the process degradation.
+Exact responses and correction text remain attempt-local and are excluded from
+ordinary errors, warnings, manifests, receipts, caches, and checkpoints.
+
+This decision extends, rather than supersedes,
+[ADR-0014](0014-feedback-aware-validation-retries.md): both correction sources
+use the same transport-neutral payload, replacement-request semantics, outer
+retry budget, and sensitive-data boundary.
+
+## Alternatives considered
+
+- Continue blind module retries. This preserves a smaller contract but wastes
+  the module's deterministic diagnosis and commonly repeats the same defect.
+- Convert module safety checks into validators. Typed reconciliation must apply
+  only safe proposal groups and retain a fallback before validation; moving
+  artifact-owned translation and application policy into validators would blur
+  stage ownership.
+- Copy the retry reason or operator message into the model request. Those values
+  are written for provenance and humans, can contain opaque internal labels,
+  and do not reliably describe a correct replacement.
+- Require feedback for every module retry. Structural failures may have no
+  valid exact candidate, so this would either prevent useful fresh retries or
+  fabricate prior-response material.
+
+## Consequences
+
+The normalize retry contract and generic producer-attempt directive gain an
+optional correction-guidance field and candidate-pairing validation. Modules
+that use it must provide semantically meaningful bounded prose and an exact
+candidate. Registry reconciliation maintains separate operator and model
+renderers, and policy fingerprints change so checkpoints created under blind
+retry behavior are not reused.

docs/adr/0017-defer-cache-access-policy-to-deployment.md

@@ -0,0 +1,59 @@
+# ADR-0017: Defer cache access policy to the deployment
+
+**Status:** Accepted
+**Date:** 2026-09-11
+
+## Context
+
+Canonical chunk plans and invocation checkpoints are reconstructible cache
+state. They may include source-derived content, so access and retention matter,
+but Notarius cannot determine whether a deployment needs a private cache or a
+cache shared by a trusted group. The current application-enforced `0700` and
+`0600` modes prevent ordinary Unix provisioning from making that choice.
+
+[ADR-0005](0005-cache-canonical-chunk-plans-by-source.md) governs canonical
+chunk-plan reuse, while [ADR-0006](0006-separate-output-cache-and-debug-state.md)
+established the output, cache, and debug separation refined by
+[ADR-0007](0007-separate-checkpoint-recording-from-reuse.md). None of those
+decisions requires Notarius to own exact cache access modes.
+
+## Decision
+
+Deployments own cache access policy through provisioned directories, process
+umask, setgid inheritance, and default ACLs. Notarius requests conventional
+maximum creation modes for cache entries and leaves the kernel to select their
+effective permissions.
+
+Notarius continues to own confined paths, symlink rejection, validation,
+atomic publication, cleanup, and recovery. Those correctness boundaries are
+independent from deciding which accounts may access cache state.
+
+Source-derived cache contents can be sensitive. Operators own their access and
+retention policy, while API credentials remain outside cache payloads under the
+existing secret boundary. Existing cache inode modes are not migrated
+automatically.
+
+This decision does not supersede ADR-0005, ADR-0006, or ADR-0007.
+
+## Alternatives considered
+
+- Continue enforcing private `0700` directory and `0600` file modes. This
+  makes one deployment choice for every operator and prevents trusted-group
+  provisioning.
+- Add configurable Notarius permission modes or a private/group cache setting.
+  This preserves application ownership of a deployment concern and expands the
+  public configuration surface without a durable policy reason.
+- Recursively converge existing cache ownership, modes, or ACLs. This would
+  make upgrades mutate operator-managed state and cannot safely infer an
+  intended policy.
+
+## Consequences
+
+Operators can use a restrictive umask for private cache state or provision a
+setgid/default-ACL cache root for trusted-group access. They must deliberately
+recreate or administratively migrate pre-existing cache trees when their
+existing modes do not match the desired deployment policy.
+
+Notarius does not add user or group management, ACL mutation, permission
+configuration, or recursive cache migration. Output and debug permission
+contracts remain separate from this decision.

docs/adr/0018-adopt-configkit.md

@@ -0,0 +1,53 @@
+# ADR-0018: Adopt ConfigKit for configuration loading
+
+**Status:** Accepted
+**Date:** 2026-09-13
+
+## Context
+
+Notarius's former configuration boundary owned strict YAML parsing, input
+presence bookkeeping, defaults, normalization, environment overlays, and
+configuration inspection. Those general-purpose responsibilities had grown
+alongside application-specific pipeline and module semantics.
+
+ConfigKit v0.3.0 provides strict typed YAML loading, imports, configuration
+profiles, explicit CLI overrides, recorded defaults and normalization, safe
+inspection rendering, and released source-origin APIs. The application needs
+those source records to resolve filesystem paths according to the file that
+supplied a surviving declaration.
+
+## Decision
+
+Notarius will adopt the root public `gitea.maximumdirect.net/eric/ConfigKit`
+package at v0.3.0 for its version 5 configuration contract. ConfigKit owns
+source composition, strict decoding, input presence, metadata, and safe
+effective/explanation rendering. Notarius retains its typed document schema,
+field semantics, runtime conversion, catalog-dependent pipeline resolution,
+PromptKit profile handling, and physical run preparation.
+
+Version 5 is a deliberate breaking file-contract change. It uses canonical
+object module bindings and reference sources, and enables ConfigKit imports
+and configuration profiles. The selected configuration file's canonical
+directory is the base for its declared application paths; ConfigKit's released
+`Resolution.InputInfo` and `Resolution.Source` APIs provide their origins.
+
+`NOTARIUS_CONFIG` remains file discovery, while field-level operational
+environment overlays are retired. Explicit configuration-valued CLI flags are
+represented as ConfigKit overrides; invocation actions remain outside that
+boundary.
+
+## Alternatives considered
+
+- Continue extending the custom YAML loader. This preserves duplicated
+  general-purpose parsing, presence, composition, and inspection machinery.
+- Retain version 4 alongside version 5. This would leave a supported dual
+  configuration boundary and delay removal of the machinery being replaced.
+- Wrap ConfigKit in a compatibility pre-parser. This weakens ConfigKit's
+  strict contract and recreates the application-owned parser complexity.
+
+## Consequences
+
+The released application has one ConfigKit-backed loader and one version 5
+contract. Operator documentation and maintained examples move with the cutover.
+ConfigKit metadata is retained only at the configuration publication boundary;
+its types do not become module or runtime pipeline interfaces.

docs/cli.md

@@ -10,14 +10,26 @@ defined in [Operations](operations.md).
 
 ~~~
 notarius help
+notarius --version
 notarius run <pipeline-id> --input path/to/source.json [--json] [flags]
-notarius config validate [--config path/to/config.yml] [--pipeline pipeline-id] [--only lane-a,lane-b]
+notarius config validate [--config path/to/config.yml] [--config-profile name] [--pipeline pipeline-id] [--only lane-a,lane-b]
-notarius pipelines list [--config path/to/config.yml] [--json]
+notarius pipelines list [--config path/to/config.yml] [--config-profile name] [--json]
 ~~~
 
 Running Notarius without arguments, or with **help**, **--help**, or **-h**,
 writes the command summary to standard output and exits with status 0.
 
+`notarius --version` is valid only as the sole root argument. It writes exactly
+`notarius <version>` followed by a newline to standard output and exits with
+status 0. A tagged `go install` build can report its main-module stable tag,
+and controlled builds can inject a stable tag at link time through
+`gitea.maximumdirect.net/eric/notarius/internal/buildinfo.Override`; an ordinary
+unversioned checkout reports `development`. Invalid injected version content is
+a runtime error with exit status 1, while extra `--version` arguments are a
+syntax error with exit status 2. This diagnostic does not replace the
+[run-result](integrations/run-result.md) or artifact contracts for downstream
+compatibility decisions.
+
 ## run
 
 ~~~
@@ -30,6 +42,7 @@ pipeline ID and **--input** are required.
 | Flag | Meaning |
 | --- | --- |
 | **--config path** | Use this configuration file. When omitted, configuration discovery applies; see [Configuration](config.md). |
+| **--config-profile name** | Select a ConfigKit configuration overlay. Empty and **default** select the composed base configuration. |
 | **--input path** | Source input file to process. Required. |
 | **--output-dir path** | Override the configured output root for this run. |
 | **--json** | Write the successful run-result receipt as JSON to standard output. |
@@ -43,8 +56,8 @@ pipeline ID and **--input** are required.
 | **--session-id id** | Override the generated prompt session identifier with a non-empty value for LLM-backed module calls. |
 | **--reasoning-effort value** | Replace the selected PromptKit profile's reasoning effort for every LLM-backed call in this run. The value must be non-empty and the flag may be specified only once. |
 | **--clear-reasoning-effort** | Clear reasoning effort inherited from the selected PromptKit profile for every LLM-backed call in this run. |
-| **--reference selector=path** | Add or replace a file reference binding. Repeatable. |
+| **--reference selector=path** | Add or replace external file reference bindings at pipeline, lane, chunk, or binding scope. Repeatable. |
-| **--without-reference selector** | Remove a configured optional reference binding. Repeatable. |
+| **--without-reference selector** | Remove matching configured external reference bindings. Repeatable. |
 
 **--chunk_cache** accepts only **auto**, **bypass**, or **refresh**.
 **--debug-dir**, **--output-dir**, **--session-id**, and
@@ -69,33 +82,62 @@ guidance.
 
 ### Reference selectors
 
-Use **--reference** only for a reference slot declared by the selected
+Use **--reference** only for reference slots declared by the selected
-configured target. The accepted selector forms are:
+configured targets. Qualification narrows the scope of an override:
 
 | Form | Target |
 | --- | --- |
-| slot=path | The unique selected target that declares slot. |
+| slot=path | Every selected target that declares slot. |
 | chunk.slot=path | The chunker. |
-| merge.slot=path | The unique selected merger that declares slot. |
+| lane.slot=path | Every extractor, merger, or normalizer in lane that declares slot. |
-| lane.slot=path | The unique extractor, merger, or normalizer in lane that declares slot. |
 | lane.extract.slot=path | The extractor in lane. |
 | lane.merge.slot=path | The merger in lane. |
 | lane.normalize.slot=path | The normalizer in lane. |
 
-**--without-reference** uses the same selector forms without =path. Slot
+Pipeline- and lane-scoped selectors are expected to match multiple targets and
-names, requiredness, and configured bindings are part of the
+fail if they match none. A stage-specific selector fails when its lane is not
+selected or its target does not declare the slot. There is no stage-wide
+`merge.slot` shorthand; name the lane when targeting a merger.
+
+CLI bindings override configured external paths. For overlapping CLI
+selectors, a binding-specific or chunk selector overrides a lane selector, and
+a lane selector overrides a pipeline selector. The last occurrence wins at
+equal scope. Binding and unbinding the same concrete target at equal scope is
+an error; a narrower bind or unbind may create an intentional exception to a
+broader action.
+
+**--without-reference** uses the same selector forms without `=path` and
+removes external bindings only. Neither flag replaces or removes a generated
+artifact handoff; an external/generated collision is a resolution error.
+Required slots are checked after all effective changes. CLI reference paths
+are resolved relative to the process working directory, so subprocess and
+service callers should use absolute paths. Slot names, accepted media types,
+size limits, requiredness, and configured generated bindings are part of the
 [configuration contract](config.md).
 
+For example, one shared campaign reference can reach every compatible target,
+with an optional lane-specific exception:
+
+~~~
+notarius run dnd-session \
+  --input /data/transcript.json \
+  --reference party=/data/references/party.txt \
+  --reference npc-registry.party=/data/references/npc-party-context.txt
+~~~
+
 ### Run output
 
 Without **--json**, standard output contains the completed pipeline ID, counts
 of normalized and rejected outputs, and the output directory. A debug-enabled
 run also prints its debug-bundle path to standard output. A successful run with
-warnings reports the warning count to standard error. The published JSON bundle
+actionable process warnings reports their group and occurrence counts to
+standard error. When the selected output module publishes `warnings.json`, the
+summary also reports that durable file's path. Advisory and observation findings
+do not produce a warning line. The published JSON bundle
 is defined by the [JSON output contract](integrations/json-output.md).
 
 With **--json**, successful standard output is exactly one
-`notarius.run-result.v1` JSON document followed by a newline, with no
+`notarius.run-result.v2` JSON document followed by a newline, with no
 human-oriented status or debug-path line. Its fields and compatibility policy
 are defined by the [run-result contract](integrations/run-result.md). A caller
 must check for exit status 0 before decoding this output; a failed write can
@@ -113,10 +155,10 @@ OPENROUTER_API_KEY=your-api-key \
 ## config validate
 
 ~~~
-notarius config validate [--config path/to/config.yml] [--pipeline pipeline-id] [--only lane-a,lane-b]
+notarius config validate [--config path/to/config.yml] [--config-profile name] [--pipeline pipeline-id] [--only lane-a,lane-b]
 ~~~
 
-This command loads and validates a configuration. With **--pipeline**, it also
+This command loads and validates the selected composed configuration. With **--pipeline**, it also
 resolves that pipeline against the production module catalog. **--only** selects
 lanes during that resolution and requires **--pipeline**.
 
@@ -139,10 +181,32 @@ OPENROUTER_API_KEY=validation-placeholder \
 The placeholder in the second command is sufficient only for offline
 validation; it cannot run a provider-backed pipeline.
 
+## config effective
+
+~~~
+notarius config effective [--config path/to/config.yml] [--config-profile name]
+~~~
+
+This command writes the selected composed configuration as deterministic,
+redacted YAML. Standard output contains only that YAML: it does not validate a
+pipeline, prepare modules, materialize references, or contact a provider.
+
+## config explain
+
+~~~
+notarius config explain [--config path/to/config.yml] [--config-profile name] <json-pointer>
+~~~
+
+This command writes ConfigKit's redacted, human-readable explanation for one
+canonical JSON Pointer. Supply `""` explicitly to explain the root. A malformed
+pointer is a syntax error; a well-formed unknown path is a command failure.
+The explanation can describe a value displaced by a selected profile. Standard
+output contains only the explanation.
+
 ## pipelines list
 
 ~~~
-notarius pipelines list [--config path/to/config.yml] [--json]
+notarius pipelines list [--config path/to/config.yml] [--config-profile name] [--json]
 ~~~
 
 This command lists configured pipeline IDs in sorted order. By default, it
@@ -159,7 +223,11 @@ go run ./cmd/notarius pipelines list \
 Successful commands write their primary result to standard output. Warnings and
 errors are written to standard error.
 
-For **run --json**, warnings remain on standard error and standard output is a
+Configuration load errors include ConfigKit's field diagnostics and source
+coordinates, followed by a source-ID legend identifying the acquired files or
+source labels. This includes imported files and the selected configuration profile.
+
+For **run --json**, actionable process warnings remain on standard error and standard output is a
 machine-readable success result only. Syntax and runtime diagnostics remain on
 standard error. Parse the result only after the process exits with status 0.
 
@@ -170,6 +238,6 @@ standard error. Parse the result only after the process exits with status 0.
 | 2 | The command or flag syntax was invalid, including unknown commands, missing required arguments, invalid flag values, or invalid flag combinations. |
 
 The root help spellings are the supported help path. Invoking **--help** on
-**run**, **config validate**, or **pipelines list** is handled by the flag
+**run**, a **config** subcommand, or **pipelines list** is handled by the flag
 parser as a usage error: it writes an error to standard error and exits with
 status 2.

docs/config.md

@@ -1,7 +1,7 @@
 # Configuration
 
 This is the canonical reference for Notarius configuration. Configuration files
-are YAML and must declare version 4. They select pipelines and their modules;
+are YAML and must declare version 5. They select pipelines and their modules;
 the [CLI reference](cli.md) owns invocation syntax, and
 [Operations](operations.md) owns run-state procedures.
 
@@ -19,12 +19,15 @@ The command fails if none of these paths provides a configuration file.
 For configuration values, precedence is:
 
 1. built-in defaults;
-2. the selected YAML file;
+2. composed YAML sources, including imports;
-3. supported operational environment variables; and
+3. the selected ConfigKit profile; and
-4. the CLI run overrides that apply to a command.
+4. explicitly supplied configuration-valued run flags.
 
-Environment variables do not provide a second configuration schema. They only
+`--config-profile` selects a ConfigKit overlay from `profiles/<name>.yml`
-override the fields listed below.
+beneath the selected configuration root. Empty and `default` select no overlay.
+Configuration profiles are distinct from PromptKit LLM profiles selected by
+`llm_profile` or `--llm-profile`. The retired operational environment variables
+have no effect; `NOTARIUS_CONFIG` remains a source-discovery input.
 
 ## Maintained Examples
 
@@ -33,7 +36,8 @@ override the fields listed below.
 - [Complete D&D configuration](../examples/dnd-complete.config.yml) uses
   ordered steps, all implemented D&D lanes, generated references, state
   settings, bounded LLM concurrency, and the maintained
-  [operator profile](../examples/profiles/dnd-extraction.yml).
+  [LLM profile](../examples/llm-profiles/dnd-extraction.yml) and imports its
+  pipeline from [a fragment](../examples/pipelines/dnd-session.yml).
 
 Use these complete files as starting points rather than combining the
 illustrative fragments in this reference.
@@ -46,7 +50,7 @@ other than **version** is optional.
 
 | Field | Type | Default | Rules |
 | --- | --- | --- | --- |
-| **version** | integer | none | Required; must be 4. |
+| **version** | integer or quoted string | none | Required; must be 5. Maintained files use `version: 5`. |
 | **promptkit** | object | none | Profile source and optional local-backend configuration. |
 | **pipelines** | map | empty | Maps pipeline IDs to pipeline definitions. |
 | **concurrency** | object | see below | Global LLM and extraction limits. |
@@ -69,6 +73,22 @@ Built-in defaults are:
 
 An empty cache directory in YAML deliberately selects the corresponding
 per-user root. An explicit empty output or debug directory is invalid.
+Selecting a chunk-plan or checkpoint directory does not configure filesystem
+access policy. Cache permissions come from deployment provisioning, process
+umask, setgid inheritance, and default ACLs; see [Operations](operations.md#cache-provisioning).
+
+Every nonempty relative configured destination or reference path resolves from
+the canonical directory of the file that supplies its surviving declaration.
+This includes imported fragments and selected configuration profiles. Built-in
+relative destinations use the selected main configuration file's directory;
+explicit `--output-dir` and `--debug-dir` values use the invocation working
+directory. Absolute values remain unchanged.
+
+The root file can use ConfigKit imports to compose disjoint definitions. Imports
+and selected profiles remain under the configuration root; they do not merge or
+append a pipeline's `steps` sequence. A profile replaces sequences as defined
+by ConfigKit, so changing an individual ordered binding requires supplying the
+whole replacement sequence.
 
 ## PromptKit Profiles
 
@@ -76,7 +96,7 @@ The optional **promptkit** object selects one source of profile definitions and
 may register one conventional local OpenAI-compatible backend:
 
 ~~~yaml
-version: 4
+version: 5
 
 promptkit:
   profile_dir: ./profiles
@@ -94,17 +114,18 @@ promptkit:
 | **local_backend.endpoint** | string | Required when **local_backend** is present; absolute HTTP or HTTPS URL with a host. |
 | **local_backend.concurrency_limit** | integer | Optional non-negative limit; defaults to 0. |
 
-Set at most one of **profile_dir** and **profile_file**. Relative values use
+Set at most one of **profile_dir** and **profile_file**. Every nonempty relative
-the process working directory, not the configuration file's directory. The
+configured filesystem path is resolved from the canonical directory of the
-complete example's `./examples/profiles/dnd-extraction.yml` value is therefore
+file that supplies it. The complete example's
-valid when Notarius is launched from the repository root; use an absolute path
+`./llm-profiles/dnd-extraction.yml` value therefore resolves beside that example.
-for services and containers.
+Use absolute paths for services and containers when their deployment layout is
+not configuration-relative.
 
 An operator source is optional. For a requested ID, PromptKit checks the
 configured operator source first, then Notarius's embedded fallback profiles,
 then its own built-in catalog. A matching profile is complete: it replaces a
 lower-precedence definition rather than merging with it. The maintained
-[`dnd-extraction` operator profile](../examples/profiles/dnd-extraction.yml)
+[`dnd-extraction` LLM profile](../examples/llm-profiles/dnd-extraction.yml)
 is a secret-free deployment artifact; production, development, and local
 deployments can each provide a complete definition with that same workload ID.
 Use workload-oriented IDs for new profiles instead of model names.
@@ -132,7 +153,11 @@ model: example-model
 Keep credentials out of the local-backend object. A PromptKit profile may name
 its credential environment variable through `api_key_env`; set that variable
 only in the run environment. PromptKit owns the
-[pinned profile-file format](https://gitea.maximumdirect.net/eric/promptkit/src/tag/v0.5.0/docs/formats.md).
+[pinned profile-file format](https://gitea.maximumdirect.net/eric/promptkit/src/tag/v0.9.0/docs/formats.md),
+including `base_profile` inheritance. Notarius passes profiles through without
+merging them. Filesystem profiles cannot express PromptKit's in-memory
+`APIKeyRequired` setting; an unset `api_key_env` is optional and may reach the
+provider without authorization.
 The [PromptKit upstream boundary](integrations/pkg-promptkit.md) identifies the
 supported package API, and [Operations](operations.md#operational-limits)
 describes the effective concurrency layers.
@@ -143,30 +168,15 @@ requiring credential values. It rejects absent, malformed, or incompatible
 profiles before a run prepares modules. Credential availability is checked only
 when a generation is prepared.
 
-## Migrating Version 3 Configuration
+## Version 5 Migration
 
-Version 3 files are not decoded or rewritten. Change **version: 3** to
+Version 3 and version 4 files are rejected and are not rewritten at load time.
-**version: 4** and rename the top-level **scriptorium:** section to
+Use `version: 5`, rename the former `scriptorium` section to `promptkit`, and
-**promptkit:**. Version 4 decoding is strict, so a remaining **scriptorium**
+convert every module binding to an object containing `module`. Convert every
-field is rejected as unknown.
+external reference to `{path: ...}` and move any lane-level references to the
-
+corresponding extraction binding. Put durable operational values in YAML or
-## Operational Environment Variables
+use the documented explicit run flags; the former field-level environment
-
+variables are not read.
-These variables are applied after YAML values:
-
-| Variable | Overrides | Rules |
-| --- | --- | --- |
-| **NOTARIUS_TOTAL_LLM_CONCURRENCY** | **concurrency.total_llm** | Integer. |
-| **NOTARIUS_STAGE_WORKERS_EXTRACT** | **concurrency.stage_workers.extract** | Integer. |
-| **NOTARIUS_OUTPUT_DIR** | **output.directory** | Non-empty path. |
-| **NOTARIUS_CACHE_CHUNK_PLANS_MODE** | **cache.chunk_plans.mode** | **auto**, **bypass**, or **refresh**. |
-| **NOTARIUS_CACHE_CHUNK_PLANS_DIR** | **cache.chunk_plans.directory** | Non-empty path. |
-| **NOTARIUS_CACHE_CHECKPOINTS_DIR** | **cache.checkpoints.directory** | Non-empty path. |
-| **NOTARIUS_DEBUG_DIR** | **debug.directory** | Non-empty path. |
-
-Integer values are trimmed then parsed as base-10 integers. Directory and
-output values reject NUL characters. **NOTARIUS_CONFIG** participates only in
-configuration discovery.
 
 ## Concurrency, Output, Cache, And Debug
 
@@ -191,11 +201,14 @@ debug:
 **concurrency.total_llm** must be greater than zero. The only supported
 **concurrency.stage_workers** key is **extract**; its value must be from 1
 through **total_llm**. When omitted, it is recalculated from the effective
-**total_llm** after YAML and environment precedence.
+**total_llm** after imports, profile selection, and explicit ConfigKit
+overrides.
 
 **cache.chunk_plans.mode** accepts **auto**, **bypass**, or **refresh**.
 **cache.checkpoints.enabled** is a boolean. The CLI can override the output
 directory and chunk-plan mode for one run; see [CLI reference](cli.md#run).
+Cache directory fields select only locations; Notarius has no cache permission
+field or operational environment override.
 
 ## Pipelines
 
@@ -205,19 +218,27 @@ Each **pipelines** entry has a unique, non-empty ID and the following shape:
 pipelines:
   dnd-session:
     llm_profile: dnd-extraction
-    input: seriatim
+    input:
-    chunk: generic
+      module: seriatim
-    output: json
+    chunk:
+      module: generic
+    output:
+      module: json
     artifacts:
       spells:
-        extract: dnd/spells
+        extract:
-        merge: appendorder
+          module: dnd/spells
-        normalize: dnd/spells
+        merge:
+          module: appendorder
+        normalize:
+          module: dnd/spells
 ~~~
 
 | Field | Type | Default | Rules |
 | --- | --- | --- | --- |
 | **llm_profile** | string | none | Optional non-empty default PromptKit profile ID for selected LLM-backed bindings and validators. An explicitly present blank value is invalid. |
+| **structured_output_repair_attempts** | integer | prompt-owned (1 in maintained production prompts) | Optional structural-repair limit from 0 through 3 for selected LLM-backed bindings and validators. Omission leaves the prompt's declared policy in control; explicit 0 disables structural repair at that scope. |
+| **validation_policy** | object | see below | Optional terminal policy defaults for producer validation. Its fields inherit independently into chunk, extract, merge, and normalize bindings. |
 | **input** | module binding | none | Required. |
 | **chunk** | module binding | **generic** | Optional. |
 | **output** | module binding | **json** | Optional. |
@@ -237,6 +258,42 @@ run-level **--llm-profile** value first, then the binding's **llm_profile**,
 then the pipeline's **llm_profile**, and finally the PromptKit default.
 Deterministic bindings do not receive these defaults or run overrides.
 
+Structural output repair is resolved after module, validator, and `--only` lane
+selection. An object's **structured_output_repair_attempts** value takes
+precedence over the pipeline value; otherwise, an LLM-backed binding or
+validator inherits the pipeline value. If both are omitted, PromptKit uses the
+prompt's declared repair policy. The value must be an integer from 0 through 3;
+explicit `null` and non-integer values are invalid. An explicit value on a
+deterministic binding or validator is invalid, while a pipeline value simply
+does not apply to deterministic selections.
+
+`validation_policy` controls terminal disposition for one complete producer
+attempt and validator chain. It may appear on a pipeline or a **chunk**,
+**extract**, **merge**, or **normalize** module binding; input, output, and
+validator bindings reject it. Every field is optional and resolves in binding,
+pipeline, then application-default order:
+
+| Field | Values | Default |
+| --- | --- | --- |
+| **producer_structural_failure** | **fail_run**, **reject_output** | **fail_run** |
+| **semantic_rejection** | **fail_run**, **reject_output** | **fail_run** |
+| **validator_failure** | **warn_continue**, **fail_run** | **warn_continue** |
+
+The policy object and its fields must be non-null, and unknown fields are
+rejected. A deterministic producer may not explicitly set
+**producer_structural_failure** on its binding, although a pipeline-level
+default remains valid for pipelines that include LLM-backed producers.
+
+After the producer binding's retry budget is exhausted, an invalid structured
+response uses **producer_structural_failure**. One or more semantic validator
+rejections use **semantic_rejection**; rejection takes precedence over an
+exhausted validator failure or skip. With no rejection, an exhausted validator
+failure or skip uses **validator_failure**. `reject_output` records the
+terminal rejection without advancing that candidate. `warn_continue` is valid
+only for validator execution failure: it advances a structurally valid,
+otherwise unrejected result with incomplete-validation provenance and without
+making it reusable checkpoint state.
+
 A lane has these fields:
 
 | Field | Type | Default | Rules |
@@ -244,19 +301,20 @@ A lane has these fields:
 | **extract** | module binding | none | Required. |
 | **merge** | module binding | **appendorder** | Optional. |
 | **normalize** | module binding | **noop** | Optional. |
-| **references** | map | none | Supported compatibility alias for **extract.references**. |
+| **references** | map | none | Not supported at lane scope; place references on the eligible binding. |
 | **validators** | list | none | Non-empty lane-level lists are rejected. Set validator overrides on a binding instead. |
 
-The lane-level **references** alias remains accepted. When the alias and
+Lane-level **references** are not supported. Put a lane extraction reference
-**extract.references** bind the same slot, **extract.references** wins. Use
+under **extract.references**.
-the binding-local form in new configurations.
 
 ## Module Bindings And Validators
 
-Use a module key directly when no other binding fields are needed:
+Every module and validator binding uses an object, even when it has no fields
+beyond its module key:
 
 ~~~yaml
-input: seriatim
+input:
+  module: seriatim
 ~~~
 
 Use an object for fields:
@@ -267,24 +325,40 @@ extract:
   llm_profile: dnd-extraction
   retries: 2
   references:
-    spell_catalog: ./dnd-spell-catalog.json
+    spell_catalog:
+      path: ./dnd-spell-catalog.json
 ~~~
 
 | Binding field | Type | Default | Rules |
 | --- | --- | --- | --- |
 | **module** | string | none | Required for an object binding. Must be a registered compatible key. |
 | **llm_profile** | string | none | Optional non-empty PromptKit profile ID for an LLM-backed binding. It overrides the pipeline default unless the run supplies **--llm-profile**. |
-| **retries** | integer | 0 | Non-negative additional attempts for chunk, extract, merge, and normalize bindings. |
+| **structured_output_repair_attempts** | integer | pipeline or prompt-owned (1 in maintained production prompts) | Optional structural-repair limit from 0 through 3 for an LLM-backed binding. It overrides the pipeline value; explicit 0 disables structural repair. |
+| **validation_policy** | object | pipeline or application defaults | Optional field-by-field terminal-policy override for a chunk, extract, merge, or normalize binding. |
+| **retries** | integer | 0 | Non-negative additional complete producer attempts for chunk, extract, merge, and normalize bindings. This single budget covers operational errors, invalid structured output, module-requested normalization retry, and semantic correction. |
 | **options** | object | none | Must satisfy the selected module. |
 | **references** | map | none | Valid only on chunk, extract, merge, and normalize bindings. |
 | **validators** | list | production chain | Valid only on chunk, extract, merge, and normalize bindings. |
 
 Omitting **validators** uses the registered chain. **validators: []** selects
 an empty chain; a non-empty list replaces the chain in the listed order.
-Validator bindings accept only **module**, **llm_profile**, and **options**.
+Validator bindings accept only **module**, **llm_profile**,
-They reject **references**, **retries**, and nested **validators**. Deterministic
+**structured_output_repair_attempts**, **retries**, and **options**. Their
-validators reject an explicit **llm_profile**. Deterministic module bindings
+**retries** value is a non-negative additional validator-execution budget and
-also reject an explicit **llm_profile**.
+is valid only when the selected validator is LLM-backed. A validator retry
+rechecks the same immutable candidate; it never regenerates the producer.
+They reject
+**validation_policy**, **references**, and nested **validators**. Deterministic
+validators reject explicit **llm_profile** and
+**structured_output_repair_attempts**.
+Deterministic module bindings also reject those explicit fields.
+
+An LLM-backed chunk, extract, merge, or normalize producer with both a
+non-empty validator chain and positive **retries** must declare the supported
+single-response correction capability. Preparation rejects a configuration
+that could require semantic correction from a producer that cannot provide an
+exact prior response. A deterministic producer, or an LLM attempt that did
+not make a model call, cannot consume a semantic retry after rejection.
 
 The **json** output module accepts optional **include_chunk_map** and
 **evidence_context** settings:
@@ -298,7 +372,7 @@ output:
       enabled: true
       window_units: 3
       lanes:
-        - npcs
+        - npc-registry
         - spells
 ~~~
 
@@ -319,32 +393,37 @@ Unknown outer or nested option fields are rejected, as are incompatible YAML
 types. The allowlist remains valid when a run uses lane filtering: a configured
 lane that is not active for that invocation simply contributes no evidence.
 Evidence publication is opt-in because it can persist source text and metadata.
-Its payload contract is [Published Evidence Context](integrations/evidence-context.md).
+When enabled, it publishes the selected source-unit excerpt defined by the
+[Published Evidence Context contract](integrations/evidence-context.md).
 
 ## References And Ordered Handoffs
 
-Reference maps bind named slots that the selected target declares. A scalar is
+Reference maps bind named slots that the selected target declares. An external
-an external path. Pipeline-level maps accept only external paths; step-local
+reference is an object with `path`. Pipeline-level maps accept only external
-and binding-local maps may also select a normalized artifact from an earlier
+paths; step-local and binding-local maps may also select a normalized artifact
-step:
+from an earlier step:
 
 ~~~yaml
 steps:
   - id: describe-session
     artifacts:
-      npcs:
+      npc-registry:
-        extract: dnd/npcs
+        extract:
-        normalize: dnd/npcs
+          module: dnd/npc-registry
+        normalize:
+          module: dnd/npc-registry
   - id: extract-events
     references:
-      npcs:
+      npc_registry:
         artifact:
           step: describe-session
-          lane: npcs
+          lane: npc-registry
     artifacts:
       spells:
-        extract: dnd/spells
+        extract:
-        normalize: dnd/spells
+          module: dnd/spells
+        normalize:
+          module: dnd/spells
 ~~~
 
 An artifact selector contains only **step** and **lane**. The producer must be
@@ -353,10 +432,16 @@ slot. A generated binding supplies one accepted normalized artifact; it does
 not name a file. A configured generated dependency remains required even when
 that consumer slot is otherwise optional.
 
-Pipeline references are defaults. A matching step-local or binding-local
+Pipeline references are configuration defaults. A matching step-local or
-external path overrides a pipeline default. Required slots must be bound after
+binding-local external path overrides a pipeline default. CLI reference
-these configuration values and any CLI reference overrides are applied.
+bindings are then operational overrides of configured external paths; their
-Reference paths in YAML are resolved relative to the configuration file.
+pipeline, lane, and binding scopes and precedence are defined by the
+[CLI reference](cli.md#reference-selectors). A CLI file reference cannot
+replace a configured generated artifact handoff. Required slots must be bound
+after configuration and CLI reference actions are applied. A YAML reference
+path resolves from the file that supplies its surviving declaration, including
+an imported fragment or selected profile. CLI reference paths resolve relative
+to the process working directory.
 
 ### D&D Reference Slots
 
@@ -370,31 +455,36 @@ selected target declares them:
 | **players** | Optional text player context. |
 | **glossary** | Optional text campaign glossary. |
 | **spell_catalog** | Optional JSON spell-catalog overlay for spell extraction and normalization. See [spell-catalog overlays](integrations/dnd-spell-catalog-overlays.md). |
-| **locations** | Required normalized location registry for location-occurrence extraction and normalization. |
+| **location_registry** | Required normalized location registry for location-occurrence extraction and normalization. |
-| **npcs** | Normalized NPC registry. Optional for spells and combat turns; required for NPC interactions and enemy-event extraction and normalization. |
+| **item_registry** | Required normalized item registry for item-occurrence extraction and normalization. |
+| **npc_registry** | Normalized NPC registry. Optional for spells and combat turns; required for NPC occurrences and enemy-event extraction and normalization. |
 | **scene_descriptions** | Required normalized scene-description artifact for combat-turn and enemy-event extraction. |
 | **combat_turns** | Required normalized combat-turn artifact for enemy-event extraction. |
-| **npc_interactions** | Required normalized NPC-interaction artifact for enemy-event extraction. |
+| **npc_occurrences** | Required normalized NPC-occurrence artifact for enemy-event extraction. |
 
-Location-occurrence and enemy-event artifact slots have the following exact
+Registry-backed occurrence and enemy-event artifact slots have the following
-binding contracts. Durable semantics and wire shapes remain in their
+exact binding contracts. Durable semantics and wire shapes remain in their
-[location-occurrence](integrations/dnd-location-occurrence-artifacts.md) and
+[NPC occurrence](integrations/dnd-npc-occurrence-artifacts.md),
+[location occurrence](integrations/dnd-location-occurrence-artifacts.md),
+[item occurrence](integrations/dnd-item-occurrence-artifacts.md), and
 [enemy-event](integrations/dnd-enemy-event-artifacts.md) contracts.
 
 | Slot | Accepted artifact kind | Media type | Maximum size | Required stage |
 | --- | --- | --- | --- | --- |
-| `npcs` | `dnd/npc-list` | `application/json` | 1,048,576 bytes | extract and normalize |
+| `npc_registry` | `dnd/npc-registry` | `application/json` | 1,048,576 bytes | extract and normalize |
 | `scene_descriptions` | `dnd/scene-description-list` | `application/json` | 1,048,576 bytes | extract only |
 | `combat_turns` | `dnd/combat-turn-list` | `application/json` | 1,048,576 bytes | extract only |
-| `npc_interactions` | `dnd/npc-interaction-list` | `application/json` | 1,048,576 bytes | extract only |
+| `npc_occurrences` | `dnd/npc-occurrence-list` | `application/json` | 1,048,576 bytes | extract only |
-| `locations` | `dnd/location-list` | `application/json` | 1,048,576 bytes | location-occurrence extract and normalize |
+| `location_registry` | `dnd/location-registry` | `application/json` | 1,048,576 bytes | location-occurrence extract and normalize |
+| `item_registry` | `dnd/item-registry` | `application/json` | 1,048,576 bytes | item-occurrence extract and normalize |
 
 Scene descriptions accept **party**, **players**, and **glossary**, but not
-**roster**. NPC interactions require **npcs** for both extraction and
+**roster**. NPC occurrences require **npc_registry** for both extraction and
 normalization. Combat turns require **scene_descriptions** for extraction; the
-normalized combat-turn module may use optional **npcs**. Location occurrences
+normalized combat-turn module may use optional **npc_registry**. Location occurrences
-require **locations** for extraction and normalization. Enemy-event extraction
+require **location_registry** for extraction and normalization. Item occurrences require
-requires all four of its JSON artifact slots; its normalizer requires **npcs**.
+**item_registry** for extraction and normalization. Enemy-event extraction requires all
+four of its JSON artifact slots; its normalizer requires **npc_registry**.
 The [complete example](../examples/dnd-complete.config.yml) shows the ordered
 generated bindings.
 
@@ -404,26 +494,28 @@ generated bindings.
 | --- | --- |
 | Input | **seriatim** |
 | Chunk | **generic**, **dnd/scenes** |
-| Extract | **dnd/spells**, **dnd/npcs**, **dnd/combat-turns**, **dnd/item-events**, **dnd/npc-interactions**, **dnd/scene-descriptions**, **dnd/enemy-events**, **dnd/locations**, **dnd/location-occurrences** |
+| Extract | **dnd/spells**, **dnd/npc-registry**, **dnd/combat-turns**, **dnd/item-occurrences**, **dnd/item-registry**, **dnd/npc-occurrences**, **dnd/scene-descriptions**, **dnd/enemy-events**, **dnd/location-registry**, **dnd/location-occurrences** |
 | Merge | **appendorder** |
-| Normalize | **noop**, **dnd/spells**, **dnd/npcs**, **dnd/combat-turns**, **dnd/item-events**, **dnd/npc-interactions**, **dnd/scene-descriptions**, **dnd/enemy-events**, **dnd/locations**, **dnd/location-occurrences** |
+| Normalize | **noop**, **dnd/spells**, **dnd/npc-registry**, **dnd/combat-turns**, **dnd/item-occurrences**, **dnd/item-registry**, **dnd/npc-occurrences**, **dnd/scene-descriptions**, **dnd/enemy-events**, **dnd/location-registry**, **dnd/location-occurrences** |
 | Output | **json** |
 
-`dnd/locations` extraction and normalization are `llm_backed`; location
+`dnd/scenes` and every D&D extractor are `llm_backed`. The
-normalization may use the pipeline's selected LLM profile for bounded duplicate
+`dnd/npc-registry`, `dnd/location-registry`, and `dnd/item-registry`
-proposals. `dnd/location-occurrences` extraction is `llm_backed`, while its
+normalizers are also `llm_backed` for bounded duplicate proposals; every other
-normalizer is `deterministic`. The complete example binds the registry in one
+D&D normalizer is `deterministic`. LLM-backed bindings use the effective
-step and the occurrence lane in the next.
+[PromptKit profile](#promptkit-profiles). The complete example binds each
+registry in an earlier step before its occurrence consumer.
 
 The D&D artifact contracts define each emitted schema:
 [spells](integrations/dnd-spell-artifacts.md),
-[NPCs](integrations/dnd-npc-artifacts.md),
+[NPC registry](integrations/dnd-npc-registry-artifacts.md),
-[NPC interactions](integrations/dnd-npc-interaction-artifacts.md),
+[NPC occurrences](integrations/dnd-npc-occurrence-artifacts.md),
 [combat turns](integrations/dnd-combat-turn-artifacts.md),
-[item events](integrations/dnd-item-event-artifacts.md),
+[item registry](integrations/dnd-item-registry-artifacts.md),
-[scene descriptions](integrations/dnd-scene-description-artifacts.md), and
+[item occurrences](integrations/dnd-item-occurrence-artifacts.md),
+[scene descriptions](integrations/dnd-scene-description-artifacts.md),
 [enemy events](integrations/dnd-enemy-event-artifacts.md),
-[locations](integrations/dnd-location-artifacts.md), and
+[location registry](integrations/dnd-location-registry-artifacts.md), and
 [location occurrences](integrations/dnd-location-occurrence-artifacts.md).
 
 ## Production Validator Keys And Default Chains
@@ -434,15 +526,38 @@ Available validator keys are:
 | --- | --- |
 | Generic | **generic/always_accept**, **generic/always_reject**, **generic/valid_json**, **generic/valid_json_schema** |
 | Spells | **extract/dnd/spells/shape**, **extract/dnd/spells/catalog**, **extract/dnd/spells/source_refs**, **extract/dnd/spells/source_relatedness** |
-| NPCs | **extract/dnd/npcs/shape**, **extract/dnd/npcs/source_refs**, **extract/dnd/npcs/source_relatedness**, **normalize/dnd/npcs/identity** |
+| NPC registry | **extract/dnd/npc-registry/shape**, **extract/dnd/npc-registry/source_refs**, **extract/dnd/npc-registry/source_relatedness**, **normalize/dnd/npc-registry/identity** |
 | Combat turns | **extract/dnd/combat-turns/shape**, **extract/dnd/combat-turns/source_refs**, **extract/dnd/combat-turns/source_relatedness**, **normalize/dnd/combat-turns/invariants** |
-| Item events | **extract/dnd/item-events/shape**, **extract/dnd/item-events/source_refs**, **extract/dnd/item-events/source_relatedness**, **normalize/dnd/item-events/invariants** |
+| Item occurrences | **extract/dnd/item-occurrences/shape**, **extract/dnd/item-occurrences/registry**, **extract/dnd/item-occurrences/source_refs**, **extract/dnd/item-occurrences/source_relatedness**, **normalize/dnd/item-occurrences/invariants** |
-| NPC interactions | **extract/dnd/npc-interactions/shape**, **extract/dnd/npc-interactions/registry**, **extract/dnd/npc-interactions/source_refs**, **extract/dnd/npc-interactions/source_relatedness**, **normalize/dnd/npc-interactions/invariants** |
+| Item registry | **extract/dnd/item-registry/shape**, **extract/dnd/item-registry/source_refs**, **extract/dnd/item-registry/source_relatedness**, **normalize/dnd/item-registry/identity** |
-| Scene descriptions | **extract/dnd/scene-descriptions/shape**, **extract/dnd/scene-descriptions/source_refs**, **extract/dnd/scene-descriptions/source_relatedness**, **normalize/dnd/scene-descriptions/invariants** |
+| NPC occurrences | **extract/dnd/npc-occurrences/shape**, **extract/dnd/npc-occurrences/registry**, **extract/dnd/npc-occurrences/source_refs**, **extract/dnd/npc-occurrences/source_relatedness**, **normalize/dnd/npc-occurrences/invariants** |
+| Scene descriptions | **extract/dnd/scene-descriptions/shape**, **extract/dnd/scene-descriptions/source_refs**, **extract/dnd/scene-descriptions/source_relatedness**, **extract/dnd/scene-descriptions/combat_semantics** (LLM-backed, opt-in), **normalize/dnd/scene-descriptions/invariants** |
 | Enemy events | **extract/dnd/enemy-events/shape**, **extract/dnd/enemy-events/engagements**, **extract/dnd/enemy-events/source_refs**, **extract/dnd/enemy-events/source_relatedness**, **normalize/dnd/enemy-events/invariants** |
-| Locations | **extract/dnd/locations/shape**, **extract/dnd/locations/source_refs**, **extract/dnd/locations/source_relatedness**, **normalize/dnd/locations/identity** |
+| Location registry | **extract/dnd/location-registry/shape**, **extract/dnd/location-registry/source_refs**, **extract/dnd/location-registry/source_relatedness**, **normalize/dnd/location-registry/identity** |
 | Location occurrences | **extract/dnd/location-occurrences/shape**, **extract/dnd/location-occurrences/registry**, **extract/dnd/location-occurrences/source_refs**, **extract/dnd/location-occurrences/source_relatedness**, **normalize/dnd/location-occurrences/invariants** |
 
+`extract/dnd/scene-descriptions/combat_semantics` is not in a production default chain. To opt in, replace the scene extractor validator chain with the current ordered chain plus the semantic validator last, and set a positive producer retry budget if a rejection should request a corrected scene:
+
+~~~yaml
+extract:
+  module: dnd/scene-descriptions
+  retries: 1
+  validators:
+    - module: generic/valid_json
+    - module: extract/dnd/scene-descriptions/shape
+    - module: extract/dnd/scene-descriptions/source_refs
+    - module: generic/valid_json_schema
+    - module: extract/dnd/scene-descriptions/source_relatedness
+    - module: extract/dnd/scene-descriptions/combat_semantics
+      retries: 1
+~~~
+
+An override replaces, rather than extends, the default chain. See [Module Bindings And Validators](#module-bindings-and-validators) for binding, profile, repair, retry, and failure-policy rules.
+
+The validator retry shown above permits one additional execution against the
+same scene candidate when the LLM-backed validator itself fails; it is separate
+from both the extractor's producer retry and PromptKit structural repair.
+
 When no override is configured, production D&D bindings use the following
 ordered chains. Each row lists extract then normalize; spell chains are the
 same at both stages.
@@ -450,13 +565,14 @@ same at both stages.
 | Lane | Extract | Normalize |
 | --- | --- | --- |
 | Spells | generic/valid_json, extract/dnd/spells/shape, extract/dnd/spells/catalog, extract/dnd/spells/source_refs, generic/valid_json_schema, extract/dnd/spells/source_relatedness | Same as extract |
-| NPCs | generic/valid_json, extract/dnd/npcs/shape, extract/dnd/npcs/source_refs, generic/valid_json_schema, extract/dnd/npcs/source_relatedness | generic/valid_json, extract/dnd/npcs/shape, normalize/dnd/npcs/identity, extract/dnd/npcs/source_refs, generic/valid_json_schema, extract/dnd/npcs/source_relatedness |
+| NPC registry | generic/valid_json, extract/dnd/npc-registry/shape, extract/dnd/npc-registry/source_refs, generic/valid_json_schema, extract/dnd/npc-registry/source_relatedness | generic/valid_json, extract/dnd/npc-registry/shape, normalize/dnd/npc-registry/identity, extract/dnd/npc-registry/source_refs, generic/valid_json_schema, extract/dnd/npc-registry/source_relatedness |
 | Combat turns | generic/valid_json, extract/dnd/combat-turns/shape, extract/dnd/combat-turns/source_refs, generic/valid_json_schema, extract/dnd/combat-turns/source_relatedness | generic/valid_json, extract/dnd/combat-turns/shape, normalize/dnd/combat-turns/invariants, extract/dnd/combat-turns/source_refs, generic/valid_json_schema, extract/dnd/combat-turns/source_relatedness |
-| Item events | generic/valid_json, extract/dnd/item-events/shape, extract/dnd/item-events/source_refs, generic/valid_json_schema, extract/dnd/item-events/source_relatedness | generic/valid_json, extract/dnd/item-events/shape, normalize/dnd/item-events/invariants, extract/dnd/item-events/source_refs, generic/valid_json_schema, extract/dnd/item-events/source_relatedness |
+| Item occurrences | generic/valid_json, extract/dnd/item-occurrences/shape, extract/dnd/item-occurrences/registry, extract/dnd/item-occurrences/source_refs, generic/valid_json_schema, extract/dnd/item-occurrences/source_relatedness | generic/valid_json, extract/dnd/item-occurrences/shape, extract/dnd/item-occurrences/registry, normalize/dnd/item-occurrences/invariants, extract/dnd/item-occurrences/source_refs, generic/valid_json_schema, extract/dnd/item-occurrences/source_relatedness |
-| NPC interactions | generic/valid_json, extract/dnd/npc-interactions/shape, extract/dnd/npc-interactions/registry, extract/dnd/npc-interactions/source_refs, generic/valid_json_schema, extract/dnd/npc-interactions/source_relatedness | generic/valid_json, extract/dnd/npc-interactions/shape, extract/dnd/npc-interactions/registry, normalize/dnd/npc-interactions/invariants, extract/dnd/npc-interactions/source_refs, generic/valid_json_schema, extract/dnd/npc-interactions/source_relatedness |
+| Item registry | generic/valid_json, extract/dnd/item-registry/shape, extract/dnd/item-registry/source_refs, generic/valid_json_schema, extract/dnd/item-registry/source_relatedness | generic/valid_json, extract/dnd/item-registry/shape, normalize/dnd/item-registry/identity, extract/dnd/item-registry/source_refs, generic/valid_json_schema, extract/dnd/item-registry/source_relatedness |
+| NPC occurrences | generic/valid_json, extract/dnd/npc-occurrences/shape, extract/dnd/npc-occurrences/registry, extract/dnd/npc-occurrences/source_refs, generic/valid_json_schema, extract/dnd/npc-occurrences/source_relatedness | generic/valid_json, extract/dnd/npc-occurrences/shape, extract/dnd/npc-occurrences/registry, normalize/dnd/npc-occurrences/invariants, extract/dnd/npc-occurrences/source_refs, generic/valid_json_schema, extract/dnd/npc-occurrences/source_relatedness |
 | Scene descriptions | generic/valid_json, extract/dnd/scene-descriptions/shape, extract/dnd/scene-descriptions/source_refs, generic/valid_json_schema, extract/dnd/scene-descriptions/source_relatedness | generic/valid_json, extract/dnd/scene-descriptions/shape, normalize/dnd/scene-descriptions/invariants, extract/dnd/scene-descriptions/source_refs, generic/valid_json_schema, extract/dnd/scene-descriptions/source_relatedness |
 | Enemy events | generic/valid_json, extract/dnd/enemy-events/shape, extract/dnd/enemy-events/engagements, extract/dnd/enemy-events/source_refs, generic/valid_json_schema, extract/dnd/enemy-events/source_relatedness | generic/valid_json, extract/dnd/enemy-events/shape, normalize/dnd/enemy-events/invariants, extract/dnd/enemy-events/source_refs, generic/valid_json_schema, extract/dnd/enemy-events/source_relatedness |
-| Locations | generic/valid_json, extract/dnd/locations/shape, extract/dnd/locations/source_refs, generic/valid_json_schema, extract/dnd/locations/source_relatedness | generic/valid_json, extract/dnd/locations/shape, normalize/dnd/locations/identity, extract/dnd/locations/source_refs, generic/valid_json_schema, extract/dnd/locations/source_relatedness |
+| Location registry | generic/valid_json, extract/dnd/location-registry/shape, extract/dnd/location-registry/source_refs, generic/valid_json_schema, extract/dnd/location-registry/source_relatedness | generic/valid_json, extract/dnd/location-registry/shape, normalize/dnd/location-registry/identity, extract/dnd/location-registry/source_refs, generic/valid_json_schema, extract/dnd/location-registry/source_relatedness |
 | Location occurrences | generic/valid_json, extract/dnd/location-occurrences/shape, extract/dnd/location-occurrences/registry, extract/dnd/location-occurrences/source_refs, generic/valid_json_schema, extract/dnd/location-occurrences/source_relatedness | generic/valid_json, extract/dnd/location-occurrences/shape, extract/dnd/location-occurrences/registry, normalize/dnd/location-occurrences/invariants, extract/dnd/location-occurrences/source_refs, generic/valid_json_schema, extract/dnd/location-occurrences/source_relatedness |
 
 Chains are only registered for the D&D extract and normalize modules shown
@@ -474,7 +590,16 @@ go run ./cmd/notarius config validate \
 ~~~
 
 Configuration validation rejects invalid YAML, unsupported fields, invalid
-defaults or environment overrides, incompatible module keys, unknown options,
+defaults or explicit CLI overrides, incompatible module keys, unknown options,
 invalid reference bindings, missing required reference slots, invalid validator
 overrides, and incompatible generated artifact handoffs. Use
 [pipelines list](cli.md#pipelines-list) to inspect configured IDs.
+
+## Inspection
+
+Use [config effective](cli.md#config-effective) to write the selected composed
+configuration as deterministic, redacted YAML. Use
+[config explain](cli.md#config-explain) with a canonical JSON Pointer to inspect
+the effective or historical provenance for one path, including a value displaced
+by a selected profile. Neither command resolves a pipeline, prepares modules,
+materializes references, or requires provider credentials.

docs/consumers/dnd-pipeline.md

@@ -0,0 +1,221 @@
+# Consuming The Complete D&D Pipeline
+
+Use this workflow when an orchestrator runs the maintained complete D&D
+pipeline and consumes its structured JSON artifacts. The generic
+[subprocess consumer guide](subprocess.md) owns process-level responsibilities;
+this guide connects that workflow to the complete D&D configuration, its
+Seriatim input, and its artifact inventory.
+
+The [CLI reference](../cli.md), [configuration reference](../config.md),
+[run-result receipt](../integrations/run-result.md), and
+[published JSON output contract](../integrations/json-output.md) remain the
+canonical definitions of those public interfaces.
+
+## Prepare And Validate The Deployment
+
+Start from the maintained
+[complete D&D configuration](../../examples/dnd-complete.config.yml). It uses
+the `dnd-session` pipeline and demonstrates every implemented D&D lane, ordered
+artifact handoffs, campaign references, chunk-map publication, and evidence
+context.
+
+A deployment must provide its own PromptKit profile and campaign reference
+files. Use absolute paths for service and subprocess deployments. In
+particular, observe these different resolution rules:
+
+- reference and PromptKit profile paths in YAML are resolved relative to the
+  file that supplies their surviving declaration;
+- reference paths passed with `--reference` are resolved relative to the
+  Notarius process working directory.
+
+Do not copy the repository example's relative profile path into a deployment
+without preserving its configuration-relative layout. The complete path and
+profile rules are defined in [Configuration](../config.md).
+
+Preflight the deployed configuration before processing sessions and whenever
+it changes:
+
+```sh
+notarius config validate \
+  --config /absolute/path/to/notarius.yml \
+  --pipeline dnd-session
+```
+
+Provide credentials through the environment or the documented configuration
+mechanism. Do not put credentials in command arguments, generated
+configuration, or logs.
+
+## Supply The Transcript
+
+The complete pipeline consumes a Seriatim JSON document. The
+[Seriatim input contract](../integrations/seriatim.md) defines its required
+metadata, segments, and validation rules. Preserve segment IDs: D&D artifact
+citations use those segment IDs as source-unit ranges.
+
+When the caller maintains several transcript tiers, use the final trimmed JSON
+transcript so extraction operates on the same session content presented to
+later consumers. For example, Narratio identifies this implemented artifact as
+`narratio.transcript.final_trimmed` and normally stores it at
+`transcripts/final.trimmed.json`.
+
+Notarius generates a stable prompt session from the resolved input module and
+the exact input bytes. An ordinary orchestrator should not pass `--session-id`.
+Use that override only when intentionally changing the routing relationship
+between invocations; it is not a credential or output identity.
+
+## Run Notarius
+
+Invoke the pipeline with explicit absolute paths and request its
+machine-readable receipt:
+
+```sh
+notarius run dnd-session \
+  --config /absolute/path/to/notarius.yml \
+  --input /absolute/path/to/transcripts/final.trimmed.json \
+  --output-dir /absolute/path/to/notarius-output \
+  --reference party=/absolute/path/to/references/party.txt \
+  --reference players=/absolute/path/to/references/players.txt \
+  --reference glossary=/absolute/path/to/references/glossary.txt \
+  --reference spell_catalog=/absolute/path/to/references/spells.json \
+  --json
+```
+
+Each unqualified reference is pipeline-scoped: Notarius supplies it to every
+selected D&D target that declares the slot. A deployment may omit an optional
+reference it does not maintain, and may use the lane- or binding-qualified
+forms from the [CLI reference](../cli.md#reference-selectors) for an exceptional
+override. The registry, scene-description, combat-turn, and NPC-occurrence
+references declared between ordered steps in the complete configuration are
+generated artifacts. Do not pass those handoffs on the CLI.
+
+The caller should:
+
+- capture stdout and stderr separately;
+- propagate cancellation and impose an operator-appropriate timeout;
+- wait for process completion before interpreting stdout; and
+- retain stderr for diagnosis without copying secrets or transcript content
+  into other logs.
+
+Only exit status 0 permits decoding stdout as a receipt. Ignore stdout after a
+nonzero exit because a failed receipt write can leave partial bytes. The
+[CLI reference](../cli.md#output-streams-and-exit-statuses) defines the complete
+stream and exit-status contract.
+
+## Discover The Published Bundle
+
+Decode the successful stdout document as a supported run-result schema. For
+the current contract, `schema_version` is `notarius.run-result.v2`. Tolerate
+unknown fields allowed by that version, but reject an unsupported schema
+version.
+
+Use the receipt's absolute `output_directory` as the exact run-specific bundle
+root. Do not scan the output root for its newest directory, guess a run ID, or
+construct a bundle path. Resolve `index_file` beneath `output_directory` and
+reject an absolute logical path or any result that escapes the bundle root.
+
+The complete configuration uses the application validation defaults. A caller
+that requires fully validated D&D artifacts must also require receipt
+`validation_status: approved`; a successful `incomplete` result reflects the
+configured validator-failure continuation policy and carries its bounded
+validator provenance in `validation_summaries`.
+
+Read `index.json` and locate each requested lane in `output_files` by its exact
+`lane_id`. Do not guess a lane filename. Before decoding a payload:
+
+1. resolve its descriptor's relative `file` beneath the bundle root with the
+   same confinement check;
+2. verify the descriptor's media type and schema identity against the linked
+   artifact contract; and
+3. decode the payload according to that contract.
+
+The [published JSON output contract](../integrations/json-output.md) defines
+the index and bundle layout. Treat all paths obtained from a decoded external
+document as untrusted until confined to their documented root.
+
+## Complete Artifact Inventory
+
+When every configured lane is accepted, the complete example publishes these
+lane artifacts:
+
+| Lane ID | Purpose | Canonical contract |
+| --- | --- | --- |
+| `item-registry` | Canonical registry of encountered items and currency. | [Item registry](../integrations/dnd-item-registry-artifacts.md) |
+| `npc-registry` | Canonical registry of named NPCs. | [NPC registry](../integrations/dnd-npc-registry-artifacts.md) |
+| `location-registry` | Canonical registry of named locations. | [Location registry](../integrations/dnd-location-registry-artifacts.md) |
+| `scene-descriptions` | Classification, title, and summary for each scene. | [Scene descriptions](../integrations/dnd-scene-description-artifacts.md) |
+| `item-occurrences` | Source-grounded item discovery, acquisition, use, transfer, and loss events. | [Item occurrences](../integrations/dnd-item-occurrence-artifacts.md) |
+| `spells` | Source-grounded spell casts and casters. | [Spell casts](../integrations/dnd-spell-artifacts.md) |
+| `combat-turns` | Source-grounded combat turn participation. | [Combat turns](../integrations/dnd-combat-turn-artifacts.md) |
+| `npc-occurrences` | Source-grounded NPC interaction occurrences. | [NPC occurrences](../integrations/dnd-npc-occurrence-artifacts.md) |
+| `location-occurrences` | Source-grounded location occurrences. | [Location occurrences](../integrations/dnd-location-occurrence-artifacts.md) |
+| `enemy-events` | Source-grounded enemy combat events. | [Enemy events](../integrations/dnd-enemy-event-artifacts.md) |
+
+The JSON encoder always publishes these bundle-management files:
+
+| File | Purpose |
+| --- | --- |
+| `index.json` | Discovery document for lane and pipeline-wide artifacts. |
+| `manifest.json` | Run provenance and result summaries. |
+| `rejected.json` | Rejected pipeline outputs. |
+| `warnings.json` | Actionable process-degradation warnings. |
+| `diagnostics.json` | Advisory and observation findings for accepted artifacts. |
+
+The complete configuration also requests two pipeline-wide artifacts:
+
+- [`chunk-map.json`](../integrations/chunk-map.md), the accepted chunk plan and
+  chunk metadata; and
+- [`evidence-context.json`](../integrations/evidence-context.md), a reading
+  excerpt containing the union of selected cited source units and the
+  configured surrounding window.
+
+Discover both from their top-level `index.json` descriptors rather than
+treating them as lanes. Evidence context is convenient reading material, not
+authoritative provenance; citations in the normalized lane payloads remain the
+evidence contract.
+
+Every optional or lane file is published only when its corresponding artifact
+is available. A successful process does not guarantee that all configured
+lanes were accepted.
+
+## Decide What Counts As Consumer Success
+
+Exit status 0 means Notarius completed the pipeline and published its result
+bundle. The receipt or bundle may still report warnings, rejected outputs, or
+missing lane descriptors. A downstream consumer must define its own required
+artifact set explicitly.
+
+A caller that claims to consume the complete D&D workflow should normally
+require all ten lane IDs in the table and verify each descriptor's expected
+contract. If any required lane is missing, rejected, or incompatible, fail the
+caller's extraction step while retaining the Notarius bundle for diagnosis. A
+consumer that needs only a subset may define and document a narrower policy.
+
+Keep the successful receipt with the complete published bundle. Retain
+`manifest.json`, `rejected.json`, `warnings.json`, and captured process logs as
+required by the caller's provenance, diagnosis, and retention policies. Avoid
+selectively copying payload files without also preserving enough index and
+manifest information to identify their originating run and contracts.
+
+The transcript, lane artifacts, evidence context, manifest, debug data, and
+logs can all contain private campaign information. Apply the same access,
+publication, and retention controls used for the source transcript.
+
+## Consumer Checklist
+
+- Validate the deployed Notarius configuration and `dnd-session` pipeline.
+- Pass the final trimmed Seriatim JSON transcript with stable segment IDs.
+- Use absolute configuration, input, output-root, profile, and reference paths
+  in service deployments.
+- Capture stdout and stderr separately and enforce cancellation and timeout.
+- Parse stdout only after exit status 0.
+- Accept only supported receipt, index, and artifact schema versions while
+  tolerating permitted unknown fields.
+- Use the receipt's `output_directory`; never guess the run directory.
+- Confine `index_file` and every descriptor path to the published bundle root.
+- Discover lanes by `lane_id` and verify descriptor compatibility before
+  decoding payloads.
+- Enforce an explicit required-lane policy and inspect rejections and warnings.
+- Preserve the receipt and sufficient bundle provenance for every retained
+  artifact.
+- Protect all transcript-derived files and diagnostic streams as sensitive
+  campaign data.

docs/consumers/subprocess.md

@@ -6,14 +6,21 @@ statuses, while the [run-result receipt](../integrations/run-result.md) and
 [Published JSON Output contract](../integrations/json-output.md) own the
 durable result formats.
 
+For the maintained complete D&D workflow, including its transcript input,
+configured lane inventory, and downstream acceptance checklist, see
+[Consuming The Complete D&D Pipeline](dnd-pipeline.md).
+
 ## Run And Check The Process
 
 Optionally preflight a selected configuration and pipeline before work starts:
 
 ```sh
-notarius config validate --config /path/to/notarius.yml --pipeline pipeline-id
+notarius config validate --config /path/to/notarius.yml --config-profile production --pipeline pipeline-id
 ```
 
+Omit `--config-profile` when the composed base configuration is the intended
+selection; it is independent from any `--llm-profile` run override.
+
 Invoke the run with explicit paths and machine-readable output. Capture
 standard output and standard error separately; do not combine them before
 processing the result.
@@ -21,19 +28,43 @@ processing the result.
 ```sh
 notarius run pipeline-id \
   --config /path/to/notarius.yml \
+  --config-profile production \
   --input /path/to/source.json \
   --output-dir /path/to/output-root \
   --json
 ```
 
 Use absolute paths for supplied input, configuration, output-root, and
-reference files. Notarius generates a stable prompt session for the resolved
+reference files. Pass each external reference as its own argument-vector pair;
-input module and exact input bytes. Pass **--session-id** only when intentionally
+do not construct and invoke a shell command. An unqualified reference selector
-grouping different invocations under a different session. Supply credentials
+supplies that file to every compatible selected target. Lane and stage
-through Notarius's documented configuration and environment mechanisms, never
+qualification are available for exceptional overrides, while generated
-as command-line arguments or generated secret-bearing configuration. In
+same-run references remain part of configured pipeline composition. The
-particular, a session identifier is provider-visible and is not a credential
+[CLI reference](../cli.md#reference-selectors) owns the exact selector and
-mechanism.
+precedence contract.
+
+The maintained D&D subprocess workflow uses this facility for campaign context:
+
+```sh
+notarius run dnd-session \
+  --config /absolute/path/to/notarius.yml \
+  --input /absolute/path/to/transcripts/final.trimmed.json \
+  --output-dir /absolute/path/to/notarius-output \
+  --reference party=/absolute/path/to/references/party.txt \
+  --reference players=/absolute/path/to/references/players.txt \
+  --reference glossary=/absolute/path/to/references/glossary.txt \
+  --reference spell_catalog=/absolute/path/to/references/spells.json \
+  --json
+```
+
+Only pass the external references available to and desired by the deployment.
+Notarius generates a stable prompt session for the resolved input module and
+exact input bytes; reference changes do not change it. Pass **--session-id**
+only when intentionally grouping different invocations under a different
+session. Supply credentials through Notarius's documented configuration and
+environment mechanisms, never as command-line arguments or generated
+secret-bearing configuration. In particular, a session identifier is
+provider-visible and is not a credential mechanism.
 
 Wait for the process before interpreting standard output. Only an exit status
 of 0 permits decoding the receipt. On a nonzero exit, retain standard error for
@@ -55,23 +86,30 @@ contract. The JSON bundle contract links to the available lane contracts.
 If `index.json` has an `evidence_context` descriptor, treat it as a
 pipeline-wide artifact rather than a lane entry. Verify its six descriptor
 fields before decoding the linked file according to the [Published Evidence
-Context contract](../integrations/evidence-context.md). Use each
+Context contract](../integrations/evidence-context.md). Decode its top-level
-`evidence_refs` entry as the citation to source material. Its surrounding
+source-unit array as a reading excerpt. Obtain authoritative citations and lane
-context range and included units explain the citation, but do not widen or
+provenance from the normalized lane artifacts; the excerpt has neither and its
-replace the cited source reference.
+nearby units do not widen a lane artifact's cited source reference.
 
 A zero exit status may still report rejected outputs, warnings, or absent
 lanes. The caller decides which lane IDs are required for its own work and
 which are optional; it should make that decision explicitly rather than infer
 failure from the receipt counts alone.
 
+When complete validation is required, also require receipt
+`validation_status: approved` and inspect `validation_summaries`. A successful
+run with `validation_status: incomplete` contains a structurally valid result
+that advanced after validator execution could not complete under the configured
+`warn_continue` policy. It is not reusable checkpoint state and should not be
+silently treated as fully reviewed by the caller.
+
 ## Preserve Provenance And Handle Data Carefully
 
 Keep the receipt with the published `manifest.json`, and retain
-`rejected.json` and `warnings.json` when review or later provenance requires
+`rejected.json`, `warnings.json`, and `diagnostics.json` when review or later provenance requires
 them. Treat the input, output bundle, cache, debug bundle, and captured process
 logs as potentially sensitive data. Apply the caller's access controls and
 retention policy, and avoid copying secrets into arguments, logs, or
 provenance records. An evidence-context artifact contains source-unit text and
-metadata, and selected lanes can cover most of an input; preserve and share it
+metadata and can cover most of an input; preserve and share it only when that
-only when that source content is authorized for the recipient.
+source content is authorized for the recipient.

docs/development.md

@@ -18,13 +18,14 @@ implemented component map.
 | Any documentation addition or revision | [Documentation Policy](policy/documentation.md) | It defines canonical homes, audiences, current-behavior rules, and maintenance requirements. |
 | Adding, changing, reviewing, or deleting tests | [Testing Policy](policy/testing.md) | It defines risk-based sufficiency, durable test boundaries, test-double guidance, and criteria for retaining tests. |
 | CLI composition or command behavior | [CLI Internals](internal/cli.md) and [CLI Reference](cli.md) | The internal guide owns composition and command flow; the reference owns public syntax. |
-| Building a subprocess caller or changing its result protocol | [Subprocess Consumer Guide](consumers/subprocess.md), [Run Result Receipt](integrations/run-result.md), and [CLI Internals](internal/cli.md) | These separate caller workflow, durable receipt contract, and CLI implementation behavior. |
+| Building a subprocess caller or changing its result protocol | [Subprocess Consumer Guide](consumers/subprocess.md), [Complete D&D Consumer Guide](consumers/dnd-pipeline.md), [Run Result Receipt](integrations/run-result.md), and [CLI Internals](internal/cli.md) | These separate generic caller workflow, the complete D&D workflow, the durable receipt contract, and CLI implementation behavior. |
 | Configuration loading, resolution, or user-visible configuration behavior | [Configuration Internals](internal/configuration.md) and [Configuration](config.md) | The internal guide owns loading and resolution mechanics; the reference owns the configuration contract. |
 | Pipeline resolution or execution | [Pipeline Internals](internal/pipeline.md) | It documents profiles, references, validation, retries, checkpoints, and runner behavior. |
 | Production modules or validators | [Module Internals](internal/modules.md), [D&D Module Internals](internal/dnd.md), and [D&D integration contracts](integrations/) | The generic guide owns extension mechanics, the D&D guide owns shared family conventions, and the contracts own durable output shapes. |
 | LLM clients, prompts, schemas, profiles, or scheduling | [LLM Runtime](internal/llm.md) | It documents the transport boundary and PromptKit integration. |
 | Output, cache, resume, or debug artifacts | [Run State Internals](internal/state.md), [Operations](operations.md), and [Configuration](config.md) | These separate implementation details, operator behavior, and configuration contracts. |
 | External input formats, artifact schemas, or durable output files | [Integration Contracts](integrations/) | Integration documents define external and durable data contracts. |
+| Release preparation, tagging, publication, or verification | [Source Releases](release.md) and [Documentation Policy](policy/documentation.md) | The release procedure owns maintainer guards and immutable-tag recovery; the policy assigns release-note ownership. |
 | Proposed or unimplemented behavior | [Roadmap](roadmap/) | Future work belongs only in roadmap documentation until implemented. |
 
 For an existing subsystem, also inspect its focused tests and the package-local

docs/integrations/dnd-combat-turn-artifacts.md

@@ -55,7 +55,7 @@ record controls eligibility only: its title, summary, and reference do not
 become turn evidence. No exact matching scene also produces an empty list and
 the `scene_classification_unavailable` warning.
 
-An optional normalized [NPC artifact](dnd-npc-artifacts.md) can ground an
+An optional normalized [NPC registry artifact](dnd-npc-registry-artifacts.md) can ground an
 actor name. Its registry references are provenance, never combat evidence.
 Normalization trims and, where possible, canonicalizes actor names; orders and
 deduplicates exact source references; orders valid-evidence turns by source
@@ -63,7 +63,7 @@ chronology; and collapses only duplicates with the same actor identity, turn
 kind, and complete valid evidence. It does not infer turns, initiative, or
 actions from registry or scene data.
 
-The [NPC-interaction artifact](dnd-npc-interaction-artifacts.md) records
+The [NPC-occurrence artifact](dnd-npc-occurrence-artifacts.md) records
 broader NPC occurrences. The [enemy-event artifact](dnd-enemy-event-artifacts.md)
 uses combat turns as grounding only; turns do not establish an enemy event or
 its outcome. The [JSON output contract](json-output.md) defines publication,

docs/integrations/dnd-enemy-event-artifacts.md

@@ -66,7 +66,7 @@ are positive and the start may not follow the end.
 | `incapacitated` | The subject is explicitly rendered unable to continue acting without being established as killed or captured. A missed turn is insufficient. |
 
 The current transcript is the only event evidence. Campaign context and
-normalized NPC, scene-description, combat-turn, and NPC-interaction artifacts
+normalized NPC, scene-description, combat-turn, and NPC-occurrence artifacts
 can ground names or control combat eligibility, but none may supply event
 evidence. An outcome may share evidence with an engagement, in which case both
 events are retained.

docs/integrations/dnd-item-event-artifacts.md

@@ -1,78 +0,0 @@
-# D&D Item-Event Artifact
-
-This contract defines the durable item and currency occurrence list produced by
-`dnd/item-events`. It records source-grounded discoveries and possession
-changes; it does not maintain an inventory, balance, or ledger.
-
-## Identity and compatibility
-
-| Property | Value |
-| --- | --- |
-| Artifact kind | `dnd/item-event-list` |
-| Schema ID | `notarius.dnd.item_events` |
-| Schema name | `notarius_dnd_item_events_v1` |
-| Schema version | `v1` |
-| Media type | `application/json` |
-
-`v1` is a strict JSON object with required `events`; the array may be empty.
-Event and source-reference objects reject unknown fields. An incompatible
-shape change requires a new schema version.
-
-## Wire shape
-
-Every event has required `name`, `kind`, and `source_refs`. `quantity`, `from`,
-and `to` are optional where the event kind permits them.
-
-| Field | Contract |
-| --- | --- |
-| `name` | Non-empty item or currency display name. |
-| `kind` | `discovered`, `acquired`, `lost`, `consumed`, or `transferred`. |
-| `quantity` | Optional positive integer; omit it when no count is established. |
-| `from` | Optional non-empty losing holder, when allowed by `kind`. |
-| `to` | Optional non-empty gaining holder, when allowed by `kind`. |
-| `source_refs` | One or more transcript evidence ranges. |
-
-Each source reference has exactly `source_id`, `start_unit_id`, and
-`end_unit_id`. It identifies an inclusive current-transcript range; unit IDs
-are positive and the start may not follow the end.
-
-```json
-{
-  "events": [
-    {
-      "name": "Silver Pieces",
-      "kind": "acquired",
-      "quantity": 20,
-      "to": "party",
-      "source_refs": [
-        {"source_id": "session-7", "start_unit_id": 2, "end_unit_id": 2}
-      ]
-    }
-  ]
-}
-```
-
-## Holder rules and minimal extraction
-
-`discovered` has neither holder; `acquired` requires `to` and forbids `from`;
-`lost` and `consumed` require `from` and forbid `to`; `transferred` requires
-both holders. `party` denotes collective possession. A transfer cannot use
-`party` for either holder and its two normalized holders must differ.
-
-Only an evidenced discovery or possession change belongs in this artifact.
-It does not infer quantities or holders, convert currency denominations,
-calculate balances, or merge nearby events. Campaign references may
-disambiguate names but are never event evidence. Currency uses the ordinary
-`name` field and an explicit `quantity` only when the transcript establishes
-one; each denomination remains a separate event.
-
-Normalization trims display whitespace, orders and removes exact duplicate
-source references, then orders events by valid source chronology, name identity
-and display value, kind, holders, quantity, and reference sequence. It
-collapses only entries with the same normalized durable fields and complete
-valid evidence.
-
-The [JSON output contract](json-output.md) defines publication. See
-[D&D module internals](../internal/dnd.md) for implementation details and the
-[NPC-interaction artifact](dnd-npc-interaction-artifacts.md) for a distinct
-kind of occurrence.

docs/integrations/dnd-item-occurrence-artifacts.md

@@ -0,0 +1,72 @@
+# D&D Item-Occurrence Artifact
+
+`dnd/item-occurrences` currently produces this source-grounded item and currency
+occurrence list. It records discoveries and possession changes, not an
+inventory, balance, or ledger.
+
+## Identity and compatibility
+
+| Property | Value |
+| --- | --- |
+| Artifact kind | `dnd/item-occurrence-list` |
+| Schema ID | `notarius.dnd.item_occurrences` |
+| Schema name | `notarius_dnd_item_occurrences_v1` |
+| Schema version | `v1` |
+| Media type | `application/json` |
+
+`v1` accepts one strict JSON object with required `occurrences`; the array may
+be empty. Each occurrence has required `item_id`, `name`, `kind`, and
+`source_refs`, and occurrence and source-reference objects reject unknown
+fields. `quantity`, `from`, and `to` appear only when their kind permits them.
+An incompatible shape change requires a new schema version.
+
+## Registry grounding
+
+Both extraction and normalization require an `item_registry` reference bound to
+an earlier normalized `dnd/item-registry` artifact. The registry is immutable
+for an operation and contributes names-only grounding after the shared evidence
+message. Notarius resolves the model's selected name into the unchanged exact
+durable ID/name pair. It is never occurrence evidence.
+
+Each occurrence must use one exact registry ID/name pair. An extraction response
+with an unknown or ambiguous selected name is rejected as invalid model output;
+the configured pipeline may retry it and never accepts a partial artifact.
+Normalization and validation remain defense in depth for artifacts entering
+through other boundaries: normalization canonicalizes a recognized name by ID,
+preserves unknown values for the registry validator, and the registry validator
+rejects unknown or mismatched pairs.
+
+## Wire shape
+
+Each source reference has exactly `source_id`, `start_unit_id`, and
+`end_unit_id`. It identifies an inclusive range in the current transcript;
+unit IDs are positive and the start may not follow the end.
+
+```json
+{
+  "occurrences": [
+    {
+      "item_id": "item:sha256:…",
+      "name": "Silver Pieces",
+      "kind": "acquired",
+      "quantity": 20,
+      "to": "party",
+      "source_refs": [
+        {"source_id": "session-7", "start_unit_id": 2, "end_unit_id": 2}
+      ]
+    }
+  ]
+}
+```
+
+The five kinds remain `discovered`, `acquired`, `lost`, `consumed`, and
+`transferred`. Holder, quantity, currency, ordering, and exact-duplicate rules
+are unchanged: discovered has no holder; acquired requires `to`; lost and
+consumed require `from`; transferred requires distinct non-`party` holders.
+The only current downstream compatibility requirement is its registry handoff;
+the normalized occurrence list is otherwise published for callers. See
+[Configuration](../config.md#d-d-reference-slots) for the binding and
+[JSON output](json-output.md) for publication.
+
+See [item registry](dnd-item-registry-artifacts.md) for the grounding artifact
+and [D&D module internals](../internal/dnd.md) for implementation details.